Merge pull request #132942 from thockin/kyaml

Add KYAML support to kubectl

Kubernetes-commit: 1451dd1b0873e801e082f3a06a52685bcd68dcac

go.mod

@@ -2,36 +2,34 @@
 
 module k8s.io/apimachinery
 
-go 1.23.0
+go 1.24.0
 
-godebug default=go1.23
-
-godebug winsymlink=0
+godebug default=go1.24
 
 require (
 	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
 	github.com/davecgh/go-spew v1.1.1
-	github.com/fxamacker/cbor/v2 v2.7.0
+	github.com/fxamacker/cbor/v2 v2.9.0
 	github.com/gogo/protobuf v1.3.2
-	github.com/google/gnostic-models v0.6.9
-	github.com/google/go-cmp v0.6.0
-	github.com/google/gofuzz v1.2.0
+	github.com/google/gnostic-models v0.7.0
+	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/moby/spdystream v0.5.0
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f
-	github.com/onsi/ginkgo/v2 v2.21.0
-	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.9.0
-	golang.org/x/net v0.33.0
-	golang.org/x/time v0.7.0
+	github.com/pmezard/go-difflib v1.0.0
+	github.com/spf13/pflag v1.0.6
+	github.com/stretchr/testify v1.10.0
+	golang.org/x/net v0.38.0
+	golang.org/x/time v0.9.0
 	gopkg.in/evanphx/json-patch.v4 v4.12.0
 	gopkg.in/inf.v0 v0.9.1
 	k8s.io/klog/v2 v2.130.1
-	k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.2
-	sigs.k8s.io/yaml v1.4.0
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8
+	sigs.k8s.io/randfill v1.0.0
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
@@ -39,20 +37,19 @@ require (
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/onsi/ginkgo/v2 v2.21.0 // indirect
 	github.com/onsi/gomega v1.35.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/rogpeppe/go-internal v1.13.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	golang.org/x/sys v0.28.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/tools v0.26.0 // indirect
-	google.golang.org/protobuf v1.35.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -4,8 +4,8 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
@@ -20,14 +20,11 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
-github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
-github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
 github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -52,8 +49,9 @@ github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVO
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
@@ -64,10 +62,10 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -75,12 +73,16 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -90,22 +92,22 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
+golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
-golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
@@ -116,8 +118,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
-google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -130,13 +132,15 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7 h1:hcha5B1kVACrLujCKLbr8XWMxCxzQx42DY8QKYJrDLg=
-k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7/go.mod h1:GewRfANuJ70iYzvn+i4lezLDAFzvjxZYK1gn1lWcfas=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
-k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
-sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.2 h1:MdmvkGuXi/8io6ixD5wud3vOLwc1rj0aNqRlpuvjmwA=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.2/go.mod h1:N8f93tFZh9U6vpxwRArLiikrE5/2tiu1w1AGfACIGE4=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

pkg/api/apitesting/close.go

@@ -0,0 +1,54 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apitesting
+
+import (
+	"io"
+	"testing"
+)
+
+// Close and fail the test if it returns an error.
+func Close(t TestingT, c io.Closer) {
+	t.Helper()
+	assertNoError(t, c.Close())
+}
+
+// CloseNoOp does nothing. Use as a replacement for Close when you
+// need to disable a defer.
+func CloseNoOp(TestingT, io.Closer) {}
+
+// TestingT simulates assert.TestingT and assert.tHelper without adding
+// testify as a non-test dependency.
+type TestingT interface {
+	Errorf(format string, args ...interface{})
+	Helper()
+}
+
+// Ensure that testing T & B satisfy the TestingT interface
+var _ TestingT = &testing.T{}
+var _ TestingT = &testing.B{}
+
+// assertNoError simulates assert.NoError without adding testify as a
+// non-test dependency.
+//
+// In test files, use github.com/stretchr/testify/assert instead.
+func assertNoError(t TestingT, err error) {
+	t.Helper()
+	if err != nil {
+		t.Errorf("Received unexpected error:\n%+v", err)
+	}
+}

pkg/api/apitesting/fuzzer/fuzzer.go

@@ -21,19 +21,19 @@ import (
 	"fmt"
 	"math/rand"
 
-	"github.com/google/gofuzz"
+	"sigs.k8s.io/randfill"
 
 	"k8s.io/apimachinery/pkg/runtime"
 	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
 	kjson "k8s.io/apimachinery/pkg/util/json"
 )
 
-// FuzzerFuncs returns a list of func(*SomeType, c fuzz.Continue) functions.
+// FuzzerFuncs returns a list of func(*SomeType, c randfill.Continue) functions.
 type FuzzerFuncs func(codecs runtimeserializer.CodecFactory) []interface{}
 
 // FuzzerFor can randomly populate api objects that are destined for version.
-func FuzzerFor(funcs FuzzerFuncs, src rand.Source, codecs runtimeserializer.CodecFactory) *fuzz.Fuzzer {
-	f := fuzz.New().NilChance(.5).NumElements(0, 1)
+func FuzzerFor(funcs FuzzerFuncs, src rand.Source, codecs runtimeserializer.CodecFactory) *randfill.Filler {
+	f := randfill.New().NilChance(.5).NumElements(0, 1)
 	if src != nil {
 		f.RandSource(src)
 	}

pkg/api/apitesting/roundtrip/compatibility.go

@@ -20,6 +20,7 @@ import (
 	"bytes"
 	gojson "encoding/json"
 	"io/ioutil"
+	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -28,7 +29,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/go-cmp/cmp" //nolint:depguard
+	"github.com/google/go-cmp/cmp"
 
 	apiequality "k8s.io/apimachinery/pkg/api/equality"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -115,7 +116,7 @@ func (c *CompatibilityTestOptions) Complete(t *testing.T) *CompatibilityTestOpti
 		c.TestDataDir = "testdata"
 	}
 	if c.TestDataDirCurrentVersion == "" {
-		c.TestDataDirCurrentVersion = filepath.Join(c.TestDataDir, "HEAD")
+		c.TestDataDirCurrentVersion = filepath.Join(c.TestDataDir, http.MethodHead)
 	}
 	if c.TestDataDirsPreviousVersions == nil {
 		dirs, err := filepath.Glob(filepath.Join(c.TestDataDir, "v*"))
@@ -199,7 +200,7 @@ func (c *CompatibilityTestOptions) Run(t *testing.T) {
 	for _, gvk := range c.Kinds {
 		t.Run(makeName(gvk), func(t *testing.T) {
 
-			t.Run("HEAD", func(t *testing.T) {
+			t.Run(http.MethodHead, func(t *testing.T) {
 				c.runCurrentVersionTest(t, gvk, usedHEADFixtures)
 			})
 

pkg/api/apitesting/roundtrip/roundtrip.go

@@ -24,9 +24,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/go-cmp/cmp" //nolint:depguard
-	fuzz "github.com/google/gofuzz"
+	"github.com/google/go-cmp/cmp"
 	flag "github.com/spf13/pflag"
+	"sigs.k8s.io/randfill"
 
 	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
 	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
@@ -120,15 +120,15 @@ func GlobalNonRoundTrippableTypes() sets.String {
 
 // RoundTripTypesWithoutProtobuf applies the round-trip test to all round-trippable Kinds
 // in the scheme.  It will skip all the GroupVersionKinds in the skip list.
-func RoundTripTypesWithoutProtobuf(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *fuzz.Fuzzer, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+func RoundTripTypesWithoutProtobuf(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
 	roundTripTypes(t, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, true)
 }
 
-func RoundTripTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *fuzz.Fuzzer, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+func RoundTripTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
 	roundTripTypes(t, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, false)
 }
 
-func roundTripTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *fuzz.Fuzzer, nonRoundTrippableTypes map[schema.GroupVersionKind]bool, skipProtobuf bool) {
+func roundTripTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool, skipProtobuf bool) {
 	for _, group := range groupsFromScheme(scheme) {
 		t.Logf("starting group %q", group)
 		internalVersion := schema.GroupVersion{Group: group, Version: runtime.APIVersionInternal}
@@ -149,7 +149,7 @@ func roundTripTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimese
 
 // RoundTripExternalTypes applies the round-trip test to all external round-trippable Kinds
 // in the scheme.  It will skip all the GroupVersionKinds in the nonRoundTripExternalTypes list .
-func RoundTripExternalTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *fuzz.Fuzzer, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+func RoundTripExternalTypes(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
 	kinds := scheme.AllKnownTypes()
 	for gvk := range kinds {
 		if gvk.Version == runtime.APIVersionInternal || globalNonRoundTrippableTypes.Has(gvk.Kind) {
@@ -163,7 +163,7 @@ func RoundTripExternalTypes(t *testing.T, scheme *runtime.Scheme, codecFactory r
 
 // RoundTripExternalTypesWithoutProtobuf applies the round-trip test to all external round-trippable Kinds
 // in the scheme.  It will skip all the GroupVersionKinds in the nonRoundTripExternalTypes list.
-func RoundTripExternalTypesWithoutProtobuf(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *fuzz.Fuzzer, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+func RoundTripExternalTypesWithoutProtobuf(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
 	kinds := scheme.AllKnownTypes()
 	for gvk := range kinds {
 		if gvk.Version == runtime.APIVersionInternal || globalNonRoundTrippableTypes.Has(gvk.Kind) {
@@ -175,15 +175,15 @@ func RoundTripExternalTypesWithoutProtobuf(t *testing.T, scheme *runtime.Scheme,
 	}
 }
 
-func RoundTripSpecificKindWithoutProtobuf(t *testing.T, gvk schema.GroupVersionKind, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *fuzz.Fuzzer, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+func RoundTripSpecificKindWithoutProtobuf(t *testing.T, gvk schema.GroupVersionKind, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
 	roundTripSpecificKind(t, gvk, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, true)
 }
 
-func RoundTripSpecificKind(t *testing.T, gvk schema.GroupVersionKind, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *fuzz.Fuzzer, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
+func RoundTripSpecificKind(t *testing.T, gvk schema.GroupVersionKind, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool) {
 	roundTripSpecificKind(t, gvk, scheme, codecFactory, fuzzer, nonRoundTrippableTypes, false)
 }
 
-func roundTripSpecificKind(t *testing.T, gvk schema.GroupVersionKind, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *fuzz.Fuzzer, nonRoundTrippableTypes map[schema.GroupVersionKind]bool, skipProtobuf bool) {
+func roundTripSpecificKind(t *testing.T, gvk schema.GroupVersionKind, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, nonRoundTrippableTypes map[schema.GroupVersionKind]bool, skipProtobuf bool) {
 	if nonRoundTrippableTypes[gvk] {
 		t.Logf("skipping %v", gvk)
 		return
@@ -204,8 +204,8 @@ func roundTripSpecificKind(t *testing.T, gvk schema.GroupVersionKind, scheme *ru
 
 // fuzzInternalObject fuzzes an arbitrary runtime object using the appropriate
 // fuzzer registered with the apitesting package.
-func fuzzInternalObject(t *testing.T, fuzzer *fuzz.Fuzzer, object runtime.Object) runtime.Object {
-	fuzzer.Fuzz(object)
+func fuzzInternalObject(t *testing.T, fuzzer *randfill.Filler, object runtime.Object) runtime.Object {
+	fuzzer.Fill(object)
 
 	j, err := apimeta.TypeAccessor(object)
 	if err != nil {
@@ -225,7 +225,7 @@ func groupsFromScheme(scheme *runtime.Scheme) []string {
 	return ret.List()
 }
 
-func roundTripToAllExternalVersions(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *fuzz.Fuzzer, internalGVK schema.GroupVersionKind, nonRoundTrippableTypes map[schema.GroupVersionKind]bool, skipProtobuf bool) {
+func roundTripToAllExternalVersions(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, internalGVK schema.GroupVersionKind, nonRoundTrippableTypes map[schema.GroupVersionKind]bool, skipProtobuf bool) {
 	object, err := scheme.New(internalGVK)
 	if err != nil {
 		t.Fatalf("Couldn't make a %v? %v", internalGVK, err)
@@ -262,7 +262,7 @@ func roundTripToAllExternalVersions(t *testing.T, scheme *runtime.Scheme, codecF
 	}
 }
 
-func roundTripOfExternalType(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *fuzz.Fuzzer, externalGVK schema.GroupVersionKind, skipProtobuf bool) {
+func roundTripOfExternalType(t *testing.T, scheme *runtime.Scheme, codecFactory runtimeserializer.CodecFactory, fuzzer *randfill.Filler, externalGVK schema.GroupVersionKind, skipProtobuf bool) {
 	object, err := scheme.New(externalGVK)
 	if err != nil {
 		t.Fatalf("Couldn't make a %v? %v", externalGVK, err)

pkg/api/apitesting/roundtrip/unstructured.go

@@ -37,7 +37,7 @@ import (
 	jsonserializer "k8s.io/apimachinery/pkg/runtime/serializer/json"
 	"k8s.io/apimachinery/pkg/util/sets"
 
-	"github.com/google/go-cmp/cmp" //nolint:depguard
+	"github.com/google/go-cmp/cmp"
 )
 
 // RoundtripToUnstructured verifies the roundtrip faithfulness of all external types in a scheme
@@ -92,13 +92,13 @@ func RoundtripToUnstructured(t *testing.T, scheme *runtime.Scheme, funcs fuzzer.
 				}
 
 				if nointernal.Has(gvk) {
-					fuzzer.Fuzz(item)
+					fuzzer.Fill(item)
 				} else {
 					internalObj, err := scheme.New(gvk.GroupKind().WithVersion(runtime.APIVersionInternal))
 					if err != nil {
 						t.Fatalf("couldn't create internal object %v: %v", gvk.Kind, err)
 					}
-					fuzzer.Fuzz(internalObj)
+					fuzzer.Fill(internalObj)
 
 					if err := scheme.Convert(internalObj, item, nil); err != nil {
 						t.Fatalf("conversion for %v failed: %v", gvk.Kind, err)

pkg/api/errors/errors.go

@@ -438,7 +438,7 @@ func NewGenericServerResponse(code int, verb string, qualifiedResource schema.Gr
 	message := fmt.Sprintf("the server responded with the status code %d but did not return more information", code)
 	switch code {
 	case http.StatusConflict:
-		if verb == "POST" {
+		if verb == http.MethodPost {
 			reason = metav1.StatusReasonAlreadyExists
 		} else {
 			reason = metav1.StatusReasonConflict

pkg/api/errors/errors_test.go

@@ -110,13 +110,13 @@ func TestErrorNew(t *testing.T) {
 	if time, ok := SuggestsClientDelay(NewTooManyRequests("doing something", 1)); time != 1 || !ok {
 		t.Errorf("unexpected %d", time)
 	}
-	if time, ok := SuggestsClientDelay(NewGenericServerResponse(429, "get", resource("tests"), "test", "doing something", 10, true)); time != 10 || !ok {
+	if time, ok := SuggestsClientDelay(NewGenericServerResponse(429, http.MethodGet, resource("tests"), "test", "doing something", 10, true)); time != 10 || !ok {
 		t.Errorf("unexpected %d", time)
 	}
-	if time, ok := SuggestsClientDelay(NewGenericServerResponse(500, "get", resource("tests"), "test", "doing something", 10, true)); time != 10 || !ok {
+	if time, ok := SuggestsClientDelay(NewGenericServerResponse(500, http.MethodGet, resource("tests"), "test", "doing something", 10, true)); time != 10 || !ok {
 		t.Errorf("unexpected %d", time)
 	}
-	if time, ok := SuggestsClientDelay(NewGenericServerResponse(429, "get", resource("tests"), "test", "doing something", 0, true)); time != 0 || ok {
+	if time, ok := SuggestsClientDelay(NewGenericServerResponse(429, http.MethodGet, resource("tests"), "test", "doing something", 0, true)); time != 0 || ok {
 		t.Errorf("unexpected %d", time)
 	}
 }

pkg/api/meta/help.go

@@ -221,6 +221,9 @@ func extractList(obj runtime.Object, allocNew bool) ([]runtime.Object, error) {
 	if err != nil {
 		return nil, err
 	}
+	if items.IsNil() {
+		return nil, nil
+	}
 	list := make([]runtime.Object, items.Len())
 	if len(list) == 0 {
 		return list, nil

pkg/api/meta/meta_test.go

@@ -25,15 +25,15 @@ import (
 	metav1beta1 "k8s.io/apimachinery/pkg/apis/meta/v1beta1"
 
 	"github.com/google/go-cmp/cmp"
-	fuzz "github.com/google/gofuzz"
+	"sigs.k8s.io/randfill"
 )
 
 func TestAsPartialObjectMetadata(t *testing.T) {
-	f := fuzz.New().NilChance(.5).NumElements(0, 1).RandSource(rand.NewSource(1))
+	f := randfill.New().NilChance(.5).NumElements(0, 1).RandSource(rand.NewSource(1))
 
 	for i := 0; i < 100; i++ {
 		m := &metav1.ObjectMeta{}
-		f.Fuzz(m)
+		f.Fill(m)
 		partial := AsPartialObjectMetadata(m)
 		if !reflect.DeepEqual(&partial.ObjectMeta, m) {
 			t.Fatalf("incomplete partial object metadata: %s", cmp.Diff(&partial.ObjectMeta, m))
@@ -42,7 +42,7 @@ func TestAsPartialObjectMetadata(t *testing.T) {
 
 	for i := 0; i < 100; i++ {
 		m := &metav1beta1.PartialObjectMetadata{}
-		f.Fuzz(&m.ObjectMeta)
+		f.Fill(&m.ObjectMeta)
 		partial := AsPartialObjectMetadata(m)
 		if !reflect.DeepEqual(&partial.ObjectMeta, &m.ObjectMeta) {
 			t.Fatalf("incomplete partial object metadata: %s", cmp.Diff(&partial.ObjectMeta, &m.ObjectMeta))

pkg/api/operation/operation.go

@@ -0,0 +1,102 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package operation
+
+import (
+	"slices"
+	"strings"
+)
+
+// Operation provides contextual information about a validation request and the API
+// operation being validated.
+// This type is intended for use with generate validation code and may be enhanced
+// in the future to include other information needed to validate requests.
+type Operation struct {
+	// Type is the category of operation being validated.  This does not
+	// differentiate between HTTP verbs like PUT and PATCH, but rather merges
+	// those into a single "Update" category.
+	Type Type
+
+	// Options declare the options enabled for validation.
+	//
+	// Options should be set according to a resource validation strategy before validation
+	// is performed, and must be treated as read-only during validation.
+	//
+	// Options are identified by string names. Option string names may match the name of a feature
+	// gate, in which case the presence of the name in the set indicates that the feature is
+	// considered enabled for the resource being validated.  Note that a resource may have a
+	// feature enabled even when the feature gate is disabled. This can happen when feature is
+	// already in-use by a resource, often because the feature gate was enabled when the
+	// resource first began using the feature.
+	//
+	// Unset options are disabled/false.
+	Options []string
+
+	// Request provides information about the request being validated.
+	Request Request
+}
+
+// HasOption returns true if the given string is in the Options slice.
+func (o Operation) HasOption(option string) bool {
+	return slices.Contains(o.Options, option)
+}
+
+// Request provides information about the request being validated.
+type Request struct {
+	// Subresources identifies the subresource path components of the request. For
+	// example, Subresources for a request to `/api/v1/pods/my-pod/status` would be
+	// `["status"]`. For `/api/v1/widget/my-widget/x/y/z`, it would be `["x", "y",
+	// "z"]`. For a root resource (`/api/v1/pods/my-pod`), Subresources will be an
+	// empty slice.
+	//
+	// Validation logic should only consult this field if the validation rules for a
+	// particular field differ depending on whether the main resource or a specific
+	// subresource is being accessed. For example:
+	//
+	// Updates to a Pod resource (`/`) normally cannot change container resource
+	// requests/limits after the Pod is created (they are immutable). However, when
+	// accessing the Pod's "resize" subresource (`/resize`), these specific fields
+	// are allowed to be modified. In this scenario, the validation logic for
+	// `spec.container[*].resources` must check `Subresources` to permit changes only
+	// when the request targets the "resize" subresource.
+	//
+	// Note: This field should not be used to control which fields a subresource
+	// operation is allowed to write. This is the responsibility of "field wiping".
+	// Field wiping logic is expected to be handled in resource strategies by
+	// modifying the incoming object before it is validated.
+	Subresources []string
+}
+
+// SubresourcePath returns the path is a slash-separated list of subresource
+// names. For example, `/status`, `/resize`, or `/x/y/z`.
+func (r Request) SubresourcePath() string {
+	if len(r.Subresources) == 0 {
+		return "/"
+	}
+	return "/" + strings.Join(r.Subresources, "/")
+}
+
+// Code is the request operation to be validated.
+type Type uint32
+
+const (
+	// Create indicates the request being validated is for a resource create operation.
+	Create Type = iota
+
+	// Update indicates the request being validated is for a resource update operation.
+	Update
+)

pkg/api/resource/quantity_test.go

@@ -28,9 +28,9 @@ import (
 	"unicode"
 
 	"github.com/google/go-cmp/cmp"
-	fuzz "github.com/google/gofuzz"
 	"github.com/spf13/pflag"
 	inf "gopkg.in/inf.v0"
+	"sigs.k8s.io/randfill"
 
 	cbor "k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
 )
@@ -827,12 +827,12 @@ func TestQuantityParseEmit(t *testing.T) {
 	}
 }
 
-var fuzzer = fuzz.New().Funcs(
-	func(q *Quantity, c fuzz.Continue) {
+var fuzzer = randfill.New().Funcs(
+	func(q *Quantity, c randfill.Continue) {
 		q.i = Zero
-		if c.RandBool() {
+		if c.Bool() {
 			q.Format = BinarySI
-			if c.RandBool() {
+			if c.Bool() {
 				dec := &inf.Dec{}
 				q.d = infDecAmount{Dec: dec}
 				dec.SetScale(0)
@@ -846,12 +846,12 @@ var fuzzer = fuzz.New().Funcs(
 			dec.SetUnscaled(c.Int63n(1024) << uint(10*c.Intn(5)))
 			return
 		}
-		if c.RandBool() {
+		if c.Bool() {
 			q.Format = DecimalSI
 		} else {
 			q.Format = DecimalExponent
 		}
-		if c.RandBool() {
+		if c.Bool() {
 			dec := &inf.Dec{}
 			q.d = infDecAmount{Dec: dec}
 			dec.SetScale(inf.Scale(c.Intn(4)))
@@ -897,7 +897,7 @@ func TestQuantityDeepCopy(t *testing.T) {
 func TestJSON(t *testing.T) {
 	for i := 0; i < 500; i++ {
 		q := &Quantity{}
-		fuzzer.Fuzz(q)
+		fuzzer.Fill(q)
 		b, err := json.Marshal(q)
 		if err != nil {
 			t.Errorf("error encoding %v: %v", q, err)
@@ -1801,7 +1801,7 @@ func TestQuantityUnmarshalCBOR(t *testing.T) {
 func TestQuantityRoundtripCBOR(t *testing.T) {
 	for i := 0; i < 500; i++ {
 		var initial, final Quantity
-		fuzzer.Fuzz(&initial)
+		fuzzer.Fill(&initial)
 		b, err := cbor.Marshal(initial)
 		if err != nil {
 			t.Errorf("error encoding %v: %v", initial, err)

pkg/api/safe/safe.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package safe
+
+// Field takes a pointer to any value (which may or may not be nil) and a
+// function that traverses to a target type R (a typical use case is to
+// dereference a field), and returns the result of the traversal, or the zero
+// value of the target type.
+//
+// This is roughly equivalent to:
+//
+//	value != nil ? fn(value) : zero-value
+//
+// ...in languages that support the ternary operator.
+func Field[V any, R any](value *V, fn func(*V) R) R {
+	if value == nil {
+		var zero R
+		return zero
+	}
+	o := fn(value)
+	return o
+}
+
+// Cast takes any value, attempts to cast it to T, and returns the T value if
+// the cast is successful, or else the zero value of T.
+func Cast[T any](value any) T {
+	result, _ := value.(T)
+	return result
+}
+
+// Value takes a pointer to any value (which may or may not be nil) and a
+// function that returns a pointer to the same type.  If the value is not nil,
+// it is returned, otherwise the result of the function is returned.
+//
+// This is roughly equivalent to:
+//
+//	value != nil ? value : fn()
+//
+// ...in languages that support the ternary operator.
+func Value[T any](value *T, fn func() *T) *T {
+	if value != nil {
+		return value
+	}
+	return fn()
+}

pkg/api/validate/README.md

@@ -0,0 +1,64 @@
+# API validation
+
+This package holds functions which validate fields and types in the Kubernetes
+API. It may be useful beyond API validation, but this is the primary goal.
+
+Most of the public functions here have signatures which adhere to the following
+pattern, which is assumed by automation and code-generation:
+
+```
+import (
+        "context"
+        "k8s.io/apimachinery/pkg/api/operation"
+        "k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func <Name>(ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue <ValueType>, <OtherArgs...>) field.ErrorList
+```
+
+The name of validator functions should consider that callers will generally be
+spelling out the package name and the function name, and so should aim for
+legibility.  E.g. `validate.Concept()`.
+
+The `ctx` argument is Go's usual Context.
+
+The `opCtx` argument provides information about the API operation in question.
+
+The `fldPath` argument indicates the path to the field in question, to be used
+in errors.
+
+The `value` and `oldValue` arguments are the thing(s) being validated.  For
+CREATE operations (`opCtx.Operation == operation.Create`), the `oldValue`
+argument will be nil.  Many validators functions only look at the current value
+(`value`) and disregard `oldValue`.
+
+The `value` and `oldValue` arguments are always nilable - pointers to primitive
+types, slices of any type, or maps of any type.  Validator functions should
+avoid dereferencing nil. Callers are expected to not pass a nil `value` unless the
+API field itself was nilable. `oldValue` is always nil for CREATE operations and 
+is also nil for UPDATE operations if the `value` is not correlated with an `oldValue`.
+
+Simple content-validators may have no `<OtherArgs>`, but validator functions
+may take additional arguments.  Some validator functions will be built as
+generics, e.g. to allow any integer type or to handle arbitrary slices.
+
+Examples:
+
+```
+// NonEmpty validates that a string is not empty.
+func NonEmpty(ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ *string) field.ErrorList
+
+// Even validates that a slice has an even number of items.
+func Even[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ []T) field.ErrorList
+
+// KeysMaxLen validates that all of the string keys in a map are under the
+// specified length.
+func KeysMaxLen[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, _ map[string]T, maxLen int) field.ErrorList
+```
+
+Validator functions always return an `ErrorList` where each item is a distinct
+validation failure and a zero-length return value (not just nil) indicates
+success.
+
+Good validation failure messages follow the Kubernetes API conventions, for
+example using "must" instead of "should".

pkg/api/validate/common.go

@@ -0,0 +1,28 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ValidateFunc is a function that validates a value, possibly considering the
+// old value (if any).
+type ValidateFunc[T any] func(ctx context.Context, op operation.Operation, fldPath *field.Path, newValue, oldValue T) field.ErrorList

pkg/api/validate/constraints/constraints.go

@@ -0,0 +1,32 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package constraints
+
+// Signed is a constraint that permits any signed integer type.
+type Signed interface {
+	~int | ~int8 | ~int16 | ~int32 | ~int64
+}
+
+// Unsigned is a constraint that permits any unsigned integer type.
+type Unsigned interface {
+	~uint | ~uint8 | ~uint16 | ~uint32 | ~uint64 | ~uintptr
+}
+
+// Integer is a constraint that permits any integer type.
+type Integer interface {
+	Signed | Unsigned
+}

pkg/api/validate/content/errors.go

@@ -0,0 +1,39 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package content
+
+import (
+	"fmt"
+	"reflect"
+
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+)
+
+// MinError returns a string explanation of a "must be greater than or equal"
+// validation failure.
+func MinError[T constraints.Integer](min T) string {
+	return fmt.Sprintf("must be greater than or equal to %d", min)
+}
+
+// NEQError returns a string explanation of a "must not be equal to" validation failure.
+func NEQError[T any](disallowed T) string {
+	format := "%v"
+	if reflect.ValueOf(disallowed).Kind() == reflect.String {
+		format = "%q"
+	}
+	return fmt.Sprintf("must not be equal to "+format, disallowed)
+}

pkg/api/validate/doc.go

@@ -0,0 +1,50 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package validate holds API validation functions which are designed for use
+// with the k8s.io/code-generator/cmd/validation-gen tool.  Each validation
+// function has a similar fingerprint:
+//
+//	func <Name>(ctx context.Context,
+//	            op operation.Operation,
+//	            fldPath *field.Path,
+//	            value, oldValue <nilable type>,
+//	            <other args...>) field.ErrorList
+//
+// The value and oldValue arguments will always be a nilable type.  If the
+// original value was a string, these will be a *string.  If the original value
+// was a slice or map, these will be the same slice or map type.
+//
+// For a CREATE operation, the oldValue will always be nil.  For an UPDATE
+// operation, either value or oldValue may be nil, e.g. when adding or removing
+// a value in a list-map.  Validators which care about UPDATE operations should
+// look at the opCtx argument to know which operation is being executed.
+//
+// Tightened validation (also known as ratcheting validation) is supported by
+// defining a new validation function. For example:
+//
+//	func TightenedMaxLength(ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *string) field.ErrorList {
+//	  if oldValue != nil && len(MaxLength(ctx, op, fldPath, oldValue, nil)) > 0 {
+//	    // old value is not valid, so this value skips the tightened validation
+//	    return nil
+//	  }
+//	  return MaxLength(ctx, op, fldPath, value, nil)
+//	}
+//
+// In general, we cannot distinguish a non-specified slice or map from one that
+// is specified but empty.  Validators should not rely on nil values, but use
+// len() instead.
+package validate

pkg/api/validate/each.go

@@ -0,0 +1,171 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// MatchFunc is a function that compares two values of the same type,
+// according to some criteria, and returns true if they match.
+type MatchFunc[T any] func(T, T) bool
+
+// EachSliceVal performs validation on each element of newSlice using the provided validation function.
+//
+// For update operations, the match function finds corresponding values in oldSlice for each
+// value in newSlice. This comparison can be either full or partial (e.g., matching only
+// specific struct fields that serve as a unique identifier). If match is nil, validation
+// proceeds without considering old values, and the equiv function is not used.
+//
+// For update operations, the equiv function checks if a new value is equivalent to its
+// corresponding old value, enabling validation ratcheting. If equiv is nil but match is
+// provided, the match function is assumed to perform full value comparison.
+//
+// Note: The slice element type must be non-nilable.
+func EachSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newSlice, oldSlice []T,
+	match, equiv MatchFunc[T], validator ValidateFunc[*T]) field.ErrorList {
+	var errs field.ErrorList
+	for i, val := range newSlice {
+		var old *T
+		if match != nil && len(oldSlice) > 0 {
+			old = lookup(oldSlice, val, match)
+		}
+		// If the operation is an update, for validation ratcheting, skip re-validating if the old
+		// value exists and either:
+		// 1. The match function provides full comparison (equiv is nil)
+		// 2. The equiv function confirms the values are equivalent (either directly or semantically)
+		//
+		// The equiv function provides equality comparison when match uses partial comparison.
+		if op.Type == operation.Update && old != nil && (equiv == nil || equiv(val, *old)) {
+			continue
+		}
+		errs = append(errs, validator(ctx, op, fldPath.Index(i), &val, old)...)
+	}
+	return errs
+}
+
+// lookup returns a pointer to the first element in the list that matches the
+// target, according to the provided comparison function, or else nil.
+func lookup[T any](list []T, target T, match MatchFunc[T]) *T {
+	for i := range list {
+		if match(list[i], target) {
+			return &list[i]
+		}
+	}
+	return nil
+}
+
+// EachMapVal validates each value in newMap using the specified validation
+// function, passing the corresponding old value from oldMap if the key exists in oldMap.
+// For update operations, it implements validation ratcheting by skipping validation
+// when the old value exists and the equiv function confirms the values are equivalent.
+// The value-type of the map is assumed to not be nilable.
+// If equiv is nil, value-based ratcheting is disabled and all values will be validated.
+func EachMapVal[K ~string, V any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]V,
+	equiv MatchFunc[V], validator ValidateFunc[*V]) field.ErrorList {
+	var errs field.ErrorList
+	for key, val := range newMap {
+		var old *V
+		if o, found := oldMap[key]; found {
+			old = &o
+		}
+		// If the operation is an update, for validation ratcheting, skip re-validating if the old
+		// value is found and the equiv function confirms the values are equivalent.
+		if op.Type == operation.Update && old != nil && equiv != nil && equiv(val, *old) {
+			continue
+		}
+		errs = append(errs, validator(ctx, op, fldPath.Key(string(key)), &val, old)...)
+	}
+	return errs
+}
+
+// EachMapKey validates each element of newMap with the specified
+// validation function.
+func EachMapKey[K ~string, T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]T,
+	validator ValidateFunc[*K]) field.ErrorList {
+	var errs field.ErrorList
+	for key := range newMap {
+		var old *K
+		if _, found := oldMap[key]; found {
+			old = &key
+		}
+		// If the operation is an update, for validation ratcheting, skip re-validating if
+		// the key is found in oldMap.
+		if op.Type == operation.Update && old != nil {
+			continue
+		}
+		// Note: the field path is the field, not the key.
+		errs = append(errs, validator(ctx, op, fldPath, &key, nil)...)
+	}
+	return errs
+}
+
+// Unique verifies that each element of newSlice is unique, according to the
+// match function. It compares every element of the slice with every other
+// element and returns errors for non-unique items.
+func Unique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []T, match MatchFunc[T]) field.ErrorList {
+	var dups []int
+	for i, val := range newSlice {
+		for j := i + 1; j < len(newSlice); j++ {
+			other := newSlice[j]
+			if match(val, other) {
+				if dups == nil {
+					dups = make([]int, 0, len(newSlice))
+				}
+				if lookup(dups, j, func(a, b int) bool { return a == b }) == nil {
+					dups = append(dups, j)
+				}
+			}
+		}
+	}
+
+	var errs field.ErrorList
+	sort.Ints(dups)
+	for _, i := range dups {
+		var val any = newSlice[i]
+		// TODO: we don't want the whole item to be logged in the error, just
+		// the key(s). Unfortunately, the way errors are rendered, it comes out
+		// as something like "map[string]any{...}" which is not very nice. Once
+		// that is fixed, we can consider adding a way for this function to
+		// specify that just the keys should be rendered in the error.
+		errs = append(errs, field.Duplicate(fldPath.Index(i), val))
+	}
+	return errs
+}
+
+// SemanticDeepEqual is a MatchFunc that uses equality.Semantic.DeepEqual to
+// compare two values.
+// This wrapper is needed because MatchFunc requires a function that takes two
+// arguments of specific type T, while equality.Semantic.DeepEqual takes
+// arguments of type interface{}/any. The wrapper satisfies the type
+// constraints of MatchFunc while leveraging the underlying semantic equality
+// logic. It can be used by any other function that needs to call DeepEqual.
+func SemanticDeepEqual[T any](a, b T) bool {
+	return equality.Semantic.DeepEqual(a, b)
+}
+
+// DirectEqual is a MatchFunc that uses the == operator to compare two values.
+// It can be used by any other function that needs to compare two values
+// directly.
+func DirectEqual[T comparable](a, b T) bool {
+	return a == b
+}

pkg/api/validate/each_test.go

@@ -0,0 +1,492 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"slices"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+type TestStruct struct {
+	I int
+	D string
+}
+
+type TestStructWithKey struct {
+	Key string
+	I   int
+	D   string
+}
+
+type NonComparableKey struct {
+	I *int
+}
+
+type NonComparableStruct struct {
+	I int
+	S []string
+}
+
+type NonComparableStructWithKey struct {
+	Key string
+	I   int
+	S   []string
+}
+
+type NonComparableStructWithPtr struct {
+	I int
+	P *int
+}
+
+func TestEachSliceVal(t *testing.T) {
+	testEachSliceVal(t, "valid", []int{11, 12, 13})
+	testEachSliceVal(t, "valid", []string{"a", "b", "c"})
+	testEachSliceVal(t, "valid", []TestStruct{{11, "a"}, {12, "b"}, {13, "c"}})
+
+	testEachSliceVal(t, "empty", []int{})
+	testEachSliceVal(t, "empty", []string{})
+	testEachSliceVal(t, "empty", []TestStruct{})
+
+	testEachSliceVal[int](t, "nil", nil)
+	testEachSliceVal[string](t, "nil", nil)
+	testEachSliceVal[TestStruct](t, "nil", nil)
+
+	testEachSliceValUpdate(t, "valid", []int{11, 12, 13})
+	testEachSliceValUpdate(t, "valid", []string{"a", "b", "c"})
+	testEachSliceValUpdate(t, "valid", []TestStruct{{11, "a"}, {12, "b"}, {13, "c"}})
+
+	testEachSliceValUpdate(t, "empty", []int{})
+	testEachSliceValUpdate(t, "empty", []string{})
+	testEachSliceValUpdate(t, "empty", []TestStruct{})
+
+	testEachSliceValUpdate[int](t, "nil", nil)
+	testEachSliceValUpdate[string](t, "nil", nil)
+	testEachSliceValUpdate[TestStruct](t, "nil", nil)
+}
+
+func testEachSliceVal[T any](t *testing.T, name string, input []T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		_ = EachSliceVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, nil, vfn)
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func testEachSliceValUpdate[T any](t *testing.T, name string, input []T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal == nil {
+				t.Fatalf("expected non-nil oldVal")
+			}
+			if !reflect.DeepEqual(*newVal, *oldVal) {
+				t.Errorf("expected oldVal == newVal, got %v, %v", *oldVal, *newVal)
+			}
+			calls++
+			return nil
+		}
+		old := make([]T, len(input))
+		copy(old, input)
+		slices.Reverse(old)
+		match := func(a, b T) bool { return reflect.DeepEqual(a, b) }
+		_ = EachSliceVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, old, match, match, vfn)
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachSliceValRatcheting(t *testing.T) {
+	testEachSliceValRatcheting(t, "ComparableStruct same data different order",
+		[]TestStruct{
+			{11, "a"}, {12, "b"}, {13, "c"},
+		},
+		[]TestStruct{
+			{11, "a"}, {13, "c"}, {12, "b"},
+		},
+		SemanticDeepEqual,
+		nil,
+	)
+	testEachSliceValRatcheting(t, "ComparableStruct less data in new, exist in old",
+		[]TestStruct{
+			{11, "a"}, {12, "b"}, {13, "c"},
+		},
+		[]TestStruct{
+			{11, "a"}, {13, "c"},
+		},
+		DirectEqual,
+		nil,
+	)
+	testEachSliceValRatcheting(t, "Comparable struct with key same data different order",
+		[]TestStructWithKey{
+			{Key: "a", I: 11, D: "a"}, {Key: "b", I: 12, D: "b"}, {Key: "c", I: 13, D: "c"},
+		},
+		[]TestStructWithKey{
+			{Key: "a", I: 11, D: "a"}, {Key: "c", I: 13, D: "c"}, {Key: "b", I: 12, D: "b"},
+		},
+		MatchFunc[TestStructWithKey](func(a, b TestStructWithKey) bool {
+			return a.Key == b.Key
+		}),
+		DirectEqual,
+	)
+	testEachSliceValRatcheting(t, "Comparable struct with key less data in new, exist in old",
+		[]TestStructWithKey{
+			{Key: "a", I: 11, D: "a"}, {Key: "b", I: 12, D: "b"}, {Key: "c", I: 13, D: "c"},
+		},
+		[]TestStructWithKey{
+			{Key: "a", I: 11, D: "a"}, {Key: "c", I: 13, D: "c"},
+		},
+		MatchFunc[TestStructWithKey](func(a, b TestStructWithKey) bool {
+			return a.Key == b.Key
+		}),
+		DirectEqual,
+	)
+	testEachSliceValRatcheting(t, "NonComparableStruct same data different order",
+		[]NonComparableStruct{
+			{I: 11, S: []string{"a"}}, {I: 12, S: []string{"b"}}, {I: 13, S: []string{"c"}},
+		},
+		[]NonComparableStruct{
+			{I: 11, S: []string{"a"}}, {I: 13, S: []string{"c"}}, {I: 12, S: []string{"b"}},
+		},
+		SemanticDeepEqual,
+		nil,
+	)
+	testEachSliceValRatcheting(t, "NonComparableStructWithKey same data different order",
+		[]NonComparableStructWithKey{
+			{Key: "a", I: 11, S: []string{"a"}}, {Key: "b", I: 12, S: []string{"b"}}, {Key: "c", I: 13, S: []string{"c"}},
+		},
+		[]NonComparableStructWithKey{
+			{Key: "a", I: 11, S: []string{"a"}}, {Key: "b", I: 12, S: []string{"b"}}, {Key: "c", I: 13, S: []string{"c"}},
+		},
+		MatchFunc[NonComparableStructWithKey](func(a, b NonComparableStructWithKey) bool {
+			return a.Key == b.Key
+		}),
+		SemanticDeepEqual,
+	)
+
+}
+
+func testEachSliceValRatcheting[T any](t *testing.T, name string, old, new []T, match, equiv MatchFunc[T]) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			return field.ErrorList{field.Invalid(fldPath, *newVal, "expected no calls")}
+		}
+		errs := EachSliceVal(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, match, equiv, vfn)
+		if len(errs) > 0 {
+			t.Errorf("expected no errors, got %d: %s", len(errs), fmtErrs(errs))
+		}
+	})
+}
+
+func TestEachMapVal(t *testing.T) {
+	testEachMapVal(t, "valid", map[string]int{"one": 11, "two": 12, "three": 13})
+	testEachMapVal(t, "valid", map[string]string{"A": "a", "B": "b", "C": "c"})
+	testEachMapVal(t, "valid", map[string]TestStruct{"one": {11, "a"}, "two": {12, "b"}, "three": {13, "c"}})
+
+	testEachMapVal(t, "empty", map[string]int{})
+	testEachMapVal(t, "empty", map[string]string{})
+	testEachMapVal(t, "empty", map[string]TestStruct{})
+
+	testEachMapVal[int](t, "nil", nil)
+	testEachMapVal[string](t, "nil", nil)
+	testEachMapVal[TestStruct](t, "nil", nil)
+}
+
+func testEachMapVal[T any](t *testing.T, name string, input map[string]T) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *T) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		_ = EachMapVal(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, nil, vfn)
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachMapValRatcheting(t *testing.T) {
+	testEachMapValRatcheting(t, "primitive same data",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13, "two": 12},
+		DirectEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "primitive less data in new, exist in old",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13},
+		DirectEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "primitive new data, not exist in old",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13, "two": 12, "four": 14},
+		DirectEqual,
+		1,
+	)
+	testEachMapValRatcheting(t, "non comparable value, same data",
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+			"two":   {I: 12, S: []string{"b"}},
+		},
+		SemanticDeepEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "non comparable value, less data in new, exist in old",
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		SemanticDeepEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "non comparable value, new data, not exist in old",
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"three": {I: 13, S: []string{"c"}},
+		},
+		map[string]NonComparableStruct{
+			"one":   {I: 11, S: []string{"a"}},
+			"three": {I: 13, S: []string{"c"}},
+			"two":   {I: 12, S: []string{"b"}},
+			"four":  {I: 14, S: []string{"d"}},
+		},
+		SemanticDeepEqual,
+		1,
+	)
+	testEachMapValRatcheting(t, "struct with pointer field, same value different pointer",
+		map[string]NonComparableStructWithPtr{
+			"one": {I: 11, P: ptr.To(1)},
+			"two": {I: 12, P: ptr.To(2)},
+		},
+		map[string]NonComparableStructWithPtr{
+			"one": {I: 11, P: ptr.To(1)},
+			"two": {I: 12, P: ptr.To(2)},
+		},
+		SemanticDeepEqual,
+		0,
+	)
+	testEachMapValRatcheting(t, "nil map to empty map",
+		nil,
+		map[string]int{},
+		DirectEqual,
+		0,
+	)
+
+	testEachMapValRatcheting(t, "nil map to non-empty map",
+		nil,
+		map[string]int{"one": 1},
+		DirectEqual,
+		1, // Expect validation for new entry
+	)
+
+	testEachMapValRatcheting(t, "empty map to nil map",
+		map[string]int{},
+		nil,
+		DirectEqual,
+		0,
+	)
+
+	testEachMapValRatcheting(t, "non-empty map to nil map",
+		map[string]int{"one": 1},
+		nil,
+		DirectEqual,
+		0,
+	)
+}
+
+func testEachMapValRatcheting[K ~string, V any](t *testing.T, name string, old, new map[K]V, equiv MatchFunc[V], wantCalls int) {
+	t.Helper()
+	var zero V
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *V) field.ErrorList {
+			calls++
+			return nil
+		}
+		_ = EachMapVal(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, equiv, vfn)
+		if calls != wantCalls {
+			t.Errorf("expected %d calls, got %d", wantCalls, calls)
+		}
+	})
+}
+
+type StringType string
+
+func TestEachMapKey(t *testing.T) {
+	testEachMapKey(t, "valid", map[string]int{"one": 11, "two": 12, "three": 13})
+	testEachMapKey(t, "valid", map[StringType]string{"A": "a", "B": "b", "C": "c"})
+}
+
+func testEachMapKey[K ~string, V any](t *testing.T, name string, input map[K]V) {
+	t.Helper()
+	var zero K
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *K) field.ErrorList {
+			if oldVal != nil {
+				t.Errorf("expected nil oldVal, got %v", *oldVal)
+			}
+			calls++
+			return nil
+		}
+		_ = EachMapKey(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, vfn)
+		if calls != len(input) {
+			t.Errorf("expected %d calls, got %d", len(input), calls)
+		}
+	})
+}
+
+func TestEachMapKeyRatcheting(t *testing.T) {
+	testEachMapKeyRatcheting(t, "same data, 0 validation calls",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13, "two": 12},
+		0,
+	)
+	testEachMapKeyRatcheting(t, "less data in new, exist in old, 0 validation calls",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13},
+		0,
+	)
+	testEachMapKeyRatcheting(t, "new data, not exist in old, 1 validation call",
+		map[string]int{"one": 11, "two": 12, "three": 13},
+		map[string]int{"one": 11, "three": 13, "two": 12, "four": 14},
+		1,
+	)
+}
+
+func testEachMapKeyRatcheting[K ~string, V any](t *testing.T, name string, old, new map[K]V, wantCalls int) {
+	t.Helper()
+	var zero V
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		calls := 0
+		vfn := func(ctx context.Context, op operation.Operation, fldPath *field.Path, newVal, oldVal *K) field.ErrorList {
+			calls++
+			return nil
+		}
+		_ = EachMapKey(context.Background(), operation.Operation{Type: operation.Update}, field.NewPath("test"), new, old, vfn)
+		if calls != wantCalls {
+			t.Errorf("expected %d calls, got %d", wantCalls, calls)
+		}
+	})
+}
+
+func TestUniqueComparableValues(t *testing.T) {
+	testUnique(t, "int_nil", []int(nil), 0)
+	testUnique(t, "int_empty", []int{}, 0)
+	testUnique(t, "int_uniq", []int{1, 2, 3}, 0)
+	testUnique(t, "int_dup", []int{1, 2, 3, 2, 1}, 2)
+
+	testUnique(t, "string_nil", []string(nil), 0)
+	testUnique(t, "string_empty", []string{}, 0)
+	testUnique(t, "string_uniq", []string{"a", "b", "c"}, 0)
+	testUnique(t, "string_dup", []string{"a", "a", "c", "b", "a"}, 2)
+
+	type isComparable struct {
+		I int
+		S string
+	}
+
+	testUnique(t, "struct_nil", []isComparable(nil), 0)
+	testUnique(t, "struct_empty", []isComparable{}, 0)
+	testUnique(t, "struct_uniq", []isComparable{{1, "a"}, {2, "b"}, {3, "c"}}, 0)
+	testUnique(t, "struct_dup", []isComparable{{1, "a"}, {2, "b"}, {3, "c"}, {2, "b"}, {1, "a"}}, 2)
+}
+
+func testUnique[T comparable](t *testing.T, name string, input []T, wantErrs int) {
+	t.Helper()
+	t.Run(fmt.Sprintf("%s(direct)", name), func(t *testing.T) {
+		errs := Unique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, DirectEqual)
+		if len(errs) != wantErrs {
+			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+		}
+	})
+	t.Run(fmt.Sprintf("%s(reflect)", name), func(t *testing.T) {
+		errs := Unique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, SemanticDeepEqual)
+		if len(errs) != wantErrs {
+			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+		}
+	})
+}
+
+func TestUniqueNonComparableValues(t *testing.T) {
+	type nonComparable struct {
+		I int
+		S []string
+	}
+
+	testUniqueByReflect(t, "noncomp_nil", []nonComparable(nil), 0)
+	testUniqueByReflect(t, "noncomp_empty", []nonComparable{}, 0)
+	testUniqueByReflect(t, "noncomp_uniq", []nonComparable{{1, []string{"a"}}, {2, []string{"b"}}, {3, []string{"c"}}}, 0)
+	testUniqueByReflect(t, "noncomp_dup", []nonComparable{
+		{1, []string{"a"}},
+		{2, []string{"b"}},
+		{3, []string{"c"}},
+		{2, []string{"b"}},
+		{1, []string{"a"}}}, 2)
+}
+
+func testUniqueByReflect[T any](t *testing.T, name string, input []T, wantErrs int) {
+	t.Helper()
+	var zero T
+	t.Run(fmt.Sprintf("%s(%T)", name, zero), func(t *testing.T) {
+		errs := Unique(context.Background(), operation.Operation{}, field.NewPath("test"), input, nil, SemanticDeepEqual)
+		if len(errs) != wantErrs {
+			t.Errorf("expected %d errors, got %d: %s", wantErrs, len(errs), fmtErrs(errs))
+		}
+	})
+}

pkg/api/validate/enum.go

@@ -0,0 +1,40 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"slices"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Enum verifies that the specified value is one of the valid symbols.
+// This is for string enums only.
+func Enum[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T, symbols sets.Set[T]) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	if !symbols.Has(*value) {
+		symbolList := symbols.UnsortedList()
+		slices.Sort(symbolList)
+		return field.ErrorList{field.NotSupported[T](fldPath, *value, symbolList)}
+	}
+	return nil
+}

pkg/api/validate/enum_test.go

@@ -0,0 +1,107 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestEnum(t *testing.T) {
+	cases := []struct {
+		value string
+		valid sets.Set[string]
+		err   bool
+	}{{
+		value: "a",
+		valid: sets.New("a", "b", "c"),
+		err:   false,
+	}, {
+		value: "x",
+		valid: sets.New("c", "a", "b"),
+		err:   true,
+	}}
+
+	for i, tc := range cases {
+		result := Enum(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &tc.value, nil, tc.valid)
+		if len(result) > 0 && !tc.err {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err {
+			t.Errorf("case %d: unexpected success", i)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if want, got := `supported values: "a", "b", "c"`, result[0].Detail; got != want {
+				t.Errorf("case %d: wrong error, expected: %q, got: %q", i, want, got)
+			}
+		}
+	}
+}
+
+func TestEnumTypedef(t *testing.T) {
+	type StringType string
+	const (
+		NotStringFoo StringType = "foo"
+		NotStringBar StringType = "bar"
+		NotStringQux StringType = "qux"
+	)
+
+	cases := []struct {
+		value StringType
+		valid sets.Set[StringType]
+		err   bool
+	}{{
+		value: "foo",
+		valid: sets.New(NotStringFoo, NotStringBar, NotStringQux),
+		err:   false,
+	}, {
+		value: "x",
+		valid: sets.New(NotStringFoo, NotStringBar, NotStringQux),
+		err:   true,
+	}}
+
+	for i, tc := range cases {
+		result := Enum(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &tc.value, nil, tc.valid)
+		if len(result) > 0 && !tc.err {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err {
+			t.Errorf("case %d: unexpected success", i)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if want, got := `supported values: "bar", "foo", "qux"`, result[0].Detail; got != want {
+				t.Errorf("case %d: wrong error, expected: %q, got: %q", i, want, got)
+			}
+		}
+	}
+}

pkg/api/validate/equality.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/content"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// NEQ validates that the specified comparable value is not equal to the disallowed value.
+func NEQ[T comparable](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, disallowed T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	if *value == disallowed {
+		return field.ErrorList{
+			field.Invalid(fldPath, *value, content.NEQError(disallowed)).WithOrigin("neq"),
+		}
+	}
+	return nil
+}

pkg/api/validate/immutable.go

@@ -0,0 +1,64 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/equality"
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ImmutableByCompare verifies that the specified value has not changed in the
+// course of an update operation.  It does nothing if the old value is not
+// provided. If the caller needs to compare types that are not trivially
+// comparable, they should use ImmutableByReflect instead.
+//
+// Caution: structs with pointer fields satisfy comparable, but this function
+// will only compare pointer values.  It does not compare the pointed-to
+// values.
+func ImmutableByCompare[T comparable](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+	if value == nil && oldValue == nil {
+		return nil
+	}
+	if value == nil || oldValue == nil || *value != *oldValue {
+		return field.ErrorList{
+			field.Forbidden(fldPath, "field is immutable"),
+		}
+	}
+	return nil
+}
+
+// ImmutableByReflect verifies that the specified value has not changed in
+// the course of an update operation.  It does nothing if the old value is not
+// provided. Unlike ImmutableByCompare, this function can be used with types that are
+// not directly comparable, at the cost of performance.
+func ImmutableByReflect[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue T) field.ErrorList {
+	if op.Type != operation.Update {
+		return nil
+	}
+	if !equality.Semantic.DeepEqual(value, oldValue) {
+		return field.ErrorList{
+			field.Forbidden(fldPath, "field is immutable"),
+		}
+	}
+	return nil
+}

pkg/api/validate/immutable_test.go

@@ -0,0 +1,250 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+type StructComparable struct {
+	S string
+	I int
+	B bool
+}
+
+func TestImmutableByCompare(t *testing.T) {
+	structA := StructComparable{"abc", 123, true}
+	structA2 := structA
+	structB := StructComparable{"xyz", 456, false}
+
+	for _, tc := range []struct {
+		name string
+		fn   func(operation.Operation, *field.Path) field.ErrorList
+		fail bool
+	}{{
+		name: "nil both values",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByCompare[int](context.Background(), op, fld, nil, nil)
+		},
+	}, {
+		name: "nil value",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByCompare(context.Background(), op, fld, nil, ptr.To(123))
+		},
+		fail: true,
+	}, {
+		name: "nil oldValue",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByCompare(context.Background(), op, fld, ptr.To(123), nil)
+		},
+		fail: true,
+	}, {
+		name: "int",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByCompare(context.Background(), op, fld, ptr.To(123), ptr.To(123))
+		},
+	}, {
+		name: "int fail",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByCompare(context.Background(), op, fld, ptr.To(123), ptr.To(456))
+		},
+		fail: true,
+	}, {
+		name: "string",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByCompare(context.Background(), op, fld, ptr.To("abc"), ptr.To("abc"))
+		},
+	}, {
+		name: "string fail",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByCompare(context.Background(), op, fld, ptr.To("abc"), ptr.To("xyz"))
+		},
+		fail: true,
+	}, {
+		name: "bool",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByCompare(context.Background(), op, fld, ptr.To(true), ptr.To(true))
+		},
+	}, {
+		name: "bool fail",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByCompare(context.Background(), op, fld, ptr.To(true), ptr.To(false))
+		},
+		fail: true,
+	}, {
+		name: "same struct",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByCompare(context.Background(), op, fld, ptr.To(structA), ptr.To(structA))
+		},
+	}, {
+		name: "equal struct",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByCompare(context.Background(), op, fld, ptr.To(structA), ptr.To(structA2))
+		},
+	}, {
+		name: "struct fail",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByCompare(context.Background(), op, fld, ptr.To(structA), ptr.To(structB))
+		},
+		fail: true,
+	}} {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := tc.fn(operation.Operation{Type: operation.Create}, field.NewPath(""))
+			if len(errs) != 0 { // Create should always succeed
+				t.Errorf("case %q (create): expected success: %v", tc.name, errs)
+			}
+			errs = tc.fn(operation.Operation{Type: operation.Update}, field.NewPath(""))
+			if tc.fail && len(errs) == 0 {
+				t.Errorf("case %q (update): expected failure", tc.name)
+			} else if !tc.fail && len(errs) != 0 {
+				t.Errorf("case %q (update): expected success: %v", tc.name, errs)
+			}
+		})
+	}
+}
+
+type StructNonComparable struct {
+	S   string
+	SP  *string
+	I   int
+	IP  *int
+	B   bool
+	BP  *bool
+	SS  []string
+	MSS map[string]string
+}
+
+func TestImmutableByReflect(t *testing.T) {
+	structA := StructNonComparable{
+		S:   "abc",
+		SP:  ptr.To("abc"),
+		I:   123,
+		IP:  ptr.To(123),
+		B:   true,
+		BP:  ptr.To(true),
+		SS:  []string{"a", "b", "c"},
+		MSS: map[string]string{"a": "b", "c": "d"},
+	}
+
+	structA2 := structA
+	structA2.SP = ptr.To("abc")
+	structA2.IP = ptr.To(123)
+	structA2.BP = ptr.To(true)
+	structA2.SS = []string{"a", "b", "c"}
+	structA2.MSS = map[string]string{"a": "b", "c": "d"}
+
+	structB := StructNonComparable{
+		S:   "xyz",
+		SP:  ptr.To("xyz"),
+		I:   456,
+		IP:  ptr.To(456),
+		B:   false,
+		BP:  ptr.To(false),
+		SS:  []string{"x", "y", "z"},
+		MSS: map[string]string{"x": "X", "y": "Y"},
+	}
+
+	for _, tc := range []struct {
+		name string
+		fn   func(operation.Operation, *field.Path) field.ErrorList
+		fail bool
+	}{{
+		name: "nil both values",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByReflect[*int](context.Background(), op, fld, nil, nil)
+		},
+	}, {
+		name: "nil value",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByReflect(context.Background(), op, fld, nil, ptr.To(123))
+		},
+		fail: true,
+	}, {
+		name: "nil oldValue",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByReflect(context.Background(), op, fld, ptr.To(123), nil)
+		},
+		fail: true,
+	}, {
+		name: "int",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByReflect(context.Background(), op, fld, ptr.To(123), ptr.To(123))
+		},
+	}, {
+		name: "int fail",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByReflect(context.Background(), op, fld, ptr.To(123), ptr.To(456))
+		},
+		fail: true,
+	}, {
+		name: "string",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByReflect(context.Background(), op, fld, ptr.To("abc"), ptr.To("abc"))
+		},
+	}, {
+		name: "string fail",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByReflect(context.Background(), op, fld, ptr.To("abc"), ptr.To("xyz"))
+		},
+		fail: true,
+	}, {
+		name: "bool",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByReflect(context.Background(), op, fld, ptr.To(true), ptr.To(true))
+		},
+	}, {
+		name: "bool fail",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByReflect(context.Background(), op, fld, ptr.To(true), ptr.To(false))
+		},
+		fail: true,
+	}, {
+		name: "same struct",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByReflect(context.Background(), op, fld, ptr.To(structA), ptr.To(structA))
+		},
+	}, {
+		name: "equal struct",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByReflect(context.Background(), op, fld, ptr.To(structA), ptr.To(structA2))
+		},
+	}, {
+		name: "struct fail",
+		fn: func(op operation.Operation, fld *field.Path) field.ErrorList {
+			return ImmutableByReflect(context.Background(), op, fld, ptr.To(structA), ptr.To(structB))
+		},
+		fail: true,
+	}} {
+		t.Run(tc.name, func(t *testing.T) {
+			errs := tc.fn(operation.Operation{Type: operation.Create}, field.NewPath(""))
+			if len(errs) != 0 { // Create should always succeed
+				t.Errorf("case %q (create): expected success: %v", tc.name, errs)
+			}
+			errs = tc.fn(operation.Operation{Type: operation.Update}, field.NewPath(""))
+			if tc.fail && len(errs) == 0 {
+				t.Errorf("case %q (update): expected failure", tc.name)
+			} else if !tc.fail && len(errs) != 0 {
+				t.Errorf("case %q (update): expected success: %v", tc.name, errs)
+			}
+		})
+	}
+}

pkg/api/validate/item.go

@@ -0,0 +1,72 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// MatchItemFn takes a pointer to an item and returns true if it matches the criteria.
+type MatchItemFn[T any] func(*T) bool
+
+// SliceItem finds the first item in newList that satisfies the 'matches' predicate,
+// and if found, also looks for a matching item in oldList. It then invokes
+// 'itemValidator' on these items.
+// The fldPath passed to itemValidator is indexed to the matched item's position in newList.
+// This function processes only the *first* matching item found in newList.
+// It assumes that the 'matches' predicate targets a unique identifier (primary key) and
+// will match at most one element per list.
+// If this assumption is violated, changes in list order can lead this function
+// to have inconsistent behavior.
+// This function does not validate items that were removed (present in oldList but not in newList).
+func SliceItem[TList ~[]TItem, TItem any](
+	ctx context.Context, op operation.Operation, fldPath *field.Path,
+	newList, oldList TList,
+	matches MatchItemFn[TItem],
+	equiv MatchFunc[TItem],
+	itemValidator func(ctx context.Context, op operation.Operation, fldPath *field.Path, newObj, oldObj *TItem) field.ErrorList,
+) field.ErrorList {
+	var matchedNew, matchedOld *TItem
+	var newIndex int
+
+	for i := range newList {
+		if matches(&newList[i]) {
+			matchedNew = &newList[i]
+			newIndex = i
+			break
+		}
+	}
+	if matchedNew == nil {
+		return nil
+	}
+
+	for i := range oldList {
+		if matches(&oldList[i]) {
+			matchedOld = &oldList[i]
+			break
+		}
+	}
+
+	if op.Type == operation.Update && matchedOld != nil && equiv(*matchedNew, *matchedOld) {
+		return nil
+	}
+
+	return itemValidator(ctx, op, fldPath.Index(newIndex), matchedNew, matchedOld)
+}

pkg/api/validate/item_test.go

@@ -0,0 +1,167 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type multiKeyItem struct {
+	K1 string `json:"k1"`
+	K2 string `json:"k2"`
+	V  int    `json:"v"`
+}
+
+func TestSliceItem(t *testing.T) {
+	testCases := []struct {
+		name      string
+		new       []multiKeyItem
+		old       []multiKeyItem
+		match     MatchItemFn[multiKeyItem]
+		validator func(context.Context, operation.Operation, *field.Path, *multiKeyItem, *multiKeyItem) field.ErrorList
+		expected  field.ErrorList
+	}{
+		{
+			name: "no match",
+			new: []multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "target"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, _, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, nil, "err")}
+			},
+			expected: nil,
+		},
+		{
+			name: "new item with matching keys",
+			new: []multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+				{K1: "target", K2: "target2", V: 2},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "target" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n != nil && o == nil {
+					return field.ErrorList{field.Invalid(fp, n.K1, "added")}
+				}
+				return nil
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(1), "target", "added")},
+		},
+		{
+			name: "updated item - same keys different values",
+			new: []multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+				{K1: "update", K2: "target2", V: 20},
+			},
+			old: []multiKeyItem{
+				{K1: "a", K2: "1", V: 1},
+				{K1: "update", K2: "target2", V: 2},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "update" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n != nil && o != nil && n.V != o.V {
+					return field.ErrorList{field.Invalid(fp.Child("v"), n.V, "changed")}
+				}
+				return nil
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(1).Child("v"), 20, "changed")},
+		},
+		{
+			// For completeness as listType=map && listKey=... required tags prevents dupes.
+			name: "first match only - multiple items with same keys",
+			new: []multiKeyItem{
+				{K1: "dup", K2: "target2", V: 1},
+				{K1: "dup", K2: "target2", V: 2},
+			},
+			old: []multiKeyItem{
+				{K1: "dup", K2: "target2", V: 10},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "dup" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n != nil && o != nil {
+					return field.ErrorList{field.Invalid(fp, n.V, "value")}
+				}
+				return nil
+			},
+			expected: field.ErrorList{field.Invalid(field.NewPath("").Index(0), 1, "value")},
+		},
+		{
+			name: "nil new list",
+			new:  nil,
+			old: []multiKeyItem{
+				{K1: "exists", K2: "target2", V: 1},
+			},
+			match: func(i *multiKeyItem) bool {
+				return i.K1 == "exists" && i.K2 == "target2"
+			},
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, n, o *multiKeyItem) field.ErrorList {
+				if n == nil && o != nil {
+					return field.ErrorList{field.Invalid(fp, nil, "deleted")}
+				}
+				return nil
+			},
+			expected: nil,
+		},
+		{
+			name:  "empty lists",
+			new:   []multiKeyItem{},
+			old:   []multiKeyItem{},
+			match: func(i *multiKeyItem) bool { return true },
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, _, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, nil, "err")}
+			},
+			expected: nil,
+		},
+		{
+			name:  "nil lists",
+			new:   nil,
+			old:   nil,
+			match: func(i *multiKeyItem) bool { return true },
+			validator: func(_ context.Context, _ operation.Operation, fp *field.Path, _, _ *multiKeyItem) field.ErrorList {
+				return field.ErrorList{field.Invalid(fp, nil, "err")}
+			},
+			expected: nil,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			op := operation.Operation{Type: operation.Update}
+			fp := field.NewPath("")
+
+			got := SliceItem(ctx, op, fp, tc.new, tc.old, tc.match, SemanticDeepEqual, tc.validator)
+
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}

pkg/api/validate/limits.go

@@ -0,0 +1,37 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+	"k8s.io/apimachinery/pkg/api/validate/content"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// Minimum verifies that the specified value is greater than or equal to min.
+func Minimum[T constraints.Integer](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, min T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	if *value < min {
+		return field.ErrorList{field.Invalid(fldPath, *value, content.MinError(min)).WithOrigin("minimum")}
+	}
+	return nil
+}

pkg/api/validate/limits_test.go

@@ -0,0 +1,111 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"regexp"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/api/validate/constraints"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestMinimum(t *testing.T) {
+	testMinimumPositive[int](t)
+	testMinimumNegative[int](t)
+	testMinimumPositive[int8](t)
+	testMinimumNegative[int8](t)
+	testMinimumPositive[int16](t)
+	testMinimumNegative[int16](t)
+	testMinimumPositive[int32](t)
+	testMinimumNegative[int32](t)
+	testMinimumPositive[int64](t)
+	testMinimumNegative[int64](t)
+
+	testMinimumPositive[uint](t)
+	testMinimumPositive[uint8](t)
+	testMinimumPositive[uint16](t)
+	testMinimumPositive[uint32](t)
+	testMinimumPositive[uint64](t)
+}
+
+type minimumTestCase[T constraints.Integer] struct {
+	value T
+	min   T
+	err   string // regex
+}
+
+func testMinimumPositive[T constraints.Integer](t *testing.T) {
+	t.Helper()
+	cases := []minimumTestCase[T]{{
+		value: 0,
+		min:   0,
+	}, {
+		value: 0,
+		min:   1,
+		err:   "fldpath: Invalid value.*must be greater than or equal to",
+	}, {
+		value: 1,
+		min:   1,
+	}, {
+		value: 1,
+		min:   2,
+		err:   "fldpath: Invalid value.*must be greater than or equal to",
+	}}
+	doTestMinimum[T](t, cases)
+}
+
+func testMinimumNegative[T constraints.Signed](t *testing.T) {
+	t.Helper()
+	cases := []minimumTestCase[T]{{
+		value: -1,
+		min:   -1,
+	}, {
+		value: -2,
+		min:   -1,
+		err:   "fldpath: Invalid value.*must be greater than or equal to",
+	}}
+
+	doTestMinimum[T](t, cases)
+}
+
+func doTestMinimum[T constraints.Integer](t *testing.T, cases []minimumTestCase[T]) {
+	t.Helper()
+	for i, tc := range cases {
+		v := tc.value
+		result := Minimum(context.Background(), operation.Operation{}, field.NewPath("fldpath"), &v, nil, tc.min)
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}

pkg/api/validate/required.go

@@ -0,0 +1,133 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// RequiredValue verifies that the specified value is not the zero-value for
+// its type.
+func RequiredValue[T comparable](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	var zero T
+	if *value != zero {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "")}
+}
+
+// RequiredPointer verifies that the specified pointer is not nil.
+func RequiredPointer[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value != nil {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "")}
+}
+
+// RequiredSlice verifies that the specified slice is not empty.
+func RequiredSlice[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T) field.ErrorList {
+	if len(value) > 0 {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "")}
+}
+
+// RequiredMap verifies that the specified map is not empty.
+func RequiredMap[K comparable, T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]T) field.ErrorList {
+	if len(value) > 0 {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "")}
+}
+
+// ForbiddenValue verifies that the specified value is the zero-value for its
+// type.
+func ForbiddenValue[T comparable](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	var zero T
+	if *value == zero {
+		return nil
+	}
+	return field.ErrorList{field.Forbidden(fldPath, "")}
+}
+
+// ForbiddenPointer verifies that the specified pointer is nil.
+func ForbiddenPointer[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value == nil {
+		return nil
+	}
+	return field.ErrorList{field.Forbidden(fldPath, "")}
+}
+
+// ForbiddenSlice verifies that the specified slice is empty.
+func ForbiddenSlice[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T) field.ErrorList {
+	if len(value) == 0 {
+		return nil
+	}
+	return field.ErrorList{field.Forbidden(fldPath, "")}
+}
+
+// ForbiddenMap verifies that the specified map is empty.
+func ForbiddenMap[K comparable, T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]T) field.ErrorList {
+	if len(value) == 0 {
+		return nil
+	}
+	return field.ErrorList{field.Forbidden(fldPath, "")}
+}
+
+// OptionalValue verifies that the specified value is not the zero-value for
+// its type. This is identical to RequiredValue, but the caller should treat an
+// error here as an indication that the optional value was not specified.
+func OptionalValue[T comparable](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	var zero T
+	if *value != zero {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "optional value was not specified")}
+}
+
+// OptionalPointer verifies that the specified pointer is not nil. This is
+// identical to RequiredPointer, but the caller should treat an error here as an
+// indication that the optional value was not specified.
+func OptionalPointer[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList {
+	if value != nil {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "optional value was not specified")}
+}
+
+// OptionalSlice verifies that the specified slice is not empty. This is
+// identical to RequiredSlice, but the caller should treat an error here as an
+// indication that the optional value was not specified.
+func OptionalSlice[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T) field.ErrorList {
+	if len(value) > 0 {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "optional value was not specified")}
+}
+
+// OptionalMap verifies that the specified map is not empty. This is identical
+// to RequiredMap, but the caller should treat an error here as an indication that
+// the optional value was not specified.
+func OptionalMap[K comparable, T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]T) field.ErrorList {
+	if len(value) > 0 {
+		return nil
+	}
+	return field.ErrorList{field.Required(fldPath, "optional value was not specified")}
+}

pkg/api/validate/required_test.go

@@ -0,0 +1,924 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"regexp"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestRequiredValue(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "value"
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "" // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 123
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0 // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := true
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{"value"}
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{} // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ptr.To("")
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil) // zero-value
+			return RequiredValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Required value",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestRequiredPointer(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ""
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*string)(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*int)(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*bool)(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{}
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*struct{ S string })(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil)
+			return RequiredPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (**string)(nil)
+			return RequiredPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath: Required value",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestRequiredSlice(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{""}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{0}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{false}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{nil}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{}
+			return RequiredSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestRequiredMap(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{"": ""}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{0: 0}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[bool]bool{false: false}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]bool{}
+			return RequiredMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Required value",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestOptionalValue(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "value"
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "" // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 123
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0 // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := true
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{"value"}
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{} // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ptr.To("")
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil) // zero-value
+			return OptionalValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestOptionalPointer(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ""
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*string)(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*int)(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*bool)(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{}
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*struct{ S string })(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil)
+			return OptionalPointer(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (**string)(nil)
+			return OptionalPointer(context.Background(), op, fp, pointer, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestOptionalSlice(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{""}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{0}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{false}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{nil}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{}
+			return OptionalSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestOptionalMap(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{"": ""}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{0: 0}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[bool]bool{false: false}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]bool{}
+			return OptionalMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath:.*optional value was not specified",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestForbiddenValue(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ""
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := "value"
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 123
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := true
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{}
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{"value"}
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil)
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ptr.To("")
+			return ForbiddenValue(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestForbiddenPointer(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*string)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := ""
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*int)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := 0
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*bool)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := false
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (*struct{ S string })(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := struct{ S string }{}
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			pointer := (**string)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, pointer, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := (*string)(nil)
+			return ForbiddenPointer(context.Background(), op, fp, &value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestForbiddenSlice(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []string{""}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []int{0}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []bool{false}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := []*string{nil}
+			return ForbiddenSlice(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}
+
+func TestForbiddenMap(t *testing.T) {
+	cases := []struct {
+		fn  func(op operation.Operation, fp *field.Path) field.ErrorList
+		err string // regex
+	}{{
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]string{"": ""}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[int]int{0: 0}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[string]bool{}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+	}, {
+		fn: func(op operation.Operation, fp *field.Path) field.ErrorList {
+			value := map[bool]bool{false: false}
+			return ForbiddenMap(context.Background(), op, fp, value, nil)
+		},
+		err: "fldpath: Forbidden",
+	}}
+
+	for i, tc := range cases {
+		result := tc.fn(operation.Operation{}, field.NewPath("fldpath"))
+		if len(result) > 0 && tc.err == "" {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && tc.err != "" {
+			t.Errorf("case %d: unexpected success: expected %q", i, tc.err)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			if re := regexp.MustCompile(tc.err); !re.MatchString(result[0].Error()) {
+				t.Errorf("case %d: wrong error\nexpected: %q\n     got: %v", i, tc.err, fmtErrs(result))
+			}
+		}
+	}
+}

pkg/api/validate/subfield.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// GetFieldFunc is a function that extracts a field from a type and returns a
+// nilable value.
+type GetFieldFunc[Tstruct any, Tfield any] func(*Tstruct) Tfield
+
+// Subfield validates a subfield of a struct against a validator function.
+func Subfield[Tstruct any, Tfield any](ctx context.Context, op operation.Operation, fldPath *field.Path, newStruct, oldStruct *Tstruct,
+	fldName string, getField GetFieldFunc[Tstruct, Tfield], validator ValidateFunc[Tfield]) field.ErrorList {
+	var errs field.ErrorList
+	newVal := getField(newStruct)
+	var oldVal Tfield
+	if oldStruct != nil {
+		oldVal = getField(oldStruct)
+	}
+	// TODO: passing an equiv function to Subfield for direct comparison instead of
+	// SemanticDeepEqual if fields can be compared directly, to improve performance.
+	if op.Type == operation.Update && SemanticDeepEqual(newVal, oldVal) {
+		return nil
+	}
+	errs = append(errs, validator(ctx, op, fldPath.Child(fldName), newVal, oldVal)...)
+	return errs
+}

pkg/api/validate/testing.go

@@ -0,0 +1,35 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// FixedResult asserts a fixed boolean result.  This is mostly useful for
+// testing.
+func FixedResult[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ T, result bool, arg string) field.ErrorList {
+	if result {
+		return nil
+	}
+	return field.ErrorList{
+		field.Invalid(fldPath, value, "forced failure: "+arg).WithOrigin("validateFalse"),
+	}
+}

pkg/api/validate/testing_test.go

@@ -0,0 +1,146 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+	"k8s.io/utils/ptr"
+)
+
+func TestFixedResult(t *testing.T) {
+	cases := []struct {
+		value any
+		pass  bool
+	}{{
+		value: "",
+		pass:  false,
+	}, {
+		value: "",
+		pass:  true,
+	}, {
+		value: "nonempty",
+		pass:  false,
+	}, {
+		value: "nonempty",
+		pass:  true,
+	}, {
+		value: 0,
+		pass:  false,
+	}, {
+		value: 0,
+		pass:  true,
+	}, {
+		value: 1,
+		pass:  false,
+	}, {
+		value: 1,
+		pass:  true,
+	}, {
+		value: false,
+		pass:  false,
+	}, {
+		value: false,
+		pass:  true,
+	}, {
+		value: true,
+		pass:  false,
+	}, {
+		value: true,
+		pass:  true,
+	}, {
+		value: nil,
+		pass:  false,
+	}, {
+		value: nil,
+		pass:  true,
+	}, {
+		value: ptr.To(""),
+		pass:  false,
+	}, {
+		value: ptr.To(""),
+		pass:  true,
+	}, {
+		value: ptr.To("nonempty"),
+		pass:  false,
+	}, {
+		value: ptr.To("nonempty"),
+		pass:  true,
+	}, {
+		value: []string(nil),
+		pass:  false,
+	}, {
+		value: []string(nil),
+		pass:  true,
+	}, {
+		value: []string{},
+		pass:  false,
+	}, {
+		value: []string{},
+		pass:  true,
+	}, {
+		value: []string{"s"},
+		pass:  false,
+	}, {
+		value: []string{"s"},
+		pass:  true,
+	}, {
+		value: map[string]string(nil),
+		pass:  false,
+	}, {
+		value: map[string]string(nil),
+		pass:  true,
+	}, {
+		value: map[string]string{},
+		pass:  false,
+	}, {
+		value: map[string]string{},
+		pass:  true,
+	}, {
+		value: map[string]string{"k": "v"},
+		pass:  false,
+	}, {
+		value: map[string]string{"k": "v"},
+		pass:  true,
+	}}
+
+	matcher := field.ErrorMatcher{}.ByOrigin().ByDetailExact()
+	for i, tc := range cases {
+		result := FixedResult(context.Background(), operation.Operation{}, field.NewPath("fldpath"), tc.value, nil, tc.pass, "detail string")
+		if len(result) != 0 && tc.pass {
+			t.Errorf("case %d: unexpected failure: %v", i, fmtErrs(result))
+			continue
+		}
+		if len(result) == 0 && !tc.pass {
+			t.Errorf("case %d: unexpected success", i)
+			continue
+		}
+		if len(result) > 0 {
+			if len(result) > 1 {
+				t.Errorf("case %d: unexepected multi-error: %v", i, fmtErrs(result))
+				continue
+			}
+			wantErrorList := field.ErrorList{
+				field.Invalid(field.NewPath("fldpath"), tc.value, "forced failure: detail string").WithOrigin("validateFalse"),
+			}
+			matcher.Test(t, wantErrorList, result)
+		}
+	}
+}

pkg/api/validate/union.go

@@ -0,0 +1,212 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ExtractorFn extracts a value from a parent object. Depending on the context,
+// that could be the value of a field or just whether that field was set or
+// not.
+// Note: obj is not guaranteed to be non-nil, need to handle nil obj in the
+// extractor.
+type ExtractorFn[T, V any] func(obj T) V
+
+// UnionValidationOptions configures how union validation behaves
+type UnionValidationOptions struct {
+	// ErrorForEmpty returns error when no fields are set (nil means no error)
+	ErrorForEmpty func(fldPath *field.Path, allFields []string) *field.Error
+
+	// ErrorForMultiple returns error when multiple fields are set (nil means no error)
+	ErrorForMultiple func(fldPath *field.Path, specifiedFields []string, allFields []string) *field.Error
+}
+
+// Union verifies that exactly one member of a union is specified.
+//
+// UnionMembership must define all the members of the union.
+//
+// For example:
+//
+//	var UnionMembershipForABC := validate.NewUnionMembership([2]string{"a", "A"}, [2]string{"b", "B"}, [2]string{"c", "C"})
+//	func ValidateABC(ctx context.Context, op operation.Operation, fldPath *field.Path, in *ABC) (errs fields.ErrorList) {
+//		errs = append(errs, Union(ctx, op, fldPath, in, oldIn, UnionMembershipForABC,
+//			func(in *ABC) bool { return in.A != nil },
+//			func(in *ABC) bool { return in.B != ""},
+//			func(in *ABC) bool { return in.C != 0 },
+//		)...)
+//		return errs
+//	}
+func Union[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj T, union *UnionMembership, isSetFns ...ExtractorFn[T, bool]) field.ErrorList {
+	options := UnionValidationOptions{
+		ErrorForEmpty: func(fldPath *field.Path, allFields []string) *field.Error {
+			return field.Invalid(fldPath, "",
+				fmt.Sprintf("must specify one of: %s", strings.Join(allFields, ", ")))
+		},
+		ErrorForMultiple: func(fldPath *field.Path, specifiedFields []string, allFields []string) *field.Error {
+			return field.Invalid(fldPath, fmt.Sprintf("{%s}", strings.Join(specifiedFields, ", ")),
+				fmt.Sprintf("must specify exactly one of: %s", strings.Join(allFields, ", ")))
+		},
+	}
+
+	return unionValidate(op, fldPath, obj, oldObj, union, options, isSetFns...)
+}
+
+// DiscriminatedUnion verifies specified union member matches the discriminator.
+//
+// UnionMembership must define all the members of the union and the discriminator.
+//
+// For example:
+//
+//	var UnionMembershipForABC = validate.NewDiscriminatedUnionMembership("type", [2]string{"a", "A"}, [2]string{"b", "B"}, [2]string{"c", "C"})
+//	func ValidateABC(ctx context.Context, op operation.Operation, fldPath *field.Path, in *ABC) (errs field.ErrorList) {
+//		errs = append(errs, DiscriminatedUnion(ctx, op, fldPath, in, oldIn, UnionMembershipForABC,
+//			func(in *ABC) string { return string(in.Type) },
+//			func(in *ABC) bool { return in.A != nil },
+//			func(in *ABC) bool { return in.B != ""},
+//			func(in *ABC) bool { return in.C != 0 },
+//		)...)
+//		return errs
+//	}
+//
+// It is not an error for the discriminatorValue to be unknown.  That must be
+// validated on its own.
+func DiscriminatedUnion[T any, D ~string](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj T, union *UnionMembership, discriminatorExtractor ExtractorFn[T, D], isSetFns ...ExtractorFn[T, bool]) (errs field.ErrorList) {
+	if len(union.members) != len(isSetFns) {
+		return field.ErrorList{
+			field.InternalError(fldPath,
+				fmt.Errorf("number of extractors (%d) does not match number of union members (%d)",
+					len(isSetFns), len(union.members))),
+		}
+	}
+	var changed bool
+	discriminatorValue := discriminatorExtractor(obj)
+	if op.Type == operation.Update {
+		oldDiscriminatorValue := discriminatorExtractor(oldObj)
+		changed = discriminatorValue != oldDiscriminatorValue
+	}
+
+	for i, fieldIsSet := range isSetFns {
+		member := union.members[i]
+		isDiscriminatedMember := string(discriminatorValue) == member.discriminatorValue
+		newIsSet := fieldIsSet(obj)
+		if op.Type == operation.Update && !changed {
+			oldIsSet := fieldIsSet(oldObj)
+			changed = changed || newIsSet != oldIsSet
+		}
+		if newIsSet && !isDiscriminatedMember {
+			errs = append(errs, field.Invalid(fldPath.Child(member.fieldName), "",
+				fmt.Sprintf("may only be specified when `%s` is %q", union.discriminatorName, member.discriminatorValue)))
+		} else if !newIsSet && isDiscriminatedMember {
+			errs = append(errs, field.Invalid(fldPath.Child(member.fieldName), "",
+				fmt.Sprintf("must be specified when `%s` is %q", union.discriminatorName, discriminatorValue)))
+		}
+	}
+	// If the union discriminator and membership is unchanged, we don't need to
+	// re-validate.
+	if op.Type == operation.Update && !changed {
+		return nil
+	}
+	return errs
+}
+
+type member struct {
+	fieldName, discriminatorValue string
+}
+
+// UnionMembership represents an ordered list of field union memberships.
+type UnionMembership struct {
+	discriminatorName string
+	members           []member
+}
+
+// NewUnionMembership returns a new UnionMembership for the given list of members.
+//
+// Each member is a [2]string to provide a fieldName and discriminatorValue pair, where
+// [0] identifies the field name and [1] identifies the union member Name.
+//
+// Field names must be unique.
+func NewUnionMembership(member ...[2]string) *UnionMembership {
+	return NewDiscriminatedUnionMembership("", member...)
+}
+
+// NewDiscriminatedUnionMembership returns a new UnionMembership for the given discriminator field and list of members.
+// members are provided in the same way as for NewUnionMembership.
+func NewDiscriminatedUnionMembership(discriminatorFieldName string, members ...[2]string) *UnionMembership {
+	u := &UnionMembership{}
+	u.discriminatorName = discriminatorFieldName
+	for _, fieldName := range members {
+		u.members = append(u.members, member{fieldName: fieldName[0], discriminatorValue: fieldName[1]})
+	}
+	return u
+}
+
+// allFields returns a string listing all the field names of the member of a union for use in error reporting.
+func (u UnionMembership) allFields() []string {
+	memberNames := make([]string, 0, len(u.members))
+	for _, f := range u.members {
+		memberNames = append(memberNames, fmt.Sprintf("`%s`", f.fieldName))
+	}
+	return memberNames
+}
+
+func unionValidate[T any](op operation.Operation, fldPath *field.Path,
+	obj, oldObj T, union *UnionMembership, options UnionValidationOptions, isSetFns ...ExtractorFn[T, bool],
+) field.ErrorList {
+	if len(union.members) != len(isSetFns) {
+		return field.ErrorList{
+			field.InternalError(fldPath,
+				fmt.Errorf("number of extractors (%d) does not match number of union members (%d)",
+					len(isSetFns), len(union.members))),
+		}
+	}
+
+	var specifiedFields []string
+	var changed bool
+	for i, fieldIsSet := range isSetFns {
+		newIsSet := fieldIsSet(obj)
+		if op.Type == operation.Update && !changed {
+			oldIsSet := fieldIsSet(oldObj)
+			changed = changed || newIsSet != oldIsSet
+		}
+		if newIsSet {
+			specifiedFields = append(specifiedFields, union.members[i].fieldName)
+		}
+	}
+
+	// If the union membership is unchanged, we don't need to re-validate.
+	if op.Type == operation.Update && !changed {
+		return nil
+	}
+
+	var errs field.ErrorList
+
+	if len(specifiedFields) > 1 && options.ErrorForMultiple != nil {
+		errs = append(errs, options.ErrorForMultiple(fldPath, specifiedFields, union.allFields()))
+	}
+
+	if len(specifiedFields) == 0 && options.ErrorForEmpty != nil {
+		errs = append(errs, options.ErrorForEmpty(fldPath, union.allFields()))
+	}
+
+	return errs
+}

pkg/api/validate/union_test.go

@@ -0,0 +1,328 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+type testMember struct{}
+
+func TestUnion(t *testing.T) {
+	testCases := []struct {
+		name        string
+		fields      [][2]string
+		fieldValues []bool
+		expected    field.ErrorList
+	}{
+		{
+			name:        "one member set",
+			fields:      [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			fieldValues: []bool{false, false, false, true},
+			expected:    nil,
+		},
+		{
+			name:        "two members set",
+			fields:      [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			fieldValues: []bool{false, true, false, true},
+			expected:    field.ErrorList{field.Invalid(nil, "{b, d}", "must specify exactly one of: `a`, `b`, `c`, `d`")},
+		},
+		{
+			name:        "all members set",
+			fields:      [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			fieldValues: []bool{true, true, true, true},
+			expected:    field.ErrorList{field.Invalid(nil, "{a, b, c, d}", "must specify exactly one of: `a`, `b`, `c`, `d`")},
+		},
+		{
+			name:        "no member set",
+			fields:      [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			fieldValues: []bool{false, false, false, false},
+			expected:    field.ErrorList{field.Invalid(nil, "", "must specify one of: `a`, `b`, `c`, `d`")},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Create mock extractors that return predefined values instead of
+			// actually extracting from the object.
+			extractors := make([]ExtractorFn[*testMember, bool], len(tc.fieldValues))
+			for i, val := range tc.fieldValues {
+				extractors[i] = func(_ *testMember) bool { return val }
+			}
+
+			got := Union(context.Background(), operation.Operation{}, nil, &testMember{}, nil, NewUnionMembership(tc.fields...), extractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
+
+func TestDiscriminatedUnion(t *testing.T) {
+	testCases := []struct {
+		name               string
+		discriminatorField string
+		fields             [][2]string
+		discriminatorValue string
+		fieldValues        []bool
+		expected           field.ErrorList
+	}{
+		{
+			name:               "valid discriminated union A",
+			discriminatorField: "d",
+			fields:             [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			discriminatorValue: "A",
+			fieldValues:        []bool{true, false, false, false},
+		},
+		{
+			name:               "valid discriminated union C",
+			discriminatorField: "d",
+			fields:             [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			discriminatorValue: "C",
+			fieldValues:        []bool{false, false, true, false},
+		},
+		{
+			name:               "invalid, discriminator not set to member that is specified",
+			discriminatorField: "type",
+			fields:             [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			discriminatorValue: "C",
+			fieldValues:        []bool{false, true, false, false},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("b"), "", "may only be specified when `type` is \"B\""),
+				field.Invalid(field.NewPath("c"), "", "must be specified when `type` is \"C\""),
+			},
+		},
+		{
+			name:               "invalid, discriminator correct, multiple members set",
+			discriminatorField: "type",
+			fields:             [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			discriminatorValue: "C",
+			fieldValues:        []bool{false, true, true, true},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("b"), "", "may only be specified when `type` is \"B\""),
+				field.Invalid(field.NewPath("d"), "", "may only be specified when `type` is \"D\""),
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			discriminatorExtractor := func(_ *testMember) string { return tc.discriminatorValue }
+
+			// Create mock extractors that return predefined values instead of
+			// actually extracting from the object.
+			extractors := make([]ExtractorFn[*testMember, bool], len(tc.fieldValues))
+			for i, val := range tc.fieldValues {
+				extractors[i] = func(_ *testMember) bool { return val }
+			}
+
+			got := DiscriminatedUnion(context.Background(), operation.Operation{}, nil, &testMember{}, nil, NewDiscriminatedUnionMembership(tc.discriminatorField, tc.fields...), discriminatorExtractor, extractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got.ToAggregate(), tc.expected.ToAggregate())
+			}
+		})
+	}
+}
+
+type testStruct struct {
+	M1 *m1 `json:"m1"`
+	M2 *m2 `json:"m2"`
+}
+
+type m1 struct{}
+type m2 struct{}
+
+var extractors = []ExtractorFn[*testStruct, bool]{
+	func(s *testStruct) bool {
+		if s == nil {
+			return false
+		}
+		return s.M1 != nil
+	},
+	func(s *testStruct) bool {
+		if s == nil {
+			return false
+		}
+		return s.M2 != nil
+	},
+}
+
+func TestUnionRatcheting(t *testing.T) {
+	testCases := []struct {
+		name      string
+		oldStruct *testStruct
+		newStruct *testStruct
+		expected  field.ErrorList
+	}{
+		{
+			name:      "both nil",
+			oldStruct: nil,
+			newStruct: nil,
+		},
+		{
+			name:      "both empty struct",
+			oldStruct: &testStruct{},
+			newStruct: &testStruct{},
+		},
+		{
+			name: "both have more than one member",
+			oldStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+			newStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+		},
+		{
+			name: "change to invalid",
+			oldStruct: &testStruct{
+				M1: &m1{},
+			},
+			newStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(nil, "{m1, m2}", "must specify exactly one of: `m1`, `m2`"),
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := Union(context.Background(), operation.Operation{Type: operation.Update}, nil, tc.newStruct, tc.oldStruct, NewUnionMembership([][2]string{{"m1", "m1"}, {"m2", "m2"}}...), extractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
+
+type testDiscriminatedStruct struct {
+	D  string `json:"d"`
+	M1 *m1    `json:"m1"`
+	M2 *m2    `json:"m2"`
+}
+
+var testDiscriminatorExtractor = func(s *testDiscriminatedStruct) string {
+	if s != nil {
+		return s.D
+	}
+	return ""
+}
+var testDiscriminatedExtractors = []ExtractorFn[*testDiscriminatedStruct, bool]{
+	func(s *testDiscriminatedStruct) bool {
+		if s == nil {
+			return false
+		}
+		return s.M1 != nil
+	},
+	func(s *testDiscriminatedStruct) bool {
+		if s == nil {
+			return false
+		}
+		return s.M2 != nil
+	},
+}
+
+func TestDiscriminatedUnionRatcheting(t *testing.T) {
+	testCases := []struct {
+		name      string
+		oldStruct *testDiscriminatedStruct
+		newStruct *testDiscriminatedStruct
+		expected  field.ErrorList
+	}{
+		{
+			name: "pass with both nil",
+		},
+		{
+			name:      "pass with both empty struct",
+			oldStruct: &testDiscriminatedStruct{},
+			newStruct: &testDiscriminatedStruct{},
+		},
+		{
+			name: "pass with both not set to member that is specified",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M2: &m2{},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M2: &m2{},
+			},
+		},
+		{
+			name: "pass with both set to more than one member",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+				M2: &m2{},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+				M2: &m2{},
+			},
+		},
+		{
+			name: "fail on changing to invalid with both set",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+				M2: &m2{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("m2"), "", "may only be specified when `d` is \"m2\""),
+			},
+		},
+		{
+			name: "fail on changing the discriminator",
+			oldStruct: &testDiscriminatedStruct{
+				D:  "m1",
+				M1: &m1{},
+			},
+			newStruct: &testDiscriminatedStruct{
+				D:  "m2",
+				M1: &m1{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(field.NewPath("m1"), "", "may only be specified when `d` is \"m1\""),
+				field.Invalid(field.NewPath("m2"), "", "must be specified when `d` is \"m2\""),
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := DiscriminatedUnion(context.Background(), operation.Operation{Type: operation.Update}, nil, tc.newStruct, tc.oldStruct, NewDiscriminatedUnionMembership("d", [][2]string{{"m1", "m1"}, {"m2", "m2"}}...), testDiscriminatorExtractor, testDiscriminatedExtractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}

pkg/api/validate/util_test.go

@@ -0,0 +1,41 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"bytes"
+	"strconv"
+
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// fmtErrs is a helper for nicer test output.  It will use multiple lines if
+// errs has more than 1 item.
+func fmtErrs(errs field.ErrorList) string {
+	if len(errs) == 0 {
+		return "<no errors>"
+	}
+	if len(errs) == 1 {
+		return strconv.Quote(errs[0].Error())
+	}
+	buf := bytes.Buffer{}
+	for _, e := range errs {
+		buf.WriteString("\n")
+		buf.WriteString(strconv.Quote(e.Error()))
+	}
+	return buf.String()
+}

pkg/api/validate/zeroorone.go

@@ -0,0 +1,54 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+// ZeroOrOneOfUnion verifies that at most one member of a union is specified.
+//
+// ZeroOrOneOfMembership must define all the members of the union.
+//
+// For example:
+//
+//	var ZeroOrOneOfMembershipForABC = validate.NewUnionMembership([2]string{"a", "A"}, [2]string{"b", "B"}, [2]string{"c", "C"})
+//	func ValidateABC(ctx context.Context, op operation.Operation, fldPath *field.Path, in *ABC) (errs field.ErrorList) {
+//		errs = append(errs, ZeroOrOneOfUnion(ctx, op, fldPath, in, oldIn, UnionMembershipForABC,
+//			func(in *ABC) bool { return in.A != nil },
+//			func(in *ABC) bool { return in.B != ""},
+//			func(in *ABC) bool { return in.C != 0 },
+//		)...)
+//		return errs
+//	}
+func ZeroOrOneOfUnion[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj T, union *UnionMembership, isSetFns ...ExtractorFn[T, bool]) field.ErrorList {
+	options := UnionValidationOptions{
+		ErrorForEmpty: nil,
+		ErrorForMultiple: func(fldPath *field.Path, specifiedFields []string, allFields []string) *field.Error {
+			return field.Invalid(fldPath, fmt.Sprintf("{%s}", strings.Join(specifiedFields, ", ")),
+				fmt.Sprintf("must specify at most one of: %s", strings.Join(allFields, ", "))).WithOrigin("zeroOrOneOf")
+		},
+	}
+
+	errs := unionValidate(op, fldPath, obj, oldObj, union, options, isSetFns...)
+	return errs
+}

pkg/api/validate/zeroorone_test.go

@@ -0,0 +1,145 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package validate
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
+)
+
+func TestZeroOrOneOfUnion(t *testing.T) {
+	testCases := []struct {
+		name        string
+		fields      [][2]string
+		fieldValues []bool
+		expected    field.ErrorList
+	}{
+		{
+			name:        "one member set",
+			fields:      [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			fieldValues: []bool{false, false, false, true},
+			expected:    nil,
+		},
+		{
+			name:        "two members set",
+			fields:      [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			fieldValues: []bool{false, true, false, true},
+			expected:    field.ErrorList{field.Invalid(nil, "{b, d}", "must specify at most one of: `a`, `b`, `c`, `d`").WithOrigin("zeroOrOneOf")},
+		},
+		{
+			name:        "all members set",
+			fields:      [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			fieldValues: []bool{true, true, true, true},
+			expected:    field.ErrorList{field.Invalid(nil, "{a, b, c, d}", "must specify at most one of: `a`, `b`, `c`, `d`").WithOrigin("zeroOrOneOf")},
+		},
+		{
+			name:        "no member set - allowed for ZeroOrOneOf",
+			fields:      [][2]string{{"a", "A"}, {"b", "B"}, {"c", "C"}, {"d", "D"}},
+			fieldValues: []bool{false, false, false, false},
+			expected:    nil, // This is the key difference from Union
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Create mock extractors that return predefined values instead of
+			// actually extracting from the object.
+			extractors := make([]ExtractorFn[*testMember, bool], len(tc.fieldValues))
+			for i, val := range tc.fieldValues {
+				extractors[i] = func(_ *testMember) bool { return val }
+			}
+
+			got := ZeroOrOneOfUnion(context.Background(), operation.Operation{}, nil, &testMember{}, nil, NewUnionMembership(tc.fields...), extractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}
+
+func TestZeroOrOneOfUnionRatcheting(t *testing.T) {
+	testCases := []struct {
+		name      string
+		oldStruct *testStruct
+		newStruct *testStruct
+		expected  field.ErrorList
+	}{
+		{
+			name:      "both nil",
+			oldStruct: nil,
+			newStruct: nil,
+		},
+		{
+			name:      "both empty struct - allowed for ZeroOrOneOf",
+			oldStruct: &testStruct{},
+			newStruct: &testStruct{},
+		},
+		{
+			name: "both have more than one member",
+			oldStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+			newStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+		},
+		{
+			name: "change to invalid",
+			oldStruct: &testStruct{
+				M1: &m1{},
+			},
+			newStruct: &testStruct{
+				M1: &m1{},
+				M2: &m2{},
+			},
+			expected: field.ErrorList{
+				field.Invalid(nil, "{m1, m2}", "must specify at most one of: `m1`, `m2`").WithOrigin("zeroOrOneOf"),
+			},
+		},
+		{
+			name:      "change from empty to one member - allowed",
+			oldStruct: &testStruct{},
+			newStruct: &testStruct{
+				M1: &m1{},
+			},
+			expected: nil,
+		},
+		{
+			name: "change from one member to empty - allowed",
+			oldStruct: &testStruct{
+				M1: &m1{},
+			},
+			newStruct: &testStruct{},
+			expected:  nil,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := ZeroOrOneOfUnion(context.Background(), operation.Operation{Type: operation.Update}, nil, tc.newStruct, tc.oldStruct, NewUnionMembership([][2]string{{"m1", "m1"}, {"m2", "m2"}}...), extractors...)
+			if !reflect.DeepEqual(got, tc.expected) {
+				t.Errorf("got %v want %v", got, tc.expected)
+			}
+		})
+	}
+}

pkg/api/validation/generic.go

@@ -82,7 +82,7 @@ func maskTrailingDash(name string) string {
 func ValidateNonnegativeField(value int64, fldPath *field.Path) field.ErrorList {
 	allErrs := field.ErrorList{}
 	if value < 0 {
-		allErrs = append(allErrs, field.Invalid(fldPath, value, IsNegativeErrorMsg))
+		allErrs = append(allErrs, field.Invalid(fldPath, value, IsNegativeErrorMsg).WithOrigin("minimum"))
 	}
 	return allErrs
 }

pkg/api/validation/objectmeta.go

@@ -74,13 +74,13 @@ func validateOwnerReference(ownerReference metav1.OwnerReference, fldPath *field
 		allErrs = append(allErrs, field.Invalid(fldPath.Child("apiVersion"), ownerReference.APIVersion, "version must not be empty"))
 	}
 	if len(gvk.Kind) == 0 {
-		allErrs = append(allErrs, field.Invalid(fldPath.Child("kind"), ownerReference.Kind, "kind must not be empty"))
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("kind"), ownerReference.Kind, "must not be empty"))
 	}
 	if len(ownerReference.Name) == 0 {
-		allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), ownerReference.Name, "name must not be empty"))
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), ownerReference.Name, "must not be empty"))
 	}
 	if len(ownerReference.UID) == 0 {
-		allErrs = append(allErrs, field.Invalid(fldPath.Child("uid"), ownerReference.UID, "uid must not be empty"))
+		allErrs = append(allErrs, field.Invalid(fldPath.Child("uid"), ownerReference.UID, "must not be empty"))
 	}
 	if _, ok := BannedOwners[gvk]; ok {
 		allErrs = append(allErrs, field.Invalid(fldPath, ownerReference, fmt.Sprintf("%s is disallowed from being an owner", gvk)))

pkg/api/validation/objectmeta_test.go

@@ -328,19 +328,19 @@ func TestValidateObjectMetaUpdatePreventsDeletionFieldMutation(t *testing.T) {
 			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
 			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now},
 			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now},
-			ExpectedErrs: []string{"field.deletionTimestamp: Invalid value: 1970-01-01 00:16:40 +0000 UTC: field is immutable"},
+			ExpectedErrs: []string{"field.deletionTimestamp: Invalid value: \"1970-01-01T00:16:40Z\": field is immutable"},
 		},
 		"invalid clear deletionTimestamp": {
 			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now},
 			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
 			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
-			ExpectedErrs: []string{"field.deletionTimestamp: Invalid value: \"null\": field is immutable"},
+			ExpectedErrs: []string{"field.deletionTimestamp: Invalid value: null: field is immutable"},
 		},
 		"invalid change deletionTimestamp": {
 			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &now},
 			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &later},
 			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionTimestamp: &later},
-			ExpectedErrs: []string{"field.deletionTimestamp: Invalid value: 1970-01-01 00:33:20 +0000 UTC: field is immutable"},
+			ExpectedErrs: []string{"field.deletionTimestamp: Invalid value: \"1970-01-01T00:33:20Z\": field is immutable"},
 		},
 
 		"invalid set deletionGracePeriodSeconds": {
@@ -353,7 +353,7 @@ func TestValidateObjectMetaUpdatePreventsDeletionFieldMutation(t *testing.T) {
 			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodShort},
 			New:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
 			ExpectedNew:  metav1.ObjectMeta{Name: "test", ResourceVersion: "1"},
-			ExpectedErrs: []string{"field.deletionGracePeriodSeconds: Invalid value: \"null\": field is immutable"},
+			ExpectedErrs: []string{"field.deletionGracePeriodSeconds: Invalid value: null: field is immutable"},
 		},
 		"invalid change deletionGracePeriodSeconds": {
 			Old:          metav1.ObjectMeta{Name: "test", ResourceVersion: "1", DeletionGracePeriodSeconds: &gracePeriodShort},
@@ -373,7 +373,7 @@ func TestValidateObjectMetaUpdatePreventsDeletionFieldMutation(t *testing.T) {
 		}
 		for i := range errs {
 			if errs[i].Error() != tc.ExpectedErrs[i] {
-				t.Errorf("%s: error #%d: expected %q, got %q", k, i, tc.ExpectedErrs[i], errs[i].Error())
+				t.Errorf("%s: error #%d:\n  expected: %q\n       got: %q", k, i, tc.ExpectedErrs[i], errs[i].Error())
 			}
 		}
 		if !reflect.DeepEqual(tc.New, tc.ExpectedNew) {
@@ -419,7 +419,7 @@ func TestObjectMetaGenerationUpdate(t *testing.T) {
 		}
 		for i := range errList {
 			if errList[i] != tc.ExpectedErrs[i] {
-				t.Errorf("%s: error #%d: expected %q, got %q", k, i, tc.ExpectedErrs[i], errList[i])
+				t.Errorf("%s: error #%d:\n  expected: %q\n       got: %q", k, i, tc.ExpectedErrs[i], errs[i].Error())
 			}
 		}
 	}

pkg/apis/meta/fuzzer/fuzzer.go

@@ -23,7 +23,7 @@ import (
 	"strconv"
 	"strings"
 
-	fuzz "github.com/google/gofuzz"
+	"sigs.k8s.io/randfill"
 
 	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
 	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
@@ -38,29 +38,29 @@ import (
 
 func genericFuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 	return []interface{}{
-		func(q *resource.Quantity, c fuzz.Continue) {
+		func(q *resource.Quantity, c randfill.Continue) {
 			*q = *resource.NewQuantity(c.Int63n(1000), resource.DecimalExponent)
 		},
-		func(j *int, c fuzz.Continue) {
+		func(j *int, c randfill.Continue) {
 			*j = int(c.Int31())
 		},
-		func(j **int, c fuzz.Continue) {
-			if c.RandBool() {
+		func(j **int, c randfill.Continue) {
+			if c.Bool() {
 				i := int(c.Int31())
 				*j = &i
 			} else {
 				*j = nil
 			}
 		},
-		func(j *runtime.TypeMeta, c fuzz.Continue) {
+		func(j *runtime.TypeMeta, c randfill.Continue) {
 			// We have to customize the randomization of TypeMetas because their
 			// APIVersion and Kind must remain blank in memory.
 			j.APIVersion = ""
 			j.Kind = ""
 		},
-		func(j *runtime.Object, c fuzz.Continue) {
+		func(j *runtime.Object, c randfill.Continue) {
 			// TODO: uncomment when round trip starts from a versioned object
-			if true { //c.RandBool() {
+			if true { // c.Bool() {
 				*j = &runtime.Unknown{
 					// We do not set TypeMeta here because it is not carried through a round trip
 					Raw:         []byte(`{"apiVersion":"unknown.group/unknown","kind":"Something","someKey":"someValue"}`),
@@ -69,15 +69,15 @@ func genericFuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 			} else {
 				types := []runtime.Object{&metav1.Status{}, &metav1.APIGroup{}}
 				t := types[c.Rand.Intn(len(types))]
-				c.Fuzz(t)
+				c.Fill(t)
 				*j = t
 			}
 		},
-		func(r *runtime.RawExtension, c fuzz.Continue) {
+		func(r *runtime.RawExtension, c randfill.Continue) {
 			// Pick an arbitrary type and fuzz it
 			types := []runtime.Object{&metav1.Status{}, &metav1.APIGroup{}}
 			obj := types[c.Rand.Intn(len(types))]
-			c.Fuzz(obj)
+			c.Fill(obj)
 
 			// Find a codec for converting the object to raw bytes.  This is necessary for the
 			// api version and kind to be correctly set be serialization.
@@ -100,7 +100,7 @@ func genericFuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 	}
 }
 
-// taken from gofuzz internals for RandString
+// taken from randfill (nee gofuzz) internals for RandString
 type charRange struct {
 	first, last rune
 }
@@ -114,7 +114,7 @@ func (c *charRange) choose(r *rand.Rand) rune {
 
 // randomLabelPart produces a valid random label value or name-part
 // of a label key.
-func randomLabelPart(c fuzz.Continue, canBeEmpty bool) string {
+func randomLabelPart(c randfill.Continue, canBeEmpty bool) string {
 	validStartEnd := []charRange{{'0', '9'}, {'a', 'z'}, {'A', 'Z'}}
 	validMiddle := []charRange{{'0', '9'}, {'a', 'z'}, {'A', 'Z'},
 		{'.', '.'}, {'-', '-'}, {'_', '_'}}
@@ -138,7 +138,7 @@ func randomLabelPart(c fuzz.Continue, canBeEmpty bool) string {
 	return string(runes)
 }
 
-func randomDNSLabel(c fuzz.Continue) string {
+func randomDNSLabel(c randfill.Continue) string {
 	validStartEnd := []charRange{{'0', '9'}, {'a', 'z'}}
 	validMiddle := []charRange{{'0', '9'}, {'a', 'z'}, {'-', '-'}}
 
@@ -154,11 +154,11 @@ func randomDNSLabel(c fuzz.Continue) string {
 	return string(runes)
 }
 
-func randomLabelKey(c fuzz.Continue) string {
+func randomLabelKey(c randfill.Continue) string {
 	namePart := randomLabelPart(c, false)
 	prefixPart := ""
 
-	usePrefix := c.RandBool()
+	usePrefix := c.Bool()
 	if usePrefix {
 		// we can fit, with dots, at most 3 labels in the 253 allotted characters
 		prefixPartsLen := c.Rand.Intn(2) + 1
@@ -175,28 +175,28 @@ func randomLabelKey(c fuzz.Continue) string {
 func v1FuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 
 	return []interface{}{
-		func(j *metav1.TypeMeta, c fuzz.Continue) {
+		func(j *metav1.TypeMeta, c randfill.Continue) {
 			// We have to customize the randomization of TypeMetas because their
 			// APIVersion and Kind must remain blank in memory.
 			j.APIVersion = ""
 			j.Kind = ""
 		},
-		func(j *metav1.ObjectMeta, c fuzz.Continue) {
-			c.FuzzNoCustom(j)
+		func(j *metav1.ObjectMeta, c randfill.Continue) {
+			c.FillNoCustom(j)
 
-			j.ResourceVersion = strconv.FormatUint(c.RandUint64(), 10)
-			j.UID = types.UID(c.RandString())
+			j.ResourceVersion = strconv.FormatUint(c.Uint64(), 10)
+			j.UID = types.UID(c.String(0))
 
 			// Fuzzing sec and nsec in a smaller range (uint32 instead of int64),
 			// so that the result Unix time is a valid date and can be parsed into RFC3339 format.
 			var sec, nsec uint32
-			c.Fuzz(&sec)
-			c.Fuzz(&nsec)
+			c.Fill(&sec)
+			c.Fill(&nsec)
 			j.CreationTimestamp = metav1.Unix(int64(sec), int64(nsec)).Rfc3339Copy()
 
 			if j.DeletionTimestamp != nil {
-				c.Fuzz(&sec)
-				c.Fuzz(&nsec)
+				c.Fill(&sec)
+				c.Fill(&nsec)
 				t := metav1.Unix(int64(sec), int64(nsec)).Rfc3339Copy()
 				j.DeletionTimestamp = &t
 			}
@@ -218,16 +218,16 @@ func v1FuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 				j.Finalizers = nil
 			}
 		},
-		func(j *metav1.ResourceVersionMatch, c fuzz.Continue) {
+		func(j *metav1.ResourceVersionMatch, c randfill.Continue) {
 			matches := []metav1.ResourceVersionMatch{"", metav1.ResourceVersionMatchExact, metav1.ResourceVersionMatchNotOlderThan}
 			*j = matches[c.Rand.Intn(len(matches))]
 		},
-		func(j *metav1.ListMeta, c fuzz.Continue) {
-			j.ResourceVersion = strconv.FormatUint(c.RandUint64(), 10)
-			j.SelfLink = c.RandString()
+		func(j *metav1.ListMeta, c randfill.Continue) {
+			j.ResourceVersion = strconv.FormatUint(c.Uint64(), 10)
+			j.SelfLink = c.String(0) //nolint:staticcheck // SA1019 backwards compatibility
 		},
-		func(j *metav1.LabelSelector, c fuzz.Continue) {
-			c.FuzzNoCustom(j)
+		func(j *metav1.LabelSelector, c randfill.Continue) {
+			c.FillNoCustom(j)
 			// we can't have an entirely empty selector, so force
 			// use of MatchExpression if necessary
 			if len(j.MatchLabels) == 0 && len(j.MatchExpressions) == 0 {
@@ -257,7 +257,7 @@ func v1FuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 
 				for i := range j.MatchExpressions {
 					req := metav1.LabelSelectorRequirement{}
-					c.Fuzz(&req)
+					c.Fill(&req)
 					req.Key = randomLabelKey(c)
 					req.Operator = validOperators[c.Rand.Intn(len(validOperators))]
 					if req.Operator == metav1.LabelSelectorOpIn || req.Operator == metav1.LabelSelectorOpNotIn {
@@ -278,8 +278,8 @@ func v1FuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 				sort.Slice(j.MatchExpressions, func(a, b int) bool { return j.MatchExpressions[a].Key < j.MatchExpressions[b].Key })
 			}
 		},
-		func(j *metav1.ManagedFieldsEntry, c fuzz.Continue) {
-			c.FuzzNoCustom(j)
+		func(j *metav1.ManagedFieldsEntry, c randfill.Continue) {
+			c.FillNoCustom(j)
 			j.FieldsV1 = nil
 		},
 	}
@@ -287,15 +287,15 @@ func v1FuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 
 func v1beta1FuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 	return []interface{}{
-		func(r *metav1beta1.TableOptions, c fuzz.Continue) {
-			c.FuzzNoCustom(r)
+		func(r *metav1beta1.TableOptions, c randfill.Continue) {
+			c.FillNoCustom(r)
 			// NoHeaders is not serialized to the wire but is allowed within the versioned
 			// type because we don't use meta internal types in the client and API server.
 			r.NoHeaders = false
 		},
-		func(r *metav1beta1.TableRow, c fuzz.Continue) {
-			c.Fuzz(&r.Object)
-			c.Fuzz(&r.Conditions)
+		func(r *metav1beta1.TableRow, c randfill.Continue) {
+			c.Fill(&r.Object)
+			c.Fill(&r.Conditions)
 			if len(r.Conditions) == 0 {
 				r.Conditions = nil
 			}
@@ -307,15 +307,15 @@ func v1beta1FuzzerFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 				t := c.Intn(6)
 				switch t {
 				case 0:
-					r.Cells[i] = c.RandString()
+					r.Cells[i] = c.String(0)
 				case 1:
 					r.Cells[i] = c.Int63()
 				case 2:
-					r.Cells[i] = c.RandBool()
+					r.Cells[i] = c.Bool()
 				case 3:
 					x := map[string]interface{}{}
 					for j := c.Intn(10) + 1; j >= 0; j-- {
-						x[c.RandString()] = c.RandString()
+						x[c.String(0)] = c.String(0)
 					}
 					r.Cells[i] = x
 				case 4:

pkg/apis/meta/internalversion/defaults_test.go

@@ -25,13 +25,10 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/utils/ptr"
 )
 
 func TestSetListOptionsDefaults(t *testing.T) {
-	boolPtrFn := func(b bool) *bool {
-		return &b
-	}
-
 	scenarios := []struct {
 		name                    string
 		watchListFeatureEnabled bool
@@ -47,8 +44,8 @@ func TestSetListOptionsDefaults(t *testing.T) {
 		{
 			name:                    "no-op, SendInitialEvents set",
 			watchListFeatureEnabled: true,
-			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: boolPtrFn(true)},
-			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: boolPtrFn(true)},
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true)},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true)},
 		},
 		{
 			name:                    "no-op, ResourceVersionMatch set",
@@ -66,13 +63,13 @@ func TestSetListOptionsDefaults(t *testing.T) {
 			name:                    "defaults applied, match on empty RV",
 			watchListFeatureEnabled: true,
 			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true},
-			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: boolPtrFn(true), ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true), ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan},
 		},
 		{
 			name:                    "defaults applied, match on RV=0",
 			watchListFeatureEnabled: true,
 			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersion: "0"},
-			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersion: "0", SendInitialEvents: boolPtrFn(true), ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, ResourceVersion: "0", SendInitialEvents: ptr.To(true), ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan},
 		},
 		{
 			name:        "no-op, match on empty RV but watch-list fg is off",
@@ -82,14 +79,14 @@ func TestSetListOptionsDefaults(t *testing.T) {
 		{
 			name:                    "no-op, match on empty RV but SendInitialEvents is on",
 			watchListFeatureEnabled: true,
-			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: boolPtrFn(true)},
-			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: boolPtrFn(true)},
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true)},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(true)},
 		},
 		{
 			name:                    "no-op, match on empty RV but SendInitialEvents is off",
 			watchListFeatureEnabled: true,
-			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: boolPtrFn(false)},
-			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: boolPtrFn(false)},
+			targetObj:               ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(false)},
+			expectedObj:             ListOptions{LabelSelector: labels.Everything(), FieldSelector: fields.Everything(), Watch: true, SendInitialEvents: ptr.To(false)},
 		},
 		{
 			name:                    "no-op, match on empty RV but ResourceVersionMatch set",

pkg/apis/meta/internalversion/validation/validation_test.go

@@ -21,13 +21,10 @@ import (
 
 	"k8s.io/apimachinery/pkg/apis/meta/internalversion"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/ptr"
 )
 
 func TestValidateListOptions(t *testing.T) {
-	boolPtrFn := func(b bool) *bool {
-		return &b
-	}
-
 	cases := []struct {
 		name                    string
 		opts                    internalversion.ListOptions
@@ -65,7 +62,7 @@ func TestValidateListOptions(t *testing.T) {
 	}, {
 		name: "list-sendInitialEvents-forbidden",
 		opts: internalversion.ListOptions{
-			SendInitialEvents: boolPtrFn(true),
+			SendInitialEvents: ptr.To(true),
 		},
 		expectErrors: []string{"sendInitialEvents: Forbidden: sendInitialEvents is forbidden for list"},
 	}, {
@@ -77,7 +74,7 @@ func TestValidateListOptions(t *testing.T) {
 		name: "valid-watch-sendInitialEvents-on",
 		opts: internalversion.ListOptions{
 			Watch:                true,
-			SendInitialEvents:    boolPtrFn(true),
+			SendInitialEvents:    ptr.To(true),
 			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
 			AllowWatchBookmarks:  true,
 		},
@@ -86,7 +83,7 @@ func TestValidateListOptions(t *testing.T) {
 		name: "valid-watch-sendInitialEvents-off",
 		opts: internalversion.ListOptions{
 			Watch:                true,
-			SendInitialEvents:    boolPtrFn(false),
+			SendInitialEvents:    ptr.To(false),
 			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
 			AllowWatchBookmarks:  true,
 		},
@@ -102,14 +99,14 @@ func TestValidateListOptions(t *testing.T) {
 		name: "watch-sendInitialEvents-without-resourceversionmatch-forbidden",
 		opts: internalversion.ListOptions{
 			Watch:             true,
-			SendInitialEvents: boolPtrFn(true),
+			SendInitialEvents: ptr.To(true),
 		},
 		expectErrors: []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "sendInitialEvents: Forbidden: sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"},
 	}, {
 		name: "watch-sendInitialEvents-with-exact-resourceversionmatch-forbidden",
 		opts: internalversion.ListOptions{
 			Watch:                true,
-			SendInitialEvents:    boolPtrFn(true),
+			SendInitialEvents:    ptr.To(true),
 			ResourceVersionMatch: metav1.ResourceVersionMatchExact,
 			AllowWatchBookmarks:  true,
 		},
@@ -119,7 +116,7 @@ func TestValidateListOptions(t *testing.T) {
 		name: "watch-sendInitialEvents-on-with-empty-resourceversionmatch-forbidden",
 		opts: internalversion.ListOptions{
 			Watch:                true,
-			SendInitialEvents:    boolPtrFn(true),
+			SendInitialEvents:    ptr.To(true),
 			ResourceVersionMatch: "",
 		},
 		expectErrors: []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "sendInitialEvents: Forbidden: sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"},
@@ -127,7 +124,7 @@ func TestValidateListOptions(t *testing.T) {
 		name: "watch-sendInitialEvents-off-with-empty-resourceversionmatch-forbidden",
 		opts: internalversion.ListOptions{
 			Watch:                true,
-			SendInitialEvents:    boolPtrFn(false),
+			SendInitialEvents:    ptr.To(false),
 			ResourceVersionMatch: "",
 		},
 		expectErrors: []string{"resourceVersionMatch: Forbidden: sendInitialEvents requires setting resourceVersionMatch to NotOlderThan", "sendInitialEvents: Forbidden: sendInitialEvents is forbidden for watch unless the WatchList feature gate is enabled"},
@@ -135,7 +132,7 @@ func TestValidateListOptions(t *testing.T) {
 		name: "watch-sendInitialEvents-with-incorrect-resourceversionmatch-forbidden",
 		opts: internalversion.ListOptions{
 			Watch:                true,
-			SendInitialEvents:    boolPtrFn(true),
+			SendInitialEvents:    ptr.To(true),
 			ResourceVersionMatch: "incorrect",
 			AllowWatchBookmarks:  true,
 		},
@@ -147,7 +144,7 @@ func TestValidateListOptions(t *testing.T) {
 		name: "watch-sendInitialEvents-no-allowWatchBookmark",
 		opts: internalversion.ListOptions{
 			Watch:                true,
-			SendInitialEvents:    boolPtrFn(true),
+			SendInitialEvents:    ptr.To(true),
 			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
 		},
 		watchListFeatureEnabled: true,
@@ -155,7 +152,7 @@ func TestValidateListOptions(t *testing.T) {
 		name: "watch-sendInitialEvents-no-watchlist-fg-disabled",
 		opts: internalversion.ListOptions{
 			Watch:                true,
-			SendInitialEvents:    boolPtrFn(true),
+			SendInitialEvents:    ptr.To(true),
 			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
 			AllowWatchBookmarks:  true,
 		},
@@ -164,7 +161,7 @@ func TestValidateListOptions(t *testing.T) {
 		name: "watch-sendInitialEvents-no-watchlist-fg-disabled",
 		opts: internalversion.ListOptions{
 			Watch:                true,
-			SendInitialEvents:    boolPtrFn(true),
+			SendInitialEvents:    ptr.To(true),
 			ResourceVersionMatch: metav1.ResourceVersionMatchNotOlderThan,
 			AllowWatchBookmarks:  true,
 			Continue:             "123",

pkg/apis/meta/v1/helpers_test.go

@@ -23,9 +23,9 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
-	fuzz "github.com/google/gofuzz"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/randfill"
 )
 
 func TestLabelSelectorAsSelector(t *testing.T) {
@@ -188,8 +188,8 @@ func TestResetObjectMetaForStatus(t *testing.T) {
 	existingMeta := &ObjectMeta{}
 
 	// fuzz the existingMeta to set every field, no nils
-	f := fuzz.New().NilChance(0).NumElements(1, 1).MaxDepth(10)
-	f.Fuzz(existingMeta)
+	f := randfill.New().NilChance(0).NumElements(1, 1).MaxDepth(10)
+	f.Fill(existingMeta)
 	ResetObjectMetaForStatus(meta, existingMeta)
 
 	// not all fields are stomped during the reset.  These fields should not have been set. False

pkg/apis/meta/v1/micro_time_fuzz.go

@@ -20,21 +20,22 @@ limitations under the License.
 package v1
 
 import (
+	"math/rand"
 	"time"
 
-	fuzz "github.com/google/gofuzz"
+	"sigs.k8s.io/randfill"
 )
 
-// Fuzz satisfies fuzz.Interface.
-func (t *MicroTime) Fuzz(c fuzz.Continue) {
+// Fuzz satisfies randfill.SimpleSelfFiller.
+func (t *MicroTime) RandFill(r *rand.Rand) {
 	if t == nil {
 		return
 	}
 	// Allow for about 1000 years of randomness. Accurate to a tenth of
 	// micro second. Leave off nanoseconds because JSON doesn't
 	// represent them so they can't round-trip properly.
-	t.Time = time.Unix(c.Rand.Int63n(1000*365*24*60*60), 1000*c.Rand.Int63n(1000000))
+	t.Time = time.Unix(r.Int63n(1000*365*24*60*60), 1000*r.Int63n(1000000))
 }
 
-// ensure MicroTime implements fuzz.Interface
-var _ fuzz.Interface = &MicroTime{}
+// ensure MicroTime implements randfill.Interface
+var _ randfill.SimpleSelfFiller = &MicroTime{}

pkg/apis/meta/v1/micro_time_test.go

@@ -27,7 +27,7 @@ import (
 	"sigs.k8s.io/yaml"
 
 	"github.com/google/go-cmp/cmp"
-	fuzz "github.com/google/gofuzz"
+	"sigs.k8s.io/randfill"
 )
 
 type MicroTimeHolder struct {
@@ -378,10 +378,10 @@ func TestMicroTimeProtoUnmarshalRaw(t *testing.T) {
 }
 
 func TestMicroTimeRoundtripCBOR(t *testing.T) {
-	fuzzer := fuzz.New()
+	fuzzer := randfill.New()
 	for i := 0; i < 500; i++ {
 		var initial, final MicroTime
-		fuzzer.Fuzz(&initial)
+		fuzzer.Fill(&initial)
 		b, err := cbor.Marshal(initial)
 		if err != nil {
 			t.Errorf("error encoding %v: %v", initial, err)

pkg/apis/meta/v1/options_test.go

@@ -22,15 +22,15 @@ import (
 	"reflect"
 	"testing"
 
-	fuzz "github.com/google/gofuzz"
+	"sigs.k8s.io/randfill"
 )
 
 func TestPatchOptionsIsSuperSetOfUpdateOptions(t *testing.T) {
-	f := fuzz.New()
+	f := randfill.New()
 	for i := 0; i < 1000; i++ {
 		t.Run(fmt.Sprintf("Run %d/1000", i), func(t *testing.T) {
 			update := UpdateOptions{}
-			f.Fuzz(&update)
+			f.Fill(&update)
 
 			b, err := json.Marshal(update)
 			if err != nil {

pkg/apis/meta/v1/time_fuzz.go

@@ -20,21 +20,22 @@ limitations under the License.
 package v1
 
 import (
+	"math/rand"
 	"time"
 
-	fuzz "github.com/google/gofuzz"
+	"sigs.k8s.io/randfill"
 )
 
-// Fuzz satisfies fuzz.Interface.
-func (t *Time) Fuzz(c fuzz.Continue) {
+// Fuzz satisfies randfill.SimpleSelfFiller.
+func (t *Time) RandFill(r *rand.Rand) {
 	if t == nil {
 		return
 	}
 	// Allow for about 1000 years of randomness.  Leave off nanoseconds
 	// because JSON doesn't represent them so they can't round-trip
 	// properly.
-	t.Time = time.Unix(c.Rand.Int63n(1000*365*24*60*60), 0)
+	t.Time = time.Unix(r.Int63n(1000*365*24*60*60), 0)
 }
 
-// ensure Time implements fuzz.Interface
-var _ fuzz.Interface = &Time{}
+// ensure Time implements randfill.SimpleSelfFiller
+var _ randfill.SimpleSelfFiller = &Time{}

pkg/apis/meta/v1/time_test.go

@@ -27,7 +27,7 @@ import (
 	"sigs.k8s.io/yaml"
 
 	"github.com/google/go-cmp/cmp"
-	fuzz "github.com/google/gofuzz"
+	"sigs.k8s.io/randfill"
 )
 
 type TimeHolder struct {
@@ -303,10 +303,10 @@ func TestTimeIsZero(t *testing.T) {
 }
 
 func TestTimeRoundtripCBOR(t *testing.T) {
-	fuzzer := fuzz.New()
+	fuzzer := randfill.New()
 	for i := 0; i < 500; i++ {
 		var initial, final Time
-		fuzzer.Fuzz(&initial)
+		fuzzer.Fill(&initial)
 		b, err := cbor.Marshal(initial)
 		if err != nil {
 			t.Errorf("error encoding %v: %v", initial, err)

pkg/apis/meta/v1/types.go

@@ -185,7 +185,7 @@ type ObjectMeta struct {
 	// Null for lists.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	CreationTimestamp Time `json:"creationTimestamp,omitempty" protobuf:"bytes,8,opt,name=creationTimestamp"`
+	CreationTimestamp Time `json:"creationTimestamp,omitempty,omitzero" protobuf:"bytes,8,opt,name=creationTimestamp"`
 
 	// DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This
 	// field is set by the server when a graceful deletion is requested by the user, and is not
@@ -439,20 +439,6 @@ const (
 	//
 	// The annotation is added to a "Bookmark" event.
 	InitialEventsAnnotationKey = "k8s.io/initial-events-end"
-
-	// InitialEventsListBlueprintAnnotationKey is the name of the key
-	// where an empty, versioned list is encoded in the requested format
-	// (e.g., protobuf, JSON, CBOR), then base64-encoded and stored as a string.
-	//
-	// This encoding matches the request encoding format, which may be
-	// protobuf, JSON, CBOR, or others, depending on what the client requested.
-	// This ensures that the reconstructed list can be processed through the
-	// same decoder chain that would handle a standard LIST call response.
-	//
-	// The annotation is added to a "Bookmark" event and is used by clients
-	// to guarantee the format consistency when reconstructing
-	// the list during WatchList processing.
-	InitialEventsListBlueprintAnnotationKey = "kubernetes.io/initial-events-list-blueprint"
 )
 
 // resourceVersionMatch specifies how the resourceVersion parameter is applied. resourceVersionMatch

pkg/apis/meta/v1/unstructured/unstructured_conversion_test.go

@@ -55,11 +55,9 @@ func TestObjectToUnstructuredConversion(t *testing.T) {
 				Object: map[string]interface{}{
 					"apiVersion": "v1",
 					"kind":       "Carp",
-					"metadata": map[string]interface{}{
-						"creationTimestamp": nil,
-					},
-					"spec":   map[string]interface{}{},
-					"status": map[string]interface{}{},
+					"metadata":   map[string]interface{}{},
+					"spec":       map[string]interface{}{},
+					"status":     map[string]interface{}{},
 				},
 			},
 		},
@@ -78,8 +76,7 @@ func TestObjectToUnstructuredConversion(t *testing.T) {
 					"apiVersion": "v1",
 					"kind":       "Carp",
 					"metadata": map[string]interface{}{
-						"creationTimestamp": nil,
-						"name":              "noxu",
+						"name": "noxu",
 					},
 					"spec": map[string]interface{}{
 						"hostname": "example.com",
@@ -155,8 +152,7 @@ func TestUnstructuredToObjectConversion(t *testing.T) {
 					"apiVersion": "v1",
 					"kind":       "Carp",
 					"metadata": map[string]interface{}{
-						"creationTimestamp": nil,
-						"name":              "noxu",
+						"name": "noxu",
 					},
 					"spec": map[string]interface{}{
 						"hostname": "example.com",
@@ -181,8 +177,7 @@ func TestUnstructuredToObjectConversion(t *testing.T) {
 					"apiVersion": "v1",
 					"kind":       "Carp",
 					"metadata": map[string]interface{}{
-						"creationTimestamp": nil,
-						"name":              "noxu",
+						"name": "noxu",
 					},
 					"spec": map[string]interface{}{
 						"hostname": "example.com",
@@ -207,8 +202,7 @@ func TestUnstructuredToObjectConversion(t *testing.T) {
 					"apiVersion": "v9",
 					"kind":       "Carp",
 					"metadata": map[string]interface{}{
-						"creationTimestamp": nil,
-						"name":              "noxu",
+						"name": "noxu",
 					},
 					"spec": map[string]interface{}{
 						"hostname": "example.com",
@@ -232,8 +226,7 @@ func TestUnstructuredToObjectConversion(t *testing.T) {
 					"apiVersion": "v1",
 					"kind":       "Carp",
 					"metadata": map[string]interface{}{
-						"creationTimestamp": nil,
-						"name":              "noxu",
+						"name": "noxu",
 					},
 					"spec": map[string]interface{}{
 						"hostname": "example.com",
@@ -358,8 +351,7 @@ func TestUnstructuredToGVConversion(t *testing.T) {
 					"apiVersion": "v1",
 					"kind":       "Carp",
 					"metadata": map[string]interface{}{
-						"creationTimestamp": nil,
-						"name":              "noxu",
+						"name": "noxu",
 					},
 					"spec": map[string]interface{}{
 						"hostname": "example.com",
@@ -388,8 +380,7 @@ func TestUnstructuredToGVConversion(t *testing.T) {
 					"apiVersion": "v1",
 					"kind":       "Carp",
 					"metadata": map[string]interface{}{
-						"creationTimestamp": nil,
-						"name":              "noxu",
+						"name": "noxu",
 					},
 					"spec": map[string]interface{}{
 						"hostname": "example.com",
@@ -414,8 +405,7 @@ func TestUnstructuredToGVConversion(t *testing.T) {
 					"apiVersion": "v1",
 					"kind":       "Carp",
 					"metadata": map[string]interface{}{
-						"creationTimestamp": nil,
-						"name":              "noxu",
+						"name": "noxu",
 					},
 					"spec": map[string]interface{}{
 						"hostname": "example.com",

pkg/apis/meta/v1/unstructured/unstructured_test.go

@@ -28,8 +28,8 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
-	fuzz "github.com/google/gofuzz"
 	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/randfill"
 
 	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
 	"k8s.io/apimachinery/pkg/api/equality"
@@ -67,7 +67,7 @@ func TestUnstructuredMetadataRoundTrip(t *testing.T) {
 		u := &unstructured.Unstructured{Object: map[string]interface{}{}}
 		uCopy := u.DeepCopy()
 		metadata := &metav1.ObjectMeta{}
-		fuzzer.Fuzz(metadata)
+		fuzzer.Fill(metadata)
 
 		if err := setObjectMeta(u, metadata); err != nil {
 			t.Fatalf("unexpected error setting fuzzed ObjectMeta: %v", err)
@@ -94,7 +94,7 @@ func TestUnstructuredMetadataOmitempty(t *testing.T) {
 	// fuzz to make sure we don't miss any function calls below
 	u := &unstructured.Unstructured{Object: map[string]interface{}{}}
 	metadata := &metav1.ObjectMeta{}
-	fuzzer.Fuzz(metadata)
+	fuzzer.Fill(metadata)
 	if err := setObjectMeta(u, metadata); err != nil {
 		t.Fatalf("unexpected error setting fuzzed ObjectMeta: %v", err)
 	}
@@ -184,7 +184,7 @@ func roundtripType[U runtime.Unstructured](t *testing.T) {
 
 	for i := 0; i < 50; i++ {
 		original := reflect.New(reflect.TypeFor[U]().Elem()).Interface().(runtime.Unstructured)
-		fuzzer.Fuzz(original)
+		fuzzer.Fill(original)
 		// unstructured -> JSON > unstructured > CBOR -> unstructured -> JSON -> unstructured
 		roundtrip(t, original, jS, cS)
 		// unstructured -> CBOR > unstructured > JSON -> unstructured -> CBOR -> unstructured
@@ -285,25 +285,25 @@ const (
 
 func unstructuredFuzzerFuncs(codecs serializer.CodecFactory) []interface{} {
 	return []interface{}{
-		func(u *unstructured.Unstructured, c fuzz.Continue) {
+		func(u *unstructured.Unstructured, c randfill.Continue) {
 			obj := make(map[string]interface{})
 			obj["apiVersion"] = generateValidAPIVersionString(c)
 			obj["kind"] = generateNonEmptyString(c)
 			for j := c.Intn(maxUnstructuredFanOut); j >= 0; j-- {
-				obj[c.RandString()] = generateRandomTypeValue(maxUnstructuredDepth, c)
+				obj[c.String(0)] = generateRandomTypeValue(maxUnstructuredDepth, c)
 			}
 			u.Object = obj
 		},
-		func(ul *unstructured.UnstructuredList, c fuzz.Continue) {
+		func(ul *unstructured.UnstructuredList, c randfill.Continue) {
 			obj := make(map[string]interface{})
 			obj["apiVersion"] = generateValidAPIVersionString(c)
 			obj["kind"] = generateNonEmptyString(c)
 			for j := c.Intn(maxUnstructuredFanOut); j >= 0; j-- {
-				obj[c.RandString()] = generateRandomTypeValue(maxUnstructuredDepth, c)
+				obj[c.String(0)] = generateRandomTypeValue(maxUnstructuredDepth, c)
 			}
 			for j := c.Intn(maxUnstructuredFanOut); j >= 0; j-- {
 				var item = unstructured.Unstructured{}
-				c.Fuzz(&item)
+				c.Fill(&item)
 				ul.Items = append(ul.Items, item)
 			}
 			ul.Object = obj
@@ -311,16 +311,16 @@ func unstructuredFuzzerFuncs(codecs serializer.CodecFactory) []interface{} {
 	}
 }
 
-func generateNonEmptyString(c fuzz.Continue) string {
-	temp := c.RandString()
+func generateNonEmptyString(c randfill.Continue) string {
+	temp := c.String(0)
 	for len(temp) == 0 {
-		temp = c.RandString()
+		temp = c.String(0)
 	}
 	return temp
 }
 
 // generateNonEmptyNoSlashString generates a non-empty string without any slashes
-func generateNonEmptyNoSlashString(c fuzz.Continue) string {
+func generateNonEmptyNoSlashString(c randfill.Continue) string {
 	temp := strings.ReplaceAll(generateNonEmptyString(c), "/", "")
 	for len(temp) == 0 {
 		temp = strings.ReplaceAll(generateNonEmptyString(c), "/", "")
@@ -330,8 +330,8 @@ func generateNonEmptyNoSlashString(c fuzz.Continue) string {
 
 // generateValidAPIVersionString generates valid apiVersion string with formats:
 // <string>/<string> or <string>
-func generateValidAPIVersionString(c fuzz.Continue) string {
-	if c.RandBool() {
+func generateValidAPIVersionString(c randfill.Continue) string {
+	if c.Bool() {
 		return generateNonEmptyNoSlashString(c) + "/" + generateNonEmptyNoSlashString(c)
 	} else {
 		return generateNonEmptyNoSlashString(c)
@@ -355,7 +355,7 @@ func generateValidAPIVersionString(c fuzz.Continue) string {
 // All external-versioned builtin types are exercised through RoundtripToUnstructured
 // in apitesting package. Types like metav1.Time are implicitly being exercised
 // because they appear as fields in those types.
-func generateRandomTypeValue(depth int, c fuzz.Continue) interface{} {
+func generateRandomTypeValue(depth int, c randfill.Continue) interface{} {
 	t := c.Rand.Intn(120)
 	// If the max depth for unstructured is reached, only add non-recursive types
 	// which is 20+ in range
@@ -373,21 +373,21 @@ func generateRandomTypeValue(depth int, c fuzz.Continue) interface{} {
 	case t < 20:
 		item := map[string]interface{}{}
 		for j := c.Intn(maxUnstructuredFanOut); j >= 0; j-- {
-			item[c.RandString()] = generateRandomTypeValue(depth-1, c)
+			item[c.String(0)] = generateRandomTypeValue(depth-1, c)
 		}
 		return item
 	case t < 40:
 		// Only valid UTF-8 encodings
 		var item string
-		c.Fuzz(&item)
+		c.Fill(&item)
 		return item
 	case t < 60:
 		var item int64
-		c.Fuzz(&item)
+		c.Fill(&item)
 		return item
 	case t < 80:
 		var item bool
-		c.Fuzz(&item)
+		c.Fill(&item)
 		return item
 	case t < 100:
 		return c.Rand.NormFloat64()

pkg/apis/meta/v1/validation/validation.go

@@ -104,7 +104,7 @@ func ValidateLabelSelectorRequirement(sr metav1.LabelSelectorRequirement, opts L
 func ValidateLabelName(labelName string, fldPath *field.Path) field.ErrorList {
 	allErrs := field.ErrorList{}
 	for _, msg := range validation.IsQualifiedName(labelName) {
-		allErrs = append(allErrs, field.Invalid(fldPath, labelName, msg))
+		allErrs = append(allErrs, field.Invalid(fldPath, labelName, msg).WithOrigin("labelKey"))
 	}
 	return allErrs
 }
@@ -328,11 +328,11 @@ func ValidateCondition(condition metav1.Condition, fldPath *field.Path) field.Er
 	}
 
 	if condition.LastTransitionTime.IsZero() {
-		allErrs = append(allErrs, field.Required(fldPath.Child("lastTransitionTime"), "must be set"))
+		allErrs = append(allErrs, field.Required(fldPath.Child("lastTransitionTime"), ""))
 	}
 
 	if len(condition.Reason) == 0 {
-		allErrs = append(allErrs, field.Required(fldPath.Child("reason"), "must be set"))
+		allErrs = append(allErrs, field.Required(fldPath.Child("reason"), ""))
 	} else {
 		for _, currErr := range isValidConditionReason(condition.Reason) {
 			allErrs = append(allErrs, field.Invalid(fldPath.Child("reason"), condition.Reason, currErr))

pkg/apis/meta/v1/validation/validation_test.go

@@ -132,10 +132,6 @@ func TestInvalidDryRun(t *testing.T) {
 
 }
 
-func boolPtr(b bool) *bool {
-	return &b
-}
-
 func TestValidateDeleteOptionsWithIgnoreStoreReadError(t *testing.T) {
 	fieldPath := field.NewPath("ignoreStoreReadErrorWithClusterBreakingPotential")
 	tests := []struct {
@@ -232,7 +228,7 @@ func TestValidPatchOptions(t *testing.T) {
 		patchType types.PatchType
 	}{{
 		opts: metav1.PatchOptions{
-			Force:        boolPtr(true),
+			Force:        ptr.To(true),
 			FieldManager: "kubectl",
 		},
 		patchType: types.ApplyYAMLPatchType,
@@ -243,7 +239,7 @@ func TestValidPatchOptions(t *testing.T) {
 		patchType: types.ApplyYAMLPatchType,
 	}, {
 		opts: metav1.PatchOptions{
-			Force:        boolPtr(true),
+			Force:        ptr.To(true),
 			FieldManager: "kubectl",
 		},
 		patchType: types.ApplyCBORPatchType,
@@ -290,7 +286,7 @@ func TestInvalidPatchOptions(t *testing.T) {
 		// force on non-apply
 		{
 			opts: metav1.PatchOptions{
-				Force: boolPtr(true),
+				Force: ptr.To(true),
 			},
 			patchType: types.MergePatchType,
 		},
@@ -298,7 +294,7 @@ func TestInvalidPatchOptions(t *testing.T) {
 		{
 			opts: metav1.PatchOptions{
 				FieldManager: "kubectl",
-				Force:        boolPtr(false),
+				Force:        ptr.To(false),
 			},
 			patchType: types.MergePatchType,
 		},
@@ -442,7 +438,7 @@ func TestValidateConditions(t *testing.T) {
 			if !hasError(errs, needle) {
 				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
 			}
-			needle = `status.conditions[0].lastTransitionTime: Required value: must be set`
+			needle = `status.conditions[0].lastTransitionTime: Required value`
 			if !hasError(errs, needle) {
 				t.Errorf("missing %q in\n%v", needle, errorsAsString(errs))
 			}

pkg/apis/testapigroup/fuzzer/fuzzer.go

@@ -19,12 +19,12 @@ package fuzzer
 import (
 	"fmt"
 
-	"github.com/google/gofuzz"
+	"sigs.k8s.io/randfill"
 
 	apitesting "k8s.io/apimachinery/pkg/api/apitesting"
 	"k8s.io/apimachinery/pkg/api/apitesting/fuzzer"
 	"k8s.io/apimachinery/pkg/apis/testapigroup"
-	"k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
 )
@@ -33,9 +33,9 @@ import (
 // values in a Kubernetes context.
 func overrideMetaFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 	return []interface{}{
-		func(j *runtime.Object, c fuzz.Continue) {
+		func(j *runtime.Object, c randfill.Continue) {
 			// TODO: uncomment when round trip starts from a versioned object
-			if true { //c.RandBool() {
+			if true { // c.Bool() {
 				*j = &runtime.Unknown{
 					// We do not set TypeMeta here because it is not carried through a round trip
 					Raw:         []byte(`{"apiVersion":"unknown.group/unknown","kind":"Something","someKey":"someValue"}`),
@@ -44,15 +44,15 @@ func overrideMetaFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 			} else {
 				types := []runtime.Object{&testapigroup.Carp{}}
 				t := types[c.Rand.Intn(len(types))]
-				c.Fuzz(t)
+				c.Fill(t)
 				*j = t
 			}
 		},
-		func(r *runtime.RawExtension, c fuzz.Continue) {
+		func(r *runtime.RawExtension, c randfill.Continue) {
 			// Pick an arbitrary type and fuzz it
 			types := []runtime.Object{&testapigroup.Carp{}}
 			obj := types[c.Rand.Intn(len(types))]
-			c.Fuzz(obj)
+			c.Fill(obj)
 
 			// Convert the object to raw bytes
 			bytes, err := runtime.Encode(apitesting.TestCodec(codecs, v1.SchemeGroupVersion), obj)
@@ -68,11 +68,11 @@ func overrideMetaFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 
 func testapigroupFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 	return []interface{}{
-		func(s *testapigroup.CarpSpec, c fuzz.Continue) {
-			c.FuzzNoCustom(s)
+		func(s *testapigroup.CarpSpec, c randfill.Continue) {
+			c.FillNoCustom(s)
 			// has a default value
 			ttl := int64(30)
-			if c.RandBool() {
+			if c.Bool() {
 				ttl = int64(c.Uint32())
 			}
 			s.TerminationGracePeriodSeconds = &ttl
@@ -81,11 +81,11 @@ func testapigroupFuncs(codecs runtimeserializer.CodecFactory) []interface{} {
 				s.SchedulerName = "default-scheduler"
 			}
 		},
-		func(j *testapigroup.CarpPhase, c fuzz.Continue) {
+		func(j *testapigroup.CarpPhase, c randfill.Continue) {
 			statuses := []testapigroup.CarpPhase{"Pending", "Running", "Succeeded", "Failed", "Unknown"}
 			*j = statuses[c.Rand.Intn(len(statuses))]
 		},
-		func(rp *testapigroup.RestartPolicy, c fuzz.Continue) {
+		func(rp *testapigroup.RestartPolicy, c randfill.Continue) {
 			policies := []testapigroup.RestartPolicy{"Always", "Never", "OnFailure"}
 			*rp = policies[c.Rand.Intn(len(policies))]
 		},

pkg/apis/testapigroup/register.go

@@ -46,6 +46,7 @@ func Resource(resource string) schema.GroupResource {
 func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
 		&Carp{},
+		&CarpList{},
 	)
 	return nil
 }

pkg/apis/testapigroup/types.go

@@ -68,6 +68,14 @@ type CarpStatus struct {
 	// This is before the Kubelet pulled the container image(s) for the carp.
 	// +optional
 	StartTime *metav1.Time
+
+	// Carp infos are provided by different clients, hence the map type.
+	//
+	// +listType=map
+	// +listKey=a
+	// +listKey=b
+	// +listKey=c
+	Infos []CarpInfo
 }
 
 type CarpCondition struct {
@@ -83,6 +91,21 @@ type CarpCondition struct {
 	Message string
 }
 
+type CarpInfo struct {
+	// A is the first map key.
+	// +required
+	A int64
+	// B is the second map key.
+	// +required
+	B string
+	// C is the third, optional map key
+	// +optional
+	C *string
+
+	// Some data for each pair of A and B.
+	Data string
+}
+
 // CarpSpec is a description of a carp
 type CarpSpec struct {
 	// +optional

pkg/apis/testapigroup/v1/doc.go

@@ -14,11 +14,13 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+// +k8s:openapi-gen=true
 // +k8s:deepcopy-gen=package
 // +k8s:conversion-gen=k8s.io/apimachinery/pkg/apis/testapigroup
 // +k8s:openapi-gen=false
 // +k8s:defaulter-gen=TypeMeta
 
+// +k8s:prerelease-lifecycle-gen=true
 // +groupName=testapigroup.apimachinery.k8s.io
 
 package v1

pkg/apis/testapigroup/v1/generated.pb.go

@@ -101,10 +101,38 @@ func (m *CarpCondition) XXX_DiscardUnknown() {
 
 var xxx_messageInfo_CarpCondition proto.InternalMessageInfo
 
+func (m *CarpInfo) Reset()      { *m = CarpInfo{} }
+func (*CarpInfo) ProtoMessage() {}
+func (*CarpInfo) Descriptor() ([]byte, []int) {
+	return fileDescriptor_83e19b543dd132db, []int{2}
+}
+func (m *CarpInfo) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *CarpInfo) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	b = b[:cap(b)]
+	n, err := m.MarshalToSizedBuffer(b)
+	if err != nil {
+		return nil, err
+	}
+	return b[:n], nil
+}
+func (m *CarpInfo) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_CarpInfo.Merge(m, src)
+}
+func (m *CarpInfo) XXX_Size() int {
+	return m.Size()
+}
+func (m *CarpInfo) XXX_DiscardUnknown() {
+	xxx_messageInfo_CarpInfo.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_CarpInfo proto.InternalMessageInfo
+
 func (m *CarpList) Reset()      { *m = CarpList{} }
 func (*CarpList) ProtoMessage() {}
 func (*CarpList) Descriptor() ([]byte, []int) {
-	return fileDescriptor_83e19b543dd132db, []int{2}
+	return fileDescriptor_83e19b543dd132db, []int{3}
 }
 func (m *CarpList) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -132,7 +160,7 @@ var xxx_messageInfo_CarpList proto.InternalMessageInfo
 func (m *CarpSpec) Reset()      { *m = CarpSpec{} }
 func (*CarpSpec) ProtoMessage() {}
 func (*CarpSpec) Descriptor() ([]byte, []int) {
-	return fileDescriptor_83e19b543dd132db, []int{3}
+	return fileDescriptor_83e19b543dd132db, []int{4}
 }
 func (m *CarpSpec) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -160,7 +188,7 @@ var xxx_messageInfo_CarpSpec proto.InternalMessageInfo
 func (m *CarpStatus) Reset()      { *m = CarpStatus{} }
 func (*CarpStatus) ProtoMessage() {}
 func (*CarpStatus) Descriptor() ([]byte, []int) {
-	return fileDescriptor_83e19b543dd132db, []int{4}
+	return fileDescriptor_83e19b543dd132db, []int{5}
 }
 func (m *CarpStatus) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -188,6 +216,7 @@ var xxx_messageInfo_CarpStatus proto.InternalMessageInfo
 func init() {
 	proto.RegisterType((*Carp)(nil), "k8s.io.apimachinery.pkg.apis.testapigroup.v1.Carp")
 	proto.RegisterType((*CarpCondition)(nil), "k8s.io.apimachinery.pkg.apis.testapigroup.v1.CarpCondition")
+	proto.RegisterType((*CarpInfo)(nil), "k8s.io.apimachinery.pkg.apis.testapigroup.v1.CarpInfo")
 	proto.RegisterType((*CarpList)(nil), "k8s.io.apimachinery.pkg.apis.testapigroup.v1.CarpList")
 	proto.RegisterType((*CarpSpec)(nil), "k8s.io.apimachinery.pkg.apis.testapigroup.v1.CarpSpec")
 	proto.RegisterMapType((map[string]string)(nil), "k8s.io.apimachinery.pkg.apis.testapigroup.v1.CarpSpec.NodeSelectorEntry")
@@ -199,72 +228,77 @@ func init() {
 }
 
 var fileDescriptor_83e19b543dd132db = []byte{
-	// 1037 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0xc1, 0x6e, 0xdb, 0x46,
-	0x13, 0x36, 0x2d, 0xc9, 0x96, 0xd6, 0x56, 0x62, 0x6f, 0x62, 0x80, 0xbf, 0x81, 0x48, 0x8e, 0x0f,
-	0x86, 0xff, 0xc2, 0xa5, 0x62, 0xa3, 0x09, 0xdc, 0xa6, 0x40, 0x11, 0xda, 0x45, 0xa5, 0xc2, 0x71,
-	0x84, 0x95, 0x81, 0x14, 0x45, 0x0f, 0x59, 0x51, 0x5b, 0x8a, 0x95, 0xc8, 0x25, 0x76, 0x57, 0x2a,
-	0x74, 0x2b, 0xfa, 0x04, 0x7d, 0x88, 0xde, 0x7a, 0xee, 0x03, 0xf4, 0x50, 0xc0, 0xc7, 0x1c, 0x73,
-	0x12, 0x6a, 0xf5, 0x2d, 0x7c, 0x2a, 0x76, 0xb9, 0xa4, 0x48, 0x4b, 0x55, 0xa3, 0xdc, 0xb8, 0x33,
-	0xdf, 0xf7, 0xcd, 0xec, 0xce, 0x68, 0x46, 0xe0, 0xf3, 0xde, 0x29, 0xb7, 0x3c, 0x5a, 0xc3, 0xa1,
-	0xe7, 0x63, 0xa7, 0xeb, 0x05, 0x84, 0x8d, 0x6a, 0x61, 0xcf, 0x95, 0x06, 0x5e, 0x13, 0x84, 0x0b,
-	0x1c, 0x7a, 0x2e, 0xa3, 0x83, 0xb0, 0x36, 0x3c, 0xae, 0xb9, 0x24, 0x20, 0x0c, 0x0b, 0xd2, 0xb1,
-	0x42, 0x46, 0x05, 0x85, 0x47, 0x11, 0xdb, 0x4a, 0xb3, 0xad, 0xb0, 0xe7, 0x4a, 0x03, 0xb7, 0xd2,
-	0x6c, 0x6b, 0x78, 0xbc, 0xfb, 0xb1, 0xeb, 0x89, 0xee, 0xa0, 0x6d, 0x39, 0xd4, 0xaf, 0xb9, 0xd4,
-	0xa5, 0x35, 0x25, 0xd2, 0x1e, 0x7c, 0xaf, 0x4e, 0xea, 0xa0, 0xbe, 0x22, 0xf1, 0xdd, 0x4f, 0x16,
-	0xa6, 0xe6, 0x13, 0x81, 0xe7, 0xa4, 0xb4, 0x5b, 0xfb, 0x37, 0x16, 0x1b, 0x04, 0xc2, 0xf3, 0xc9,
-	0x0c, 0xe1, 0xd9, 0x7f, 0x11, 0xb8, 0xd3, 0x25, 0x3e, 0xbe, 0xcb, 0xdb, 0xff, 0x75, 0x15, 0xe4,
-	0xcf, 0x30, 0x0b, 0xe1, 0x1b, 0x50, 0x94, 0xc9, 0x74, 0xb0, 0xc0, 0xa6, 0xb1, 0x67, 0x1c, 0x6e,
-	0x9c, 0x3c, 0xb1, 0x16, 0xbe, 0x8b, 0x44, 0x5b, 0xc3, 0x63, 0xeb, 0x55, 0xfb, 0x07, 0xe2, 0x88,
-	0x97, 0x44, 0x60, 0x1b, 0x5e, 0x8f, 0xab, 0x2b, 0x93, 0x71, 0x15, 0x4c, 0x6d, 0x28, 0x51, 0x85,
-	0xdf, 0x80, 0x3c, 0x0f, 0x89, 0x63, 0xae, 0x2a, 0xf5, 0x67, 0xd6, 0x32, 0xaf, 0x6e, 0xc9, 0x1c,
-	0x5b, 0x21, 0x71, 0xec, 0x4d, 0x1d, 0x23, 0x2f, 0x4f, 0x48, 0x29, 0xc2, 0x37, 0x60, 0x8d, 0x0b,
-	0x2c, 0x06, 0xdc, 0xcc, 0x29, 0xed, 0xd3, 0x0f, 0xd0, 0x56, 0x7c, 0xfb, 0x9e, 0x56, 0x5f, 0x8b,
-	0xce, 0x48, 0xeb, 0xee, 0xff, 0x9e, 0x03, 0x65, 0x09, 0x3b, 0xa3, 0x41, 0xc7, 0x13, 0x1e, 0x0d,
-	0xe0, 0x53, 0x90, 0x17, 0xa3, 0x90, 0xa8, 0xb7, 0x2a, 0xd9, 0x8f, 0xe3, 0xac, 0xae, 0x46, 0x21,
-	0xb9, 0x1d, 0x57, 0xb7, 0x33, 0x60, 0x69, 0x44, 0x0a, 0x0e, 0x3f, 0x4d, 0x52, 0x5d, 0xcd, 0x10,
-	0x75, 0xc0, 0xdb, 0x71, 0xf5, 0x7e, 0x42, 0xcb, 0xe6, 0x00, 0x5d, 0x50, 0xee, 0x63, 0x2e, 0x9a,
-	0x8c, 0xb6, 0xc9, 0x95, 0xe7, 0x13, 0x7d, 0xd9, 0x8f, 0xde, 0xaf, 0x4c, 0x92, 0x61, 0xef, 0xe8,
-	0x68, 0xe5, 0x8b, 0xb4, 0x10, 0xca, 0xea, 0xc2, 0x21, 0x80, 0xd2, 0x70, 0xc5, 0x70, 0xc0, 0xa3,
-	0xfc, 0x65, 0xb4, 0xfc, 0xd2, 0xd1, 0x76, 0x75, 0x34, 0x78, 0x31, 0xa3, 0x86, 0xe6, 0x44, 0x80,
-	0x07, 0x60, 0x8d, 0x11, 0xcc, 0x69, 0x60, 0x16, 0xd4, 0xdb, 0x24, 0xc5, 0x40, 0xca, 0x8a, 0xb4,
-	0x17, 0xfe, 0x1f, 0xac, 0xfb, 0x84, 0x73, 0xec, 0x12, 0x73, 0x4d, 0x01, 0xef, 0x6b, 0xe0, 0xfa,
-	0xcb, 0xc8, 0x8c, 0x62, 0xff, 0xfe, 0x1f, 0x06, 0x28, 0xca, 0x52, 0x5c, 0x78, 0x5c, 0xc0, 0xef,
-	0x66, 0x5a, 0xdc, 0x7a, 0xbf, 0xdb, 0x48, 0xb6, 0x6a, 0xf0, 0x2d, 0x1d, 0xa8, 0x18, 0x5b, 0x52,
-	0xed, 0xfd, 0x1a, 0x14, 0x3c, 0x41, 0x7c, 0x59, 0xd8, 0xdc, 0xe1, 0xc6, 0xc9, 0xc9, 0xf2, 0x3d,
-	0x68, 0x97, 0xb5, 0x7c, 0xa1, 0x21, 0x85, 0x50, 0xa4, 0xb7, 0xff, 0xe7, 0x7a, 0x74, 0x07, 0xd9,
-	0xf0, 0xf0, 0x02, 0x94, 0x99, 0xa4, 0x32, 0xd1, 0xa4, 0x7d, 0xcf, 0x19, 0xa9, 0x26, 0x28, 0xd9,
-	0x07, 0x71, 0x61, 0x51, 0xda, 0x79, 0x7b, 0xd7, 0x80, 0xb2, 0x64, 0xe8, 0x82, 0x47, 0x82, 0x30,
-	0xdf, 0x0b, 0xb0, 0x2c, 0xc2, 0x57, 0x0c, 0x3b, 0xa4, 0x49, 0x98, 0x47, 0x3b, 0x2d, 0xe2, 0xd0,
-	0xa0, 0xc3, 0x55, 0xd1, 0x73, 0xf6, 0xe3, 0xc9, 0xb8, 0xfa, 0xe8, 0x6a, 0x11, 0x10, 0x2d, 0xd6,
-	0x81, 0xaf, 0xc0, 0x0e, 0x76, 0x84, 0x37, 0x24, 0xe7, 0x04, 0x77, 0xfa, 0x5e, 0x40, 0xe2, 0x00,
-	0x05, 0x15, 0xe0, 0x7f, 0x93, 0x71, 0x75, 0xe7, 0xc5, 0x3c, 0x00, 0x9a, 0xcf, 0x83, 0x3f, 0x1b,
-	0x60, 0x33, 0xa0, 0x1d, 0xd2, 0x22, 0x7d, 0xe2, 0x08, 0xca, 0xcc, 0x75, 0xf5, 0xea, 0xf5, 0x0f,
-	0x9b, 0x2a, 0xd6, 0x65, 0x4a, 0xea, 0xcb, 0x40, 0xb0, 0x91, 0xfd, 0x50, 0xbf, 0xe8, 0x66, 0xda,
-	0x85, 0x32, 0x31, 0xe1, 0xd7, 0x00, 0x72, 0xc2, 0x86, 0x9e, 0x43, 0x5e, 0x38, 0x0e, 0x1d, 0x04,
-	0xe2, 0x12, 0xfb, 0xc4, 0x2c, 0xaa, 0x8a, 0x24, 0xcd, 0xdf, 0x9a, 0x41, 0xa0, 0x39, 0x2c, 0x58,
-	0x07, 0xf7, 0xb2, 0x56, 0xb3, 0xa4, 0x74, 0xf6, 0xb4, 0x8e, 0x79, 0x4e, 0x42, 0x46, 0x1c, 0x39,
-	0xba, 0xb3, 0x8a, 0xe8, 0x0e, 0x0f, 0x1e, 0x81, 0xa2, 0xcc, 0x52, 0xe5, 0x02, 0x94, 0x46, 0xd2,
-	0xb6, 0x97, 0xda, 0x8e, 0x12, 0x04, 0x7c, 0x0a, 0x36, 0xba, 0x94, 0x8b, 0x4b, 0x22, 0x7e, 0xa4,
-	0xac, 0x67, 0x6e, 0xec, 0x19, 0x87, 0x45, 0xfb, 0x81, 0x26, 0x6c, 0xd4, 0xa7, 0x2e, 0x94, 0xc6,
-	0xc9, 0xdf, 0xa0, 0x3c, 0x36, 0x1b, 0xe7, 0xe6, 0xa6, 0xa2, 0x24, 0xbf, 0xc1, 0x7a, 0x64, 0x46,
-	0xb1, 0x3f, 0x86, 0x36, 0x9a, 0x67, 0x66, 0x79, 0x16, 0xda, 0x68, 0x9e, 0xa1, 0xd8, 0x2f, 0x53,
-	0x97, 0x9f, 0x81, 0x4c, 0x7d, 0x2b, 0x9b, 0x7a, 0x5d, 0xdb, 0x51, 0x82, 0x80, 0x35, 0x50, 0xe2,
-	0x83, 0x76, 0x87, 0xfa, 0xd8, 0x0b, 0xcc, 0x6d, 0x05, 0xdf, 0xd6, 0xf0, 0x52, 0x2b, 0x76, 0xa0,
-	0x29, 0x06, 0x3e, 0x07, 0x65, 0xb9, 0x06, 0x3b, 0x83, 0x3e, 0x61, 0x2a, 0xc6, 0x03, 0x45, 0x4a,
-	0xa6, 0x62, 0x2b, 0x76, 0xaa, 0x37, 0xca, 0x62, 0x77, 0xbf, 0x00, 0xdb, 0x33, 0x5d, 0x02, 0xb7,
-	0x40, 0xae, 0x47, 0x46, 0xd1, 0x12, 0x40, 0xf2, 0x13, 0x3e, 0x04, 0x85, 0x21, 0xee, 0x0f, 0x48,
-	0x34, 0xdf, 0x51, 0x74, 0xf8, 0x6c, 0xf5, 0xd4, 0xd8, 0xff, 0x2d, 0x07, 0xc0, 0x74, 0xd5, 0xc0,
-	0x27, 0xa0, 0x10, 0x76, 0x31, 0x8f, 0x37, 0x48, 0xdc, 0x2f, 0x85, 0xa6, 0x34, 0xde, 0x8e, 0xab,
-	0x25, 0x89, 0x55, 0x07, 0x14, 0x01, 0x21, 0x05, 0xc0, 0x89, 0x77, 0x43, 0x3c, 0x66, 0x9e, 0x2f,
-	0xdf, 0xf0, 0xc9, 0x7e, 0x99, 0xee, 0xeb, 0xc4, 0xc4, 0x51, 0x2a, 0x44, 0x7a, 0xd0, 0xe6, 0x16,
-	0x0f, 0xda, 0xd4, 0xec, 0xce, 0x2f, 0x9c, 0xdd, 0x07, 0x60, 0x2d, 0x2a, 0xf6, 0xdd, 0x19, 0x1f,
-	0xf5, 0x02, 0xd2, 0x5e, 0x89, 0x73, 0x30, 0x0b, 0x1b, 0x4d, 0x3d, 0xe2, 0x13, 0xdc, 0x99, 0xb2,
-	0x22, 0xed, 0x85, 0xaf, 0x41, 0x49, 0x0d, 0x34, 0xb5, 0xa2, 0xd6, 0x97, 0x5e, 0x51, 0x65, 0xd5,
-	0x2b, 0xb1, 0x00, 0x9a, 0x6a, 0xd9, 0xe8, 0xfa, 0xa6, 0xb2, 0xf2, 0xf6, 0xa6, 0xb2, 0xf2, 0xee,
-	0xa6, 0xb2, 0xf2, 0xd3, 0xa4, 0x62, 0x5c, 0x4f, 0x2a, 0xc6, 0xdb, 0x49, 0xc5, 0x78, 0x37, 0xa9,
-	0x18, 0x7f, 0x4d, 0x2a, 0xc6, 0x2f, 0x7f, 0x57, 0x56, 0xbe, 0x3d, 0x5a, 0xe6, 0x8f, 0xe7, 0x3f,
-	0x01, 0x00, 0x00, 0xff, 0xff, 0x9e, 0xd1, 0x13, 0x90, 0xa7, 0x0a, 0x00, 0x00,
+	// 1115 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0x41, 0x4f, 0x1b, 0x47,
+	0x14, 0x66, 0xb1, 0x0d, 0xf6, 0x80, 0x1b, 0x18, 0x82, 0xba, 0x45, 0x8a, 0x4d, 0x7c, 0x40, 0xb4,
+	0xa2, 0xeb, 0x80, 0x9a, 0x88, 0x36, 0x95, 0x2a, 0x16, 0xaa, 0x42, 0x45, 0x88, 0x35, 0x46, 0x4a,
+	0xd5, 0xe6, 0x90, 0xf1, 0xee, 0xb0, 0x6c, 0xf1, 0xee, 0xac, 0x66, 0xc6, 0xae, 0x7c, 0xab, 0x7a,
+	0xea, 0xb1, 0x3f, 0xa2, 0x7f, 0xa1, 0x3f, 0xa0, 0x37, 0x8e, 0x39, 0xa6, 0x17, 0xab, 0xb8, 0xff,
+	0x82, 0x53, 0x35, 0xb3, 0xb3, 0xeb, 0x35, 0x06, 0x27, 0xe6, 0xe6, 0x79, 0xef, 0xfb, 0xbe, 0xf7,
+	0xf6, 0xcd, 0x9b, 0xf7, 0x0c, 0xbe, 0xbe, 0xd8, 0xe5, 0x96, 0x4f, 0xeb, 0x38, 0xf2, 0x03, 0xec,
+	0x9c, 0xfb, 0x21, 0x61, 0xbd, 0x7a, 0x74, 0xe1, 0x49, 0x03, 0xaf, 0x0b, 0xc2, 0x05, 0x8e, 0x7c,
+	0x8f, 0xd1, 0x4e, 0x54, 0xef, 0x6e, 0xd7, 0x3d, 0x12, 0x12, 0x86, 0x05, 0x71, 0xad, 0x88, 0x51,
+	0x41, 0xe1, 0x56, 0xcc, 0xb6, 0xb2, 0x6c, 0x2b, 0xba, 0xf0, 0xa4, 0x81, 0x5b, 0x59, 0xb6, 0xd5,
+	0xdd, 0x5e, 0xfb, 0xdc, 0xf3, 0xc5, 0x79, 0xa7, 0x65, 0x39, 0x34, 0xa8, 0x7b, 0xd4, 0xa3, 0x75,
+	0x25, 0xd2, 0xea, 0x9c, 0xa9, 0x93, 0x3a, 0xa8, 0x5f, 0xb1, 0xf8, 0xda, 0x17, 0x13, 0x53, 0x0b,
+	0x88, 0xc0, 0xb7, 0xa4, 0xb4, 0x56, 0xbf, 0x8b, 0xc5, 0x3a, 0xa1, 0xf0, 0x03, 0x32, 0x46, 0x78,
+	0xf6, 0x3e, 0x02, 0x77, 0xce, 0x49, 0x80, 0x6f, 0xf2, 0x6a, 0x7f, 0xce, 0x82, 0xfc, 0x3e, 0x66,
+	0x11, 0x7c, 0x03, 0x8a, 0x32, 0x19, 0x17, 0x0b, 0x6c, 0x1a, 0xeb, 0xc6, 0xe6, 0xc2, 0xce, 0x13,
+	0x6b, 0x62, 0x5d, 0x24, 0xda, 0xea, 0x6e, 0x5b, 0x2f, 0x5b, 0x3f, 0x13, 0x47, 0xbc, 0x20, 0x02,
+	0xdb, 0xf0, 0xb2, 0x5f, 0x9d, 0x19, 0xf4, 0xab, 0x60, 0x68, 0x43, 0xa9, 0x2a, 0xfc, 0x01, 0xe4,
+	0x79, 0x44, 0x1c, 0x73, 0x56, 0xa9, 0x3f, 0xb3, 0xa6, 0xa9, 0xba, 0x25, 0x73, 0x6c, 0x46, 0xc4,
+	0xb1, 0x17, 0x75, 0x8c, 0xbc, 0x3c, 0x21, 0xa5, 0x08, 0xdf, 0x80, 0x39, 0x2e, 0xb0, 0xe8, 0x70,
+	0x33, 0xa7, 0xb4, 0x77, 0xef, 0xa1, 0xad, 0xf8, 0xf6, 0x47, 0x5a, 0x7d, 0x2e, 0x3e, 0x23, 0xad,
+	0x5b, 0xfb, 0x2b, 0x07, 0xca, 0x12, 0xb6, 0x4f, 0x43, 0xd7, 0x17, 0x3e, 0x0d, 0xe1, 0x53, 0x90,
+	0x17, 0xbd, 0x88, 0xa8, 0x5a, 0x95, 0xec, 0xc7, 0x49, 0x56, 0xa7, 0xbd, 0x88, 0x5c, 0xf7, 0xab,
+	0xcb, 0x23, 0x60, 0x69, 0x44, 0x0a, 0x0e, 0xbf, 0x4c, 0x53, 0x9d, 0x1d, 0x21, 0xea, 0x80, 0xd7,
+	0xfd, 0xea, 0x83, 0x94, 0x36, 0x9a, 0x03, 0xf4, 0x40, 0xb9, 0x8d, 0xb9, 0x68, 0x30, 0xda, 0x22,
+	0xa7, 0x7e, 0x40, 0xf4, 0xc7, 0x7e, 0xf6, 0x61, 0xd7, 0x24, 0x19, 0xf6, 0xaa, 0x8e, 0x56, 0x3e,
+	0xce, 0x0a, 0xa1, 0x51, 0x5d, 0xd8, 0x05, 0x50, 0x1a, 0x4e, 0x19, 0x0e, 0x79, 0x9c, 0xbf, 0x8c,
+	0x96, 0x9f, 0x3a, 0xda, 0x9a, 0x8e, 0x06, 0x8f, 0xc7, 0xd4, 0xd0, 0x2d, 0x11, 0xe0, 0x06, 0x98,
+	0x63, 0x04, 0x73, 0x1a, 0x9a, 0x05, 0x55, 0x9b, 0xf4, 0x32, 0x90, 0xb2, 0x22, 0xed, 0x85, 0x9f,
+	0x82, 0xf9, 0x80, 0x70, 0x8e, 0x3d, 0x62, 0xce, 0x29, 0xe0, 0x03, 0x0d, 0x9c, 0x7f, 0x11, 0x9b,
+	0x51, 0xe2, 0xaf, 0x71, 0x50, 0x94, 0x37, 0x71, 0x14, 0x9e, 0x51, 0xf8, 0x31, 0x30, 0xe2, 0xd6,
+	0xce, 0xd9, 0x25, 0x4d, 0x30, 0xf6, 0x90, 0x81, 0xa5, 0xa3, 0xa5, 0xaf, 0x23, 0x75, 0xd8, 0xc8,
+	0x68, 0xc1, 0x15, 0x60, 0x38, 0xea, 0xbb, 0x4b, 0x76, 0x41, 0x1a, 0xf7, 0x91, 0xe1, 0xc0, 0x75,
+	0x90, 0x57, 0x8f, 0x24, 0xa7, 0xec, 0x69, 0x3b, 0x1e, 0x60, 0x81, 0x91, 0xf2, 0xd4, 0xfe, 0x36,
+	0xe2, 0xa8, 0xc7, 0x3e, 0x17, 0xf0, 0xf5, 0xd8, 0xbb, 0xb2, 0x3e, 0xac, 0x84, 0x92, 0xad, 0x5e,
+	0xd5, 0x92, 0x0e, 0x51, 0x4c, 0x2c, 0x99, 0x37, 0xf5, 0x0a, 0x14, 0x7c, 0x41, 0x02, 0xd9, 0x4d,
+	0xb9, 0xcd, 0x85, 0x9d, 0x9d, 0xe9, 0x1b, 0xdf, 0x2e, 0x6b, 0xf9, 0xc2, 0x91, 0x14, 0x42, 0xb1,
+	0x5e, 0xed, 0x9f, 0xf9, 0xf8, 0x1b, 0xe4, 0x2b, 0x83, 0xc7, 0xa0, 0xcc, 0x24, 0x95, 0x89, 0x06,
+	0x6d, 0xfb, 0x4e, 0x4f, 0x7f, 0xfb, 0x46, 0xd2, 0x4d, 0x28, 0xeb, 0xbc, 0xbe, 0x69, 0x40, 0xa3,
+	0x64, 0xe8, 0x81, 0x47, 0x82, 0xb0, 0xc0, 0x0f, 0xb1, 0xbc, 0xf9, 0xef, 0x18, 0x76, 0x48, 0x83,
+	0x30, 0x9f, 0xba, 0x4d, 0xe2, 0xd0, 0xd0, 0xe5, 0xaa, 0xe2, 0x39, 0xfb, 0xf1, 0xa0, 0x5f, 0x7d,
+	0x74, 0x3a, 0x09, 0x88, 0x26, 0xeb, 0xc0, 0x97, 0x60, 0x15, 0x3b, 0xc2, 0xef, 0x92, 0x03, 0x82,
+	0xdd, 0xb6, 0x1f, 0x92, 0x24, 0x40, 0x41, 0x05, 0xf8, 0x64, 0xd0, 0xaf, 0xae, 0xee, 0xdd, 0x06,
+	0x40, 0xb7, 0xf3, 0xe0, 0x6f, 0x06, 0x58, 0x0c, 0xa9, 0x4b, 0x9a, 0xa4, 0x4d, 0x1c, 0x41, 0x99,
+	0x39, 0xaf, 0xaa, 0x7e, 0x78, 0xbf, 0x51, 0x66, 0x9d, 0x64, 0xa4, 0xbe, 0x0d, 0x05, 0xeb, 0xd9,
+	0x0f, 0x75, 0x45, 0x17, 0xb3, 0x2e, 0x34, 0x12, 0x13, 0x7e, 0x0f, 0x20, 0x27, 0xac, 0xeb, 0x3b,
+	0x64, 0xcf, 0x71, 0x68, 0x27, 0x14, 0x27, 0x38, 0x20, 0x66, 0x51, 0xdd, 0x48, 0xfa, 0xe2, 0x9a,
+	0x63, 0x08, 0x74, 0x0b, 0x0b, 0xbe, 0x06, 0xa6, 0x4b, 0x22, 0x46, 0x1c, 0xb9, 0x11, 0x46, 0x39,
+	0x66, 0x49, 0x29, 0xae, 0x6b, 0x45, 0xf3, 0xe0, 0x0e, 0x1c, 0xba, 0x53, 0x01, 0x6e, 0x81, 0xa2,
+	0xcc, 0x5c, 0xe5, 0x07, 0x94, 0x5a, 0xda, 0xca, 0x27, 0xda, 0x8e, 0x52, 0x04, 0x7c, 0x0a, 0x16,
+	0xce, 0x29, 0x17, 0x27, 0x44, 0xfc, 0x42, 0xd9, 0x85, 0xb9, 0xb0, 0x6e, 0x6c, 0x16, 0xed, 0x15,
+	0x4d, 0x58, 0x38, 0x1c, 0xba, 0x50, 0x16, 0x27, 0x87, 0x81, 0x3c, 0x36, 0x8e, 0x0e, 0xcc, 0x45,
+	0x45, 0x49, 0x87, 0xc1, 0x61, 0x6c, 0x46, 0x89, 0x3f, 0x81, 0x1e, 0x35, 0xf6, 0xcd, 0xf2, 0x38,
+	0xf4, 0xa8, 0xb1, 0x8f, 0x12, 0xbf, 0x4c, 0x5d, 0xfe, 0x0c, 0x65, 0xea, 0x4b, 0xa3, 0xa9, 0x1f,
+	0x6a, 0x3b, 0x4a, 0x11, 0xb0, 0x0e, 0x4a, 0xbc, 0xd3, 0x72, 0x69, 0x80, 0xfd, 0xd0, 0x5c, 0x56,
+	0xf0, 0x65, 0x0d, 0x2f, 0x35, 0x13, 0x07, 0x1a, 0x62, 0xe0, 0x73, 0x50, 0x96, 0xfb, 0xd8, 0xed,
+	0xb4, 0x09, 0x53, 0xe5, 0x59, 0x51, 0xa4, 0x74, 0x3c, 0x37, 0xb3, 0x4e, 0x34, 0x8a, 0x5d, 0xfb,
+	0x06, 0x2c, 0x8f, 0x75, 0x0e, 0x5c, 0x02, 0xb9, 0x0b, 0xd2, 0x8b, 0xb7, 0x11, 0x92, 0x3f, 0xe1,
+	0x43, 0x50, 0xe8, 0xe2, 0x76, 0x87, 0xc4, 0x93, 0x0d, 0xc5, 0x87, 0xaf, 0x66, 0x77, 0x8d, 0xda,
+	0xef, 0x79, 0x00, 0x86, 0x3b, 0x0f, 0x3e, 0x01, 0x85, 0xe8, 0x1c, 0xf3, 0x64, 0x95, 0x25, 0x3d,
+	0x54, 0x68, 0x48, 0xe3, 0x75, 0xbf, 0x5a, 0x92, 0x58, 0x75, 0x40, 0x31, 0x10, 0x52, 0x00, 0x9c,
+	0x64, 0x49, 0x25, 0xa3, 0xe7, 0xf9, 0xf4, 0x8f, 0x20, 0x5d, 0x74, 0xc3, 0x3f, 0x0e, 0xa9, 0x89,
+	0xa3, 0x4c, 0x88, 0xec, 0xc4, 0xcf, 0x4d, 0x9e, 0xf8, 0x99, 0x25, 0x92, 0x9f, 0xb8, 0x44, 0x36,
+	0xc0, 0x5c, 0x7c, 0xd9, 0x37, 0x97, 0x4d, 0xdc, 0x0b, 0x48, 0x7b, 0x25, 0xce, 0x91, 0x1b, 0xa4,
+	0xa1, 0x77, 0x4d, 0x8a, 0x53, 0x7b, 0xa5, 0x81, 0xb4, 0x17, 0xbe, 0x02, 0x25, 0x35, 0xe4, 0xd4,
+	0xae, 0x9c, 0x9f, 0x7a, 0x57, 0x96, 0x55, 0xaf, 0x24, 0x02, 0x68, 0xa8, 0x05, 0x7f, 0x02, 0x05,
+	0x3f, 0x3c, 0xa3, 0xdc, 0x2c, 0xaa, 0x3a, 0xdf, 0xe3, 0x7f, 0x93, 0xdc, 0x7e, 0x99, 0x31, 0x2f,
+	0xc5, 0x50, 0xac, 0x69, 0xa3, 0xcb, 0xab, 0xca, 0xcc, 0xdb, 0xab, 0xca, 0xcc, 0xbb, 0xab, 0xca,
+	0xcc, 0xaf, 0x83, 0x8a, 0x71, 0x39, 0xa8, 0x18, 0x6f, 0x07, 0x15, 0xe3, 0xdd, 0xa0, 0x62, 0xfc,
+	0x3b, 0xa8, 0x18, 0x7f, 0xfc, 0x57, 0x99, 0xf9, 0x71, 0x6b, 0x9a, 0xbf, 0xd7, 0xff, 0x07, 0x00,
+	0x00, 0xff, 0xff, 0xa8, 0x1e, 0x19, 0x20, 0x8d, 0x0b, 0x00, 0x00,
 }
 
 func (m *Carp) Marshal() (dAtA []byte, err error) {
@@ -383,6 +417,49 @@ func (m *CarpCondition) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *CarpInfo) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CarpInfo) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *CarpInfo) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.C != nil {
+		i -= len(*m.C)
+		copy(dAtA[i:], *m.C)
+		i = encodeVarintGenerated(dAtA, i, uint64(len(*m.C)))
+		i--
+		dAtA[i] = 0x22
+	}
+	i -= len(m.Data)
+	copy(dAtA[i:], m.Data)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.Data)))
+	i--
+	dAtA[i] = 0x1a
+	i -= len(m.B)
+	copy(dAtA[i:], m.B)
+	i = encodeVarintGenerated(dAtA, i, uint64(len(m.B)))
+	i--
+	dAtA[i] = 0x12
+	i = encodeVarintGenerated(dAtA, i, uint64(m.A))
+	i--
+	dAtA[i] = 0x8
+	return len(dAtA) - i, nil
+}
+
 func (m *CarpList) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -572,6 +649,20 @@ func (m *CarpStatus) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.Infos) > 0 {
+		for iNdEx := len(m.Infos) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Infos[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGenerated(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x42
+		}
+	}
 	if m.StartTime != nil {
 		{
 			size, err := m.StartTime.MarshalToSizedBuffer(dAtA[:i])
@@ -673,6 +764,24 @@ func (m *CarpCondition) Size() (n int) {
 	return n
 }
 
+func (m *CarpInfo) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 1 + sovGenerated(uint64(m.A))
+	l = len(m.B)
+	n += 1 + l + sovGenerated(uint64(l))
+	l = len(m.Data)
+	n += 1 + l + sovGenerated(uint64(l))
+	if m.C != nil {
+		l = len(*m.C)
+		n += 1 + l + sovGenerated(uint64(l))
+	}
+	return n
+}
+
 func (m *CarpList) Size() (n int) {
 	if m == nil {
 		return 0
@@ -756,6 +865,12 @@ func (m *CarpStatus) Size() (n int) {
 		l = m.StartTime.Size()
 		n += 1 + l + sovGenerated(uint64(l))
 	}
+	if len(m.Infos) > 0 {
+		for _, e := range m.Infos {
+			l = e.Size()
+			n += 1 + l + sovGenerated(uint64(l))
+		}
+	}
 	return n
 }
 
@@ -792,6 +907,19 @@ func (this *CarpCondition) String() string {
 	}, "")
 	return s
 }
+func (this *CarpInfo) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&CarpInfo{`,
+		`A:` + fmt.Sprintf("%v", this.A) + `,`,
+		`B:` + fmt.Sprintf("%v", this.B) + `,`,
+		`Data:` + fmt.Sprintf("%v", this.Data) + `,`,
+		`C:` + valueToStringGenerated(this.C) + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func (this *CarpList) String() string {
 	if this == nil {
 		return "nil"
@@ -849,6 +977,11 @@ func (this *CarpStatus) String() string {
 		repeatedStringForConditions += strings.Replace(strings.Replace(f.String(), "CarpCondition", "CarpCondition", 1), `&`, ``, 1) + ","
 	}
 	repeatedStringForConditions += "}"
+	repeatedStringForInfos := "[]CarpInfo{"
+	for _, f := range this.Infos {
+		repeatedStringForInfos += strings.Replace(strings.Replace(f.String(), "CarpInfo", "CarpInfo", 1), `&`, ``, 1) + ","
+	}
+	repeatedStringForInfos += "}"
 	s := strings.Join([]string{`&CarpStatus{`,
 		`Phase:` + fmt.Sprintf("%v", this.Phase) + `,`,
 		`Conditions:` + repeatedStringForConditions + `,`,
@@ -857,6 +990,7 @@ func (this *CarpStatus) String() string {
 		`HostIP:` + fmt.Sprintf("%v", this.HostIP) + `,`,
 		`CarpIP:` + fmt.Sprintf("%v", this.CarpIP) + `,`,
 		`StartTime:` + strings.Replace(fmt.Sprintf("%v", this.StartTime), "Time", "v1.Time", 1) + `,`,
+		`Infos:` + repeatedStringForInfos + `,`,
 		`}`,
 	}, "")
 	return s
@@ -1262,6 +1396,172 @@ func (m *CarpCondition) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *CarpInfo) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowGenerated
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CarpInfo: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CarpInfo: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field A", wireType)
+			}
+			m.A = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.A |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field B", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.B = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field C", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			s := string(dAtA[iNdEx:postIndex])
+			m.C = &s
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipGenerated(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *CarpList) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -2139,6 +2439,40 @@ func (m *CarpStatus) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Infos", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGenerated
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGenerated
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Infos = append(m.Infos, CarpInfo{})
+			if err := m.Infos[len(m.Infos)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGenerated(dAtA[iNdEx:])

pkg/apis/testapigroup/v1/generated.proto

@@ -77,6 +77,23 @@ message CarpCondition {
   optional string message = 6;
 }
 
+message CarpInfo {
+  // A is the first map key.
+  // +required
+  optional int64 a = 1;
+
+  // B is the second map key.
+  // +required
+  optional string b = 2;
+
+  // C is the third, optional map key
+  // +optional
+  optional string c = 4;
+
+  // Some data for each pair of A and B.
+  optional string data = 3;
+}
+
 // CarpList is a list of Carps.
 message CarpList {
   // Standard list metadata.
@@ -129,7 +146,7 @@ message CarpSpec {
   // Deprecated: Use serviceAccountName instead.
   // +k8s:conversion-gen=false
   // +optional
-  optional string serviceAccount = 9;
+  optional string deprecatedServiceAccount = 9;
 
   // NodeName is a request to schedule this carp onto a specific node. If it is non-empty,
   // the scheduler simply schedules this carp onto that node, assuming that it fits resource
@@ -138,7 +155,6 @@ message CarpSpec {
   optional string nodeName = 10;
 
   // Host networking requested for this carp. Use the host's network namespace.
-  // If this option is set, the ports that will be used must be specified.
   // Default to false.
   // +k8s:conversion-gen=false
   // +optional
@@ -169,7 +185,7 @@ message CarpSpec {
   // If specified, the carp will be dispatched by specified scheduler.
   // If not specified, the carp will be dispatched by default scheduler.
   // +optional
-  optional string schedulername = 19;
+  optional string schedulerName = 19;
 }
 
 // CarpStatus represents information about the status of a carp. Status may trail the actual
@@ -182,6 +198,10 @@ message CarpStatus {
 
   // Current service state of carp.
   // More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+  // +patchStrategy=merge
+  // +patchMergeKey=type
+  // +listType=map
+  // +listMapKey=type
   // +optional
   repeated CarpCondition conditions = 2;
 
@@ -207,5 +227,13 @@ message CarpStatus {
   // This is before the Kubelet pulled the container image(s) for the carp.
   // +optional
   optional .k8s.io.apimachinery.pkg.apis.meta.v1.Time startTime = 7;
+
+  // Carp infos are provided by different clients, hence the map type.
+  //
+  // +listType=map
+  // +listMapKey=a
+  // +listMapKey=b
+  // +listMapKey=c
+  repeated CarpInfo infos = 8;
 }
 

pkg/apis/testapigroup/v1/register.go

@@ -57,6 +57,7 @@ func init() {
 func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
 		&Carp{},
+		&CarpList{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil

pkg/apis/testapigroup/v1/types.go

@@ -28,6 +28,7 @@ type (
 )
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.1
 
 // Carp is a collection of containers, used as either input (create, update) or as output (list, get).
 type Carp struct {
@@ -60,8 +61,12 @@ type CarpStatus struct {
 	Phase CarpPhase `json:"phase,omitempty" protobuf:"bytes,1,opt,name=phase,casttype=CarpPhase"`
 	// Current service state of carp.
 	// More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
+	// +patchStrategy=merge
+	// +patchMergeKey=type
+	// +listType=map
+	// +listMapKey=type
 	// +optional
-	Conditions []CarpCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,2,rep,name=conditions"`
+	Conditions []CarpCondition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,2,opt,name=conditions"`
 	// A human readable message indicating details about why the carp is in this condition.
 	// +optional
 	Message string `json:"message,omitempty" protobuf:"bytes,3,opt,name=message"`
@@ -82,6 +87,14 @@ type CarpStatus struct {
 	// This is before the Kubelet pulled the container image(s) for the carp.
 	// +optional
 	StartTime *metav1.Time `json:"startTime,omitempty" protobuf:"bytes,7,opt,name=startTime"`
+
+	// Carp infos are provided by different clients, hence the map type.
+	//
+	// +listType=map
+	// +listMapKey=a
+	// +listMapKey=b
+	// +listMapKey=c
+	Infos []CarpInfo `json:"infos,omitempty" protobuf:"bytes,8,rep,name=infos"`
 }
 
 type CarpCondition struct {
@@ -107,6 +120,21 @@ type CarpCondition struct {
 	Message string `json:"message,omitempty" protobuf:"bytes,6,opt,name=message"`
 }
 
+type CarpInfo struct {
+	// A is the first map key.
+	// +required
+	A int64 `json:"a" protobuf:"bytes,1,name=a"`
+	// B is the second map key.
+	// +required
+	B string `json:"b" protobuf:"bytes,2,name=b"`
+	// C is the third, optional map key
+	// +optional
+	C *string `json:"c,omitempty" protobuf:"bytes,4,opt,name=c"`
+
+	// Some data for each pair of A and B.
+	Data string `json:"data" protobuf:"bytes,3,name=data"`
+}
+
 // CarpSpec is a description of a carp
 type CarpSpec struct {
 	// Restart policy for all containers within the carp.
@@ -143,7 +171,7 @@ type CarpSpec struct {
 	// Deprecated: Use serviceAccountName instead.
 	// +k8s:conversion-gen=false
 	// +optional
-	DeprecatedServiceAccount string `json:"serviceAccount,omitempty" protobuf:"bytes,9,opt,name=serviceAccount"`
+	DeprecatedServiceAccount string `json:"deprecatedServiceAccount,omitempty" protobuf:"bytes,9,opt,name=deprecatedServiceAccount"`
 
 	// NodeName is a request to schedule this carp onto a specific node. If it is non-empty,
 	// the scheduler simply schedules this carp onto that node, assuming that it fits resource
@@ -151,7 +179,6 @@ type CarpSpec struct {
 	// +optional
 	NodeName string `json:"nodeName,omitempty" protobuf:"bytes,10,opt,name=nodeName"`
 	// Host networking requested for this carp. Use the host's network namespace.
-	// If this option is set, the ports that will be used must be specified.
 	// Default to false.
 	// +k8s:conversion-gen=false
 	// +optional
@@ -177,10 +204,11 @@ type CarpSpec struct {
 	// If specified, the carp will be dispatched by specified scheduler.
 	// If not specified, the carp will be dispatched by default scheduler.
 	// +optional
-	SchedulerName string `json:"schedulername,omitempty" protobuf:"bytes,19,opt,name=schedulername"`
+	SchedulerName string `json:"schedulerName,omitempty" protobuf:"bytes,19,opt,name=schedulerName"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:prerelease-lifecycle-gen:introduced=1.1
 
 // CarpList is a list of Carps.
 type CarpList struct {

pkg/apis/testapigroup/v1/zz_generated.conversion.go

@@ -57,6 +57,16 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
+	if err := s.AddGeneratedConversionFunc((*CarpInfo)(nil), (*testapigroup.CarpInfo)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1_CarpInfo_To_testapigroup_CarpInfo(a.(*CarpInfo), b.(*testapigroup.CarpInfo), scope)
+	}); err != nil {
+		return err
+	}
+	if err := s.AddGeneratedConversionFunc((*testapigroup.CarpInfo)(nil), (*CarpInfo)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_testapigroup_CarpInfo_To_v1_CarpInfo(a.(*testapigroup.CarpInfo), b.(*CarpInfo), scope)
+	}); err != nil {
+		return err
+	}
 	if err := s.AddGeneratedConversionFunc((*CarpList)(nil), (*testapigroup.CarpList)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1_CarpList_To_testapigroup_CarpList(a.(*CarpList), b.(*testapigroup.CarpList), scope)
 	}); err != nil {
@@ -152,6 +162,32 @@ func Convert_testapigroup_CarpCondition_To_v1_CarpCondition(in *testapigroup.Car
 	return autoConvert_testapigroup_CarpCondition_To_v1_CarpCondition(in, out, s)
 }
 
+func autoConvert_v1_CarpInfo_To_testapigroup_CarpInfo(in *CarpInfo, out *testapigroup.CarpInfo, s conversion.Scope) error {
+	out.A = in.A
+	out.B = in.B
+	out.C = (*string)(unsafe.Pointer(in.C))
+	out.Data = in.Data
+	return nil
+}
+
+// Convert_v1_CarpInfo_To_testapigroup_CarpInfo is an autogenerated conversion function.
+func Convert_v1_CarpInfo_To_testapigroup_CarpInfo(in *CarpInfo, out *testapigroup.CarpInfo, s conversion.Scope) error {
+	return autoConvert_v1_CarpInfo_To_testapigroup_CarpInfo(in, out, s)
+}
+
+func autoConvert_testapigroup_CarpInfo_To_v1_CarpInfo(in *testapigroup.CarpInfo, out *CarpInfo, s conversion.Scope) error {
+	out.A = in.A
+	out.B = in.B
+	out.C = (*string)(unsafe.Pointer(in.C))
+	out.Data = in.Data
+	return nil
+}
+
+// Convert_testapigroup_CarpInfo_To_v1_CarpInfo is an autogenerated conversion function.
+func Convert_testapigroup_CarpInfo_To_v1_CarpInfo(in *testapigroup.CarpInfo, out *CarpInfo, s conversion.Scope) error {
+	return autoConvert_testapigroup_CarpInfo_To_v1_CarpInfo(in, out, s)
+}
+
 func autoConvert_v1_CarpList_To_testapigroup_CarpList(in *CarpList, out *testapigroup.CarpList, s conversion.Scope) error {
 	out.ListMeta = in.ListMeta
 	if in.Items != nil {
@@ -242,6 +278,7 @@ func autoConvert_v1_CarpStatus_To_testapigroup_CarpStatus(in *CarpStatus, out *t
 	out.HostIP = in.HostIP
 	out.CarpIP = in.CarpIP
 	out.StartTime = (*metav1.Time)(unsafe.Pointer(in.StartTime))
+	out.Infos = *(*[]testapigroup.CarpInfo)(unsafe.Pointer(&in.Infos))
 	return nil
 }
 
@@ -258,6 +295,7 @@ func autoConvert_testapigroup_CarpStatus_To_v1_CarpStatus(in *testapigroup.CarpS
 	out.HostIP = in.HostIP
 	out.CarpIP = in.CarpIP
 	out.StartTime = (*metav1.Time)(unsafe.Pointer(in.StartTime))
+	out.Infos = *(*[]CarpInfo)(unsafe.Pointer(&in.Infos))
 	return nil
 }
 

pkg/apis/testapigroup/v1/zz_generated.deepcopy.go

@@ -71,6 +71,27 @@ func (in *CarpCondition) DeepCopy() *CarpCondition {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpInfo) DeepCopyInto(out *CarpInfo) {
+	*out = *in
+	if in.C != nil {
+		in, out := &in.C, &out.C
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpInfo.
+func (in *CarpInfo) DeepCopy() *CarpInfo {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpInfo)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CarpList) DeepCopyInto(out *CarpList) {
 	*out = *in
@@ -151,6 +172,13 @@ func (in *CarpStatus) DeepCopyInto(out *CarpStatus) {
 		in, out := &in.StartTime, &out.StartTime
 		*out = (*in).DeepCopy()
 	}
+	if in.Infos != nil {
+		in, out := &in.Infos, &out.Infos
+		*out = make([]CarpInfo, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	return
 }
 

pkg/apis/testapigroup/v1/zz_generated.prerelease-lifecycle.go

@@ -0,0 +1,34 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
+
+package v1
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *Carp) APILifecycleIntroduced() (major, minor int) {
+	return 1, 1
+}
+
+// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
+// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
+func (in *CarpList) APILifecycleIntroduced() (major, minor int) {
+	return 1, 1
+}

pkg/apis/testapigroup/zz_generated.deepcopy.go

@@ -71,6 +71,27 @@ func (in *CarpCondition) DeepCopy() *CarpCondition {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CarpInfo) DeepCopyInto(out *CarpInfo) {
+	*out = *in
+	if in.C != nil {
+		in, out := &in.C, &out.C
+		*out = new(string)
+		**out = **in
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CarpInfo.
+func (in *CarpInfo) DeepCopy() *CarpInfo {
+	if in == nil {
+		return nil
+	}
+	out := new(CarpInfo)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CarpList) DeepCopyInto(out *CarpList) {
 	*out = *in
@@ -151,6 +172,13 @@ func (in *CarpStatus) DeepCopyInto(out *CarpStatus) {
 		in, out := &in.StartTime, &out.StartTime
 		*out = (*in).DeepCopy()
 	}
+	if in.Infos != nil {
+		in, out := &in.Infos, &out.Infos
+		*out = make([]CarpInfo, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	return
 }
 

pkg/conversion/queryparams/convert_test.go

@@ -25,6 +25,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/conversion/queryparams"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/utils/ptr"
 )
 
 type namedString string
@@ -161,20 +162,20 @@ func TestConvert(t *testing.T) {
 		},
 		{
 			input: &baz{
-				Ptr:  intp(5),
-				Bptr: boolp(true),
+				Ptr:  ptr.To(5),
+				Bptr: ptr.To(true),
 			},
 			expected: url.Values{"ptr": {"5"}, "bptr": {"true"}},
 		},
 		{
 			input: &baz{
-				Bptr: boolp(true),
+				Bptr: ptr.To(true),
 			},
 			expected: url.Values{"ptr": {""}, "bptr": {"true"}},
 		},
 		{
 			input: &baz{
-				Ptr: intp(5),
+				Ptr: ptr.To(5),
 			},
 			expected: url.Values{"ptr": {"5"}},
 		},
@@ -213,7 +214,3 @@ func TestConvert(t *testing.T) {
 		validateResult(t, test.input, result, test.expected)
 	}
 }
-
-func intp(n int) *int { return &n }
-
-func boolp(b bool) *bool { return &b }

pkg/labels/labels.go

@@ -31,6 +31,9 @@ type Labels interface {
 
 	// Get returns the value for the provided label.
 	Get(label string) (value string)
+
+	// Lookup returns the value for the provided label if it exists and whether the provided label exist
+	Lookup(label string) (value string, exists bool)
 }
 
 // Set is a map of label:value. It implements Labels.
@@ -59,6 +62,12 @@ func (ls Set) Get(label string) string {
 	return ls[label]
 }
 
+// Lookup returns the value for the provided label if it exists and whether the provided label exist
+func (ls Set) Lookup(label string) (string, bool) {
+	val, exists := ls[label]
+	return val, exists
+}
+
 // AsSelector converts labels into a selectors. It does not
 // perform any validation, which means the server will reject
 // the request if the Set contains invalid values.

pkg/labels/selector.go

@@ -23,11 +23,12 @@ import (
 	"strconv"
 	"strings"
 
+	"k8s.io/klog/v2"
+
 	"k8s.io/apimachinery/pkg/selection"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apimachinery/pkg/util/validation"
 	"k8s.io/apimachinery/pkg/util/validation/field"
-	"k8s.io/klog/v2"
 )
 
 var (
@@ -115,6 +116,15 @@ func Nothing() Selector {
 	return sharedNothingSelector
 }
 
+// MatchesNothing only returns true for selectors which are definitively determined to match no objects.
+// This currently only detects the `labels.Nothing()` selector, but may change over time to detect more selectors that match no objects.
+//
+// Note: The current implementation does not check for selector conflict scenarios (e.g., a=a,a!=a).
+// Support for detecting such cases can be added in the future.
+func MatchesNothing(selector Selector) bool {
+	return selector == sharedNothingSelector
+}
+
 // NewSelector returns a nil selector
 func NewSelector() Selector {
 	return internalSelector(nil)
@@ -236,26 +246,29 @@ func (r *Requirement) hasValue(value string) bool {
 func (r *Requirement) Matches(ls Labels) bool {
 	switch r.operator {
 	case selection.In, selection.Equals, selection.DoubleEquals:
-		if !ls.Has(r.key) {
+		val, exists := ls.Lookup(r.key)
+		if !exists {
 			return false
 		}
-		return r.hasValue(ls.Get(r.key))
+		return r.hasValue(val)
 	case selection.NotIn, selection.NotEquals:
-		if !ls.Has(r.key) {
+		val, exists := ls.Lookup(r.key)
+		if !exists {
 			return true
 		}
-		return !r.hasValue(ls.Get(r.key))
+		return !r.hasValue(val)
 	case selection.Exists:
 		return ls.Has(r.key)
 	case selection.DoesNotExist:
 		return !ls.Has(r.key)
 	case selection.GreaterThan, selection.LessThan:
-		if !ls.Has(r.key) {
+		val, exists := ls.Lookup(r.key)
+		if !exists {
 			return false
 		}
-		lsValue, err := strconv.ParseInt(ls.Get(r.key), 10, 64)
+		lsValue, err := strconv.ParseInt(val, 10, 64)
 		if err != nil {
-			klog.V(10).Infof("ParseInt failed for value %+v in label %+v, %+v", ls.Get(r.key), ls, err)
+			klog.V(10).Infof("ParseInt failed for value %+v in label %+v, %+v", val, ls, err)
 			return false
 		}
 
@@ -996,7 +1009,8 @@ type ValidatedSetSelector Set
 
 func (s ValidatedSetSelector) Matches(labels Labels) bool {
 	for k, v := range s {
-		if !labels.Has(k) || v != labels.Get(k) {
+		val, exists := labels.Lookup(k)
+		if !exists || v != val {
 			return false
 		}
 	}

pkg/labels/selector_test.go

@@ -1008,6 +1008,26 @@ func BenchmarkRequirementString(b *testing.B) {
 	}
 }
 
+func BenchmarkRequirementMatches(b *testing.B) {
+	r := Requirement{
+		key:      "environment",
+		operator: selection.NotIn,
+		strValues: []string{
+			"dev",
+		},
+	}
+	labels := Set(map[string]string{
+		"key":         "value",
+		"environment": "dev",
+	})
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		r.Matches(labels)
+	}
+}
+
 func TestRequirementEqual(t *testing.T) {
 	tests := []struct {
 		name string
@@ -1079,3 +1099,114 @@ func TestRequirementEqual(t *testing.T) {
 		})
 	}
 }
+
+func TestMatchesNothing(t *testing.T) {
+	tests := []struct {
+		name          string
+		selector      string
+		set           map[string]string
+		labelSelector Selector
+		want          bool
+	}{
+		{
+			name:          "MatchNothing should match Nothing()",
+			labelSelector: Nothing(),
+			want:          true,
+		},
+		{
+			name:          "MatchNothing should match sharedNothingSelector",
+			labelSelector: sharedNothingSelector,
+			want:          true,
+		},
+		{
+			name:          "MatchNothing should not match Everything()",
+			labelSelector: Everything(),
+			want:          false,
+		},
+		{
+			name:          "MatchNothing should not match sharedEverythingSelector",
+			labelSelector: sharedEverythingSelector,
+			want:          false,
+		},
+		{
+			name: "MatchNothing should not match empty set",
+			set:  map[string]string{},
+			want: false,
+		},
+		{
+			name: "MatchNothing should not match non-empty set",
+			set:  map[string]string{"key": "value"},
+			want: false,
+		},
+		{
+			name:     "MatchNothing should not match empty selector",
+			selector: "",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - exists",
+			selector: "a",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - not exists",
+			selector: "!a",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - equals",
+			selector: "a=b",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - not equals",
+			selector: "a!=b",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - in",
+			selector: "a in (b)",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - notin",
+			selector: "a notin (b)",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - conflict exists and not exists",
+			selector: "a,!a",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - conflict equals and not equals",
+			selector: "a=b,a!=b",
+			want:     false,
+		},
+		{
+			name:     "MatchNothing should not match non-empty selector - conflict in and notin",
+			selector: "a in (b),a notin (b)",
+			want:     false,
+		},
+	}
+
+	for i := 0; i < len(tests); i++ {
+		if tests[i].labelSelector != nil {
+			expectMatchNothing(t, tests[i].labelSelector, tests[i].want)
+		} else if tests[i].set != nil {
+			expectMatchNothing(t, SelectorFromSet(tests[i].set), tests[i].want)
+		} else {
+			selector, err := Parse(tests[i].selector)
+			if err != nil {
+				t.Errorf("Unable to parse %v as a selector.\n", selector)
+			}
+			expectMatchNothing(t, selector, tests[i].want)
+		}
+	}
+}
+
+func expectMatchNothing(t *testing.T, selector Selector, want bool) {
+	if MatchesNothing(selector) != want {
+		t.Errorf("Wanted %s to MatchNothing '%t', but it did not.\n", selector, want)
+	}
+}

pkg/runtime/converter.go

@@ -29,10 +29,11 @@ import (
 	"sync/atomic"
 	"time"
 
+	"sigs.k8s.io/structured-merge-diff/v6/value"
+
 	"k8s.io/apimachinery/pkg/conversion"
 	"k8s.io/apimachinery/pkg/util/json"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
-	"sigs.k8s.io/structured-merge-diff/v4/value"
 
 	"k8s.io/klog/v2"
 )
@@ -53,6 +54,7 @@ type fieldInfo struct {
 	name      string
 	nameValue reflect.Value
 	omitempty bool
+	omitzero  func(dv reflect.Value) bool
 }
 
 type fieldsCacheMap map[structField]*fieldInfo
@@ -376,19 +378,24 @@ func fieldInfoFromField(structType reflect.Type, field int) *fieldInfo {
 	typeField := structType.Field(field)
 	jsonTag := typeField.Tag.Get("json")
 	if len(jsonTag) == 0 {
-		// Make the first character lowercase.
-		if typeField.Name == "" {
+		if !typeField.Anonymous {
+			// match stdlib behavior for naming fields that don't specify a json tag name
 			info.name = typeField.Name
-		} else {
-			info.name = strings.ToLower(typeField.Name[:1]) + typeField.Name[1:]
 		}
 	} else {
 		items := strings.Split(jsonTag, ",")
 		info.name = items[0]
+		if len(info.name) == 0 && !typeField.Anonymous {
+			// match stdlib behavior for naming fields that don't specify a json tag name
+			info.name = typeField.Name
+		}
+
 		for i := range items {
-			if items[i] == "omitempty" {
+			if i > 0 && items[i] == "omitempty" {
 				info.omitempty = true
-				break
+			}
+			if i > 0 && items[i] == "omitzero" {
+				info.omitzero = value.OmitZeroFunc(typeField.Type)
 			}
 		}
 	}
@@ -775,7 +782,7 @@ func pointerToUnstructured(sv, dv reflect.Value) error {
 	return toUnstructured(sv.Elem(), dv)
 }
 
-func isZero(v reflect.Value) bool {
+func isEmpty(v reflect.Value) bool {
 	switch v.Kind() {
 	case reflect.Array, reflect.String:
 		return v.Len() == 0
@@ -816,10 +823,14 @@ func structToUnstructured(sv, dv reflect.Value) error {
 			// This field should be skipped.
 			continue
 		}
-		if fieldInfo.omitempty && isZero(fv) {
+		if fieldInfo.omitempty && isEmpty(fv) {
 			// omitempty fields should be ignored.
 			continue
 		}
+		if fieldInfo.omitzero != nil && fieldInfo.omitzero(fv) {
+			// omitzero fields should be ignored
+			continue
+		}
 		if len(fieldInfo.name) == 0 {
 			// This field is inlined.
 			if err := toUnstructured(fv, dv); err != nil {

pkg/runtime/converter_test.go

@@ -36,9 +36,9 @@ import (
 	"k8s.io/apimachinery/pkg/util/json"
 
 	"github.com/google/go-cmp/cmp"
-	fuzz "github.com/google/gofuzz"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/randfill"
 )
 
 var simpleEquality = conversion.EqualitiesOrDie(
@@ -640,9 +640,9 @@ func TestUnknownFields(t *testing.T) {
 // with the various validation directives (Ignore, Warn, Strict)
 func BenchmarkFromUnstructuredWithValidation(b *testing.B) {
 	re := regexp.MustCompile("^I$")
-	f := fuzz.NewWithSeed(1).NilChance(0.1).SkipFieldsWithPattern(re)
+	f := randfill.NewWithSeed(1).NilChance(0.1).SkipFieldsWithPattern(re)
 	iObj := &I{}
-	f.Fuzz(&iObj)
+	f.Fill(&iObj)
 
 	unstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(iObj)
 	if err != nil {
@@ -998,3 +998,179 @@ func TestCustomToUnstructuredTopLevel(t *testing.T) {
 		})
 	}
 }
+
+type OmitemptyNameField struct {
+	I int `json:"omitempty"`
+}
+
+func TestOmitempty(t *testing.T) {
+	expected := `{"omitempty":0}`
+
+	o := &OmitemptyNameField{}
+	jsonData, err := json.Marshal(o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if e, a := expected, string(jsonData); e != a {
+		t.Fatalf("expected\n%s\ngot\n%s", e, a)
+	}
+
+	unstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	jsonUnstrData, err := json.Marshal(unstr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if e, a := expected, string(jsonUnstrData); e != a {
+		t.Fatalf("expected\n%s\ngot\n%s", e, a)
+	}
+}
+
+type InlineTestPrimitive struct {
+	NoNameTagPrimitive          int64 `json:""`
+	NoNameTagInlinePrimitive    int64 `json:",inline"`
+	NoNameTagOmitemptyPrimitive int64 `json:",omitempty"`
+}
+type InlineTestAnonymous struct {
+	NoTag
+	NoNameTag          `json:""`
+	NameTag            `json:"nameTagEmbedded"`
+	NoNameTagInline    `json:",inline"`
+	NoNameTagOmitempty `json:",omitempty"`
+}
+type InlineTestNamed struct {
+	NoTag              NoTag
+	NoNameTag          NoNameTag          `json:""`
+	NameTag            NameTag            `json:"nameTagEmbedded"`
+	NoNameTagInline    NoNameTagInline    `json:",inline"`
+	NoNameTagOmitempty NoNameTagOmitempty `json:",omitempty"`
+}
+type NoTag struct {
+	Data0 int `json:"data0"`
+}
+type NameTag struct {
+	Data1 int `json:"data1"`
+}
+type NoNameTag struct {
+	Data2 int `json:"data2"`
+}
+type NoNameTagInline struct {
+	Data3 int `json:"data3"`
+}
+type NoNameTagOmitempty struct {
+	Data4 int `json:"data4"`
+}
+
+func TestInline(t *testing.T) {
+	testcases := []struct {
+		name   string
+		obj    any
+		expect map[string]any
+	}{
+		{
+			name: "primitive-zero",
+			obj:  &InlineTestPrimitive{},
+			expect: map[string]any{
+				"NoNameTagPrimitive":       int64(0),
+				"NoNameTagInlinePrimitive": int64(0),
+			},
+		},
+		{
+			name: "primitive-set",
+			obj: &InlineTestPrimitive{
+				NoNameTagPrimitive:          1,
+				NoNameTagInlinePrimitive:    2,
+				NoNameTagOmitemptyPrimitive: 3,
+			},
+			expect: map[string]any{
+				"NoNameTagPrimitive":          int64(1),
+				"NoNameTagInlinePrimitive":    int64(2),
+				"NoNameTagOmitemptyPrimitive": int64(3),
+			},
+		},
+		{
+			name: "anonymous-zero",
+			obj:  &InlineTestAnonymous{},
+			expect: map[string]any{
+				"data0":           int64(0),
+				"data2":           int64(0),
+				"data3":           int64(0),
+				"data4":           int64(0),
+				"nameTagEmbedded": map[string]any{"data1": int64(0)},
+			},
+		},
+		{
+			name: "anonymous-set",
+			obj:  &InlineTestAnonymous{},
+			expect: map[string]any{
+				"data0":           int64(0),
+				"data2":           int64(0),
+				"data3":           int64(0),
+				"data4":           int64(0),
+				"nameTagEmbedded": map[string]any{"data1": int64(0)},
+			},
+		},
+		{
+			name: "named-zero",
+			obj:  &InlineTestNamed{},
+			expect: map[string]any{
+				"NoTag":              map[string]any{"data0": int64(0)},
+				"nameTagEmbedded":    map[string]any{"data1": int64(0)},
+				"NoNameTag":          map[string]any{"data2": int64(0)},
+				"NoNameTagInline":    map[string]any{"data3": int64(0)},
+				"NoNameTagOmitempty": map[string]any{"data4": int64(0)},
+			},
+		},
+		{
+			name: "named-set",
+			obj: &InlineTestNamed{
+				NoTag:              NoTag{Data0: 10},
+				NameTag:            NameTag{Data1: 11},
+				NoNameTag:          NoNameTag{Data2: 12},
+				NoNameTagInline:    NoNameTagInline{Data3: 13},
+				NoNameTagOmitempty: NoNameTagOmitempty{Data4: 14},
+			},
+			expect: map[string]any{
+				"NoTag":              map[string]any{"data0": int64(10)},
+				"nameTagEmbedded":    map[string]any{"data1": int64(11)},
+				"NoNameTag":          map[string]any{"data2": int64(12)},
+				"NoNameTagInline":    map[string]any{"data3": int64(13)},
+				"NoNameTagOmitempty": map[string]any{"data4": int64(14)},
+			},
+		},
+	}
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			defer func() {
+				// handle panics
+				if err := recover(); err != nil {
+					t.Fatal(err)
+				}
+			}()
+
+			// Check the expectation against stdlib
+			jsonData, err := json.Marshal(tc.obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+			jsonUnstr := map[string]any{}
+			if err := json.Unmarshal(jsonData, &jsonUnstr); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(tc.expect, jsonUnstr) {
+				t.Fatal(cmp.Diff(tc.expect, jsonUnstr))
+			}
+
+			// Check the expectation against DefaultUnstructuredConverter.ToUnstructured
+			unstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(tc.obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(tc.expect, unstr) {
+				t.Fatal(cmp.Diff(tc.expect, unstr))
+			}
+		})
+	}
+}

pkg/runtime/converter_zero_test.go

@@ -0,0 +1,359 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// These tests are in a separate package to break cyclic dependency in tests.
+// Unstructured type depends on unstructured converter package but we want to test how the converter handles
+// the Unstructured type so we need to import both.
+
+package runtime
+
+import (
+	encodingjson "encoding/json"
+	"fmt"
+	"reflect"
+	"testing"
+	"time"
+
+	"k8s.io/apimachinery/pkg/util/json"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+type ZeroParent struct {
+	Int               int                    `json:"int,omitzero"`
+	IntP              *int                   `json:"intP,omitzero"`
+	String            string                 `json:"string,omitzero"`
+	StringP           *string                `json:"stringP,omitzero"`
+	Bool              bool                   `json:"bool,omitzero"`
+	BoolP             bool                   `json:"boolP,omitzero"`
+	Slice             []int                  `json:"slice,omitzero"`
+	SliceP            *[]int                 `json:"sliceP,omitzero"`
+	Map               map[string]int         `json:"map,omitzero"`
+	MapP              *map[string]int        `json:"mapP,omitzero"`
+	Struct            ZeroChild              `json:"struct,omitzero"`
+	StructP           *ZeroChild             `json:"structP,omitzero"`
+	CustomPrimitive   ZeroCustomPrimitive    `json:"customPrimitive,omitzero"`
+	CustomPrimitiveP  *ZeroCustomPrimitiveP  `json:"customPrimitiveP,omitzero"`
+	CustomStruct      ZeroCustomStruct       `json:"customStruct,omitzero"`
+	CustomStructP     *ZeroCustomStructP     `json:"customStructP,omitzero"`
+	CustomPPrimitive  ZeroCustomPPrimitive   `json:"customPPrimitive,omitzero"`
+	CustomPPrimitiveP *ZeroCustomPPrimitiveP `json:"customPPrimitiveP,omitzero"`
+	CustomPStruct     ZeroCustomPStruct      `json:"customPStruct,omitzero"`
+	CustomPStructP    *ZeroCustomPStructP    `json:"customPStructP,omitzero"`
+}
+type ZeroChild struct {
+	Data int `json:"data"`
+}
+
+type ZeroCustomPrimitive int
+
+func (z ZeroCustomPrimitive) IsZero() bool {
+	return z == 42
+}
+
+type ZeroCustomPrimitiveP int
+
+func (z ZeroCustomPrimitiveP) IsZero() bool {
+	return z == 42
+}
+
+type ZeroCustomStruct struct {
+	Data int `json:"data"`
+}
+
+func (z ZeroCustomStruct) IsZero() bool {
+	return z.Data == 42
+}
+
+type ZeroCustomStructP struct {
+	Data int `json:"data"`
+}
+
+func (z ZeroCustomStructP) IsZero() bool {
+	return z.Data == 42
+}
+
+type ZeroCustomPPrimitive int
+
+func (z *ZeroCustomPPrimitive) IsZero() bool {
+	return *z == 42
+}
+
+type ZeroCustomPPrimitiveP int
+
+func (z *ZeroCustomPPrimitiveP) IsZero() bool {
+	return *z == 42
+}
+
+type ZeroCustomPStruct struct {
+	Data int `json:"data"`
+}
+
+func (z *ZeroCustomPStruct) IsZero() bool {
+	return z.Data == 42
+}
+
+type ZeroCustomPStructP struct {
+	Data int `json:"data"`
+}
+
+func (z *ZeroCustomPStructP) IsZero() bool {
+	return z.Data == 42
+}
+
+func TestOmitZero2(t *testing.T) {
+	testcases := []struct {
+		name   string
+		obj    any
+		expect map[string]any
+	}{
+		{
+			name: "emptyzero",
+			obj:  &ZeroParent{},
+			expect: map[string]any{
+				"customPPrimitive": int64(0),
+				"customPStruct":    map[string]any{"data": int64(0)},
+				"customPrimitive":  int64(0),
+				"customStruct":     map[string]any{"data": int64(0)},
+			},
+		},
+	}
+	for _, tc := range testcases {
+		t.Run(tc.name, func(t *testing.T) {
+			jsonData, err := json.Marshal(tc.obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+			jsonUnstructured := map[string]any{}
+			if err := json.Unmarshal(jsonData, &jsonUnstructured); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(jsonUnstructured, tc.expect) {
+				t.Fatal(cmp.Diff(tc.expect, jsonUnstructured))
+			}
+
+			unstr, err := DefaultUnstructuredConverter.ToUnstructured(tc.obj)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(unstr, tc.expect) {
+				t.Fatal(cmp.Diff(tc.expect, unstr))
+			}
+		})
+	}
+}
+
+type NonZeroStruct struct{}
+
+func (nzs NonZeroStruct) IsZero() bool {
+	return false
+}
+
+type NoPanicStruct struct {
+	Int int `json:"int,omitzero"`
+}
+
+func (nps *NoPanicStruct) IsZero() bool {
+	return nps.Int != 0
+}
+
+type isZeroer interface {
+	IsZero() bool
+}
+
+type OptionalsZero struct {
+	Sr string `json:"sr"`
+	So string `json:"so,omitzero"`
+	Sw string `json:"-"`
+
+	Ir int `json:"omitzero"` // actually named omitzero, not an option
+	Io int `json:"io,omitzero"`
+
+	Slr       []string `json:"slr,random"` //nolint:staticcheck // SA5008
+	Slo       []string `json:"slo,omitzero"`
+	SloNonNil []string `json:"slononnil,omitzero"`
+
+	Mr  map[string]any `json:"mr"`
+	Mo  map[string]any `json:",omitzero"`
+	Moo map[string]any `json:"moo,omitzero"`
+
+	Fr   float64    `json:"fr"`
+	Fo   float64    `json:"fo,omitzero"`
+	Foo  float64    `json:"foo,omitzero"`
+	Foo2 [2]float64 `json:"foo2,omitzero"`
+
+	Br bool `json:"br"`
+	Bo bool `json:"bo,omitzero"`
+
+	Ur uint `json:"ur"`
+	Uo uint `json:"uo,omitzero"`
+
+	Str struct{} `json:"str"`
+	Sto struct{} `json:"sto,omitzero"`
+
+	Time      time.Time     `json:"time,omitzero"`
+	TimeLocal time.Time     `json:"timelocal,omitzero"`
+	Nzs       NonZeroStruct `json:"nzs,omitzero"`
+
+	NilIsZeroer    isZeroer       `json:"niliszeroer,omitzero"`    // nil interface
+	NonNilIsZeroer isZeroer       `json:"nonniliszeroer,omitzero"` // non-nil interface
+	NoPanicStruct0 isZeroer       `json:"nps0,omitzero"`           // non-nil interface with nil pointer
+	NoPanicStruct1 isZeroer       `json:"nps1,omitzero"`           // non-nil interface with non-nil pointer
+	NoPanicStruct2 *NoPanicStruct `json:"nps2,omitzero"`           // nil pointer
+	NoPanicStruct3 *NoPanicStruct `json:"nps3,omitzero"`           // non-nil pointer
+	NoPanicStruct4 NoPanicStruct  `json:"nps4,omitzero"`           // concrete type
+}
+
+func TestOmitZero(t *testing.T) {
+	const want = `{
+ "Mo": {},
+ "br": false,
+ "fr": 0,
+ "mr": {},
+ "nps1": {},
+ "nps3": {},
+ "nps4": {},
+ "nzs": {},
+ "omitzero": 0,
+ "slononnil": [],
+ "slr": null,
+ "sr": "",
+ "str": {},
+ "ur": 0
+}`
+	var o OptionalsZero
+	o.Sw = "something"
+	o.SloNonNil = make([]string, 0)
+	o.Mr = map[string]any{}
+	o.Mo = map[string]any{}
+
+	o.Foo = -0
+	o.Foo2 = [2]float64{+0, -0}
+
+	o.TimeLocal = time.Time{}.Local()
+
+	o.NonNilIsZeroer = time.Time{}
+	o.NoPanicStruct0 = (*NoPanicStruct)(nil)
+	o.NoPanicStruct1 = &NoPanicStruct{}
+	o.NoPanicStruct3 = &NoPanicStruct{}
+
+	unstr, err := DefaultUnstructuredConverter.ToUnstructured(&o)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := encodingjson.MarshalIndent(unstr, "", " ")
+	if err != nil {
+		t.Fatalf("MarshalIndent error: %v", err)
+	}
+	if got := string(got); got != want {
+		t.Errorf("MarshalIndent:\n\tgot:  %s\n\twant: %s\n", got, want)
+	}
+}
+
+func TestOmitZeroMap(t *testing.T) {
+	const want = `{
+ "foo": {
+  "br": false,
+  "fr": 0,
+  "mr": null,
+  "nps4": {},
+  "nzs": {},
+  "omitzero": 0,
+  "slr": null,
+  "sr": "",
+  "str": {},
+  "ur": 0
+ }
+}`
+
+	m := map[string]OptionalsZero{"foo": {}}
+
+	unstr, err := DefaultUnstructuredConverter.ToUnstructured(&m)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := encodingjson.MarshalIndent(unstr, "", " ")
+	if err != nil {
+		t.Fatalf("MarshalIndent error: %v", err)
+	}
+	if got := string(got); got != want {
+		fmt.Println(got)
+		t.Errorf("MarshalIndent:\n\tgot:  %s\n\twant: %s\n", got, want)
+	}
+}
+
+type OptionalsEmptyZero struct {
+	Sr string `json:"sr"`
+	So string `json:"so,omitempty,omitzero"`
+	Sw string `json:"-"`
+
+	Io int `json:"io,omitempty,omitzero"`
+
+	Slr       []string `json:"slr,random"` //nolint:staticcheck // SA5008
+	Slo       []string `json:"slo,omitempty,omitzero"`
+	SloNonNil []string `json:"slononnil,omitempty,omitzero"`
+
+	Mr map[string]any `json:"mr"`
+	Mo map[string]any `json:",omitempty,omitzero"`
+
+	Fr float64 `json:"fr"`
+	Fo float64 `json:"fo,omitempty,omitzero"`
+
+	Br bool `json:"br"`
+	Bo bool `json:"bo,omitempty,omitzero"`
+
+	Ur uint `json:"ur"`
+	Uo uint `json:"uo,omitempty,omitzero"`
+
+	Str struct{} `json:"str"`
+	Sto struct{} `json:"sto,omitempty,omitzero"`
+
+	Time time.Time     `json:"time,omitempty,omitzero"`
+	Nzs  NonZeroStruct `json:"nzs,omitempty,omitzero"`
+}
+
+func TestOmitEmptyZero(t *testing.T) {
+	const want = `{
+ "br": false,
+ "fr": 0,
+ "mr": {},
+ "nzs": {},
+ "slr": null,
+ "sr": "",
+ "str": {},
+ "ur": 0
+}`
+	var o OptionalsEmptyZero
+	o.Sw = "something"
+	o.SloNonNil = make([]string, 0)
+	o.Mr = map[string]any{}
+	o.Mo = map[string]any{}
+
+	unstr, err := DefaultUnstructuredConverter.ToUnstructured(&o)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := encodingjson.MarshalIndent(unstr, "", " ")
+	if err != nil {
+		t.Fatalf("MarshalIndent error: %v", err)
+	}
+	if got := string(got); got != want {
+		t.Errorf("MarshalIndent:\n\tgot:  %s\n\twant: %s\n", got, want)
+	}
+}

pkg/runtime/interfaces.go

@@ -259,6 +259,7 @@ type ObjectDefaulter interface {
 
 type ObjectVersioner interface {
 	ConvertToVersion(in Object, gv GroupVersioner) (out Object, err error)
+	PrioritizedVersionsForGroup(group string) []schema.GroupVersion
 }
 
 // ObjectConvertor converts an object to a different version.
@@ -384,3 +385,9 @@ type Unstructured interface {
 	// If the items passed to fn are not retained, or are retained for the same duration, use EachListItem instead for memory efficiency.
 	EachListItemWithAlloc(func(Object) error) error
 }
+
+// ApplyConfiguration is an interface that root apply configuration types implement.
+type ApplyConfiguration interface {
+	// IsApplyConfiguration is implemented if the object is the root of an apply configuration.
+	IsApplyConfiguration()
+}

pkg/runtime/scheme.go

@@ -17,15 +17,18 @@ limitations under the License.
 package runtime
 
 import (
+	"context"
 	"fmt"
 	"reflect"
 	"strings"
 
+	"k8s.io/apimachinery/pkg/api/operation"
 	"k8s.io/apimachinery/pkg/conversion"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/naming"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
 // Scheme defines methods for serializing and deserializing API objects, a type
@@ -68,6 +71,12 @@ type Scheme struct {
 	// the provided object must be a pointer.
 	defaulterFuncs map[reflect.Type]func(interface{})
 
+	// validationFuncs is a map to funcs to be called with an object to perform validation.
+	// The provided object must be a pointer.
+	// If oldObject is non-nil, update validation is performed and may perform additional
+	// validation such as transition rules and immutability checks.
+	validationFuncs map[reflect.Type]func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList
+
 	// converter stores all registered conversion functions. It also has
 	// default converting behavior.
 	converter *conversion.Converter
@@ -96,6 +105,7 @@ func NewScheme() *Scheme {
 		unversionedKinds:          map[string]reflect.Type{},
 		fieldLabelConversionFuncs: map[schema.GroupVersionKind]FieldLabelConversionFunc{},
 		defaulterFuncs:            map[reflect.Type]func(interface{}){},
+		validationFuncs:           map[reflect.Type]func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList{},
 		versionPriority:           map[string][]string{},
 		schemeName:                naming.GetNameFromCallsite(internalPackages...),
 	}
@@ -347,6 +357,35 @@ func (s *Scheme) Default(src Object) {
 	}
 }
 
+// AddValidationFunc registered a function that can validate the object, and
+// oldObject. These functions will be invoked when Validate() or ValidateUpdate()
+// is called. The function will never be called unless the validated object
+// matches srcType. If this function is invoked twice with the same srcType, the
+// fn passed to the later call will be used instead.
+func (s *Scheme) AddValidationFunc(srcType Object, fn func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList) {
+	s.validationFuncs[reflect.TypeOf(srcType)] = fn
+}
+
+// Validate validates the provided Object according to the generated declarative validation code.
+// WARNING: This does not validate all objects!  The handwritten validation code in validation.go
+// is not run when this is called.  Only the generated zz_generated.validations.go validation code is run.
+func (s *Scheme) Validate(ctx context.Context, options []string, object Object, subresources ...string) field.ErrorList {
+	if fn, ok := s.validationFuncs[reflect.TypeOf(object)]; ok {
+		return fn(ctx, operation.Operation{Type: operation.Create, Request: operation.Request{Subresources: subresources}, Options: options}, object, nil)
+	}
+	return nil
+}
+
+// ValidateUpdate validates the provided object and oldObject according to the generated declarative validation code.
+// WARNING: This does not validate all objects!  The handwritten validation code in validation.go
+// is not run when this is called.  Only the generated zz_generated.validations.go validation code is run.
+func (s *Scheme) ValidateUpdate(ctx context.Context, options []string, object, oldObject Object, subresources ...string) field.ErrorList {
+	if fn, ok := s.validationFuncs[reflect.TypeOf(object)]; ok {
+		return fn(ctx, operation.Operation{Type: operation.Update, Request: operation.Request{Subresources: subresources}, Options: options}, object, oldObject)
+	}
+	return nil
+}
+
 // Convert will attempt to convert in into out. Both must be pointers. For easy
 // testing of conversion functions. Returns an error if the conversion isn't
 // possible. You can call this with types that haven't been registered (for example,
@@ -704,3 +743,67 @@ func (s *Scheme) Name() string {
 // internalPackages are packages that ignored when creating a default reflector name. These packages are in the common
 // call chains to NewReflector, so they'd be low entropy names for reflectors
 var internalPackages = []string{"k8s.io/apimachinery/pkg/runtime/scheme.go"}
+
+// ToOpenAPIDefinitionName returns the REST-friendly OpenAPI definition name known type identified by groupVersionKind.
+// If the groupVersionKind does not identify a known type, an error is returned.
+// The Version field of groupVersionKind is required, and the Group and Kind fields are required for unstructured.Unstructured
+// types. If a required field is empty, an error is returned.
+//
+// The OpenAPI definition name is the canonical name of the type, with the group and version removed.
+// For example, the OpenAPI definition name of Pod is `io.k8s.api.core.v1.Pod`.
+//
+// A known type that is registered as an unstructured.Unstructured type is treated as a custom resource and
+// which has an OpenAPI definition name of the form `<reversed-group>.<version.<kind>`.
+// For example, the OpenAPI definition name of `group: stable.example.com, version: v1, kind: Pod` is
+// `com.example.stable.v1.Pod`.
+func (s *Scheme) ToOpenAPIDefinitionName(groupVersionKind schema.GroupVersionKind) (string, error) {
+	if groupVersionKind.Version == "" { // Empty version is not allowed by New() so check it first to avoid a panic.
+		return "", fmt.Errorf("version is required on all types: %v", groupVersionKind)
+	}
+	example, err := s.New(groupVersionKind)
+	if err != nil {
+		return "", err
+	}
+	if _, ok := example.(Unstructured); ok {
+		if groupVersionKind.Group == "" || groupVersionKind.Kind == "" {
+			return "", fmt.Errorf("unable to convert GroupVersionKind with empty fields to unstructured type to an OpenAPI definition name: %v", groupVersionKind)
+		}
+		return reverseParts(groupVersionKind.Group) + "." + groupVersionKind.Version + "." + groupVersionKind.Kind, nil
+	}
+	rtype := reflect.TypeOf(example).Elem()
+	name := toOpenAPIDefinitionName(rtype.PkgPath() + "." + rtype.Name())
+	return name, nil
+}
+
+// toOpenAPIDefinitionName converts Golang package/type canonical name into REST friendly OpenAPI name.
+// Input is expected to be `PkgPath + "." TypeName.
+//
+// Examples of REST friendly OpenAPI name:
+//
+//	Input:  k8s.io/api/core/v1.Pod
+//	Output: io.k8s.api.core.v1.Pod
+//
+//	Input:  k8s.io/api/core/v1
+//	Output: io.k8s.api.core.v1
+//
+//	Input:  csi.storage.k8s.io/v1alpha1.CSINodeInfo
+//	Output: io.k8s.storage.csi.v1alpha1.CSINodeInfo
+//
+// Note that this is a copy of ToRESTFriendlyName from k8s.io/kube-openapi/pkg/util. It is duplicated here to avoid
+// a dependency on kube-openapi.
+func toOpenAPIDefinitionName(name string) string {
+	nameParts := strings.Split(name, "/")
+	// Reverse first part. e.g., io.k8s... instead of k8s.io...
+	if len(nameParts) > 0 && strings.Contains(nameParts[0], ".") {
+		nameParts[0] = reverseParts(nameParts[0])
+	}
+	return strings.Join(nameParts, ".")
+}
+
+func reverseParts(dotSeparatedName string) string {
+	parts := strings.Split(dotSeparatedName, ".")
+	for i, j := 0, len(parts)-1; i < j; i, j = i+1, j-1 {
+		parts[i], parts[j] = parts[j], parts[i]
+	}
+	return strings.Join(parts, ".")
+}

pkg/runtime/scheme_test.go

@@ -17,12 +17,17 @@ limitations under the License.
 package runtime_test
 
 import (
+	"context"
 	"fmt"
 	"reflect"
+	"slices"
 	"strings"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+
+	"k8s.io/apimachinery/pkg/api/operation"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/conversion"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -30,6 +35,7 @@ import (
 	runtimetesting "k8s.io/apimachinery/pkg/runtime/testing"
 	"k8s.io/apimachinery/pkg/util/diff"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
 type testConversions struct {
@@ -1009,3 +1015,165 @@ func TestMetaValuesUnregisteredConvert(t *testing.T) {
 		t.Errorf("Expected %v, got %v", e, a)
 	}
 }
+
+func TestRegisterValidate(t *testing.T) {
+	invalidValue := field.Invalid(field.NewPath("testString"), "", "Invalid value").WithOrigin("invalid-value")
+	invalidLength := field.Invalid(field.NewPath("testString"), "", "Invalid length").WithOrigin("invalid-length")
+	invalidStatusErr := field.Invalid(field.NewPath("testString"), "", "Invalid condition").WithOrigin("invalid-condition")
+	invalidIfOptionErr := field.Invalid(field.NewPath("testString"), "", "Invalid when option is set").WithOrigin("invalid-when-option-set")
+
+	testCases := []struct {
+		name        string
+		object      runtime.Object
+		oldObject   runtime.Object
+		subresource []string
+		options     []string
+		expected    field.ErrorList
+	}{
+		{
+			name:     "single error",
+			object:   &TestType1{},
+			expected: field.ErrorList{invalidValue},
+		},
+		{
+			name:     "multiple errors",
+			object:   &TestType2{},
+			expected: field.ErrorList{invalidValue, invalidLength},
+		},
+		{
+			name:      "update error",
+			object:    &TestType2{},
+			oldObject: &TestType2{},
+			expected:  field.ErrorList{invalidLength},
+		},
+		{
+			name:     "options error",
+			object:   &TestType1{},
+			options:  []string{"option1"},
+			expected: field.ErrorList{invalidIfOptionErr},
+		},
+		{
+			name:        "subresource error",
+			object:      &TestType1{},
+			subresource: []string{"status"},
+			expected:    field.ErrorList{invalidStatusErr},
+		},
+	}
+
+	s := runtime.NewScheme()
+	ctx := context.Background()
+
+	// register multiple types for testing to ensure registration is working as expected
+	s.AddValidationFunc(&TestType1{}, func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList {
+		if op.HasOption("option1") {
+			return field.ErrorList{invalidIfOptionErr}
+		}
+		if slices.Equal(op.Request.Subresources, []string{"status"}) {
+			return field.ErrorList{invalidStatusErr}
+		}
+		return field.ErrorList{invalidValue}
+	})
+
+	s.AddValidationFunc(&TestType2{}, func(ctx context.Context, op operation.Operation, object, oldObject interface{}) field.ErrorList {
+		if oldObject != nil {
+			return field.ErrorList{invalidLength}
+		}
+		return field.ErrorList{invalidValue, invalidLength}
+	})
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var results field.ErrorList
+			if tc.oldObject == nil {
+				results = s.Validate(ctx, tc.options, tc.object, tc.subresource...)
+			} else {
+				results = s.ValidateUpdate(ctx, tc.options, tc.object, tc.oldObject, tc.subresource...)
+			}
+			matcher := field.ErrorMatcher{}.ByType().ByField().ByOrigin()
+			matcher.Test(t, tc.expected, results)
+		})
+	}
+}
+
+type TestType1 struct {
+	Version    string `json:"apiVersion,omitempty"`
+	Kind       string `json:"kind,omitempty"`
+	TestString string `json:"testString"`
+}
+
+func (TestType1) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+func (TestType1) DeepCopyObject() runtime.Object { return nil }
+
+type TestType2 struct {
+	Version    string `json:"apiVersion,omitempty"`
+	Kind       string `json:"kind,omitempty"`
+	TestString string `json:"testString"`
+}
+
+func (TestType2) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind }
+
+func (TestType2) DeepCopyObject() runtime.Object { return nil }
+
+func TestToOpenAPIDefinitionName(t *testing.T) {
+	testCases := []struct {
+		name        string
+		registerGvk *schema.GroupVersionKind // defaults to gvk unless set
+		registerObj runtime.Object
+		gvk         schema.GroupVersionKind
+		out         string
+		wantErr     error
+	}{
+		{
+			name:        "unstructured type",
+			registerObj: &unstructured.Unstructured{},
+			gvk:         schema.GroupVersionKind{Group: "stable.example.com", Version: "v1", Kind: "CronTab"},
+			out:         "com.example.stable.v1.CronTab",
+		},
+		{
+			name:        "unregistered type: empty group",
+			registerObj: &unstructured.Unstructured{},
+			gvk:         schema.GroupVersionKind{Version: "v1", Kind: "CronTab"},
+			wantErr:     fmt.Errorf("unable to convert GroupVersionKind with empty fields to unstructured type to an OpenAPI definition name: %v", schema.GroupVersionKind{Version: "v1", Kind: "CronTab"}),
+		},
+		{
+			name:        "unregistered type: empty version",
+			registerObj: &unstructured.Unstructured{},
+			registerGvk: &schema.GroupVersionKind{Group: "stable.example.com", Version: "v1", Kind: "CronTab"},
+			gvk:         schema.GroupVersionKind{Group: "stable.example.com", Kind: "CronTab"},
+			wantErr:     fmt.Errorf("version is required on all types: %v", schema.GroupVersionKind{Group: "stable.example.com", Kind: "CronTab"}),
+		},
+		{
+			name:        "unregistered type: empty kind",
+			registerObj: &unstructured.Unstructured{},
+			gvk:         schema.GroupVersionKind{Group: "stable.example.com", Version: "v1"},
+			wantErr:     fmt.Errorf("unable to convert GroupVersionKind with empty fields to unstructured type to an OpenAPI definition name: %v", schema.GroupVersionKind{Group: "stable.example.com", Version: "v1"}),
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.name, func(t *testing.T) {
+			if test.registerGvk == nil {
+				test.registerGvk = &test.gvk
+			}
+
+			scheme := runtime.NewScheme()
+			scheme.AddKnownTypeWithName(*test.registerGvk, test.registerObj)
+			utilruntime.Must(runtimetesting.RegisterConversions(scheme))
+
+			out, err := scheme.ToOpenAPIDefinitionName(test.gvk)
+			if test.wantErr != nil {
+				if err == nil || err.Error() != test.wantErr.Error() {
+					t.Errorf("expected error: %v but got %v", test.wantErr, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if out != test.out {
+				t.Errorf("expected %s, got %s", test.out, out)
+			}
+		})
+	}
+}

pkg/runtime/serializer/cbor/cbor.go

@@ -152,10 +152,6 @@ func (s *serializer) encode(mode modes.EncMode, obj runtime.Object, w io.Writer)
 		v = u.UnstructuredContent()
 	}
 
-	if err := modes.RejectCustomMarshalers(v); err != nil {
-		return err
-	}
-
 	if _, err := w.Write(selfDescribedCBOR); err != nil {
 		return err
 	}
@@ -270,8 +266,6 @@ func (s *serializer) unmarshal(data []byte, into interface{}) (strict, lax error
 			}
 		}()
 		into = &content
-	} else if err := modes.RejectCustomMarshalers(into); err != nil {
-		return nil, err
 	}
 
 	if !s.options.strict {

pkg/runtime/serializer/cbor/cbor_test.go

@@ -209,38 +209,38 @@ func TestEncode(t *testing.T) {
 			},
 		},
 		{
-			name: "unsupported marshaler",
+			name: "text marshaler",
 			in:   &textMarshalerObject{},
 			assertOnWriter: func() (io.Writer, func(*testing.T)) {
 				var b bytes.Buffer
 				return &b, func(t *testing.T) {
-					if b.Len() != 0 {
-						t.Errorf("expected no bytes to be written, got %d", b.Len())
+					if diff := cmp.Diff(b.Bytes(), []byte{0xd9, 0xd9, 0xf7, 0x64, 't', 'e', 's', 't'}); diff != "" {
+						t.Errorf("unexpected diff:\n%s", diff)
 					}
 				}
 			},
 			assertOnError: func(t *testing.T, err error) {
-				if want := "unable to serialize *cbor.textMarshalerObject: *cbor.textMarshalerObject implements encoding.TextMarshaler without corresponding cbor interface"; err == nil || err.Error() != want {
-					t.Errorf("expected error %q, got: %v", want, err)
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
 				}
 			},
 		},
 		{
-			name: "unsupported marshaler within unstructured content",
+			name: "text marshaler within unstructured content",
 			in: &unstructured.Unstructured{
 				Object: map[string]interface{}{"": textMarshalerObject{}},
 			},
 			assertOnWriter: func() (io.Writer, func(*testing.T)) {
 				var b bytes.Buffer
 				return &b, func(t *testing.T) {
-					if b.Len() != 0 {
-						t.Errorf("expected no bytes to be written, got %d", b.Len())
+					if diff := cmp.Diff(b.Bytes(), []byte{0xd9, 0xd9, 0xf7, 0xa1, 0x40, 0x64, 't', 'e', 's', 't'}); diff != "" {
+						t.Errorf("unexpected diff:\n%s", diff)
 					}
 				}
 			},
 			assertOnError: func(t *testing.T, err error) {
-				if want := "unable to serialize map[string]interface {}: cbor.textMarshalerObject implements encoding.TextMarshaler without corresponding cbor interface"; err == nil || err.Error() != want {
-					t.Errorf("expected error %q, got: %v", want, err)
+				if err != nil {
+					t.Errorf("expected nil error, got: %v", err)
 				}
 			},
 		},
@@ -689,19 +689,6 @@ func TestDecode(t *testing.T) {
 				}
 			},
 		},
-		{
-			name:        "into unsupported marshaler",
-			data:        []byte("\xa0"),
-			into:        &textMarshalerObject{},
-			metaFactory: stubMetaFactory{gvk: &schema.GroupVersionKind{}},
-			typer:       stubTyper{gvks: []schema.GroupVersionKind{{Version: "v", Kind: "k"}}},
-			expectedGVK: &schema.GroupVersionKind{Version: "v", Kind: "k"},
-			assertOnError: func(t *testing.T, err error) {
-				if want := "unable to serialize *cbor.textMarshalerObject: *cbor.textMarshalerObject implements encoding.TextMarshaler without corresponding cbor interface"; err == nil || err.Error() != want {
-					t.Errorf("expected error %q, got: %v", want, err)
-				}
-			},
-		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			s := newSerializer(tc.metaFactory, tc.creater, tc.typer, tc.options...)
@@ -731,7 +718,7 @@ func (textMarshalerObject) DeepCopyObject() runtime.Object {
 }
 
 func (textMarshalerObject) MarshalText() ([]byte, error) {
-	return nil, nil
+	return []byte("test"), nil
 }
 
 func TestMetaFactoryInterpret(t *testing.T) {

pkg/runtime/serializer/cbor/direct/direct.go

@@ -25,31 +25,13 @@ import (
 
 // Marshal serializes a value to CBOR. If there is more than one way to encode the value, it will
 // make the same choice as the CBOR implementation of runtime.Serializer.
-//
-// Note: Support for CBOR is at an alpha stage. If the value (or, for composite types, any of its
-// nested values) implement any of the interfaces encoding.TextMarshaler, encoding.TextUnmarshaler,
-// encoding/json.Marshaler, or encoding/json.Unmarshaler, a non-nil error will be returned unless
-// the value also implements the corresponding CBOR interfaces. This limitation will ultimately be
-// removed in favor of automatic transcoding to CBOR.
-func Marshal(src interface{}) ([]byte, error) {
-	if err := modes.RejectCustomMarshalers(src); err != nil {
-		return nil, err
-	}
+func Marshal(src any) ([]byte, error) {
 	return modes.Encode.Marshal(src)
 }
 
 // Unmarshal deserializes from CBOR into an addressable value. If there is more than one way to
 // unmarshal a value, it will make the same choice as the CBOR implementation of runtime.Serializer.
-//
-// Note: Support for CBOR is at an alpha stage. If the value (or, for composite types, any of its
-// nested values) implement any of the interfaces encoding.TextMarshaler, encoding.TextUnmarshaler,
-// encoding/json.Marshaler, or encoding/json.Unmarshaler, a non-nil error will be returned unless
-// the value also implements the corresponding CBOR interfaces. This limitation will ultimately be
-// removed in favor of automatic transcoding to CBOR.
-func Unmarshal(src []byte, dst interface{}) error {
-	if err := modes.RejectCustomMarshalers(dst); err != nil {
-		return err
-	}
+func Unmarshal(src []byte, dst any) error {
 	return modes.Decode.Unmarshal(src, dst)
 }
 

pkg/runtime/serializer/cbor/direct/direct_test.go

@@ -1,81 +0,0 @@
-/*
-Copyright 2024 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package direct_test
-
-import (
-	"encoding"
-	"encoding/json"
-	"fmt"
-	"reflect"
-	"testing"
-
-	"k8s.io/apimachinery/pkg/runtime/serializer/cbor/direct"
-)
-
-var _ json.Marshaler = CustomJSONMarshaler{}
-
-type CustomJSONMarshaler struct{}
-
-func (CustomJSONMarshaler) MarshalJSON() ([]byte, error) {
-	panic("unimplemented")
-}
-
-var _ json.Unmarshaler = CustomJSONUnmarshaler{}
-
-type CustomJSONUnmarshaler struct{}
-
-func (CustomJSONUnmarshaler) UnmarshalJSON([]byte) error {
-	panic("unimplemented")
-}
-
-var _ encoding.TextMarshaler = CustomTextMarshaler{}
-
-type CustomTextMarshaler struct{}
-
-func (CustomTextMarshaler) MarshalText() ([]byte, error) {
-	panic("unimplemented")
-}
-
-var _ encoding.TextUnmarshaler = CustomTextUnmarshaler{}
-
-type CustomTextUnmarshaler struct{}
-
-func (CustomTextUnmarshaler) UnmarshalText([]byte) error {
-	panic("unimplemented")
-}
-
-func TestRejectsCustom(t *testing.T) {
-	for _, tc := range []struct {
-		value interface{}
-		iface reflect.Type
-	}{
-		{value: CustomJSONMarshaler{}, iface: reflect.TypeFor[json.Marshaler]()},
-		{value: CustomJSONUnmarshaler{}, iface: reflect.TypeFor[json.Unmarshaler]()},
-		{value: CustomTextMarshaler{}, iface: reflect.TypeFor[encoding.TextMarshaler]()},
-		{value: CustomTextUnmarshaler{}, iface: reflect.TypeFor[encoding.TextUnmarshaler]()},
-	} {
-		t.Run(fmt.Sprintf("%T", tc.value), func(t *testing.T) {
-			want := fmt.Sprintf("unable to serialize %T: %T implements %s without corresponding cbor interface", tc.value, tc.value, tc.iface.String())
-			if _, err := direct.Marshal(tc.value); err == nil || err.Error() != want {
-				t.Errorf("want error: %q, got: %v", want, err)
-			}
-			if err := direct.Unmarshal(nil, tc.value); err == nil || err.Error() != want {
-				t.Errorf("want error: %q, got: %v", want, err)
-			}
-		})
-	}
-}

pkg/runtime/serializer/cbor/internal/modes/custom.go

@@ -1,422 +0,0 @@
-/*
-Copyright 2024 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package modes
-
-import (
-	"encoding"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"reflect"
-	"sync"
-
-	"github.com/fxamacker/cbor/v2"
-)
-
-// Returns a non-nil error if and only if the argument's type (or one of its component types, for
-// composite types) implements json.Marshaler or encoding.TextMarshaler without also implementing
-// cbor.Marshaler and likewise for the respective Unmarshaler interfaces.
-//
-// This is a temporary, graduation-blocking restriction and will be removed in favor of automatic
-// transcoding between CBOR and JSON/text for these types. This restriction allows CBOR to be
-// exercised for in-tree and unstructured types while mitigating the risk of mangling out-of-tree
-// types in client programs.
-func RejectCustomMarshalers(v interface{}) error {
-	if v == nil {
-		return nil
-	}
-	rv := reflect.ValueOf(v)
-	if err := marshalerCache.getChecker(rv.Type()).check(rv, maxDepth); err != nil {
-		return fmt.Errorf("unable to serialize %T: %w", v, err)
-	}
-	if err := unmarshalerCache.getChecker(rv.Type()).check(rv, maxDepth); err != nil {
-		return fmt.Errorf("unable to serialize %T: %w", v, err)
-	}
-	return nil
-}
-
-// Recursion depth is limited as a basic mitigation against cyclic objects. Objects created by the
-// decoder shouldn't be able to contain cycles, but practically any object can be passed to the
-// encoder.
-var errMaxDepthExceeded = errors.New("object depth exceeds limit (possible cycle?)")
-
-// The JSON encoder begins detecting cycles after depth 1000. Use a generous limit here, knowing
-// that it can might deeply nested acyclic objects. The limit will be removed along with the rest of
-// this mechanism.
-const maxDepth = 2048
-
-var marshalerCache = checkers{
-	cborInterface: reflect.TypeFor[cbor.Marshaler](),
-	nonCBORInterfaces: []reflect.Type{
-		reflect.TypeFor[json.Marshaler](),
-		reflect.TypeFor[encoding.TextMarshaler](),
-	},
-}
-
-var unmarshalerCache = checkers{
-	cborInterface: reflect.TypeFor[cbor.Unmarshaler](),
-	nonCBORInterfaces: []reflect.Type{
-		reflect.TypeFor[json.Unmarshaler](),
-		reflect.TypeFor[encoding.TextUnmarshaler](),
-	},
-	assumeAddressableValues: true,
-}
-
-// checker wraps a function for dynamically checking a value of a specific type for custom JSON
-// behaviors not matched by a custom CBOR behavior.
-type checker struct {
-	// check returns a non-nil error if the given value might be marshalled to or from CBOR
-	// using the default behavior for its kind, but marshalled to or from JSON using custom
-	// behavior.
-	check func(rv reflect.Value, depth int) error
-
-	// safe returns true if all values of this type are safe from mismatched custom marshalers.
-	safe func() bool
-}
-
-// TODO: stale
-// Having a single addressable checker for comparisons lets us prune and collapse parts of the
-// object traversal that are statically known to be safe. Depending on the type, it may be
-// unnecessary to inspect each value of that type. For example, no value of the built-in type bool
-// can implement json.Marshaler (a named type whose underlying type is bool could, but it is a
-// distinct type from bool).
-var noop = checker{
-	safe: func() bool {
-		return true
-	},
-	check: func(rv reflect.Value, depth int) error {
-		return nil
-	},
-}
-
-type checkers struct {
-	m sync.Map // reflect.Type => *checker
-
-	cborInterface     reflect.Type
-	nonCBORInterfaces []reflect.Type
-
-	assumeAddressableValues bool
-}
-
-func (cache *checkers) getChecker(rt reflect.Type) checker {
-	if ptr, ok := cache.m.Load(rt); ok {
-		return *ptr.(*checker)
-	}
-
-	return cache.getCheckerInternal(rt, nil)
-}
-
-// linked list node representing the path from a composite type to an element type
-type path struct {
-	Type   reflect.Type
-	Parent *path
-}
-
-func (p path) cyclic(rt reflect.Type) bool {
-	for ancestor := &p; ancestor != nil; ancestor = ancestor.Parent {
-		if ancestor.Type == rt {
-			return true
-		}
-	}
-	return false
-}
-
-func (cache *checkers) getCheckerInternal(rt reflect.Type, parent *path) (c checker) {
-	// Store a placeholder cache entry first to handle cyclic types.
-	var wg sync.WaitGroup
-	wg.Add(1)
-	defer wg.Done()
-	placeholder := checker{
-		safe: func() bool {
-			wg.Wait()
-			return c.safe()
-		},
-		check: func(rv reflect.Value, depth int) error {
-			wg.Wait()
-			return c.check(rv, depth)
-		},
-	}
-	if actual, loaded := cache.m.LoadOrStore(rt, &placeholder); loaded {
-		// Someone else stored an entry for this type, use it.
-		return *actual.(*checker)
-	}
-
-	// Take a nonreflective path for the unstructured container types. They're common and
-	// usually nested inside one another.
-	switch rt {
-	case reflect.TypeFor[map[string]interface{}](), reflect.TypeFor[[]interface{}]():
-		return checker{
-			safe: func() bool {
-				return false
-			},
-			check: func(rv reflect.Value, depth int) error {
-				return checkUnstructuredValue(cache, rv.Interface(), depth)
-			},
-		}
-	}
-
-	// It's possible that one of the relevant interfaces is implemented on a type with a pointer
-	// receiver, but that a particular value of that type is not addressable. For example:
-	//
-	//   func (Foo) MarshalText() ([]byte, error) { ... }
-	//   func (*Foo) MarshalCBOR() ([]byte, error) { ... }
-	//
-	// Both methods are in the method set of *Foo, but the method set of Foo contains only
-	// MarshalText.
-	//
-	// Both the unmarshaler and marshaler checks assume that methods implementing a JSON or text
-	// interface with a pointer receiver are always accessible. Only the unmarshaler check
-	// assumes that CBOR methods with pointer receivers are accessible.
-
-	if rt.Implements(cache.cborInterface) {
-		return noop
-	}
-	for _, unsafe := range cache.nonCBORInterfaces {
-		if rt.Implements(unsafe) {
-			err := fmt.Errorf("%v implements %v without corresponding cbor interface", rt, unsafe)
-			return checker{
-				safe: func() bool {
-					return false
-				},
-				check: func(reflect.Value, int) error {
-					return err
-				},
-			}
-		}
-	}
-
-	if cache.assumeAddressableValues && reflect.PointerTo(rt).Implements(cache.cborInterface) {
-		return noop
-	}
-	for _, unsafe := range cache.nonCBORInterfaces {
-		if reflect.PointerTo(rt).Implements(unsafe) {
-			err := fmt.Errorf("%v implements %v without corresponding cbor interface", reflect.PointerTo(rt), unsafe)
-			return checker{
-				safe: func() bool {
-					return false
-				},
-				check: func(reflect.Value, int) error {
-					return err
-				},
-			}
-		}
-	}
-
-	self := &path{Type: rt, Parent: parent}
-
-	switch rt.Kind() {
-	case reflect.Array:
-		ce := cache.getCheckerInternal(rt.Elem(), self)
-		rtlen := rt.Len()
-		if rtlen == 0 || (!self.cyclic(rt.Elem()) && ce.safe()) {
-			return noop
-		}
-		return checker{
-			safe: func() bool {
-				return false
-			},
-			check: func(rv reflect.Value, depth int) error {
-				if depth <= 0 {
-					return errMaxDepthExceeded
-				}
-				for i := 0; i < rtlen; i++ {
-					if err := ce.check(rv.Index(i), depth-1); err != nil {
-						return err
-					}
-				}
-				return nil
-			},
-		}
-
-	case reflect.Interface:
-		// All interface values have to be checked because their dynamic type might
-		// implement one of the interesting interfaces or be composed of another type that
-		// does.
-		return checker{
-			safe: func() bool {
-				return false
-			},
-			check: func(rv reflect.Value, depth int) error {
-				if rv.IsNil() {
-					return nil
-				}
-				// Unpacking interfaces must count against recursion depth,
-				// consider this cycle:
-				// >  var i interface{}
-				// >  var p *interface{} = &i
-				// >  i = p
-				// >  rv := reflect.ValueOf(i)
-				// >  for {
-				// >    rv = rv.Elem()
-				// >  }
-				if depth <= 0 {
-					return errMaxDepthExceeded
-				}
-				rv = rv.Elem()
-				return cache.getChecker(rv.Type()).check(rv, depth-1)
-			},
-		}
-
-	case reflect.Map:
-		rtk := rt.Key()
-		ck := cache.getCheckerInternal(rtk, self)
-		rte := rt.Elem()
-		ce := cache.getCheckerInternal(rte, self)
-		if !self.cyclic(rtk) && !self.cyclic(rte) && ck.safe() && ce.safe() {
-			return noop
-		}
-		return checker{
-			safe: func() bool {
-				return false
-			},
-			check: func(rv reflect.Value, depth int) error {
-				if depth <= 0 {
-					return errMaxDepthExceeded
-				}
-				iter := rv.MapRange()
-				rvk := reflect.New(rtk).Elem()
-				rve := reflect.New(rte).Elem()
-				for iter.Next() {
-					rvk.SetIterKey(iter)
-					if err := ck.check(rvk, depth-1); err != nil {
-						return err
-					}
-					rve.SetIterValue(iter)
-					if err := ce.check(rve, depth-1); err != nil {
-						return err
-					}
-				}
-				return nil
-			},
-		}
-
-	case reflect.Pointer:
-		ce := cache.getCheckerInternal(rt.Elem(), self)
-		if !self.cyclic(rt.Elem()) && ce.safe() {
-			return noop
-		}
-		return checker{
-			safe: func() bool {
-				return false
-			},
-			check: func(rv reflect.Value, depth int) error {
-				if rv.IsNil() {
-					return nil
-				}
-				if depth <= 0 {
-					return errMaxDepthExceeded
-				}
-				return ce.check(rv.Elem(), depth-1)
-			},
-		}
-
-	case reflect.Slice:
-		ce := cache.getCheckerInternal(rt.Elem(), self)
-		if !self.cyclic(rt.Elem()) && ce.safe() {
-			return noop
-		}
-		return checker{
-			safe: func() bool {
-				return false
-			},
-			check: func(rv reflect.Value, depth int) error {
-				if depth <= 0 {
-					return errMaxDepthExceeded
-				}
-				for i := 0; i < rv.Len(); i++ {
-					if err := ce.check(rv.Index(i), depth-1); err != nil {
-						return err
-					}
-				}
-				return nil
-			},
-		}
-
-	case reflect.Struct:
-		type field struct {
-			Index   int
-			Checker checker
-		}
-		var fields []field
-		for i := 0; i < rt.NumField(); i++ {
-			f := rt.Field(i)
-			cf := cache.getCheckerInternal(f.Type, self)
-			if !self.cyclic(f.Type) && cf.safe() {
-				continue
-			}
-			fields = append(fields, field{Index: i, Checker: cf})
-		}
-		if len(fields) == 0 {
-			return noop
-		}
-		return checker{
-			safe: func() bool {
-				return false
-			},
-			check: func(rv reflect.Value, depth int) error {
-				if depth <= 0 {
-					return errMaxDepthExceeded
-				}
-				for _, fi := range fields {
-					if err := fi.Checker.check(rv.Field(fi.Index), depth-1); err != nil {
-						return err
-					}
-				}
-				return nil
-			},
-		}
-
-	default:
-		// Not a serializable composite type (funcs and channels are composite types but are
-		// rejected by JSON and CBOR serialization).
-		return noop
-
-	}
-}
-
-func checkUnstructuredValue(cache *checkers, v interface{}, depth int) error {
-	switch v := v.(type) {
-	case nil, bool, int64, float64, string:
-		return nil
-	case []interface{}:
-		if depth <= 0 {
-			return errMaxDepthExceeded
-		}
-		for _, element := range v {
-			if err := checkUnstructuredValue(cache, element, depth-1); err != nil {
-				return err
-			}
-		}
-		return nil
-	case map[string]interface{}:
-		if depth <= 0 {
-			return errMaxDepthExceeded
-		}
-		for _, element := range v {
-			if err := checkUnstructuredValue(cache, element, depth-1); err != nil {
-				return err
-			}
-		}
-		return nil
-	default:
-		// Unmarshaling an unstructured doesn't use other dynamic types, but nothing
-		// prevents inserting values with arbitrary dynamic types into unstructured content,
-		// as long as they can be marshalled.
-		rv := reflect.ValueOf(v)
-		return cache.getChecker(rv.Type()).check(rv, depth)
-	}
-}

pkg/runtime/serializer/cbor/internal/modes/custom_test.go

@@ -1,198 +0,0 @@
-/*
-Copyright 2024 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package modes
-
-import (
-	"encoding"
-	"encoding/json"
-	"reflect"
-	"sync"
-	"testing"
-
-	"github.com/fxamacker/cbor/v2"
-)
-
-type TextUnmarshalerPointer struct{}
-
-func (*TextUnmarshalerPointer) UnmarshalText([]byte) error { return nil }
-
-type Struct[F any] struct {
-	Field F
-}
-
-type StructCBORMarshalerValue[F any] struct {
-	Field F
-}
-
-func (StructCBORMarshalerValue[F]) MarshalCBOR() ([]byte, error) { return nil, nil }
-
-type StructCBORMarshalerPointer[F any] struct {
-	Field F
-}
-
-func (*StructCBORMarshalerPointer[F]) MarshalCBOR() ([]byte, error) { return nil, nil }
-
-type StructCBORUnmarshalerPointer[F any] struct {
-	Field F
-}
-
-func (*StructCBORUnmarshalerPointer[F]) UnmarshalCBOR([]byte) error { return nil }
-
-type StructCBORUnmarshalerValueWithEmbeddedJSONMarshaler struct {
-	json.Marshaler
-}
-
-func (StructCBORUnmarshalerValueWithEmbeddedJSONMarshaler) MarshalCBOR() ([]byte, error) {
-	return nil, nil
-}
-
-type SafeCyclicTypeA struct {
-	Bs []SafeCyclicTypeB
-}
-
-type SafeCyclicTypeB struct {
-	As []SafeCyclicTypeA
-}
-
-type UnsafeCyclicTypeA struct {
-	Bs []UnsafeCyclicTypeB
-}
-
-type UnsafeCyclicTypeB struct {
-	As []UnsafeCyclicTypeA
-
-	json.Marshaler
-}
-
-func TestCheckUnsupportedMarshalers(t *testing.T) {
-	t.Run("accepted", func(t *testing.T) {
-		for _, v := range []interface{}{
-			// Unstructured types.
-			nil,
-			false,
-			0,
-			0.0,
-			"",
-			[]interface{}{nil, false, 0, 0.0, "", []interface{}{}, map[string]interface{}{}},
-			map[string]interface{}{
-				"nil":                      nil,
-				"false":                    false,
-				"0":                        0,
-				"0.0":                      0.0,
-				`""`:                       "",
-				"[]interface{}{}":          []interface{}{},
-				"map[string]interface{}{}": map[string]interface{}{},
-			},
-			// Zero-length array is statically OK, even though its element type is
-			// json.Marshaler.
-			[0]json.Marshaler{},
-			[3]bool{},
-			// Has to be dynamically checked.
-			[1]interface{}{},
-			map[int]interface{}{0: nil},
-			Struct[string]{},
-			StructCBORMarshalerValue[json.Marshaler]{},
-			&StructCBORMarshalerValue[json.Marshaler]{},
-			&StructCBORMarshalerPointer[json.Marshaler]{},
-			new(string),
-			map[cbor.Marshaler]cbor.Marshaler{},
-			make([]string, 10),
-			[]Struct[interface{}]{{Field: true}},
-			&Struct[StructCBORUnmarshalerPointer[json.Unmarshaler]]{},
-			// Checked dynamically because the dynamic type of an interface, even
-			// encoding.TextMarshaler or json.Marshaler, might also implement
-			// cbor.Marshaler. Accepted because there are no map entries.
-			map[encoding.TextMarshaler]struct{}{},
-			map[string]json.Marshaler{},
-			// Methods of json.Marshaler and cbor.Marshaler are both promoted to the
-			// struct's method set.
-			struct {
-				json.Marshaler
-				StructCBORMarshalerValue[int]
-			}{},
-
-			// Embedded field's json.Marshaler implementation is promoted, but the
-			// containing struct implements cbor.Marshaler.
-			StructCBORUnmarshalerValueWithEmbeddedJSONMarshaler{},
-
-			SafeCyclicTypeA{},
-			SafeCyclicTypeB{},
-		} {
-			if err := RejectCustomMarshalers(v); err != nil {
-				t.Errorf("%#v: unexpected non-nil error: %v", v, err)
-			}
-		}
-	})
-
-	t.Run("rejected", func(t *testing.T) {
-		for _, v := range []interface{}{
-			Struct[json.Marshaler]{},
-			StructCBORMarshalerValue[json.Unmarshaler]{},
-			Struct[interface{}]{Field: [1]json.Unmarshaler{}},
-			// cbor.Marshaler implemented with pointer receiver on non-pointer type.
-			StructCBORMarshalerPointer[json.Marshaler]{},
-			[1]json.Marshaler{},
-			[1]interface{}{[1]json.Marshaler{}},
-			map[int]interface{}{0: [1]json.Marshaler{}},
-			[]interface{}{[1]json.Marshaler{}},
-			map[string]interface{}{"": [1]json.Marshaler{}},
-			[]Struct[interface{}]{{Field: [1]json.Marshaler{}}},
-			map[encoding.TextMarshaler]struct{}{[1]encoding.TextMarshaler{}[0]: {}},
-			map[string]json.Marshaler{"": [1]json.Marshaler{}[0]},
-			&Struct[StructCBORMarshalerPointer[json.Marshaler]]{},
-			Struct[TextUnmarshalerPointer]{},
-			struct {
-				json.Marshaler
-			}{},
-			UnsafeCyclicTypeA{Bs: []UnsafeCyclicTypeB{{}}},
-			UnsafeCyclicTypeB{},
-		} {
-			if err := RejectCustomMarshalers(v); err == nil {
-				t.Errorf("%#v: unexpected nil error", v)
-			}
-		}
-	})
-}
-
-// With -test.race, retrieves a custom marshaler checker for a cyclic type concurrently from many
-// goroutines to root out data races in checker lazy initialization.
-func TestLazyCheckerInitializationDataRace(t *testing.T) {
-	cache := checkers{
-		cborInterface: reflect.TypeFor[cbor.Marshaler](),
-		nonCBORInterfaces: []reflect.Type{
-			reflect.TypeFor[json.Marshaler](),
-			reflect.TypeFor[encoding.TextMarshaler](),
-		},
-	}
-
-	rt := reflect.TypeFor[SafeCyclicTypeA]()
-
-	begin := make(chan struct{})
-
-	var wg sync.WaitGroup
-	for range 32 {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			<-begin
-			cache.getChecker(rt)
-		}()
-	}
-
-	close(begin)
-	wg.Wait()
-}

pkg/runtime/serializer/cbor/internal/modes/decode.go

@@ -44,7 +44,10 @@ var simpleValues *cbor.SimpleValueRegistry = func() *cbor.SimpleValueRegistry {
 	return simpleValues
 }()
 
-var Decode cbor.DecMode = func() cbor.DecMode {
+// decode is the basis for the Decode mode, with no JSONUnmarshalerTranscoder
+// configured. TranscodeToJSON uses this directly rather than Decode to avoid an initialization
+// cycle between the two. Everything else should use one of the exported DecModes.
+var decode cbor.DecMode = func() cbor.DecMode {
 	decode, err := cbor.DecOptions{
 		// Maps with duplicate keys are well-formed but invalid according to the CBOR spec
 		// and never acceptable. Unlike the JSON serializer, inputs containing duplicate map
@@ -139,6 +142,10 @@ var Decode cbor.DecMode = func() cbor.DecMode {
 		// Disable default recognition of types implementing encoding.BinaryUnmarshaler,
 		// which is not recognized for JSON decoding.
 		BinaryUnmarshaler: cbor.BinaryUnmarshalerNone,
+
+		// Marshal types that implement encoding.TextMarshaler by calling their MarshalText
+		// method and encoding the result to a CBOR text string.
+		TextUnmarshaler: cbor.TextUnmarshalerTextString,
 	}.DecMode()
 	if err != nil {
 		panic(err)
@@ -146,6 +153,19 @@ var Decode cbor.DecMode = func() cbor.DecMode {
 	return decode
 }()
 
+var Decode cbor.DecMode = func() cbor.DecMode {
+	opts := decode.DecOptions()
+	// When decoding into a value of a type that implements json.Unmarshaler (and does not
+	// implement cbor.Unmarshaler), transcode the input to JSON and pass it to the value's
+	// UnmarshalJSON method.
+	opts.JSONUnmarshalerTranscoder = TranscodeFunc(TranscodeToJSON)
+	dm, err := opts.DecMode()
+	if err != nil {
+		panic(err)
+	}
+	return dm
+}()
+
 // DecodeLax is derived from Decode, but does not complain about unknown fields in the input.
 var DecodeLax cbor.DecMode = func() cbor.DecMode {
 	opts := Decode.DecOptions()

pkg/runtime/serializer/cbor/internal/modes/decode_test.go

@@ -211,6 +211,20 @@ func TestDecode(t *testing.T) {
 				}
 			}),
 		},
+		{
+			name:          "text unmarshaler",
+			in:            hex("4161"),
+			into:          &RoundtrippableText{},
+			want:          &RoundtrippableText{Text: "a"},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "json unmarshaler",
+			in:            hex("4161"),
+			into:          &RoundtrippableJSON{},
+			want:          &RoundtrippableJSON{Raw: `"a"`},
+			assertOnError: assertNilError,
+		},
 	})
 
 	group(t, "text string", []test{
@@ -236,6 +250,20 @@ func TestDecode(t *testing.T) {
 			want:          "",
 			assertOnError: assertNilError,
 		},
+		{
+			name:          "text unmarshaler",
+			in:            hex("6161"),
+			into:          &RoundtrippableText{},
+			want:          &RoundtrippableText{Text: "a"},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "json unmarshaler",
+			in:            hex("6161"),
+			into:          &RoundtrippableJSON{},
+			want:          &RoundtrippableJSON{Raw: `"a"`},
+			assertOnError: assertNilError,
+		},
 	})
 
 	group(t, "array", []test{

pkg/runtime/serializer/cbor/internal/modes/encode.go

@@ -22,7 +22,10 @@ import (
 	"github.com/fxamacker/cbor/v2"
 )
 
-var Encode = EncMode{
+// encode is the basis for the Encode mode, with no JSONMarshalerTranscoder
+// configured. TranscodeFromJSON uses this directly rather than Encode to avoid an initialization
+// cycle between the two. Everything else should use one of the exported EncModes.
+var encode = EncMode{
 	delegate: func() cbor.UserBufferEncMode {
 		encode, err := cbor.EncOptions{
 			// Map keys need to be sorted to have deterministic output, and this is the order
@@ -94,6 +97,10 @@ var Encode = EncMode{
 			// Disable default recognition of types implementing encoding.BinaryMarshaler, which
 			// is not recognized for JSON encoding.
 			BinaryMarshaler: cbor.BinaryMarshalerNone,
+
+			// Unmarshal into types that implement encoding.TextUnmarshaler by passing
+			// the contents of a CBOR string to their UnmarshalText method.
+			TextMarshaler: cbor.TextMarshalerTextString,
 		}.UserBufferEncMode()
 		if err != nil {
 			panic(err)
@@ -102,6 +109,21 @@ var Encode = EncMode{
 	}(),
 }
 
+var Encode = EncMode{
+	delegate: func() cbor.UserBufferEncMode {
+		opts := encode.options()
+		// To encode a value of a type that implements json.Marshaler (and does not
+		// implement cbor.Marshaler), transcode the result of calling its MarshalJSON method
+		// directly to CBOR.
+		opts.JSONMarshalerTranscoder = TranscodeFunc(TranscodeFromJSON)
+		em, err := opts.UserBufferEncMode()
+		if err != nil {
+			panic(err)
+		}
+		return em
+	}(),
+}
+
 var EncodeNondeterministic = EncMode{
 	delegate: func() cbor.UserBufferEncMode {
 		opts := Encode.options()

pkg/runtime/serializer/cbor/internal/modes/encode_test.go

@@ -96,6 +96,18 @@ func TestEncode(t *testing.T) {
 			want:          []byte{0xd6, 0x45, 'h', 'e', 'l', 'l', 'o'},
 			assertOnError: assertNilError,
 		},
+		{
+			name:          "text marshaler",
+			in:            &RoundtrippableText{Text: "a"},
+			want:          []byte{0x61, 0x61},
+			assertOnError: assertNilError,
+		},
+		{
+			name:          "json marshaler",
+			in:            &RoundtrippableJSON{Raw: `"a"`},
+			want:          []byte{0x41, 0x61},
+			assertOnError: assertNilError,
+		},
 	} {
 		encModes := tc.modes
 		if len(encModes) == 0 {

pkg/runtime/serializer/cbor/internal/modes/roundtrip_test.go

@@ -34,6 +34,28 @@ func nilPointerFor[T interface{}]() *T {
 	return nil
 }
 
+type RoundtrippableText struct{ Text string }
+
+func (rt RoundtrippableText) MarshalText() ([]byte, error) {
+	return []byte(rt.Text), nil
+}
+
+func (rt *RoundtrippableText) UnmarshalText(text []byte) error {
+	rt.Text = string(text)
+	return nil
+}
+
+type RoundtrippableJSON struct{ Raw string }
+
+func (rj RoundtrippableJSON) MarshalJSON() ([]byte, error) {
+	return []byte(rj.Raw), nil
+}
+
+func (rj *RoundtrippableJSON) UnmarshalJSON(raw []byte) error {
+	rj.Raw = string(raw)
+	return nil
+}
+
 // TestRoundtrip roundtrips object serialization to interface{} and back via CBOR.
 func TestRoundtrip(t *testing.T) {
 	type modePair struct {
@@ -264,6 +286,14 @@ func TestRoundtrip(t *testing.T) {
 				V *map[string]interface{} `json:"v,omitempty"`
 			}{},
 		},
+		{
+			name: "textmarshaler and textunmarshaler",
+			obj:  RoundtrippableText{Text: "foo"},
+		},
+		{
+			name: "json marshaler and unmarshaler",
+			obj:  RoundtrippableJSON{Raw: `{"foo":[42,3.1,true,false,null]}`},
+		},
 	} {
 		modePairs := tc.modePairs
 		if len(modePairs) == 0 {

pkg/runtime/serializer/cbor/internal/modes/transcoding.go

@@ -0,0 +1,108 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+
+	kjson "sigs.k8s.io/json"
+)
+
+type TranscodeFunc func(dst io.Writer, src io.Reader) error
+
+func (f TranscodeFunc) Transcode(dst io.Writer, src io.Reader) error {
+	return f(dst, src)
+}
+
+func TranscodeFromJSON(dst io.Writer, src io.Reader) error {
+	var tmp any
+	dec := kjson.NewDecoderCaseSensitivePreserveInts(src)
+	if err := dec.Decode(&tmp); err != nil {
+		return err
+	}
+	if err := dec.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return errors.New("extraneous data")
+	}
+
+	return encode.MarshalTo(tmp, dst)
+}
+
+func TranscodeToJSON(dst io.Writer, src io.Reader) error {
+	var tmp any
+	dec := decode.NewDecoder(src)
+	if err := dec.Decode(&tmp); err != nil {
+		return err
+	}
+	if err := dec.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return errors.New("extraneous data")
+	}
+
+	// Use an Encoder to avoid the extra []byte allocated by Marshal. Encode, unlike Marshal,
+	// appends a trailing newline to separate consecutive encodings of JSON values that aren't
+	// self-delimiting, like numbers. Strip the newline to avoid the assumption that every
+	// json.Unmarshaler implementation will accept trailing whitespace.
+	enc := json.NewEncoder(&trailingLinefeedSuppressor{delegate: dst})
+	enc.SetIndent("", "")
+	return enc.Encode(tmp)
+}
+
+// trailingLinefeedSuppressor is an io.Writer that wraps another io.Writer, suppressing a single
+// trailing linefeed if it is the last byte written by the latest call to Write.
+type trailingLinefeedSuppressor struct {
+	lf       bool
+	delegate io.Writer
+}
+
+func (w *trailingLinefeedSuppressor) Write(p []byte) (int, error) {
+	if len(p) == 0 {
+		// Avoid flushing a buffered linefeeds on an empty write.
+		return 0, nil
+	}
+
+	if w.lf {
+		// The previous write had a trailing linefeed that was buffered. That wasn't the
+		// last Write call, so flush the buffered linefeed before continuing.
+		n, err := w.delegate.Write([]byte{'\n'})
+		if n > 0 {
+			w.lf = false
+		}
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	if p[len(p)-1] != '\n' {
+		return w.delegate.Write(p)
+	}
+
+	p = p[:len(p)-1]
+
+	if len(p) == 0 { // []byte{'\n'}
+		w.lf = true
+		return 1, nil
+	}
+
+	n, err := w.delegate.Write(p)
+	if n == len(p) {
+		// Everything up to the trailing linefeed has been flushed. Eat the linefeed.
+		w.lf = true
+		n++
+	}
+	return n, err
+}

pkg/runtime/serializer/cbor/internal/modes/transcoding_test.go

@@ -0,0 +1,291 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modes
+
+import (
+	"errors"
+	"strings"
+	"testing"
+)
+
+func TestTranscodeFromJSON(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		json string
+		cbor string
+		err  error
+	}{
+		{
+			name: "whole number",
+			json: "42",
+			cbor: "\x18\x2a",
+		},
+		{
+			name: "decimal number",
+			json: "1.5",
+			cbor: "\xf9\x3e\x00",
+		},
+		{
+			name: "false",
+			json: "false",
+			cbor: "\xf4",
+		},
+		{
+			name: "true",
+			json: "true",
+			cbor: "\xf5",
+		},
+		{
+			name: "null",
+			json: "null",
+			cbor: "\xf6",
+		},
+		{
+			name: "string",
+			json: `"foo"`,
+			cbor: "\x43foo",
+		},
+		{
+			name: "array",
+			json: `[]`,
+			cbor: "\x80",
+		},
+		{
+			name: "object",
+			json: `{"foo":"bar"}`,
+			cbor: "\xa1\x43foo\x43bar",
+		},
+		{
+			name: "extraneous data",
+			json: "{}{}",
+			err:  errors.New("extraneous data"),
+		},
+		{
+			name: "eof",
+			json: "",
+			err:  errors.New("EOF"),
+		},
+		{
+			name: "unexpected eof",
+			json: "{",
+			err:  errors.New("unexpected EOF"),
+		},
+		{
+			name: "malformed json",
+			json: "}",
+			err:  errors.New("invalid character '}' looking for beginning of value"),
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var out strings.Builder
+			err := TranscodeFromJSON(&out, strings.NewReader(tc.json))
+			if (err == nil) != (tc.err == nil) || tc.err != nil && tc.err.Error() != err.Error() {
+				t.Fatalf("unexpected error: want %v got %v", tc.err, err)
+			}
+			if got, want := out.String(), tc.cbor; got != want {
+				t.Errorf("unexpected transcoding: want 0x%x got 0x%x", want, got)
+			}
+		})
+	}
+}
+
+func TestTranscodeToJSON(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		cbor string
+		json string
+		err  error
+	}{
+		{
+			name: "whole number",
+			cbor: "\x18\x2a",
+			json: "42",
+		},
+		{
+			name: "decimal number",
+			cbor: "\xf9\x3e\x00",
+			json: "1.5",
+		},
+		{
+			name: "false",
+			cbor: "\xf4",
+			json: "false",
+		},
+		{
+			name: "true",
+			cbor: "\xf5",
+			json: "true",
+		},
+		{
+			name: "null",
+			cbor: "\xf6",
+			json: "null",
+		},
+		{
+			name: "string",
+			cbor: "\x43foo",
+			json: `"foo"`,
+		},
+		{
+			name: "array",
+			cbor: "\x80",
+			json: `[]`,
+		},
+		{
+			name: "object",
+			cbor: "\xa1\x43foo\x43bar",
+			json: `{"foo":"bar"}`,
+		},
+		{
+			name: "extraneous data",
+			cbor: "\xa0\xa0",
+			err:  errors.New("extraneous data"),
+		},
+		{
+			name: "unexpected eof",
+			cbor: "\xa1",
+			err:  errors.New("unexpected EOF"),
+		},
+		{
+			name: "malformed cbor",
+			cbor: "\xff",
+			err:  errors.New(`cbor: unexpected "break" code`),
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var out strings.Builder
+			err := TranscodeToJSON(&out, strings.NewReader(tc.cbor))
+			if (err == nil) != (tc.err == nil) || tc.err != nil && tc.err.Error() != err.Error() {
+				t.Fatalf("unexpected error: want %v got %v", tc.err, err)
+			}
+			if got, want := out.String(), tc.json; got != want {
+				t.Errorf("unexpected transcoding: want %q got %q", want, got)
+			}
+		})
+	}
+}
+
+type write struct {
+	p   string
+	n   int
+	err error
+}
+
+type mockWriter struct {
+	t     testing.TB
+	calls []write
+}
+
+func (m *mockWriter) Write(p []byte) (int, error) {
+	if len(m.calls) == 0 {
+		m.t.Fatalf("unexpected call (p=%q)", string(p))
+	}
+	if got, want := string(p), m.calls[0].p; got != want {
+		m.t.Errorf("unexpected argument: want %q, got %q", want, got)
+	}
+	n, err := m.calls[0].n, m.calls[0].err
+	m.calls = m.calls[1:]
+	return n, err
+}
+
+func TestTrailingLinefeedSuppressor(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		calls     []write
+		delegated []write
+	}{
+		{
+			name:      "one write without newline",
+			calls:     []write{{"foo", 3, nil}},
+			delegated: []write{{"foo", 3, nil}},
+		},
+		{
+			name:      "one write with newline",
+			calls:     []write{{"foo\n", 4, nil}},
+			delegated: []write{{"foo", 3, nil}},
+		},
+		{
+			name:      "one write with only newline",
+			calls:     []write{{"\n", 1, nil}},
+			delegated: nil,
+		},
+		{
+			name:      "one empty write",
+			calls:     []write{{"", 0, nil}},
+			delegated: nil,
+		},
+		{
+			name:      "three writes, all with only newline",
+			calls:     []write{{"\n", 1, nil}, {"\n", 1, nil}, {"\n", 1, nil}},
+			delegated: []write{{"\n", 1, nil}, {"\n", 1, nil}},
+		},
+		{
+			name:      "buffered linefeed not flushed on empty write",
+			calls:     []write{{"\n", 1, nil}, {"", 0, nil}},
+			delegated: nil,
+		},
+
+		{
+			name:      "two writes, last with trailing newline",
+			calls:     []write{{"foo", 3, nil}, {"bar\n", 4, nil}},
+			delegated: []write{{"foo", 3, nil}, {"bar", 3, nil}},
+		},
+		{
+			name:      "two writes, first with trailing newline",
+			calls:     []write{{"foo\n", 4, nil}, {"bar", 3, nil}},
+			delegated: []write{{"foo", 3, nil}, {"\n", 1, nil}, {"bar", 3, nil}},
+		},
+		{
+			name:      "two writes, both with trailing newlines",
+			calls:     []write{{"foo\n", 4, nil}, {"bar\n", 4, nil}},
+			delegated: []write{{"foo", 3, nil}, {"\n", 1, nil}, {"bar", 3, nil}},
+		},
+		{
+			name:      "two writes, neither with newlines",
+			calls:     []write{{"foo", 3, nil}, {"bar", 3, nil}},
+			delegated: []write{{"foo", 3, nil}, {"bar", 3, nil}},
+		},
+		{
+			name:      "delegate error before reaching newline",
+			calls:     []write{{"foo\n", 1, errors.New("test")}, {"oo\n", 3, nil}},
+			delegated: []write{{"foo", 1, errors.New("test")}, {"oo", 2, nil}},
+		},
+		{
+			name:      "delegate error after reaching newline",
+			calls:     []write{{"foo\n", 4, errors.New("test")}},
+			delegated: []write{{"foo", 3, errors.New("test")}},
+		},
+		{
+			name:      "delegate error flushing newline",
+			calls:     []write{{"foo\n", 4, nil}, {"\n", 0, errors.New("test")}, {"\n", 1, nil}},
+			delegated: []write{{"foo", 3, nil}, {"\n", 0, errors.New("test")}, {"\n", 1, nil}},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			w := &trailingLinefeedSuppressor{delegate: &mockWriter{t: t, calls: tc.delegated}}
+			for _, call := range tc.calls {
+				n, err := w.Write([]byte(call.p))
+				if n != call.n {
+					t.Errorf("unexpected n: want %d got %d", call.n, n)
+				}
+				if (err == nil) != (call.err == nil) || call.err != nil && call.err.Error() != err.Error() {
+					t.Errorf("unexpected error: want %v got %v", call.err, err)
+				}
+			}
+		})
+	}
+}

pkg/runtime/serializer/codec_factory.go

@@ -28,7 +28,7 @@ import (
 func newSerializersForScheme(scheme *runtime.Scheme, mf json.MetaFactory, options CodecFactoryOptions) []runtime.SerializerInfo {
 	jsonSerializer := json.NewSerializerWithOptions(
 		mf, scheme, scheme,
-		json.SerializerOptions{Yaml: false, Pretty: false, Strict: options.Strict},
+		json.SerializerOptions{Yaml: false, Pretty: false, Strict: options.Strict, StreamingCollectionsEncoding: options.StreamingCollectionsEncodingToJSON},
 	)
 	jsonSerializerType := runtime.SerializerInfo{
 		MediaType:        runtime.ContentTypeJSON,
@@ -38,7 +38,7 @@ func newSerializersForScheme(scheme *runtime.Scheme, mf json.MetaFactory, option
 		Serializer:       jsonSerializer,
 		StrictSerializer: json.NewSerializerWithOptions(
 			mf, scheme, scheme,
-			json.SerializerOptions{Yaml: false, Pretty: false, Strict: true},
+			json.SerializerOptions{Yaml: false, Pretty: false, Strict: true, StreamingCollectionsEncoding: options.StreamingCollectionsEncodingToJSON},
 		),
 		StreamSerializer: &runtime.StreamSerializerInfo{
 			EncodesAsText: true,
@@ -61,7 +61,9 @@ func newSerializersForScheme(scheme *runtime.Scheme, mf json.MetaFactory, option
 		mf, scheme, scheme,
 		json.SerializerOptions{Yaml: true, Pretty: false, Strict: true},
 	)
-	protoSerializer := protobuf.NewSerializer(scheme, scheme)
+	protoSerializer := protobuf.NewSerializerWithOptions(scheme, scheme, protobuf.SerializerOptions{
+		StreamingCollectionsEncoding: options.StreamingCollectionsEncodingToProtobuf,
+	})
 	protoRawSerializer := protobuf.NewRawSerializer(scheme, scheme)
 
 	serializers := []runtime.SerializerInfo{
@@ -113,6 +115,9 @@ type CodecFactoryOptions struct {
 	// Pretty includes a pretty serializer along with the non-pretty one
 	Pretty bool
 
+	StreamingCollectionsEncodingToJSON     bool
+	StreamingCollectionsEncodingToProtobuf bool
+
 	serializers []func(runtime.ObjectCreater, runtime.ObjectTyper) runtime.SerializerInfo
 }
 
@@ -147,6 +152,18 @@ func WithSerializer(f func(runtime.ObjectCreater, runtime.ObjectTyper) runtime.S
 	}
 }
 
+func WithStreamingCollectionEncodingToJSON() CodecFactoryOptionsMutator {
+	return func(options *CodecFactoryOptions) {
+		options.StreamingCollectionsEncodingToJSON = true
+	}
+}
+
+func WithStreamingCollectionEncodingToProtobuf() CodecFactoryOptionsMutator {
+	return func(options *CodecFactoryOptions) {
+		options.StreamingCollectionsEncodingToProtobuf = true
+	}
+}
+
 // NewCodecFactory provides methods for retrieving serializers for the supported wire formats
 // and conversion wrappers to define preferred internal and external versions. In the future,
 // as the internal version is used less, callers may instead use a defaulting serializer and

pkg/runtime/serializer/codec_test.go

@@ -34,8 +34,8 @@ import (
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 
 	"github.com/google/go-cmp/cmp"
-	fuzz "github.com/google/gofuzz"
 	flag "github.com/spf13/pflag"
+	"sigs.k8s.io/randfill"
 	"sigs.k8s.io/yaml"
 )
 
@@ -61,9 +61,9 @@ func (testMetaFactory) Interpret(data []byte) (*schema.GroupVersionKind, error)
 }
 
 // TestObjectFuzzer can randomly populate all the above objects.
-var TestObjectFuzzer = fuzz.New().NilChance(.5).NumElements(1, 100).Funcs(
-	func(j *runtimetesting.MyWeirdCustomEmbeddedVersionKindField, c fuzz.Continue) {
-		c.FuzzNoCustom(j)
+var TestObjectFuzzer = randfill.New().NilChance(.5).NumElements(1, 100).Funcs(
+	func(j *runtimetesting.MyWeirdCustomEmbeddedVersionKindField, c randfill.Continue) {
+		c.FillNoCustom(j)
 		j.APIVersion = ""
 		j.ObjectKind = ""
 	},
@@ -106,7 +106,7 @@ var semantic = conversion.EqualitiesOrDie(
 
 func runTest(t *testing.T, source interface{}) {
 	name := reflect.TypeOf(source).Elem().Name()
-	TestObjectFuzzer.Fuzz(source)
+	TestObjectFuzzer.Fill(source)
 
 	_, codec := GetTestScheme()
 	data, err := runtime.Encode(codec, source.(runtime.Object))

pkg/runtime/serializer/json/collections.go

@@ -0,0 +1,230 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"maps"
+	"slices"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/conversion"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func streamEncodeCollections(obj runtime.Object, w io.Writer) (bool, error) {
+	list, ok := obj.(*unstructured.UnstructuredList)
+	if ok {
+		return true, streamingEncodeUnstructuredList(w, list)
+	}
+	if _, ok := obj.(json.Marshaler); ok {
+		return false, nil
+	}
+	typeMeta, listMeta, items, err := getListMeta(obj)
+	if err == nil {
+		return true, streamingEncodeList(w, typeMeta, listMeta, items)
+	}
+	return false, nil
+}
+
+// getListMeta implements list extraction logic for json stream serialization.
+//
+// Reason for a custom logic instead of reusing accessors from meta package:
+// * Validate json tags to prevent incompatibility with json standard package.
+// * ListMetaAccessor doesn't distinguish empty from nil value.
+// * TypeAccessort reparsing "apiVersion" and serializing it with "{group}/{version}"
+func getListMeta(list runtime.Object) (metav1.TypeMeta, metav1.ListMeta, []runtime.Object, error) {
+	listValue, err := conversion.EnforcePtr(list)
+	if err != nil {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err
+	}
+	listType := listValue.Type()
+	if listType.NumField() != 3 {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListType to have 3 fields")
+	}
+	// TypeMeta
+	typeMeta, ok := listValue.Field(0).Interface().(metav1.TypeMeta)
+	if !ok {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected TypeMeta field to have TypeMeta type")
+	}
+	if listType.Field(0).Tag.Get("json") != ",inline" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be ",inline"`)
+	}
+	// ListMeta
+	listMeta, ok := listValue.Field(1).Interface().(metav1.ListMeta)
+	if !ok {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListMeta field to have ListMeta type")
+	}
+	if listType.Field(1).Tag.Get("json") != "metadata,omitempty" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected ListMeta json field tag to be "metadata,omitempty"`)
+	}
+	// Items
+	items, err := meta.ExtractList(list)
+	if err != nil {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err
+	}
+	if listType.Field(2).Tag.Get("json") != "items" {
+		return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected Items json field tag to be "items"`)
+	}
+	return typeMeta, listMeta, items, nil
+}
+
+func streamingEncodeList(w io.Writer, typeMeta metav1.TypeMeta, listMeta metav1.ListMeta, items []runtime.Object) error {
+	// Start
+	if _, err := w.Write([]byte(`{`)); err != nil {
+		return err
+	}
+
+	// TypeMeta
+	if typeMeta.Kind != "" {
+		if err := encodeKeyValuePair(w, "kind", typeMeta.Kind, []byte(",")); err != nil {
+			return err
+		}
+	}
+	if typeMeta.APIVersion != "" {
+		if err := encodeKeyValuePair(w, "apiVersion", typeMeta.APIVersion, []byte(",")); err != nil {
+			return err
+		}
+	}
+
+	// ListMeta
+	if err := encodeKeyValuePair(w, "metadata", listMeta, []byte(",")); err != nil {
+		return err
+	}
+
+	// Items
+	if err := encodeItemsObjectSlice(w, items); err != nil {
+		return err
+	}
+
+	// End
+	_, err := w.Write([]byte("}\n"))
+	return err
+}
+
+func encodeItemsObjectSlice(w io.Writer, items []runtime.Object) (err error) {
+	if items == nil {
+		err := encodeKeyValuePair(w, "items", nil, nil)
+		return err
+	}
+	_, err = w.Write([]byte(`"items":[`))
+	if err != nil {
+		return err
+	}
+	suffix := []byte(",")
+	for i, item := range items {
+		if i == len(items)-1 {
+			suffix = nil
+		}
+		err := encodeValue(w, item, suffix)
+		if err != nil {
+			return err
+		}
+	}
+	_, err = w.Write([]byte("]"))
+	if err != nil {
+		return err
+	}
+	return err
+}
+
+func streamingEncodeUnstructuredList(w io.Writer, list *unstructured.UnstructuredList) error {
+	_, err := w.Write([]byte(`{`))
+	if err != nil {
+		return err
+	}
+	keys := slices.Collect(maps.Keys(list.Object))
+	if _, exists := list.Object["items"]; !exists {
+		keys = append(keys, "items")
+	}
+	sort.Strings(keys)
+
+	suffix := []byte(",")
+	for i, key := range keys {
+		if i == len(keys)-1 {
+			suffix = nil
+		}
+		if key == "items" {
+			err = encodeItemsUnstructuredSlice(w, list.Items, suffix)
+		} else {
+			err = encodeKeyValuePair(w, key, list.Object[key], suffix)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	_, err = w.Write([]byte("}\n"))
+	return err
+}
+
+func encodeItemsUnstructuredSlice(w io.Writer, items []unstructured.Unstructured, suffix []byte) (err error) {
+	_, err = w.Write([]byte(`"items":[`))
+	if err != nil {
+		return err
+	}
+	comma := []byte(",")
+	for i, item := range items {
+		if i == len(items)-1 {
+			comma = nil
+		}
+		err := encodeValue(w, item.Object, comma)
+		if err != nil {
+			return err
+		}
+	}
+	_, err = w.Write([]byte("]"))
+	if err != nil {
+		return err
+	}
+	if len(suffix) > 0 {
+		_, err = w.Write(suffix)
+	}
+	return err
+}
+
+func encodeKeyValuePair(w io.Writer, key string, value any, suffix []byte) (err error) {
+	err = encodeValue(w, key, []byte(":"))
+	if err != nil {
+		return err
+	}
+	err = encodeValue(w, value, suffix)
+	if err != nil {
+		return err
+	}
+	return err
+}
+
+func encodeValue(w io.Writer, value any, suffix []byte) error {
+	data, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	_, err = w.Write(data)
+	if err != nil {
+		return err
+	}
+	if len(suffix) > 0 {
+		_, err = w.Write(suffix)
+	}
+	return err
+}

pkg/runtime/serializer/json/collections_test.go

@@ -0,0 +1,795 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package json
+
+import (
+	"bytes"
+	"fmt"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+
+	"sigs.k8s.io/randfill"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestCollectionsEncoding(t *testing.T) {
+	t.Run("Normal", func(t *testing.T) {
+		testCollectionsEncoding(t, NewSerializerWithOptions(DefaultMetaFactory, nil, nil, SerializerOptions{}), false)
+	})
+	t.Run("Streaming", func(t *testing.T) {
+		testCollectionsEncoding(t, NewSerializerWithOptions(DefaultMetaFactory, nil, nil, SerializerOptions{StreamingCollectionsEncoding: true}), true)
+	})
+}
+
+// testCollectionsEncoding should provide comprehensive tests to validate streaming implementation of encoder.
+func testCollectionsEncoding(t *testing.T, s *Serializer, streamingEnabled bool) {
+	var buf writeCountingBuffer
+	var remainingItems int64 = 1
+	// As defined in KEP-5116 we it should include the following scenarios:
+	// Context: https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/5116-streaming-response-encoding#unit-tests
+	for _, tc := range []struct {
+		name         string
+		in           runtime.Object
+		cannotStream bool
+		expect       string
+	}{
+		// Preserving the distinction between integers and floating-point numbers
+		{
+			name: "Struct with floats",
+			in: &StructWithFloatsList{
+				Items: []StructWithFloats{
+					{
+						Int:     1,
+						Float32: float32(1),
+						Float64: 1.1,
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"Int\":1,\"Float32\":1,\"Float64\":1.1}]}\n",
+		},
+		{
+			name: "Unstructured object float",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"int":     1,
+					"float32": float32(1),
+					"float64": 1.1,
+				},
+			},
+			expect: "{\"float32\":1,\"float64\":1.1,\"int\":1,\"items\":[]}\n",
+		},
+		{
+			name: "Unstructured items float",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"int":     1,
+							"float32": float32(1),
+							"float64": 1.1,
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"float32\":1,\"float64\":1.1,\"int\":1}]}\n",
+		},
+		// Handling structs with duplicate field names (JSON tag names) without producing duplicate keys in the encoded output
+		{
+			name: "StructWithDuplicatedTags",
+			in: &StructWithDuplicatedTagsList{
+				Items: []StructWithDuplicatedTags{
+					{
+						Key1: "key1",
+						Key2: "key2",
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{}}]}\n",
+		},
+		// Encoding Go strings containing invalid UTF-8 sequences without error
+		{
+			name: "UnstructuredList object invalid UTF-8 ",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"key": "\x80", // first byte is a continuation byte
+				},
+			},
+			expect: "{\"items\":[],\"key\":\"\\ufffd\"}\n",
+		},
+		{
+			name: "UnstructuredList items invalid UTF-8 ",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"key": "\x80", // first byte is a continuation byte
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"key\":\"\\ufffd\"}]}\n",
+		},
+		// Preserving the distinction between absent, present-but-null, and present-and-empty states for slices and maps
+		{
+			name: "CarpList items nil",
+			in: &testapigroupv1.CarpList{
+				Items: nil,
+			},
+			expect: "{\"metadata\":{},\"items\":null}\n",
+		},
+		{
+			name: "CarpList slice nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: nil,
+						},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "CarpList map nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: nil,
+						},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "UnstructuredList items nil",
+			in: &unstructured.UnstructuredList{
+				Items: nil,
+			},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList items slice nil",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": ([]string)(nil),
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"slice\":null}]}\n",
+		},
+		{
+			name: "UnstructuredList items map nil",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"map": (map[string]string)(nil),
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"map\":null}]}\n",
+		},
+		{
+			name: "UnstructuredList object nil",
+			in: &unstructured.UnstructuredList{
+				Object: nil,
+			},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList object slice nil",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": ([]string)(nil),
+				},
+			},
+			expect: "{\"items\":[],\"slice\":null}\n",
+		},
+		{
+			name: "UnstructuredList object map nil",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"map": (map[string]string)(nil),
+				},
+			},
+			expect: "{\"items\":[],\"map\":null}\n",
+		},
+		{
+			name: "CarpList items empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{},
+			},
+			expect: "{\"metadata\":{},\"items\":[]}\n",
+		},
+		{
+			name: "CarpList slice empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: []testapigroupv1.CarpCondition{},
+						},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "CarpList map empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: map[string]string{},
+						},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "UnstructuredList items empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{},
+			},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList items slice empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": []string{},
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"slice\":[]}]}\n",
+		},
+		{
+			name: "UnstructuredList items map empty",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"map": map[string]string{},
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"map\":{}}]}\n",
+		},
+		{
+			name: "UnstructuredList object empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{},
+			},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList object slice empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": []string{},
+				},
+			},
+			expect: "{\"items\":[],\"slice\":[]}\n",
+		},
+		{
+			name: "UnstructuredList object map empty",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"map": map[string]string{},
+				},
+			},
+			expect: "{\"items\":[],\"map\":{}}\n",
+		},
+		// Handling structs implementing MarshallJSON method, especially built-in collection types.
+		{
+			name:         "List with MarshallJSON cannot be streamed",
+			in:           &ListWithMarshalJSONList{},
+			expect:       "\"marshallJSON\"\n",
+			cannotStream: true,
+		},
+		{
+			name: "Struct with MarshallJSON",
+			in: &StructWithMarshalJSONList{
+				Items: []StructWithMarshalJSON{
+					{},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[\"marshallJSON\"]}\n",
+		},
+		// Handling raw bytes.
+		{
+			name: "Struct with raw bytes",
+			in: &StructWithRawBytesList{
+				Items: []StructWithRawBytes{
+					{
+						Slice: []byte{0x01, 0x02, 0x03},
+						Array: [3]byte{0x01, 0x02, 0x03},
+					},
+				},
+			},
+			expect: "{\"metadata\":{},\"items\":[{\"metadata\":{},\"Slice\":\"AQID\",\"Array\":[1,2,3]}]}\n",
+		},
+		{
+			name: "UnstructuredList object raw bytes",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{
+					"slice": []byte{0x01, 0x02, 0x03},
+					"array": [3]byte{0x01, 0x02, 0x03},
+				},
+			},
+			expect: "{\"array\":[1,2,3],\"items\":[],\"slice\":\"AQID\"}\n",
+		},
+		{
+			name: "UnstructuredList items raw bytes",
+			in: &unstructured.UnstructuredList{
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"slice": []byte{0x01, 0x02, 0x03},
+							"array": [3]byte{0x01, 0x02, 0x03},
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"array\":[1,2,3],\"slice\":\"AQID\"}]}\n",
+		},
+		// Other scenarios:
+		{
+			name: "List just kind",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind: "List",
+				},
+			},
+			expect: "{\"kind\":\"List\",\"metadata\":{},\"items\":null}\n",
+		},
+		{
+			name: "List just apiVersion",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "v1",
+				},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"metadata\":{},\"items\":null}\n",
+		},
+		{
+			name: "List no elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+			expect: "{\"kind\":\"List\",\"apiVersion\":\"v1\",\"metadata\":{\"resourceVersion\":\"2345\"},\"items\":[]}\n",
+		},
+		{
+			name: "List one element with continue",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion:    "2345",
+					Continue:           "abc",
+					RemainingItemCount: &remainingItems,
+				},
+				Items: []testapigroupv1.Carp{
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod",
+						Namespace: "default",
+					}},
+				},
+			},
+			expect: "{\"kind\":\"List\",\"apiVersion\":\"v1\",\"metadata\":{\"resourceVersion\":\"2345\",\"continue\":\"abc\",\"remainingItemCount\":1},\"items\":[{\"kind\":\"Carp\",\"apiVersion\":\"v1\",\"metadata\":{\"name\":\"pod\",\"namespace\":\"default\"},\"spec\":{},\"status\":{}}]}\n",
+		},
+		{
+			name: "List two elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod",
+						Namespace: "default",
+					}},
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod2",
+						Namespace: "default2",
+					}},
+				},
+			},
+			expect: `{"kind":"List","apiVersion":"v1","metadata":{"resourceVersion":"2345"},"items":[{"kind":"Carp","apiVersion":"v1","metadata":{"name":"pod","namespace":"default"},"spec":{},"status":{}},{"kind":"Carp","apiVersion":"v1","metadata":{"name":"pod2","namespace":"default2"},"spec":{},"status":{}}]}
+`,
+		},
+		{
+			name: "List with extra field cannot be streamed",
+			in: &ListWithAdditionalFields{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+			cannotStream: true,
+			expect:       "{\"kind\":\"List\",\"apiVersion\":\"v1\",\"metadata\":{\"resourceVersion\":\"2345\"},\"items\":[],\"AdditionalField\":0}\n",
+		},
+		{
+			name: "Not a collection cannot be streamed",
+			in: &testapigroupv1.Carp{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+			},
+			cannotStream: true,
+			expect:       "{\"kind\":\"List\",\"apiVersion\":\"v1\",\"metadata\":{},\"spec\":{},\"status\":{}}\n",
+		},
+		{
+			name:   "UnstructuredList empty",
+			in:     &unstructured.UnstructuredList{},
+			expect: "{\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList just kind",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List"},
+			},
+			expect: "{\"items\":[],\"kind\":\"List\"}\n",
+		},
+		{
+			name: "UnstructuredList just apiVersion",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"apiVersion": "v1"},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"items\":[]}\n",
+		},
+		{
+			name: "UnstructuredList no elements",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{"resourceVersion": "2345"}},
+				Items:  []unstructured.Unstructured{},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"items\":[],\"kind\":\"List\",\"metadata\":{\"resourceVersion\":\"2345\"}}\n",
+		},
+		{
+			name: "UnstructuredList one element with continue",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{
+					"resourceVersion":    "2345",
+					"continue":           "abc",
+					"remainingItemCount": "1",
+				}},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod",
+								"namespace": "default",
+							},
+						},
+					},
+				},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"items\":[{\"apiVersion\":\"v1\",\"kind\":\"Carp\",\"metadata\":{\"name\":\"pod\",\"namespace\":\"default\"}}],\"kind\":\"List\",\"metadata\":{\"continue\":\"abc\",\"remainingItemCount\":\"1\",\"resourceVersion\":\"2345\"}}\n",
+		},
+		{
+			name: "UnstructuredList two elements",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"kind": "List", "apiVersion": "v1", "metadata": map[string]interface{}{
+					"resourceVersion": "2345",
+				}},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod",
+								"namespace": "default",
+							},
+						},
+					},
+					{
+						Object: map[string]interface{}{
+							"apiVersion": "v1",
+							"kind":       "Carp",
+							"metadata": map[string]interface{}{
+								"name":      "pod2",
+								"namespace": "default",
+							},
+						},
+					},
+				},
+			},
+			expect: "{\"apiVersion\":\"v1\",\"items\":[{\"apiVersion\":\"v1\",\"kind\":\"Carp\",\"metadata\":{\"name\":\"pod\",\"namespace\":\"default\"}},{\"apiVersion\":\"v1\",\"kind\":\"Carp\",\"metadata\":{\"name\":\"pod2\",\"namespace\":\"default\"}}],\"kind\":\"List\",\"metadata\":{\"resourceVersion\":\"2345\"}}\n",
+		},
+		{
+			name: "UnstructuredList conflict on items",
+			in: &unstructured.UnstructuredList{
+				Object: map[string]interface{}{"items": []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"name": "pod",
+						},
+					},
+				},
+				},
+				Items: []unstructured.Unstructured{
+					{
+						Object: map[string]interface{}{
+							"name": "pod2",
+						},
+					},
+				},
+			},
+			expect: "{\"items\":[{\"name\":\"pod2\"}]}\n",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			buf.Reset()
+			if err := s.Encode(tc.in, &buf); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			t.Logf("encoded: %s", buf.String())
+			if diff := cmp.Diff(buf.String(), tc.expect); diff != "" {
+				t.Errorf("not matching:\n%s", diff)
+			}
+			expectStreaming := !tc.cannotStream && streamingEnabled
+			if expectStreaming && buf.writeCount <= 1 {
+				t.Errorf("expected streaming but Write was called only: %d", buf.writeCount)
+			}
+			if !expectStreaming && buf.writeCount > 1 {
+				t.Errorf("expected non-streaming but Write was called more than once: %d", buf.writeCount)
+			}
+		})
+	}
+}
+
+type StructWithFloatsList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithFloats `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *StructWithFloatsList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithFloats struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	Int     int
+	Float32 float32
+	Float64 float64
+}
+
+func (s *StructWithFloats) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithDuplicatedTagsList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithDuplicatedTags `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *StructWithDuplicatedTagsList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithDuplicatedTags struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	Key1 string `json:"key"`
+	Key2 string `json:"key"` //nolint:govet
+}
+
+func (s *StructWithDuplicatedTags) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type ListWithMarshalJSONList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []string `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (l *ListWithMarshalJSONList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *ListWithMarshalJSONList) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshallJSON"`), nil
+}
+
+type StructWithMarshalJSONList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithMarshalJSON `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithMarshalJSONList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithMarshalJSON struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+}
+
+func (l *StructWithMarshalJSON) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (l *StructWithMarshalJSON) MarshalJSON() ([]byte, error) {
+	return []byte(`"marshallJSON"`), nil
+}
+
+type StructWithRawBytesList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []StructWithRawBytes `json:"items" protobuf:"bytes,2,rep,name=items"`
+}
+
+func (s *StructWithRawBytesList) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type StructWithRawBytes struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Slice             []byte
+	Array             [3]byte
+}
+
+func (s *StructWithRawBytes) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type ListWithAdditionalFields struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+	Items           []testapigroupv1.Carp `json:"items" protobuf:"bytes,2,rep,name=items"`
+	AdditionalField int
+}
+
+func (s *ListWithAdditionalFields) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+type writeCountingBuffer struct {
+	writeCount int
+	bytes.Buffer
+}
+
+func (b *writeCountingBuffer) Write(data []byte) (int, error) {
+	b.writeCount++
+	return b.Buffer.Write(data)
+}
+
+func (b *writeCountingBuffer) Reset() {
+	b.writeCount = 0
+	b.Buffer.Reset()
+}
+
+func TestFuzzCollectionsEncoding(t *testing.T) {
+	disableFuzzFieldsV1 := func(field *metav1.FieldsV1, c randfill.Continue) {}
+	fuzzUnstructuredList := func(list *unstructured.UnstructuredList, c randfill.Continue) {
+		list.Object = map[string]interface{}{
+			"kind":       "List",
+			"apiVersion": "v1",
+			c.String(0):  c.String(0),
+			c.String(0):  c.Uint64(),
+			c.String(0):  c.Bool(),
+			"metadata": map[string]interface{}{
+				"resourceVersion":    fmt.Sprintf("%d", c.Uint64()),
+				"continue":           c.String(0),
+				"remainingItemCount": fmt.Sprintf("%d", c.Uint64()),
+				c.String(0):          c.String(0),
+			}}
+		c.Fill(&list.Items)
+	}
+	fuzzMap := func(kvs map[string]interface{}, c randfill.Continue) {
+		kvs[c.String(0)] = c.Bool()
+		kvs[c.String(0)] = c.Uint64()
+		kvs[c.String(0)] = c.String(0)
+	}
+	f := randfill.New().Funcs(disableFuzzFieldsV1, fuzzUnstructuredList, fuzzMap)
+	streamingBuffer := &bytes.Buffer{}
+	normalSerializer := NewSerializerWithOptions(DefaultMetaFactory, nil, nil, SerializerOptions{StreamingCollectionsEncoding: false})
+	normalBuffer := &bytes.Buffer{}
+	t.Run("CarpList", func(t *testing.T) {
+		for i := 0; i < 1000; i++ {
+			list := &testapigroupv1.CarpList{}
+			f.Fill(list)
+			streamingBuffer.Reset()
+			normalBuffer.Reset()
+			ok, err := streamEncodeCollections(list, streamingBuffer)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if !ok {
+				t.Fatalf("expected streaming encoder to encode %T", list)
+			}
+			if err := normalSerializer.Encode(list, normalBuffer); err != nil {
+				t.Fatal(err)
+			}
+			if diff := cmp.Diff(normalBuffer.String(), streamingBuffer.String()); diff != "" {
+				t.Logf("normal: %s", normalBuffer.String())
+				t.Logf("streaming: %s", streamingBuffer.String())
+				t.Errorf("not matching:\n%s", diff)
+			}
+		}
+	})
+	t.Run("UnstructuredList", func(t *testing.T) {
+		for i := 0; i < 1000; i++ {
+			list := &unstructured.UnstructuredList{}
+			f.Fill(list)
+			streamingBuffer.Reset()
+			normalBuffer.Reset()
+			ok, err := streamEncodeCollections(list, streamingBuffer)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if !ok {
+				t.Fatalf("expected streaming encoder to encode %T", list)
+			}
+			if err := normalSerializer.Encode(list, normalBuffer); err != nil {
+				t.Fatal(err)
+			}
+			if diff := cmp.Diff(normalBuffer.String(), streamingBuffer.String()); diff != "" {
+				t.Logf("normal: %s", normalBuffer.String())
+				t.Logf("streaming: %s", streamingBuffer.String())
+				t.Errorf("not matching:\n%s", diff)
+			}
+		}
+	})
+}

pkg/runtime/serializer/json/json.go

@@ -36,7 +36,7 @@ import (
 // is not nil, the object has the group, version, and kind fields set.
 // Deprecated: use NewSerializerWithOptions instead.
 func NewSerializer(meta MetaFactory, creater runtime.ObjectCreater, typer runtime.ObjectTyper, pretty bool) *Serializer {
-	return NewSerializerWithOptions(meta, creater, typer, SerializerOptions{false, pretty, false})
+	return NewSerializerWithOptions(meta, creater, typer, SerializerOptions{false, pretty, false, false})
 }
 
 // NewYAMLSerializer creates a YAML serializer that handles encoding versioned objects into the proper YAML form. If typer
@@ -44,7 +44,7 @@ func NewSerializer(meta MetaFactory, creater runtime.ObjectCreater, typer runtim
 // matches JSON, and will error if constructs are used that do not serialize to JSON.
 // Deprecated: use NewSerializerWithOptions instead.
 func NewYAMLSerializer(meta MetaFactory, creater runtime.ObjectCreater, typer runtime.ObjectTyper) *Serializer {
-	return NewSerializerWithOptions(meta, creater, typer, SerializerOptions{true, false, false})
+	return NewSerializerWithOptions(meta, creater, typer, SerializerOptions{true, false, false, false})
 }
 
 // NewSerializerWithOptions creates a JSON/YAML serializer that handles encoding versioned objects into the proper JSON/YAML
@@ -93,6 +93,9 @@ type SerializerOptions struct {
 	// Strict: configures the Serializer to return strictDecodingError's when duplicate fields are present decoding JSON or YAML.
 	// Note that enabling this option is not as performant as the non-strict variant, and should not be used in fast paths.
 	Strict bool
+
+	// StreamingCollectionsEncoding enables encoding collection, one item at the time, drastically reducing memory needed.
+	StreamingCollectionsEncoding bool
 }
 
 // Serializer handles encoding versioned objects into the proper JSON form
@@ -242,6 +245,15 @@ func (s *Serializer) doEncode(obj runtime.Object, w io.Writer) error {
 		_, err = w.Write(data)
 		return err
 	}
+	if s.options.StreamingCollectionsEncoding {
+		ok, err := streamEncodeCollections(obj, w)
+		if err != nil {
+			return err
+		}
+		if ok {
+			return nil
+		}
+	}
 	encoder := json.NewEncoder(w)
 	return encoder.Encode(obj)
 }

pkg/runtime/serializer/protobuf/collections.go

@@ -0,0 +1,174 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"errors"
+	"io"
+	"math/bits"
+
+	"github.com/gogo/protobuf/proto"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+var (
+	errFieldCount          = errors.New("expected ListType to have 3 fields")
+	errTypeMetaField       = errors.New("expected TypeMeta field to have TypeMeta type")
+	errTypeMetaProtobufTag = errors.New(`expected TypeMeta protobuf field tag to be ""`)
+	errListMetaField       = errors.New("expected ListMeta field to have ListMeta type")
+	errListMetaProtobufTag = errors.New(`expected ListMeta protobuf field tag to be "bytes,1,opt,name=metadata"`)
+	errItemsProtobufTag    = errors.New(`expected Items protobuf field tag to be "bytes,2,rep,name=items"`)
+	errItemsSizer          = errors.New(`expected Items elements to implement proto.Sizer`)
+)
+
+// getStreamingListData implements list extraction logic for protobuf stream serialization.
+//
+// Reason for a custom logic instead of reusing accessors from meta package:
+// * Validate proto tags to prevent incompatibility with proto standard package.
+// * ListMetaAccessor doesn't distinguish empty from nil value.
+// * TypeAccessor reparsing "apiVersion" and serializing it with "{group}/{version}"
+func getStreamingListData(list runtime.Object) (data streamingListData, err error) {
+	listValue, err := conversion.EnforcePtr(list)
+	if err != nil {
+		return data, err
+	}
+	listType := listValue.Type()
+	if listType.NumField() != 3 {
+		return data, errFieldCount
+	}
+	// TypeMeta: validated, but not returned as is not serialized.
+	_, ok := listValue.Field(0).Interface().(metav1.TypeMeta)
+	if !ok {
+		return data, errTypeMetaField
+	}
+	if listType.Field(0).Tag.Get("protobuf") != "" {
+		return data, errTypeMetaProtobufTag
+	}
+	// ListMeta
+	listMeta, ok := listValue.Field(1).Interface().(metav1.ListMeta)
+	if !ok {
+		return data, errListMetaField
+	}
+	// if we were ever to relax the protobuf tag check we should update the hardcoded `0xa` below when writing ListMeta.
+	if listType.Field(1).Tag.Get("protobuf") != "bytes,1,opt,name=metadata" {
+		return data, errListMetaProtobufTag
+	}
+	data.listMeta = listMeta
+	// Items; if we were ever to relax the protobuf tag check we should update the hardcoded `0x12` below when writing Items.
+	if listType.Field(2).Tag.Get("protobuf") != "bytes,2,rep,name=items" {
+		return data, errItemsProtobufTag
+	}
+	items, err := meta.ExtractList(list)
+	if err != nil {
+		return data, err
+	}
+	data.items = items
+	data.totalSize, data.listMetaSize, data.itemsSizes, err = listSize(listMeta, items)
+	return data, err
+}
+
+type streamingListData struct {
+	// totalSize is the total size of the serialized List object, including their proto headers/size bytes
+	totalSize int
+
+	// listMetaSize caches results from .Size() call to listMeta, doesn't include header bytes (field identifier, size)
+	listMetaSize int
+	listMeta     metav1.ListMeta
+
+	// itemsSizes caches results from .Size() call to items, doesn't include header bytes (field identifier, size)
+	itemsSizes []int
+	items      []runtime.Object
+}
+
+// listSize return size of ListMeta and items to be later used for preallocations.
+// listMetaSize and itemSizes do not include header bytes (field identifier, size).
+func listSize(listMeta metav1.ListMeta, items []runtime.Object) (totalSize, listMetaSize int, itemSizes []int, err error) {
+	// ListMeta
+	listMetaSize = listMeta.Size()
+	totalSize += 1 + sovGenerated(uint64(listMetaSize)) + listMetaSize
+	// Items
+	itemSizes = make([]int, len(items))
+	for i, item := range items {
+		sizer, ok := item.(proto.Sizer)
+		if !ok {
+			return totalSize, listMetaSize, nil, errItemsSizer
+		}
+		n := sizer.Size()
+		itemSizes[i] = n
+		totalSize += 1 + sovGenerated(uint64(n)) + n
+	}
+	return totalSize, listMetaSize, itemSizes, nil
+}
+
+func streamingEncodeUnknownList(w io.Writer, unk runtime.Unknown, listData streamingListData, memAlloc runtime.MemoryAllocator) error {
+	_, err := w.Write(protoEncodingPrefix)
+	if err != nil {
+		return err
+	}
+	// encodeList is responsible for encoding the List into the unknown Raw.
+	encodeList := func(writer io.Writer) (int, error) {
+		return streamingEncodeList(writer, listData, memAlloc)
+	}
+	_, err = unk.MarshalToWriter(w, listData.totalSize, encodeList)
+	return err
+}
+
+func streamingEncodeList(w io.Writer, listData streamingListData, memAlloc runtime.MemoryAllocator) (size int, err error) {
+	// ListMeta; 0xa = (1 << 3) | 2; field number: 1, type: 2 (LEN). https://protobuf.dev/programming-guides/encoding/#structure
+	n, err := doEncodeWithHeader(&listData.listMeta, w, 0xa, listData.listMetaSize, memAlloc)
+	size += n
+	if err != nil {
+		return size, err
+	}
+	// Items; 0x12 = (2 << 3) | 2; field number: 2, type: 2 (LEN). https://protobuf.dev/programming-guides/encoding/#structure
+	for i, item := range listData.items {
+		n, err := doEncodeWithHeader(item, w, 0x12, listData.itemsSizes[i], memAlloc)
+		size += n
+		if err != nil {
+			return size, err
+		}
+	}
+	return size, nil
+}
+
+func writeVarintGenerated(w io.Writer, v int) (int, error) {
+	buf := make([]byte, sovGenerated(uint64(v)))
+	encodeVarintGenerated(buf, len(buf), uint64(v))
+	return w.Write(buf)
+}
+
+// sovGenerated is copied from `generated.pb.go` returns size of varint.
+func sovGenerated(v uint64) int {
+	return (bits.Len64(v|1) + 6) / 7
+}
+
+// encodeVarintGenerated is copied from `generated.pb.go` encodes varint.
+func encodeVarintGenerated(dAtA []byte, offset int, v uint64) int {
+	offset -= sovGenerated(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}

pkg/runtime/serializer/protobuf/collections_test.go

@@ -0,0 +1,333 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package protobuf
+
+import (
+	"bytes"
+	"encoding/base64"
+	"io"
+	"os/exec"
+	"testing"
+
+	"github.com/gogo/protobuf/proto"
+	"github.com/google/go-cmp/cmp"
+	"sigs.k8s.io/randfill"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	testapigroupv1 "k8s.io/apimachinery/pkg/apis/testapigroup/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+func TestCollectionsEncoding(t *testing.T) {
+	t.Run("Normal", func(t *testing.T) {
+		testCollectionsEncoding(t, NewSerializer(nil, nil), false)
+	})
+	t.Run("Streaming", func(t *testing.T) {
+		testCollectionsEncoding(t, NewSerializerWithOptions(nil, nil, SerializerOptions{StreamingCollectionsEncoding: true}), true)
+	})
+}
+
+func testCollectionsEncoding(t *testing.T, s *Serializer, streamingEnabled bool) {
+	var remainingItems int64 = 1
+	testCases := []struct {
+		name string
+		in   runtime.Object
+		// expect is base64 encoded protobuf bytes
+		expect string
+	}{
+		{
+			name: "CarpList items nil",
+			in: &testapigroupv1.CarpList{
+				Items: nil,
+			},
+			expect: "azhzAAoECgASABIICgYKABIAGgAaACIA",
+		},
+		{
+			name: "CarpList slice nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: nil,
+						},
+					},
+				},
+			},
+			expect: "azhzAAoECgASABJBCgYKABIAGgASNwoQCgASABoAIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+		{
+			name: "CarpList map nil",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: nil,
+						},
+					},
+				},
+			},
+			expect: "azhzAAoECgASABJBCgYKABIAGgASNwoQCgASABoAIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+		{
+			name: "CarpList items empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{},
+			},
+			expect: "azhzAAoECgASABIICgYKABIAGgAaACIA",
+		},
+		{
+			name: "CarpList slice empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Status: testapigroupv1.CarpStatus{
+							Conditions: []testapigroupv1.CarpCondition{},
+						},
+					},
+				},
+			},
+			expect: "azhzAAoECgASABJBCgYKABIAGgASNwoQCgASABoAIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+		{
+			name: "CarpList map empty",
+			in: &testapigroupv1.CarpList{
+				Items: []testapigroupv1.Carp{
+					{
+						Spec: testapigroupv1.CarpSpec{
+							NodeSelector: map[string]string{},
+						},
+					},
+				},
+			},
+			expect: "azhzAAoECgASABJBCgYKABIAGgASNwoQCgASABoAIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+		{
+			name: "List just kind",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind: "List",
+				},
+			},
+			expect: "azhzAAoICgASBExpc3QSCAoGCgASABoAGgAiAA==",
+		},
+		{
+			name: "List just apiVersion",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "v1",
+				},
+			},
+			expect: "azhzAAoGCgJ2MRIAEggKBgoAEgAaABoAIgA=",
+		},
+		{
+			name: "List no elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{},
+			},
+			expect: "azhzAAoKCgJ2MRIETGlzdBIMCgoKABIEMjM0NRoAGgAiAA==",
+		},
+		{
+			name: "List one element with continue",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion:    "2345",
+					Continue:           "abc",
+					RemainingItemCount: &remainingItems,
+				},
+				Items: []testapigroupv1.Carp{
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod",
+						Namespace: "default",
+					}},
+				},
+			},
+			expect: "azhzAAoKCgJ2MRIETGlzdBJUCg8KABIEMjM0NRoDYWJjIAESQQoaCgNwb2QSABoHZGVmYXVsdCIAKgAyADgAQgASFxoAQgBKAFIAWABgAGgAggEAigEAmgEAGgoKABoAIgAqADIAGgAiAA==",
+		},
+		{
+			name: "List two elements",
+			in: &testapigroupv1.CarpList{
+				TypeMeta: metav1.TypeMeta{
+					Kind:       "List",
+					APIVersion: "v1",
+				},
+				ListMeta: metav1.ListMeta{
+					ResourceVersion: "2345",
+				},
+				Items: []testapigroupv1.Carp{
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod",
+						Namespace: "default",
+					}},
+					{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Carp"}, ObjectMeta: metav1.ObjectMeta{
+						Name:      "pod2",
+						Namespace: "default2",
+					}},
+				},
+			},
+			expect: "azhzAAoKCgJ2MRIETGlzdBKUAQoKCgASBDIzNDUaABJBChoKA3BvZBIAGgdkZWZhdWx0IgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgASQwocCgRwb2QyEgAaCGRlZmF1bHQyIgAqADIAOABCABIXGgBCAEoAUgBYAGAAaACCAQCKAQCaAQAaCgoAGgAiACoAMgAaACIA",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var buf writeCountingBuffer
+			if err := s.Encode(tc.in, &buf); err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			actualBytes := buf.Bytes()
+			expectBytes, err := io.ReadAll(base64.NewDecoder(base64.StdEncoding, bytes.NewBufferString(tc.expect)))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !bytes.Equal(expectBytes, actualBytes) {
+				expectedBytes, err := base64.StdEncoding.DecodeString(tc.expect)
+				if err == nil {
+					t.Errorf("expected:\n%v\ngot:\n%v", expectedBytes, actualBytes)
+				} else {
+					t.Errorf("expected:\n%v\ngot:\n%v", tc.expect, base64.StdEncoding.EncodeToString(actualBytes))
+				}
+				actualProto := dumpProto(t, actualBytes[4:])
+				expectedProto := dumpProto(t, expectBytes[4:])
+				if actualProto != "" && expectedProto != "" {
+					t.Log(cmp.Diff(actualProto, expectedProto))
+				} else {
+					t.Log(cmp.Diff(actualBytes, expectBytes))
+				}
+			}
+			if streamingEnabled && buf.writeCount <= 1 {
+				t.Errorf("expected streaming but Write was called only: %d", buf.writeCount)
+			}
+			if !streamingEnabled && buf.writeCount > 1 {
+				t.Errorf("expected non-streaming but Write was called more than once: %d", buf.writeCount)
+			}
+		})
+	}
+}
+
+// dumpProto does a best-effort dump of the given proto bytes using protoc if it can be found in the path.
+// This is only used when the test has already failed, to try to give more visibility into the diff of the failure.
+func dumpProto(t *testing.T, data []byte) string {
+	t.Helper()
+	protoc, err := exec.LookPath("protoc")
+	if err != nil {
+		t.Logf("cannot find protoc in path to dump proto contents: %v", err)
+		return ""
+	}
+	cmd := exec.Command(protoc, "--decode_raw")
+	cmd.Stdin = bytes.NewBuffer(data)
+	d, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Logf("protoc invocation failed: %v", err)
+		return ""
+	}
+	return string(d)
+}
+
+type writeCountingBuffer struct {
+	writeCount int
+	bytes.Buffer
+}
+
+func (b *writeCountingBuffer) Write(data []byte) (int, error) {
+	b.writeCount++
+	return b.Buffer.Write(data)
+}
+
+func (b *writeCountingBuffer) Reset() {
+	b.writeCount = 0
+	b.Buffer.Reset()
+}
+
+func TestFuzzCollection(t *testing.T) {
+	f := randfill.New()
+	streamingEncoder := NewSerializerWithOptions(nil, nil, SerializerOptions{StreamingCollectionsEncoding: true})
+	streamingBuffer := &bytes.Buffer{}
+	normalEncoder := NewSerializerWithOptions(nil, nil, SerializerOptions{StreamingCollectionsEncoding: false})
+	normalBuffer := &bytes.Buffer{}
+	for i := 0; i < 1000; i++ {
+		list := &testapigroupv1.CarpList{}
+		f.FillNoCustom(list)
+		streamingBuffer.Reset()
+		normalBuffer.Reset()
+		if err := streamingEncoder.Encode(list, streamingBuffer); err != nil {
+			t.Fatal(err)
+		}
+		if err := normalEncoder.Encode(list, normalBuffer); err != nil {
+			t.Fatal(err)
+		}
+		if diff := cmp.Diff(streamingBuffer.String(), normalBuffer.String()); diff != "" {
+			t.Logf("normal: %s", normalBuffer.String())
+			t.Logf("streaming: %s", streamingBuffer.String())
+			t.Fatalf("unexpected output:\n%s", diff)
+		}
+	}
+}
+
+func TestCallsToSize(t *testing.T) {
+	counter := &countingSizer{data: []byte("abba")}
+	listMeta := metav1.ListMeta{}
+	listData := streamingListData{
+		totalSize:    14,
+		listMeta:     listMeta,
+		listMetaSize: listMeta.Size(),
+		itemsSizes:   []int{counter.Size()},
+		items:        []runtime.Object{counter},
+	}
+	err := streamingEncodeUnknownList(io.Discard, runtime.Unknown{}, listData, &runtime.Allocator{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if counter.count != 1 {
+		t.Errorf("Expected only 1 call to sizer, got %d", counter.count)
+	}
+}
+
+type countingSizer struct {
+	data  []byte
+	count int
+}
+
+var _ proto.Sizer = (*countingSizer)(nil)
+var _ runtime.ProtobufMarshaller = (*countingSizer)(nil)
+
+func (s *countingSizer) MarshalTo(data []byte) (int, error) {
+	return copy(data, s.data), nil
+}
+func (s *countingSizer) Size() int {
+	s.count++
+	return len(s.data)
+}
+
+func (s *countingSizer) DeepCopyObject() runtime.Object {
+	return nil
+}
+
+func (s *countingSizer) GetObjectKind() schema.ObjectKind {
+	return nil
+}

pkg/runtime/serializer/protobuf/protobuf.go

@@ -72,10 +72,18 @@ func IsNotMarshalable(err error) bool {
 // is passed, the encoded object will have group, version, and kind fields set. If typer is nil, the objects will be written
 // as-is (any type info passed with the object will be used).
 func NewSerializer(creater runtime.ObjectCreater, typer runtime.ObjectTyper) *Serializer {
+	return NewSerializerWithOptions(creater, typer, SerializerOptions{})
+}
+
+// NewSerializerWithOptions creates a Protobuf serializer that handles encoding versioned objects into the proper wire form. If a typer
+// is passed, the encoded object will have group, version, and kind fields set. If typer is nil, the objects will be written
+// as-is (any type info passed with the object will be used).
+func NewSerializerWithOptions(creater runtime.ObjectCreater, typer runtime.ObjectTyper, opts SerializerOptions) *Serializer {
 	return &Serializer{
 		prefix:  protoEncodingPrefix,
 		creater: creater,
 		typer:   typer,
+		options: opts,
 	}
 }
 
@@ -84,6 +92,14 @@ type Serializer struct {
 	prefix  []byte
 	creater runtime.ObjectCreater
 	typer   runtime.ObjectTyper
+
+	options SerializerOptions
+}
+
+// SerializerOptions holds the options which are used to configure a Proto serializer.
+type SerializerOptions struct {
+	// StreamingCollectionsEncoding enables encoding collection, one item at the time, drastically reducing memory needed.
+	StreamingCollectionsEncoding bool
 }
 
 var _ runtime.Serializer = &Serializer{}
@@ -209,6 +225,13 @@ func (s *Serializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.
 			},
 		}
 	}
+	if s.options.StreamingCollectionsEncoding {
+		listData, err := getStreamingListData(obj)
+		if err == nil {
+			// Doesn't honor custom proto marshaling methods (like json streaming), because all proto objects implement proto methods.
+			return streamingEncodeUnknownList(w, unk, listData, memAlloc)
+		}
+	}
 
 	switch t := obj.(type) {
 	case bufferedMarshaller:
@@ -428,6 +451,39 @@ func (s *RawSerializer) encode(obj runtime.Object, w io.Writer, memAlloc runtime
 }
 
 func (s *RawSerializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error {
+	_, err := doEncode(obj, w, nil, memAlloc)
+	return err
+}
+
+func doEncodeWithHeader(obj any, w io.Writer, field byte, precomputedSize int, memAlloc runtime.MemoryAllocator) (size int, err error) {
+	// Field identifier
+	n, err := w.Write([]byte{field})
+	size += n
+	if err != nil {
+		return size, err
+	}
+	// Size
+	n, err = writeVarintGenerated(w, precomputedSize)
+	size += n
+	if err != nil {
+		return size, err
+	}
+	// Obj
+	n, err = doEncode(obj, w, &precomputedSize, memAlloc)
+	size += n
+	if err != nil {
+		return size, err
+	}
+	if n != precomputedSize {
+		return size, fmt.Errorf("the size value was %d, but doEncode wrote %d bytes to data", precomputedSize, n)
+	}
+	return size, nil
+}
+
+// doEncode encodes provided object into writer using a allocator if possible.
+// Avoids call by object Size if precomputedObjSize is provided.
+// precomputedObjSize should not include header bytes (field identifier, size).
+func doEncode(obj any, w io.Writer, precomputedObjSize *int, memAlloc runtime.MemoryAllocator) (int, error) {
 	if memAlloc == nil {
 		klog.Error("a mandatory memory allocator wasn't provided, this might have a negative impact on performance, check invocations of EncodeWithAllocator method, falling back on runtime.SimpleAllocator")
 		memAlloc = &runtime.SimpleAllocator{}
@@ -436,40 +492,43 @@ func (s *RawSerializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runti
 	case bufferedReverseMarshaller:
 		// this path performs a single allocation during write only when the Allocator wasn't provided
 		// it also requires the caller to implement the more efficient Size and MarshalToSizedBuffer methods
-		encodedSize := uint64(t.Size())
-		data := memAlloc.Allocate(encodedSize)
+		if precomputedObjSize == nil {
+			s := t.Size()
+			precomputedObjSize = &s
+		}
+		data := memAlloc.Allocate(uint64(*precomputedObjSize))
 
 		n, err := t.MarshalToSizedBuffer(data)
 		if err != nil {
-			return err
+			return 0, err
 		}
-		_, err = w.Write(data[:n])
-		return err
+		return w.Write(data[:n])
 
 	case bufferedMarshaller:
 		// this path performs a single allocation during write only when the Allocator wasn't provided
 		// it also requires the caller to implement the more efficient Size and MarshalTo methods
-		encodedSize := uint64(t.Size())
-		data := memAlloc.Allocate(encodedSize)
+		if precomputedObjSize == nil {
+			s := t.Size()
+			precomputedObjSize = &s
+		}
+		data := memAlloc.Allocate(uint64(*precomputedObjSize))
 
 		n, err := t.MarshalTo(data)
 		if err != nil {
-			return err
+			return 0, err
 		}
-		_, err = w.Write(data[:n])
-		return err
+		return w.Write(data[:n])
 
 	case proto.Marshaler:
 		// this path performs extra allocations
 		data, err := t.Marshal()
 		if err != nil {
-			return err
+			return 0, err
 		}
-		_, err = w.Write(data)
-		return err
+		return w.Write(data)
 
 	default:
-		return errNotMarshalable{reflect.TypeOf(obj)}
+		return 0, errNotMarshalable{reflect.TypeOf(obj)}
 	}
 }