chore: refactor read scheme to openapi from kubernetes api definition

Previously, only a single embedded Kubernetes API version could be specified, resulting in a lack of support for certain GVKs.
To address this, the goal is to create and utilize a unified scheme that consolidates Kubernetes API definitions.
As a preliminary step, the current method of loading API definitions will be improved.

Makefile-tools.mk

@@ -69,10 +69,6 @@ $(MYGOBIN)/controller-gen:
 $(MYGOBIN)/embedmd:
 	cd $(REPO_ROOT)/hack && go install github.com/campoy/embedmd
 
-.PHONY: $(MYGOBIN)/go-bindata
-$(MYGOBIN)/go-bindata:
-	cd $(REPO_ROOT)/hack && go install github.com/go-bindata/go-bindata/v3/go-bindata
-
 .PHONY: $(MYGOBIN)/go-apidiff
 $(MYGOBIN)/go-apidiff:
 	cd $(REPO_ROOT)/hack && go install github.com/joelanford/go-apidiff

go.work.sum

@@ -105,7 +105,6 @@ cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gC
 cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ=
 cloud.google.com/go/auth v0.18.0/go.mod h1:wwkPM1AgE1f2u6dG443MiWoD8C3BtOywNsUMcUTVDRo=
 cloud.google.com/go/auth v0.18.1/go.mod h1:GfTYoS9G3CWpRA3Va9doKN9mjPGRS+v41jmZAhBzbrA=
-cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=
 cloud.google.com/go/automl v1.13.1 h1:iP9iQurb0qbz+YOOMfKSEjhONA/WcoOIjt6/m+6pIgo=
 cloud.google.com/go/automl v1.13.1/go.mod h1:1aowgAHWYZU27MybSCFiukPO7xnyawv7pt3zK4bheQE=
 cloud.google.com/go/automl v1.13.4 h1:i9tOKXX+1gE7+rHpWKjiuPfGBVIYoWvLNIGpWgPtF58=
@@ -427,6 +426,7 @@ cloud.google.com/go/grafeas v0.3.0 h1:oyTL/KjiUeBs9eYLw/40cpSZglUC+0F7X4iu/8t7NW
 cloud.google.com/go/grafeas v0.3.0/go.mod h1:P7hgN24EyONOTMyeJH6DxG4zD7fwiYa5Q6GUgyFSOU8=
 cloud.google.com/go/grafeas v0.3.11 h1:CobnwnyeY1j1Defi5vbEircI+jfrk3ci5m004ZjiFP4=
 cloud.google.com/go/grafeas v0.3.11/go.mod h1:dcQyG2+T4tBgG0MvJAh7g2wl/xHV2w+RZIqivwuLjNg=
+cloud.google.com/go/grafeas v0.3.16/go.mod h1:I/yrRMOEsLasrmZXQzmDXwrJ3ZPn3dQWLaWt4lXmYvE=
 cloud.google.com/go/gsuiteaddons v1.6.1 h1:mi9jxZpzVjLQibTS/XfPZvl+Jr6D5Bs8pGqUjllRb00=
 cloud.google.com/go/gsuiteaddons v1.6.1/go.mod h1:CodrdOqRZcLp5WOwejHWYBjZvfY0kOphkAKpF/3qdZY=
 cloud.google.com/go/gsuiteaddons v1.6.4 h1:uuw2Xd37yHftViSI8J2hUcCS8S7SH3ZWH09sUDLW30Q=
@@ -489,7 +489,6 @@ cloud.google.com/go/logging v1.7.0/go.mod h1:3xjP2CjkM3ZkO73aj4ASA5wRPGGCRrPIAeN
 cloud.google.com/go/logging v1.8.1 h1:26skQWPeYhvIasWKm48+Eq7oUqdcdbwsCVwz5Ys0FvU=
 cloud.google.com/go/logging v1.8.1/go.mod h1:TJjR+SimHwuC8MZ9cjByQulAMgni+RkXeI3wwctHJEI=
 cloud.google.com/go/logging v1.13.0/go.mod h1:36CoKh6KA/M0PbhPKMq6/qety2DCAErbhXT62TuXALA=
-cloud.google.com/go/logging v1.13.2/go.mod h1:zaybliM3yun1J8mU2dVQ1/qDzjbOqEijZCn6hSBtKak=
 cloud.google.com/go/longrunning v0.5.0/go.mod h1:0JNuqRShmscVAhIACGtskSAWtqtOoPkwP0YF1oVEchc=
 cloud.google.com/go/longrunning v0.5.1 h1:Fr7TXftcqTudoyRJa113hyaqlGdiBQkp0Gq7tErFDWI=
 cloud.google.com/go/longrunning v0.5.1/go.mod h1:spvimkwdz6SPWKEt/XBij79E9fiTkHSQl/fRUUQJYJc=
@@ -760,7 +759,6 @@ cloud.google.com/go/storage v1.10.0 h1:STgFzyU5/8miMl0//zKh2aQeTyeaUH3WN9bSUiJ09
 cloud.google.com/go/storage v1.30.1/go.mod h1:NfxhC0UJE1aXSx7CIIbCf7y9HKT7BiccwkR7+P7gN8E=
 cloud.google.com/go/storage v1.56.0/go.mod h1:Tpuj6t4NweCLzlNbw9Z9iwxEkrSem20AetIeH/shgVU=
 cloud.google.com/go/storage v1.59.0/go.mod h1:cMWbtM+anpC74gn6qjLh+exqYcfmB9Hqe5z6adx+CLI=
-cloud.google.com/go/storage v1.59.2/go.mod h1:cMWbtM+anpC74gn6qjLh+exqYcfmB9Hqe5z6adx+CLI=
 cloud.google.com/go/storagetransfer v1.10.0 h1:+ZLkeXx0K0Pk5XdDmG0MnUVqIR18lllsihU/yq39I8Q=
 cloud.google.com/go/storagetransfer v1.10.0/go.mod h1:DM4sTlSmGiNczmV6iZyceIh2dbs+7z2Ayg6YAiQlYfA=
 cloud.google.com/go/storagetransfer v1.10.3 h1:YM1dnj5gLjfL6aDldO2s4GeU8JoAvH1xyIwXre63KmI=
@@ -864,17 +862,22 @@ cloud.google.com/go/workflows v1.12.3/go.mod h1:fmOUeeqEwPzIU81foMjTRQIdwQHADi/v
 cloud.google.com/go/workflows v1.13.2 h1:jYIxrDOVCGvTBHIAVhqQ+P8fhE0trm+Hf2hgL1YzmK0=
 cloud.google.com/go/workflows v1.13.2/go.mod h1:l5Wj2Eibqba4BsADIRzPLaevLmIuYF2W+wfFBkRG3vU=
 cloud.google.com/go/workflows v1.14.3/go.mod h1:CC9+YdVI2Kvp0L58WajHpEfKJxhrtRh3uQ0SYWcmAk4=
+codeberg.org/go-fonts/liberation v0.5.0/go.mod h1:zS/2e1354/mJ4pGzIIaEtm/59VFCFnYC7YV6YdGl5GU=
+codeberg.org/go-latex/latex v0.1.0/go.mod h1:LA0q/AyWIYrqVd+A9Upkgsb+IqPcmSTKc9Dny04MHMw=
+codeberg.org/go-pdf/fpdf v0.10.0/go.mod h1:Y0DGRAdZ0OmnZPvjbMp/1bYxmIPxm0ws4tfoPOc4LjU=
 contrib.go.opencensus.io/exporter/aws v0.0.0-20230502192102-15967c811cec h1:CSNP8nIEQt4sZEo2sGUiWSmVJ9c5QdyIQvwzZAsn+8Y=
 contrib.go.opencensus.io/exporter/aws v0.0.0-20230502192102-15967c811cec/go.mod h1:uu1P0UCM/6RbsMrgPa98ll8ZcHM858i/AD06a9aLRCA=
 contrib.go.opencensus.io/exporter/stackdriver v0.13.4/go.mod h1:aXENhDJ1Y4lIg4EUaVTwzvYETVNZk10Pu26tevFKLUc=
 contrib.go.opencensus.io/exporter/stackdriver v0.13.14 h1:zBakwHardp9Jcb8sQHcHpXy/0+JIb1M8KjigCJzx7+4=
 contrib.go.opencensus.io/exporter/stackdriver v0.13.14/go.mod h1:5pSSGY0Bhuk7waTHuDf4aQ8D2DrhgETRo9fy6k3Xlzc=
+contrib.go.opencensus.io/exporter/stackdriver v0.13.15-0.20230702191903-2de6d2748484/go.mod h1:uxw+4/0SiKbbVSD/F2tk5pJTdVcfIBBcsQ8gwcu4X+E=
 contrib.go.opencensus.io/integrations/ocsql v0.1.7 h1:G3k7C0/W44zcqkpRSFyjU9f6HZkbwIrL//qqnlqWZ60=
 contrib.go.opencensus.io/integrations/ocsql v0.1.7/go.mod h1:8DsSdjz3F+APR+0z0WkU1aRorQCFfRxvqjUUPMbF3fE=
 cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9 h1:VpgP7xuJadIUuKccphEpTJnWhS2jkQyMt6Y7pJCD7fY=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 filippo.io/edwards25519 v1.1.1/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+git.sr.ht/~sbinet/gg v0.6.0/go.mod h1:uucygbfC9wVPQIfrmwM2et0imr8L7KQWywX0xpFMm94=
 github.com/360EntSecGroup-Skylar/excelize v1.4.1/go.mod h1:vnax29X2usfl7HHkBrX5EvSCJcmH3dT9luvxzu8iGAE=
 github.com/Azure/azure-amqp-common-go/v3 v3.2.3 h1:uDF62mbd9bypXWi19V1bN5NZEO84JqgmI5G73ibAmrk=
 github.com/Azure/azure-amqp-common-go/v3 v3.2.3/go.mod h1:7rPmbSfszeovxGfc5fSAXE4ehlXQZHpMja2OtxC2Tas=
@@ -917,16 +920,15 @@ github.com/GoogleCloudPlatform/cloudsql-proxy v1.33.9/go.mod h1:+FaFzlKsx+X/2dR5
 github.com/GoogleCloudPlatform/cloudsql-proxy v1.37.10/go.mod h1:gij9WLu9mdiAFCM2EB+fwnbrVvc7cLr/klV1eEcFwbQ=
 github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.0 h1:oVLqHXhnYtUwM89y9T1fXGaK9wTkXHgNp8/ZNMQzUxE=
 github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.0/go.mod h1:dppbR7CwXD4pgtV9t3wD1812RaLDcBjtblcDF5f1vI0=
+github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.6.0/go.mod h1:I7kE2kM3qCr9QPT4cU4cCFYkEpVyVr16YOGUHzy+nR0=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.24.1/go.mod h1:itPGVDKf9cC/ov4MdvJ2QZ0khw4bfoo9jzwTJlaxy2k=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0/go.mod h1:yAZHSGnqScoU556rBOVkwLze6WP5N+U11RHuWaGVxwY=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0/go.mod h1:Cz6ft6Dkn3Et6l2v2a9/RpN7epQ1GtDlO6lj8bEcOvw=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0/go.mod h1:ZPpqegjbE99EPKsu3iUWV22A04wzGPcAY/ziSIQEEgs=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.30.0/go.mod h1:4BcvJy7WxY8X2eX49z2VO1ByhO+CcQK8lKPCH/QlZvo=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0/go.mod h1:cSgYe11MCNYunTnRXrKiR/tHc0eoKjICUuWpNZoVCOo=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/propagator v0.54.0/go.mod h1:8W5IW/jylevlBQKSWkh5ZMP2oy7yT9Pnfug6Y6W/9D8=
-github.com/JohannesKaufmann/html-to-markdown/v2 v2.5.1/go.mod h1:KUwy/WLgv9kv2yeBZkPCgDokHzg0M6EdRc17thnbVFw=
 github.com/Masterminds/goutils v1.1.0 h1:zukEsf/1JZwCMgHiK3GZftabmxiCw4apj3a28RPBiVg=
 github.com/Masterminds/goutils v1.1.0/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
@@ -946,8 +948,8 @@ github.com/acomagu/bufpipe v1.0.3 h1:fxAGrHZTgQ9w5QqVItgzwj235/uYZYgbXitB+dLupOk
 github.com/acomagu/bufpipe v1.0.3/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
 github.com/agnivade/levenshtein v1.0.1 h1:3oJU7J3FGFmyhn8KHjmVaZCN5hxTr7GxgRue+sxIXdQ=
 github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
+github.com/ajstarks/svgo v0.0.0-20211024235047-1546f124cd8b/go.mod h1:1KcenG0jGWcpt8ov532z81sp/kMMUG485J2InIOyADM=
 github.com/alecthomas/chroma/v2 v2.5.0/go.mod h1:yrkMI9807G1ROx13fhe1v6PN2DDeaR73L3d+1nmYQtw=
-github.com/alecthomas/chroma/v2 v2.24.1/go.mod h1:l+ohZ9xRXIbGe7cIW+YZgOGbvuVLjMps/FYN/CwuabI=
 github.com/alecthomas/kingpin/v2 v2.3.2 h1:H0aULhgmSzN8xQ3nX1uxtdlTHYoPLu5AhHxWrKI6ocU=
 github.com/alecthomas/kingpin/v2 v2.3.2/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
 github.com/alecthomas/kingpin/v2 v2.4.0/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
@@ -989,17 +991,13 @@ github.com/aws/aws-sdk-go v1.25.37/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpi
 github.com/aws/aws-sdk-go v1.36.30/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
 github.com/aws/aws-sdk-go-v2 v1.40.0/go.mod h1:c9pm7VwuW0UPxAEYGyTmyurVcNrbF6Rt/wixFqDhcjE=
-github.com/aws/aws-sdk-go-v2 v1.41.6/go.mod h1:dy0UzBIfwSeot4grGvY1AqFWN5zgziMmWGzysDnHFcQ=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3/go.mod h1:xdCzcZEtnSTKVDOmUZs4l/j3pSV6rpo1WXl5ugNsL8Y=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.20.26/go.mod h1:P5lKM3+laQ9v0KAOLhxOkClj4UbBwXJ2QcQc2sKSOYo=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression v1.8.26/go.mod h1:qEScmjwld3lw08e6CIWbPIgfcCKBdw2htqqBtSOSINQ=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.14/go.mod h1:jyoemRAktfCyZR9bTb5gT3kn/Vj2KwYDm0Pev5TsmEQ=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.14/go.mod h1:VymhrMJUWs69D8u0/lZ7jSB6WgaG/NqHi3gX0aYf6U0=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.22/go.mod h1:6sW9iWm9DK9YRpRGga/qzrzNLgKpT2cIxb7Vo2eNOp0=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.14/go.mod h1:1ipeGBMAxZ0xcTm6y6paC2C/J6f6OO7LBODV9afuAyM=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22/go.mod h1:KIpEUx0JuRZLO7U6cbV204cWAEco2iC3l061IxlwLtI=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.14/go.mod h1:k1xtME53H1b6YpZt74YmwlONMWf4ecM+lut1WQLAF/U=
-github.com/aws/aws-sdk-go-v2/service/cloudfront v1.61.1/go.mod h1:XUduecWr236DyG8nZwJMewFbS4QcL8NZHxohdYDoPhM=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.53.2/go.mod h1:bz4cZH7uK5fLxQbj7hL4MFDL+pjReC9en/nM2Wfwxsk=
 github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.32.6/go.mod h1:r2DJVcbGPv7oJGoPICCQJ+4ci5oSGjdXtdscnJIQBfk=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.3/go.mod h1:IW1jwyrQgMdhisceG8fQLmQIydcT/jWY21rFhzgaKwo=
@@ -1027,20 +1025,11 @@ github.com/aws/aws-sdk-go-v2/service/ssm v1.37.1/go.mod h1:Z4GG8XYwKzRKKtexaeWeV
 github.com/aws/aws-sdk-go-v2/service/ssm v1.67.4/go.mod h1:+nlWvcgDPQ56mChEBzTC0puAMck+4onOFaHg5cE+Lgg=
 github.com/aws/smithy-go v1.23.2/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
-github.com/aws/smithy-go v1.25.0/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/bazelbuild/rules_go v0.49.0/go.mod h1:Dhcz716Kqg1RHNWos+N6MlXNkjNP2EwZQ0LukRKJfMs=
 github.com/beorn7/perks v1.0.0 h1:HWo1m869IqiPhD389kmkxeTalrjNbbJTC8LXupb+sl0=
-github.com/bep/golocales v0.2.0/go.mod h1:Hl78nje8mNL3LzLeJvYN9NsIZgyFJGrGfvgO9r1+mwE=
-github.com/bep/goportabletext v0.2.0/go.mod h1:xDeA5+qcgKzJq6Q6XjAiBKtxLD3Yn7f6XP4joD3J3qU=
-github.com/bep/helpers v0.12.0/go.mod h1:PfE7MGdA8sSQ19nyDh4tYbs5rAlStlJaDI21f/fnNps=
-github.com/bep/imagemeta v0.17.2/go.mod h1:+Hlp195TfZpzsqCxtDKTG6eWdyz2+F2V/oCYfr3CZKA=
-github.com/bep/mclib v1.20401.20400/go.mod h1:v5Hh3EIinPn7epigP28uf9JCkZlYzBS2vEOPe2wrHzM=
-github.com/bep/overlayfs v0.11.0/go.mod h1:L+ggdoKm+Y7Xb4a1osd+/LOPG4qsY62snqRqJH5Mspc=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
-github.com/bits-and-blooms/bitset v1.24.5/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c h1:+0HFd5KSZ/mm3JmhmrDukiId5iR6w4+BdFtfSy4yWIc=
 github.com/blang/semver v3.5.0+incompatible h1:CGxCgetQ64DKk7rdZ++Vfnb1+ogGNnB17OJKJXD2Cfs=
-github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
 github.com/bwesterb/go-ristretto v1.2.3 h1:1w53tCkGhCQ5djbat3+MH0BAQ5Kfgbt56UZQ/JMzngw=
 github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
@@ -1049,6 +1038,7 @@ github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqy
 github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1 h1:glEXhBS5PSLLv4IXzLA5yPRVX4bilULVyxxbrfOtDAk=
+github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cheekybits/is v0.0.0-20150225183255-68e9c0620927 h1:SKI1/fuSdodxmNNyVBR8d7X/HuLnRpvvFO0AgyQk764=
 github.com/cheekybits/is v0.0.0-20150225183255-68e9c0620927/go.mod h1:h/aW8ynjgkuj+NQRlZcDbAbM1ORAbXjXX77sX7T289U=
@@ -1116,7 +1106,6 @@ github.com/cristalhq/acmd v0.11.2/go.mod h1:LG5oa43pE/BbxtfMoImHCQN++0Su7dzipdgB
 github.com/cristalhq/acmd v0.12.0 h1:RdlKnxjN+txbQosg8p/TRNZ+J1Rdne43MVQZ1zDhGWk=
 github.com/cristalhq/acmd v0.12.0/go.mod h1:LG5oa43pE/BbxtfMoImHCQN++0Su7dzipdgBjMCBVDQ=
 github.com/cyphar/filepath-securejoin v0.3.6/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
-github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/devigned/tab v0.1.1/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954 h1:RMLoZVzv4GliuWafOuPuQDKSm1SJph7uCRnnS61JAn4=
@@ -1126,7 +1115,6 @@ github.com/djherbis/atime v1.1.0/go.mod h1:28OF6Y8s3NQWwacXc5eZTsEsiMzp7LF8MbXE+
 github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dlclark/regexp2 v1.10.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
 github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
 github.com/docker/docker v0.7.3-0.20190327010347-be7ac8be2ae0 h1:w3NnFcKR5241cfmQU5ZZAsf0xcpId6mWOupTvJlUX2U=
@@ -1156,7 +1144,6 @@ github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2T
 github.com/esimonov/ifshort v1.0.4/go.mod h1:Pe8zjlRrJ80+q2CxHLfEOfTwxCZ4O+MuhcHcfgNWTk0=
 github.com/evanphx/json-patch v5.6.0+incompatible h1:jBYDEEiFBPxA0v50tFdvOzQQTCvpL6mnFh5mB2/l16U=
 github.com/evanphx/json-patch v5.6.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanw/esbuild v0.28.0/go.mod h1:D2vIQZqV/vIf/VRHtViaUtViZmG7o+kKmlBfVQuRi48=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
@@ -1170,10 +1157,7 @@ github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmV
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/fullstorydev/grpcurl v1.6.0 h1:p8BB6VZF8O7w6MxGr3KJ9E6EVKaswCevSALK6FBtMzA=
 github.com/fullstorydev/grpcurl v1.6.0/go.mod h1:ZQ+ayqbKMJNhzLmbpCiurTVlaK2M/3nqZCxaQ2Ze/sM=
-github.com/getkin/kin-openapi v0.139.0/go.mod h1:NGxPfE4PwS/TRXEbyx2RrxDFPZvxcWw31Tw8XXjPZLs=
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8 h1:DujepqpGd1hyOd7aW59XpK7Qymp8iy83xq74fLr21is=
-github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
-github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1 h1:QbL/5oDUmRBzO9/Z7Seo6zf912W/a6Sr4Eu0G/3Jho0=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4 h1:WtGNWLvXpe6ZudgnXrq0barxBImvnnJoMEhXAzcbM0I=
 github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
@@ -1220,19 +1204,18 @@ github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.2.1 h1:F2aeBZrm2NDsc7vbovKrWSogd4wvfAxg0FQ89/iqOTk=
 github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
+github.com/goccmack/gocc v1.0.2/go.mod h1:LXX2tFVUggS/Zgx/ICPOr3MLyusuM7EcbfkPvNsjdO8=
 github.com/goccy/go-json v0.9.11 h1:/pAaQDLHEoCq/5FFmSKBswWmK6H0e8g4159Kc/X/nqk=
 github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/godbus/dbus/v5 v5.0.4 h1:9349emZab16e7zQvpmsbtjc18ykshndd8y2PG3sgJbA=
 github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
-github.com/gohugoio/hugo v0.163.3/go.mod h1:3FPGFgeqGYDTPRe1NJ10L1giY5ViUGeNlkVBDmVk46w=
-github.com/gohugoio/hugo-goldmark-extensions/extras v0.7.0/go.mod h1:9LJNfKWFmhEJ7HW0in5znezMwH+FYMBIhNZ3VWtRcRs=
-github.com/gohugoio/hugo-goldmark-extensions/passthrough v0.5.0/go.mod h1:ob9PCHy/ocsQhTz68uxhyInaYCbbVNpOOrJkIoSeD+8=
 github.com/golang-jwt/jwt v3.2.1+incompatible h1:73Z+4BJcrTC+KczS6WvTPvRGOp1WmfEP4Q1lOd9Z/+c=
 github.com/golang-jwt/jwt v3.2.1+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
 github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ=
 github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
@@ -1288,19 +1271,18 @@ github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/cloud-bigtable-clients-test v0.0.2 h1:S+sCHWAiAc+urcEnvg5JYJUOdlQEm/SEzQ/c/IdAH5M=
 github.com/googleapis/cloud-bigtable-clients-test v0.0.2/go.mod h1:mk3CrkrouRgtnhID6UZQDK3DrFFa7cYCAJcEmNsHYrY=
+github.com/googleapis/cloud-bigtable-clients-test v0.0.4/go.mod h1:NNHPqSxC2OBSLmt1j/qofCRRzL0OYZxk24CsicIe8MA=
 github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
 github.com/googleapis/enterprise-certificate-proxy v0.2.4/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
 github.com/googleapis/enterprise-certificate-proxy v0.3.5/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
 github.com/googleapis/gax-go/v2 v2.0.5 h1:sjZBwGj9Jlw33ImPtvFviGYvseOtDM7hkSKB7+Tv3SM=
 github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI=
 github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
 github.com/googleapis/gax-go/v2 v2.16.0/go.mod h1:o1vfQjjNZn4+dPnRdl/4ZD7S9414Y4xA+a/6Icj6l14=
 github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
-github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8 h1:tlyzajkF3030q6M8SvmJSemC9DTHL/xaMa18b65+JM4=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20210719221736-1c9a4c676720 h1:zC34cGQu69FG7qzJ3WiKW244WfhDC3xxYMeNOX2gtUQ=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20210719221736-1c9a4c676720/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
@@ -1408,6 +1390,7 @@ github.com/jhump/protoreflect v1.6.1 h1:4/2yi5LyDPP7nN+Hiird1SAJ6YoxUm13/oxHGRnb
 github.com/jhump/protoreflect v1.6.1/go.mod h1:RZQ/lnuN+zqeRVpQigTwO6o0AJUkxbnSnpuG7toUTG4=
 github.com/jirfag/go-printf-func-name v0.0.0-20200119135958-7558a9eaa5af/go.mod h1:HEWGJkRDzjJY2sqdDwxccsGicWEf9BQOZsq2tV+xzM0=
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
 github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
 github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
@@ -1442,7 +1425,6 @@ github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBF
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.2.5 h1:0E5MSMDEoAulmXNFquVs//DdoomxaoTY1kUhbc/qbZg=
 github.com/klauspost/cpuid/v2 v2.2.5/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3 h1:CE8S1cTafDpPvMhIxNJKvHsGVBgn1xWYf1NbHQhywc8=
@@ -1457,7 +1439,6 @@ github.com/lib/pq v1.9.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
-github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lufeee/execinquery v1.2.1/go.mod h1:EC7DrEKView09ocscGHC+apXMIaorh4xqSxS/dy8SbM=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
@@ -1465,7 +1446,6 @@ github.com/lyft/protoc-gen-star/v2 v2.0.3 h1:/3+/2sWyXeMLzKd1bX+ixWKgEMsULrIivpD
 github.com/lyft/protoc-gen-star/v2 v2.0.3/go.mod h1:amey7yeodaJhXSbf/TlLvWiqQfLOSpEk//mLlc+axEk=
 github.com/lyft/protoc-gen-star/v2 v2.0.4-0.20230330145011-496ad1ac90a4 h1:sIXJOMrYnQZJu7OB7ANSF4MYri2fTEGIsRLz6LwI4xE=
 github.com/lyft/protoc-gen-star/v2 v2.0.4-0.20230330145011-496ad1ac90a4/go.mod h1:amey7yeodaJhXSbf/TlLvWiqQfLOSpEk//mLlc+axEk=
-github.com/magefile/mage v1.17.2/go.mod h1:Yj51kqllmsgFpvvSzgrZPK9WtluG3kUhFaBUVLo4feA=
 github.com/magiconair/properties v1.8.1 h1:ZC2Vc7/ZFkGmsVC9KvOjumD+G5lXy2RtTKyzRKO2BQ4=
 github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
 github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
@@ -1479,7 +1459,6 @@ github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcME
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-runewidth v0.0.2 h1:UnlwIPBGaTZfPQ6T1IGzPI0EkYAQmT9fAEJ/poFC63o=
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.6/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
@@ -1487,6 +1466,7 @@ github.com/mattn/go-sqlite3 v1.14.6 h1:dNPt6NO46WmLVt2DLNpwczCmdV5boIZ6g/tlDrlRU
 github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
+github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/mbilski/exhaustivestruct v1.2.0/go.mod h1:OeTBVxQWoEmB2J2JCHmXWPJ0aksxSUOUy+nvtVEfzXc=
 github.com/mgechev/dots v0.0.0-20210922191527-e955255bf517 h1:zpIH83+oKzcpryru8ceC6BxnoG8TBrhgAvRg8obzup0=
 github.com/mgechev/dots v0.0.0-20210922191527-e955255bf517/go.mod h1:KQ7+USdGKfpPjXk4Ga+5XxQM4Lm4e3gAogrreFAYpOg=
@@ -1549,8 +1529,6 @@ github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OS
 github.com/neurosnap/sentences v1.0.6 h1:iBVUivNtlwGkYsJblWV8GGVFmXzZzak907Ci8aA0VTE=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
 github.com/nishanths/predeclared v0.0.0-20190419143655-18a43bb90ffc/go.mod h1:62PewwiQTlm/7Rj+cxVYqZvDIUc+JjZq6GHAC1fsObQ=
-github.com/oasdiff/yaml v0.1.0/go.mod h1:kOlRmMdL2X3vucLCEQO5u61SU22RysnfXvcttrZA1O0=
-github.com/oasdiff/yaml3 v0.0.13/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5 h1:58+kh9C6jJVXYjt8IE48G2eWl6BjwU5Gj0gqY84fy78=
 github.com/olekukonko/tablewriter v0.0.1/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
@@ -1577,14 +1555,12 @@ github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144T
 github.com/pborman/uuid v1.2.0 h1:J7Q5mO4ysT1dv8hyrUGHb9+ooztCXu1D8MY8DZYsu3g=
 github.com/pelletier/go-toml v1.2.0 h1:T5zMGML61Wp+FlcbWjRDT7yAxhJNAiPPLOFECq181zc=
 github.com/pelletier/go-toml/v2 v2.0.2/go.mod h1:MovirKjgVRESsAvNZlAjtFwV867yGuwRkXbG66OzopI=
-github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/phayes/checkstyle v0.0.0-20170904204023-bfd46e6a821d h1:CdDQnGF8Nq9ocOS/xlSptM1N3BbrA6/kmaep5ggwaIA=
 github.com/phayes/checkstyle v0.0.0-20170904204023-bfd46e6a821d/go.mod h1:3OzsM7FXDQlpCiw2j81fOmAwQLnZnLGXVKUzeKQXIAw=
 github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0=
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pierrec/lz4/v4 v4.1.18 h1:xaKrnTkyoqfh1YItXl56+6KJNVYWlEEPuAQW9xsplYQ=
 github.com/pierrec/lz4/v4 v4.1.18/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
-github.com/pjbgf/sha1cd v0.6.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
 github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e h1:aoZm08cpOy4WuID//EZDgcC4zIxODThtZNPirFr42+A=
 github.com/pkg/sftp v1.13.1 h1:I2qBYMChEhIjOgazfJmV3/mZM256btk6wkCDRmW7JYs=
@@ -1649,7 +1625,6 @@ github.com/russross/blackfriday v1.5.2 h1:HyvC0ARfnZBqnXwABFeSZHpKvJHJJfPz81GNue
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f h1:UFr9zpz4xgTnIE5yIMtWAMngCdZ9p/+q6lTbgelo80M=
 github.com/sagikazarmark/crypt v0.15.0 h1:TQJg76CemcIdJyC9/dmNjU9OUyIFHyvE50Tpq1t1nqY=
 github.com/sagikazarmark/crypt v0.15.0/go.mod h1:5rwNNax6Mlk9sZ40AcyVtiEw24Z4J04cfSioF2COKmc=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
 github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c/go.mod h1:/PevMnwAxekIXwN8qQyfc5gl2NlkB3CQlkizAbOkeBs=
 github.com/shirou/gopsutil/v3 v3.23.1 h1:a9KKO+kGLKEvcPIs4W62v0nu3sciVDOOOPUD0Hz7z/4=
@@ -1698,10 +1673,6 @@ github.com/tdewolff/argp v0.0.0-20231030173501-fa6c54897951 h1:QiakK8TMHgZfKZ2en
 github.com/tdewolff/argp v0.0.0-20231030173501-fa6c54897951/go.mod h1:fF+gnKbmf3iMG+ErLiF+orMU/InyZIEnKVVigUjfriw=
 github.com/tdewolff/argp v0.0.0-20250430135133-0f54527d2b1e/go.mod h1:xw2b1X81m4zY1OGytzHNr/YKXbf/STHkK5idoNamlYE=
 github.com/tdewolff/argp v0.0.0-20260424074207-decde4f86440/go.mod h1:t4IfmOfK1WpBPd456pTdSB4f+BuMp6CUGnV7CBzduxk=
-github.com/tdewolff/minify/v2 v2.24.13/go.mod h1:emvwoYeIl8bfAKqRU5ww95LX9Gpggpqv/naal9a8Yq0=
-github.com/tdewolff/parse/v2 v2.8.12/go.mod h1:Hwlni2tiVNKyzR1o6nUs4FOF07URA+JLBLd6dlIXYqo=
-github.com/tdewolff/test v1.0.12/go.mod h1:XPuWBzvdUzhCuxWO1ojpXsyzsA5bFoS3tO/Q3kFuTG8=
-github.com/tetratelabs/wazero v1.12.0/go.mod h1:LvKtzl2RqO4gyF27BiXU+nKAjcV8f38U+kP/q2vgxh0=
 github.com/tidwall/pretty v1.0.0 h1:HsD+QiTn7sK6flMKIvNmpqz1qrpP3Ps6jOKIKMooyg4=
 github.com/tklauser/go-sysconf v0.3.11 h1:89WgdJhk5SNwJfu+GKyYveZ4IaJ7xAkecBo+KdJV0CM=
 github.com/tklauser/go-sysconf v0.3.11/go.mod h1:GqXfhXY3kiPa0nAXPDIQIWzJbMCB7AmcWpGR8lSZfqI=
@@ -1751,7 +1722,6 @@ github.com/yudai/pp v2.0.1+incompatible h1:Q4//iY4pNF6yPLZIigmvcl7k/bPgrcTPIFIcm
 github.com/yudai/pp v2.0.1+incompatible/go.mod h1:PuxR/8QJ7cyCkFp/aUDS+JY727OFEZkTdatxwunjIkc=
 github.com/yuin/goldmark v1.4.13 h1:fVcFKWvrslecOb/tg+Cc05dkeYx540o0FuFt3nUVDoE=
 github.com/yuin/goldmark v1.7.10/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
-github.com/yuin/goldmark v1.8.2/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
 github.com/yusufpapurcu/wmi v1.2.2 h1:KBNDSne4vP5mbSWnJbO+51IMOXJB67QiYCSBrubbPRg=
 github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=
@@ -1803,11 +1773,9 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.4
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.42.0/go.mod h1:5z+/ZWJQKXa9YT34fQNx5K8Hd1EoIhvtUygUQPqEOgQ=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0 h1:KfYpVmrjI7JuToy5k8XV3nkapjWx48k4E4JOtVstzQI=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0/go.mod h1:SeQhzAEccGVZVEy7aH87Nh0km+utSpo1pTv6eMMop48=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
 go.opentelemetry.io/contrib/propagators/aws v1.38.0/go.mod h1:wXqc9NTGcXapBExHBDVLEZlByu6quiQL8w7Tjgv8TCg=
 go.opentelemetry.io/otel v1.19.0 h1:MuS/TNf4/j4IXsZuJegVzI1cwut7Qc00344rgH7p8bs=
 go.opentelemetry.io/otel v1.19.0/go.mod h1:i0QyjOq3UPoTzff0PJB2N66fb4S0+rSbSB15/oyH9fY=
@@ -1825,8 +1793,8 @@ go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVY
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0 h1:3d+S281UTjM+AbF31XSOYn1qXn3BgIdWl8HNEpx08Jk=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0/go.mod h1:0+KuTDyKL4gjKCF75pHOX4wuzYDUZYfAQdSu43o+Z2I=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0/go.mod h1:Kz/oCE7z5wuyhPxsXDuaPteSWqjSBD5YaSdbxZYGbGk=
+go.opentelemetry.io/otel/exporters/prometheus v0.57.0/go.mod h1:QpFWz1QxqevfjwzYdbMb4Y1NnlJvqSGwyuU0B4iuc9c=
 go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0/go.mod h1:dowW6UsM9MKbJq5JTz2AMVp3/5iW5I/TStsk8S+CfHw=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0/go.mod h1:ra3Pa40+oKjvYh+ZD3EdxFZZB0xdMfuileHAm4nNN7w=
 go.opentelemetry.io/otel/metric v1.19.0 h1:aTzpGtV0ar9wlV4Sna9sdJyII5jTVJEvKETPiOKwvpE=
 go.opentelemetry.io/otel/metric v1.19.0/go.mod h1:L5rUsV9kM1IxCj1MmSdS+JQAcVm319EUrDVLrt7jqt8=
 go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s=
@@ -1871,6 +1839,7 @@ go.starlark.net v0.0.0-20190528202925-30ae18b8564f/go.mod h1:c1/X6cHgvdXj6pUlmWK
 go.uber.org/atomic v1.4.0 h1:cxzIVoETapQEqDhQu3QfnvXAV4AlzcvUCxkVUFw3+EU=
 go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
 go.uber.org/multierr v1.1.0 h1:HoEmRHQPVSqub6w2z2d2EOVs2fjyFRGyofhKuyDq0QI=
 go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
@@ -1914,16 +1883,13 @@ golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU
 golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
 golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
 golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/exp v0.0.0-20200331195152-e8c3332aa8e5/go.mod h1:4M0jN8W1tt0AVLNr8HDosyJCDCDuyL9N9+3m7wDWgKw=
 golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
-golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/exp/typeparams v0.0.0-20221208152030-732eee02a75a/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/exp/typeparams v0.0.0-20230307190834-24139beb5833/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b h1:+qEpEAPhDZ1o0x3tHzZTQDArnOixOzGD9HUJfcg0mb4=
 golang.org/x/image v0.41.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
-golang.org/x/image v0.42.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b h1:Wh+f8QHJXR411sJR8/vRBTZ7YapZaRvUcLFFJhusH0k=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028 h1:4+4C/Iv2U4fMZBiMCc98MG1In4gJY5YRhtpDNeDeHWs=
 golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
@@ -1936,7 +1902,6 @@ golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
 golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
 golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191002035440-2ec189313ef0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
@@ -1976,7 +1941,6 @@ golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
 golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
 golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/oauth2 v0.0.0-20210427180440-81ed05c6b58c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
@@ -1993,7 +1957,6 @@ golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKl
 golang.org/x/oauth2 v0.31.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/oauth2 v0.33.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190412183630-56d357773e84/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
 golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -2008,7 +1971,6 @@ golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190130150945-aca44879d564/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -2065,7 +2027,6 @@ golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFK
 golang.org/x/telemetry v0.0.0-20250807160809-1a19826ec488 h1:3doPGa+Gg4snce233aCWnbZVFsyFMo/dR40KK/6skyE=
 golang.org/x/telemetry v0.0.0-20250807160809-1a19826ec488/go.mod h1:fGb/2+tgXXjhjHsTNdVEEMZNWA0quBnfrO+AfoDSAKw=
 golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa/go.mod h1:kHjTxDEnAu6/Nl9lDkzjWpR+bmKfxeiRuSDlsMb70gE=
-golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6/go.mod h1:Eqhaxk/wZsWEH8CRxLwj6xzEJbz7k1EFGqx7nyCoabE=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20220526004731-065cf7ba2467/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
@@ -2073,7 +2034,6 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
@@ -2098,12 +2058,10 @@ golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/time v0.13.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191010075000-0337d82405ff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -2138,11 +2096,11 @@ golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw
 golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
 golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 gomodules.xyz/jsonpatch/v2 v2.0.1 h1:xyiBuvkD2g5n7cYzx6u2sxQvsAy4QJsZFCzGVdzOXZ0=
 gonum.org/v1/gonum v0.0.0-20190331200053-3d26580ed485 h1:OB/uP/Puiu5vS5QMRPrXCDWUPb+kt8f1KW8oQzFejQw=
-gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 gonum.org/v1/netlib v0.0.0-20190331212654-76723241ea4e h1:jRyg0XfpwWlhEV8mDfdNGBeSJM2fuyh9Yjrnd8kF2Ts=
+gonum.org/v1/plot v0.15.2/go.mod h1:DX+x+DWso3LTha+AdkJEv5Txvi+Tql3KAGkehP0/Ubg=
+gonum.org/v1/tools v0.0.0-20200318103217-c168b003ce8c/go.mod h1:fy6Otjqbk477ELp8IXTpw1cObQtLbRCBVonY+bTTfcM=
 google.golang.org/api v0.10.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
 google.golang.org/api v0.46.0/go.mod h1:ceL4oozhkAiTID8XMmJBsIxID/9wMXJVVFXPg4ylg3I=
 google.golang.org/api v0.47.0/go.mod h1:Wbvgpq1HddcWVtzsVLyfLp8lDg6AA241LmgIL59tHXo=
@@ -2158,7 +2116,6 @@ google.golang.org/api v0.264.0/go.mod h1:fAU1xtNNisHgOF5JooAs8rRaTkl2rT3uaoNGo9N
 google.golang.org/api v0.265.0/go.mod h1:uAvfEl3SLUj/7n6k+lJutcswVojHPp2Sp08jWCu8hLY=
 google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA=
 google.golang.org/api v0.274.0/go.mod h1:JbAt7mF+XVmWu6xNP8/+CTiGH30ofmCmk9nM8d8fHew=
-google.golang.org/api v0.276.0/go.mod h1:Fnag/EWUPIcJXuIkP1pjoTgS5vdxlk3eeemL7Do6bvw=
 google.golang.org/appengine v1.6.2/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
 google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
@@ -2182,7 +2139,6 @@ google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9/go.mod h1:QFOrLhdA
 google.golang.org/genproto v0.0.0-20251124214823-79d6a2a48846/go.mod h1:PP0g88Dz3C7hRAfbQCQggeWAXjuqGsNPLE4s7jh0RGU=
 google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:yJ2HH4EHEDTd3JiLmhds6NkJ17ITVYOdV3m3VKOnws0=
 google.golang.org/genproto v0.0.0-20260128011058-8636f8732409/go.mod h1:rxKD3IEILWEu3P44seeNOAwZN4SaoKaQ/2eTg4mM6EM=
-google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=
 google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
 google.golang.org/genproto/googleapis/api v0.0.0-20230711160842-782d3b101e98/go.mod h1:rsr7RhLuwsDKL7RmgDDCUc6yaGr1iqceVb5Wv6f6YvQ=
 google.golang.org/genproto/googleapis/api v0.0.0-20230803162519-f966b187b2e5/go.mod h1:5DZzOUPCLYL3mNkQ0ms0F3EuUNZ7py1Bqeq6sxzI7/Q=
@@ -2209,7 +2165,6 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260120221211-b8f7ae30c516/go.
 google.golang.org/genproto/googleapis/api v0.0.0-20260122232226-8e98ce8d340d/go.mod h1:p3MLuOwURrGBRoEyFHBT3GjUwaCQVKeNqqWxlcISGdw=
 google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20/go.mod h1:ZdbssH/1SOVnjnDlXzxDHK2MCidiqXtbYccJNzNYPEE=
 google.golang.org/genproto/googleapis/api v0.0.0-20260316172706-e463d84ca32d/go.mod h1:X2gu9Qwng7Nn009s/r3RUxqkzQNqOrAy79bluY7ojIg=
-google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20230920204549-e6e6cdab5c13 h1:AzcXcS6RbpBm65S0+/F78J9hFCL0/GZWp8oCRZod780=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20230920204549-e6e6cdab5c13/go.mod h1:qDbnxtViX5J6CvFbxeNUSzKgVlDLJ/6L+caxye9+Flo=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20231120223509-83a465c0220f h1:hL+1ptbhFoeL1HcROQ8OGXaqH0jYRRibgWQWco0/Ugc=
@@ -2254,7 +2209,6 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA=
 google.golang.org/grpc v1.29.0/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
@@ -2280,12 +2234,14 @@ google.golang.org/grpc v1.77.0/go.mod h1:z0BY1iVj0q8E1uSQCjL9cppRj+gnZjzDnzV0dHh
 google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
 google.golang.org/grpc v1.79.2/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
 google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
-google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0 h1:M1YKkFIboKNieVO5DLUEVzQfGwJD30Nv2jfUgzb5UcE=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0 h1:rNBFJjBCOgVr9pWD7rs/knKL4FRTKgpZmsRfV214zcA=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0/go.mod h1:Dk1tviKTvMCz5tvh7t+fh94dhmQVHuCt2OzJB3CTW9Y=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6/go.mod h1:6ytKWczdvnpnO+m+JiG9NjEDzR1FJfsnmJdG7B8QVZ8=
+google.golang.org/grpc/gcp/observability v1.0.1/go.mod h1:yM0UcrYRMe/B+Nu0mDXeTJNDyIMJRJnzuxqnJMz7Ewk=
+google.golang.org/grpc/security/advancedtls v1.0.0/go.mod h1:o+s4go+e1PJ2AjuQMY5hU82W7lDlefjJA6FqEHRVHWk=
+google.golang.org/grpc/stats/opencensus v1.0.0/go.mod h1:FhdkeYvN43wLYUnapVuRJJ9JXkNwe403iLUW2LKSnjs=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
@@ -2318,7 +2274,7 @@ gopkg.in/square/go-jose.v2 v2.2.2 h1:orlkJ3myw8CN1nVQHBFfloD+L3egixIa4FvUP6RosSA
 gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0 h1:POO/ycCATvegFmVuPpQzZFJ+pGZeX22Ufu6fibxDVjU=
 gopkg.in/yaml.v2 v2.2.6/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
-howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 k8s.io/apiserver v0.29.0 h1:Y1xEMjJkP+BIi0GSEv1BBrf1jLU9UPfAnnGGbbDdp7o=
 k8s.io/apiserver v0.29.0/go.mod h1:31n78PsRKPmfpee7/l9NYEv67u6hOL6AfcE761HapDM=
 k8s.io/code-generator v0.29.0 h1:2LQfayGDhaIlaamXjIjEQlCMy4JNCH9lrzas4DNW1GQ=
@@ -2329,6 +2285,7 @@ k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01 h1:pWEwq4Asjm4vjW7vcsmijwBhOr1/s
 k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
 k8s.io/gengo/v2 v2.0.0-20240826214909-a7b603a56eb7 h1:cErOOTkQ3JW19o4lo91fFurouhP8NcoBvb7CkvhZZpk=
 k8s.io/gengo/v2 v2.0.0-20240826214909-a7b603a56eb7/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
+k8s.io/gengo/v2 v2.0.0-20250604051438-85fd79dbfd9f/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
 k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
 k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kms v0.29.0 h1:KJ1zaZt74CgvgV3NR7tnURJ/mJOKC5X3nwon/WdwgxI=
@@ -2341,9 +2298,9 @@ modernc.org/xc v1.0.0 h1:7ccXrupWZIS3twbUGrtKmHS2DXY6xegFua+6O3xgAFU=
 mvdan.cc/interfacer v0.0.0-20180901003855-c20040233aed/go.mod h1:Xkxe497xwlCKkIaQYRfC7CSLworTXY9RMqwhhCm+8Nc=
 mvdan.cc/lint v0.0.0-20170908181259-adc824a0674b/go.mod h1:2odslEg/xrtNQqCYg2/jCoyKnw3vv5biOc3JnIcYfL4=
 rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
+rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
 rsc.io/quote/v3 v3.1.0 h1:9JKUTTIUgS6kzR9mK1YuGKv6Nl+DijDNIc0ghT58FaY=
 rsc.io/sampler v1.3.0 h1:7uVkIFmeBqHfdjD+gZwtXXI+RODJ2Wc4O7MPEh/QiW4=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.28.0 h1:TgtAeesdhpm2SGwkQasmbeqDo8th5wOBA5h/AjTKA4I=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.28.0/go.mod h1:VHVDI/KrK4fjnV61bE2g3sA7tiETLn8sooImelsCx3Y=
 sigs.k8s.io/kustomize/cmd/config v0.19.0/go.mod h1:29Vvdl26PidPLUDi7nfjYa/I0wHBkwCZp15Nlcc4y98=
-software.sslmate.com/src/go-pkcs12 v0.7.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=

hack/go.mod

@@ -7,8 +7,6 @@ tool (
 	github.com/campoy/embedmd
 	// for creating GitHub PRs & releases
 	github.com/cli/cli/cmd/gh
-	// for bundling non-go files into go binaries
-	github.com/go-bindata/go-bindata/v3/go-bindata
 	// for site serving
 	github.com/gohugoio/hugo
 	// for code linting
@@ -174,7 +172,6 @@ require (
 	github.com/fzipp/gocyclo v0.6.0 // indirect
 	github.com/getkin/kin-openapi v0.139.0 // indirect
 	github.com/ghostiam/protogetter v0.3.9 // indirect
-	github.com/go-bindata/go-bindata/v3 v3.1.3 // indirect
 	github.com/go-critic/go-critic v0.12.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.9.0 // indirect
@@ -425,7 +422,6 @@ require (
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
 	golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac // indirect
 	golang.org/x/image v0.42.0 // indirect
-	golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 // indirect
 	golang.org/x/mod v0.36.0 // indirect
 	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect

hack/go.sum

@@ -406,8 +406,6 @@ github.com/ghostiam/protogetter v0.3.9 h1:j+zlLLWzqLay22Cz/aYwTHKQ88GE2DQ6GkWSYF
 github.com/ghostiam/protogetter v0.3.9/go.mod h1:WZ0nw9pfzsgxuRsPOFQomgDVSWtDLJRfQJEhsGbmQMA=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
-github.com/go-bindata/go-bindata/v3 v3.1.3 h1:F0nVttLC3ws0ojc7p60veTurcOm//D4QBODNM7EGrCI=
-github.com/go-bindata/go-bindata/v3 v3.1.3/go.mod h1:1/zrpXsLD8YDIbhZRqXzm1Ghc7NhEvIN9+Z6R5/xH4I=
 github.com/go-critic/go-critic v0.12.0 h1:iLosHZuye812wnkEz1Xu3aBwn5ocCPfc9yqmFG9pa6w=
 github.com/go-critic/go-critic v0.12.0/go.mod h1:DpE0P6OVc6JzVYzmM5gq5jMU31zLr4am5mB/VfFK64w=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
@@ -747,7 +745,6 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF
 github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
 github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
-github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/errcheck v1.9.0 h1:9xt1zI9EBfcYBvdU1nVrzMzzUPUtPKs9bVSIM3TAb3M=
 github.com/kisielk/errcheck v1.9.0/go.mod h1:kQxWMMVZgIkDq7U8xtG/n2juOjbLgZtedi0D+/VL/i8=
@@ -1264,8 +1261,6 @@ golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRu
 golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 h1:VLliZ0d+/avPrXXH+OakdXhpJuEoBZuwh1m2j7U6Iug=
-golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
@@ -1458,7 +1453,6 @@ golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=

kustomize/commands/openapi/info/info.go

@@ -8,7 +8,7 @@ import (
 	"io"
 
 	"github.com/spf13/cobra"
-	"sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi"
+	"sigs.k8s.io/kustomize/kyaml/openapi"
 )
 
 // NewCmdInfo makes a new info command.
@@ -18,7 +18,7 @@ func NewCmdInfo(w io.Writer) *cobra.Command {
 		Short:   "Prints the `info` field from the kubernetes OpenAPI data",
 		Example: `kustomize openapi info`,
 		Run: func(cmd *cobra.Command, args []string) {
-			fmt.Fprintln(w, kubernetesapi.Info)
+			fmt.Fprintln(w, openapi.BuiltinSchemaInfo)
 		},
 	}
 	return &infoCmd

kyaml/openapi/Makefile

@@ -1,62 +1,13 @@
 # Copyright 2020 The Kubernetes Authors.
 # SPDX-License-Identifier: Apache-2.0
 
-MYGOBIN = $(shell go env GOBIN)
-ifeq ($(MYGOBIN),)
-MYGOBIN = $(shell go env GOPATH)/bin
-endif
-KIND_VERSION := "v0.11.1"
-API_VERSION ?= "v1.21.2"
-
 .PHONY: all
-all: \
+all: generate
-	kustomizationapi/swagger.go \
-	kubernetesapi/swagger.go \
-	kubernetesapi/openapiinfo.go
 
-.PHONY: clean
+.PHONY: generate
-clean:
+generate:
-	rm kustomizationapi/swagger.go
+	go generate .
-	rm kubernetesapi/openapiinfo.go
 
-# This will remove all currently built-in schema,
+.PHONY: verify
-# so think twice before deleting.
+verify:
-# To replace what this will delete typically requires the ability
+	GOWORK=off go test ./...
-# to contact a live kubernetes API server.
-.PHONY: nuke
-nuke: clean
-	rm -r kubernetesapi/*
-
-$(MYGOBIN)/go-bindata:
-	go install github.com/go-bindata/go-bindata/v3/go-bindata@latest
-
-$(MYGOBIN)/kind:
-	( \
-		set -e; \
-		d=$(shell mktemp -d); cd $$d; \
-		wget -O ./kind https://github.com/kubernetes-sigs/kind/releases/download/$(KIND_VERSION)/kind-$(shell uname)-amd64; \
-		chmod +x ./kind; \
-		mv ./kind $(MYGOBIN); \
-		rm -rf $$d; \
-	)
-
-.PHONY: kubernetesapi/openapiinfo.go
-kubernetesapi/openapiinfo.go:
-	./scripts/makeOpenApiInfoDotGo.sh
-
-kustomizationapi/swagger.go: $(MYGOBIN)/go-bindata kustomizationapi/swagger.json
-	$(MYGOBIN)/go-bindata \
-		--pkg kustomizationapi \
-		-o kustomizationapi/swagger.go \
-		kustomizationapi/swagger.json
-
-.PHONY: kubernetesapi/swagger.pb
-kubernetesapi/swagger.pb: $(MYGOBIN)/kind $(MYGOBIN)/kustomize
-	./scripts/fetchSchemaFromCluster.sh $(API_VERSION)
-
-.PHONY: kubernetesapi/swagger.go
-kubernetesapi/swagger.go: $(MYGOBIN)/go-bindata kubernetesapi/swagger.pb
-	./scripts/generateSwaggerDotGo.sh $(API_VERSION)
-
-$(MYGOBIN)/kustomize:
-	$(shell cd ../.. && MYGOBIN=$(MYGOBIN) make $(MYGOBIN)/kustomize)

kyaml/openapi/README.md

@@ -1,84 +1,60 @@
-# Sampling New OpenAPI Data
+# Built-in OpenAPI data
 
-[OpenAPI schema]: ./kubernetesapi/
+Kustomize embeds a compiled OpenAPI bundle for Kubernetes built-in types. The
-[Kustomization schema]: ./kustomizationapi/
+runtime artifact is:
-[kind]: https://hub.docker.com/r/kindest/node/tags
-
-This document describes how to fetch OpenAPI data from a
-live kubernetes API server. 
-The scripts used will create a clean [kind] instance for this purpose.
-
-## Replacing the default openapi schema version
-
-### Delete all currently built-in schema
-
-This will remove both the Kustomization and Kubernetes schemas:
 
 ```
-make nuke
+kubernetesapi/data/kubernetes-openapi-union-v1.21.2.bundle-v1.json.gz
 ```
 
-### Choose the new version to use
+The Kubernetes suffix identifies the newest Kubernetes schema represented by
+the bundle. `bundle-v1` is the independent artifact format version. The
+initial compiler migration uses a single v1.21.2 source, so both the coverage
+floor and ceiling are v1.21.2.
 
-The compiled-in schema version should maximize API availability with respect to all actively supported Kubernetes versions. For example, while 1.20, 1.21 and 1.22 are the actively supported versions, 1.21 is the best choice. This is because 1.21 introduces at least one new API and does not remove any, while 1.22 removes a large set of long-deprecated APIs that are still supported in 1.20/1.21.
+The bundle contains the complete OpenAPI definitions and a compact index from
+GVK to root definition and resource scope. API paths and other top-level
+OpenAPI fields are compiler inputs and are not embedded in the runtime binary.
 
-### Generating additional schema
+## Regenerating the bundle
 
-If you'd like to change the default schema version, then in the Makefile in this directory, update the `API_VERSION` to your desired version.
+The checked-in source is the gzip-compressed v1.21.2 OpenAPI protobuf at:
-
-You may need to update the version of Kind these scripts use by changing `KIND_VERSION` in the Makefile in this directory. You can find compatibility information in the [kind release notes](https://github.com/kubernetes-sigs/kind/releases).
-
-In this directory, fetch the openapi schema, generate the
-corresponding swagger.go for the kubernetes api, and update `kubernetesapi/openapiinfo.go`:
 
 ```
-make all
+kubernetesapi/v1_21_2/swagger.pb.gz
 ```
 
-If you want to run the steps individually instead of using `make all`, you can run
+Its uncompressed SHA-256 is:
-the following commands:
 
 ```
-make kustomizationapi/swagger.go
+5d171b55e9601912807a870d73ffe70bb306f5889a00e76986042a0f2d7b6bc2
-make kubernetesapi/swagger.go
-make kubernetesapi/openapiinfo.go
 ```
 
-You can optionally delete the old `swagger.pb` and `swagger.go` files if we no longer need to support that kubernetes version of
+Source acquisition is deliberately separate from compilation. When updating
-openapi data. Make sure you rerun `make kubernetesapi/openapiinfo.go` after deleting any old schemas.
+Kubernetes, obtain the protobuf from an API server running the exact release,
+review its provenance, and use the compiler's `-legacy-proto-output` flag to
+write the deterministic checked-in `.pb.gz` archive. Update the embedded path,
+version constants, and generated bundle together. Every source's uncompressed
+digest is recorded in the bundle metadata.
 
-
+Regenerate the runtime bundle with:
-#### Precomputations
-
-To avoid expensive schema lookups, some functions have precomputed results based on the schema. Unit tests
-ensure these are kept in sync with the schema; if these tests fail you will need to follow the suggested diff
-to update the precomputed results.
-
-### Run all tests
-
-At the top of the repository, run the tests.
 
 ```
-make prow-presubmit-check >& /tmp/k.txt; echo $?
+make -C kyaml/openapi generate
 ```
 
-The exit code should be zero; if not, examine `/tmp/k.txt`.
+The compiler performs the protobuf-to-OpenAPI conversion, constructs the GVK
-
+and scope index, validates local references, writes canonical JSON, and uses a
-## Partial regeneration
+deterministic gzip header. The generated artifact must be byte-for-byte
-
+reproducible. Verify it and run the OpenAPI tests with:
-You can also regenerate the kubernetes api schemas specifically with:
 
 ```
-rm kubernetesapi/swagger.go
+make -C kyaml/openapi verify
-make kubernetesapi/swagger.go
 ```
 
-To fetch the schema without generating the swagger.go, you can
+The protobuf archive is retained only as the compiler input and to preserve
-run:
+the legacy public asset API. The normal Kustomize runtime does not import that
+compatibility package.
 
-```
+The small Kustomization schema remains as source JSON at
-rm kubernetesapi/swagger.pb
+`kustomizationapi/swagger.json` and is embedded directly with `go:embed`.
-make kubernetesapi/swagger.pb
-```
-
-Note that generating the swagger.go will re-fetch the schema.

kyaml/openapi/builtin_schema.go

@@ -0,0 +1,27 @@
+// Copyright 2026 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package openapi
+
+import _ "embed"
+
+//go:generate go run ./cmd/openapi-bundle -input kubernetesapi/v1_21_2/swagger.pb.gz -output kubernetesapi/data/kubernetes-openapi-union-v1.21.2.bundle-v1.json.gz -kubernetes-version v1.21.2
+
+const (
+	// DefaultOpenAPI is the Kubernetes version represented by the built-in
+	// schema. It remains v1.21.2 during the initial artifact-format migration.
+	DefaultOpenAPI = "v1.21.2"
+
+	// BuiltinSchemaInfo is the value printed by `kustomize openapi info`.
+	BuiltinSchemaInfo = "{title:Kubernetes,version:" + DefaultOpenAPI + "}"
+)
+
+//go:embed kubernetesapi/data/kubernetes-openapi-union-v1.21.2.bundle-v1.json.gz
+var builtinKubernetesOpenAPIBundle []byte
+
+//go:embed kustomizationapi/swagger.json
+var builtinKustomizationOpenAPI []byte
+
+func hasBuiltinOpenAPIVersion(version string) bool {
+	return version == DefaultOpenAPI
+}

kyaml/openapi/builtin_schema_test.go

@@ -0,0 +1,186 @@
+// Copyright 2026 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package openapi
+
+import (
+	"bytes"
+	"compress/gzip"
+	"testing"
+
+	openapi_v2 "github.com/google/gnostic-models/openapiv2"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+	"sigs.k8s.io/kustomize/kyaml/openapi/internal/builtinopenapi"
+	"sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi/v1_21_2"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
+)
+
+func TestBuiltinOpenAPIBundle(t *testing.T) {
+	bundle, err := decodeBuiltinBundle(builtinKubernetesOpenAPIBundle)
+	require.NoError(t, err)
+	require.Equal(t, builtinopenapi.FormatVersion, bundle.FormatVersion)
+	require.Equal(t, builtinopenapi.Coverage{Floor: "v1.21.2", Ceiling: "v1.21.2"}, bundle.Coverage)
+	require.Len(t, bundle.Definitions, 618)
+	require.Len(t, bundle.Resources, 275)
+
+	definitionResources := make(map[yaml.TypeMeta]string)
+	scopes := 0
+	for _, resource := range bundle.Resources {
+		typeMeta := yaml.TypeMeta{APIVersion: resource.APIVersion, Kind: resource.Kind}
+		if resource.Definition != "" {
+			definitionResources[typeMeta] = resource.Definition
+		}
+		if resource.Scope != builtinopenapi.ScopeUnknown {
+			scopes++
+		}
+	}
+
+	// A single-source bundle must carry the same GVK-to-definition mapping in
+	// both its definitions and its resource inventory. The runtime indexes
+	// schemas exclusively from the definitions' GVK extensions.
+	ResetOpenAPI()
+	t.Cleanup(ResetOpenAPI)
+	AddDefinitions(bundle.Definitions)
+	require.Len(t, globalSchema.schemaByResourceType, len(definitionResources))
+	for typeMeta, definitionName := range definitionResources {
+		indexed := globalSchema.schemaByResourceType[typeMeta]
+		require.NotNil(t, indexed, "%v", typeMeta)
+		require.Equal(t, bundle.Definitions[definitionName], *indexed, "%v", typeMeta)
+	}
+
+	ResetOpenAPI()
+	require.NoError(t, parseBuiltinBundle(builtinKubernetesOpenAPIBundle))
+	require.Len(t, globalSchema.schema.Definitions, len(bundle.Definitions))
+	require.Len(t, globalSchema.schemaByResourceType, len(definitionResources))
+	require.Len(t, globalSchema.namespaceabilityByResourceType, scopes)
+	for _, resource := range bundle.Resources {
+		if resource.Scope == builtinopenapi.ScopeUnknown {
+			continue
+		}
+		typeMeta := yaml.TypeMeta{APIVersion: resource.APIVersion, Kind: resource.Kind}
+		_, found := globalSchema.namespaceabilityByResourceType[typeMeta]
+		require.True(t, found, "%v", typeMeta)
+	}
+}
+
+func TestBuiltinOpenAPIBundleMatchesLegacySchema(t *testing.T) {
+	document := &openapi_v2.Document{}
+	require.NoError(t, proto.Unmarshal(v1_21_2.MustAsset(
+		"kubernetesapi/v1_21_2/swagger.pb"), document))
+	var swagger spec.Swagger
+	ok, err := swagger.FromGnostic(document)
+	require.NoError(t, err)
+	require.True(t, ok)
+
+	bundle, err := decodeBuiltinBundle(builtinKubernetesOpenAPIBundle)
+	require.NoError(t, err)
+	require.Equal(t, swagger.Definitions, bundle.Definitions)
+
+	ResetOpenAPI()
+	t.Cleanup(ResetOpenAPI)
+	AddDefinitions(swagger.Definitions)
+	findNamespaceability(swagger.Paths)
+	legacySchemas := make(map[yaml.TypeMeta]spec.Schema, len(globalSchema.schemaByResourceType))
+	for typeMeta, schema := range globalSchema.schemaByResourceType {
+		legacySchemas[typeMeta] = *schema
+	}
+	legacyScopes := make(map[yaml.TypeMeta]bool, len(globalSchema.namespaceabilityByResourceType))
+	for typeMeta, namespaced := range globalSchema.namespaceabilityByResourceType {
+		legacyScopes[typeMeta] = namespaced
+	}
+
+	ResetOpenAPI()
+	require.NoError(t, parseBuiltinBundle(builtinKubernetesOpenAPIBundle))
+	require.Len(t, globalSchema.schemaByResourceType, len(legacySchemas))
+	for typeMeta, schema := range legacySchemas {
+		require.Equal(t, schema, *globalSchema.schemaByResourceType[typeMeta], "%v", typeMeta)
+	}
+	require.Equal(t, legacyScopes, globalSchema.namespaceabilityByResourceType)
+}
+
+func TestDecodeBuiltinOpenAPIBundleRejectsInvalidData(t *testing.T) {
+	tests := []struct {
+		name              string
+		data              []byte
+		alreadyCompressed bool
+		corruptChecksum   bool
+		errorContains     string
+	}{
+		{
+			name:              "invalid gzip",
+			data:              []byte("not gzip"),
+			alreadyCompressed: true,
+		},
+		{
+			name: "invalid JSON",
+			data: []byte(`{"formatVersion":`),
+		},
+		{
+			name:          "multiple JSON values",
+			data:          []byte(`{} {}`),
+			errorContains: "multiple JSON values",
+		},
+		{
+			name: "invalid trailing data",
+			data: []byte(`{} trailing`),
+		},
+		{
+			name:              "invalid checksum",
+			data:              builtinKubernetesOpenAPIBundle,
+			alreadyCompressed: true,
+			corruptChecksum:   true,
+			errorContains:     "gzip: invalid checksum",
+		},
+		{
+			name:          "invalid bundle",
+			data:          []byte(`{"formatVersion":2}`),
+			errorContains: "unsupported built-in OpenAPI bundle format",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			compressed := bytes.Clone(test.data)
+			if !test.alreadyCompressed {
+				compressed = gzipBytes(t, test.data)
+			}
+			if test.corruptChecksum {
+				compressed[len(compressed)-8] ^= 0xff
+			}
+			_, err := decodeBuiltinBundle(compressed)
+			if test.errorContains == "" {
+				require.Error(t, err)
+			} else {
+				require.ErrorContains(t, err, test.errorContains)
+			}
+		})
+	}
+}
+
+func gzipBytes(t *testing.T, data []byte) []byte {
+	t.Helper()
+	var compressed bytes.Buffer
+	writer := gzip.NewWriter(&compressed)
+	_, err := writer.Write(data)
+	require.NoError(t, err)
+	require.NoError(t, writer.Close())
+	return compressed.Bytes()
+}
+
+func TestBuiltinKustomizationSchema(t *testing.T) {
+	ResetOpenAPI()
+	t.Cleanup(ResetOpenAPI)
+	schema := SchemaForResourceType(yaml.TypeMeta{
+		APIVersion: "kustomize.config.k8s.io/v1beta1",
+		Kind:       "Kustomization",
+	})
+	require.NotNil(t, schema)
+	strategy, key := schema.Field("configMapGenerator").PatchStrategyAndKey()
+	require.Equal(t, "merge", strategy)
+	require.Equal(t, "name", key)
+	strategy, key = schema.Field("secretGenerator").PatchStrategyAndKey()
+	require.Equal(t, "merge", strategy)
+	require.Equal(t, "name", key)
+}

kyaml/openapi/cmd/openapi-bundle/main.go

@@ -0,0 +1,387 @@
+// Copyright 2026 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// openapi-bundle compiles a Kubernetes OpenAPI v2 protobuf document into the
+// compact, deterministic bundle embedded by kyaml.
+package main
+
+import (
+	"bufio"
+	"compress/gzip"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	openapi_v2 "github.com/google/gnostic-models/openapiv2"
+	"google.golang.org/protobuf/proto"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+	"sigs.k8s.io/kustomize/kyaml/openapi/internal/builtinopenapi"
+)
+
+const gvkExtension = "x-kubernetes-group-version-kind"
+
+const maxInputSize = 64 << 20
+
+type options struct {
+	input             string
+	output            string
+	legacyProtoOutput string
+	kubernetesVersion string
+}
+
+func main() {
+	var opts options
+	flag.StringVar(&opts.input, "input", "", "path to a Kubernetes OpenAPI v2 protobuf document (optionally gzip-compressed)")
+	flag.StringVar(&opts.output, "output", "", "path to the generated .json.gz bundle")
+	flag.StringVar(&opts.legacyProtoOutput, "legacy-proto-output", "", "optional path to a deterministic gzip archive of the input protobuf")
+	flag.StringVar(&opts.kubernetesVersion, "kubernetes-version", "", "Kubernetes version represented by the input")
+	flag.Parse()
+
+	if err := run(opts); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func run(opts options) error {
+	if opts.input == "" || opts.output == "" || opts.kubernetesVersion == "" {
+		return errors.New("-input, -output, and -kubernetes-version are required")
+	}
+
+	input, err := readInput(opts.input)
+	if err != nil {
+		return fmt.Errorf("read input: %w", err)
+	}
+	bundle, err := compile(input, opts.kubernetesVersion)
+	if err != nil {
+		return fmt.Errorf("compile bundle: %w", err)
+	}
+	if err := writeBundle(opts.output, bundle); err != nil {
+		return fmt.Errorf("write bundle: %w", err)
+	}
+	if opts.legacyProtoOutput != "" {
+		if err := writeGzip(opts.legacyProtoOutput, input); err != nil {
+			return fmt.Errorf("write legacy protobuf archive: %w", err)
+		}
+	}
+	return nil
+}
+
+func readInput(path string) ([]byte, error) {
+	return readInputWithLimit(path, maxInputSize)
+}
+
+func readInputWithLimit(path string, limit int64) (result []byte, resultErr error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, fmt.Errorf("open %q: %w", path, err)
+	}
+	defer func() {
+		if err := file.Close(); err != nil {
+			resultErr = errors.Join(resultErr, fmt.Errorf("close input %q: %w", path, err))
+		}
+	}()
+
+	reader := bufio.NewReader(file)
+	magic, err := reader.Peek(2)
+	if err != nil && !errors.Is(err, io.EOF) {
+		return nil, fmt.Errorf("inspect input %q: %w", path, err)
+	}
+	if len(magic) < 2 || magic[0] != 0x1f || magic[1] != 0x8b {
+		return readLimitedInput(reader, limit, "input", path)
+	}
+
+	gzipReader, err := gzip.NewReader(reader)
+	if err != nil {
+		return nil, fmt.Errorf("open gzip input %q: %w", path, err)
+	}
+	uncompressed, readErr := readLimitedInput(gzipReader, limit, "decompressed input", path)
+	closeErr := gzipReader.Close()
+	if readErr != nil {
+		return nil, readErr
+	}
+	if closeErr != nil {
+		return nil, fmt.Errorf("close gzip input %q: %w", path, closeErr)
+	}
+	return uncompressed, nil
+}
+
+func readLimitedInput(reader io.Reader, limit int64, description, path string) ([]byte, error) {
+	contents, err := io.ReadAll(io.LimitReader(reader, limit+1))
+	if err != nil {
+		return nil, fmt.Errorf("read %s %q: %w", description, path, err)
+	}
+	if int64(len(contents)) > limit {
+		return nil, fmt.Errorf("%s %q exceeds %d bytes", description, path, limit)
+	}
+	return contents, nil
+}
+
+func compile(input []byte, kubernetesVersion string) (*builtinopenapi.Bundle, error) {
+	document := &openapi_v2.Document{}
+	if err := proto.Unmarshal(input, document); err != nil {
+		return nil, fmt.Errorf("unmarshal OpenAPI protobuf: %w", err)
+	}
+
+	var swagger spec.Swagger
+	ok, err := swagger.FromGnostic(document)
+	if err != nil {
+		return nil, fmt.Errorf("convert gnostic document: %w", err)
+	}
+	if !ok {
+		return nil, errors.New("gnostic document cannot be converted without data loss")
+	}
+
+	resources, err := collectResources(&swagger)
+	if err != nil {
+		return nil, err
+	}
+	if err := validateDefinitionReferences(swagger.Definitions); err != nil {
+		return nil, err
+	}
+
+	digest := sha256.Sum256(input)
+	bundle := &builtinopenapi.Bundle{
+		FormatVersion: builtinopenapi.FormatVersion,
+		Coverage: builtinopenapi.Coverage{
+			Floor:   kubernetesVersion,
+			Ceiling: kubernetesVersion,
+		},
+		SelectionPolicy: builtinopenapi.SelectionPolicy,
+		Sources: []builtinopenapi.Source{{
+			KubernetesVersion: kubernetesVersion,
+			SHA256:            hex.EncodeToString(digest[:]),
+		}},
+		Definitions: swagger.Definitions,
+		Resources:   resources,
+	}
+	if err := bundle.Validate(); err != nil {
+		return nil, fmt.Errorf("validate compiled bundle: %w", err)
+	}
+	return bundle, nil
+}
+
+func collectResources(swagger *spec.Swagger) ([]builtinopenapi.Resource, error) {
+	resources := map[string]builtinopenapi.Resource{}
+	for definitionName, definition := range swagger.Definitions {
+		extension, found := definition.Extensions[gvkExtension]
+		if !found {
+			continue
+		}
+		entries, ok := extension.([]interface{})
+		if !ok {
+			return nil, fmt.Errorf("definition %q has a malformed %s extension", definitionName, gvkExtension)
+		}
+		for _, entry := range entries {
+			apiVersion, kind, err := parseGVK(entry)
+			if err != nil {
+				return nil, fmt.Errorf("definition %q: %w", definitionName, err)
+			}
+			key := resourceKey(apiVersion, kind)
+			resource := resources[key]
+			if resource.Definition != "" && resource.Definition != definitionName {
+				return nil, fmt.Errorf("GVK %s/%s is advertised by definitions %q and %q",
+					apiVersion, kind, resource.Definition, definitionName)
+			}
+			resource.APIVersion = apiVersion
+			resource.Kind = kind
+			resource.Definition = definitionName
+			resources[key] = resource
+		}
+	}
+
+	if err := collectPathResources(swagger.Paths, resources); err != nil {
+		return nil, err
+	}
+
+	result := make([]builtinopenapi.Resource, 0, len(resources))
+	for _, resource := range resources {
+		result = append(result, resource)
+	}
+	builtinopenapi.SortResources(result)
+	return result, nil
+}
+
+func collectPathResources(paths *spec.Paths, resources map[string]builtinopenapi.Resource) error {
+	if paths == nil {
+		return nil
+	}
+	for path, pathInfo := range paths.Paths {
+		if pathInfo.Get == nil {
+			continue
+		}
+		extension, found := pathInfo.Get.Extensions[gvkExtension]
+		if !found {
+			continue
+		}
+		apiVersion, kind, err := parseGVK(extension)
+		if err != nil {
+			return fmt.Errorf("path %q: %w", path, err)
+		}
+		key := resourceKey(apiVersion, kind)
+		resource := resources[key]
+		resource.APIVersion = apiVersion
+		resource.Kind = kind
+		if strings.Contains(path, "namespaces/{namespace}") {
+			resource.Scope = builtinopenapi.ScopeNamespaced
+		} else if resource.Scope == builtinopenapi.ScopeUnknown {
+			resource.Scope = builtinopenapi.ScopeCluster
+		}
+		resources[key] = resource
+	}
+	return nil
+}
+
+func parseGVK(value interface{}) (string, string, error) {
+	entry, ok := value.(map[string]interface{})
+	if !ok {
+		return "", "", fmt.Errorf("malformed %s extension entry", gvkExtension)
+	}
+	version, versionOK := entry["version"].(string)
+	kind, kindOK := entry["kind"].(string)
+	if !versionOK || version == "" || !kindOK || kind == "" {
+		return "", "", fmt.Errorf("incomplete %s extension entry", gvkExtension)
+	}
+	group, groupOK := entry["group"].(string)
+	if groupOK && group != "" {
+		return group + "/" + version, kind, nil
+	}
+	return version, kind, nil
+}
+
+func resourceKey(apiVersion, kind string) string {
+	return apiVersion + "\x00" + kind
+}
+
+func validateDefinitionReferences(definitions spec.Definitions) error {
+	b, err := json.Marshal(definitions)
+	if err != nil {
+		return fmt.Errorf("marshal definitions for reference validation: %w", err)
+	}
+	var value interface{}
+	if err := json.Unmarshal(b, &value); err != nil {
+		return fmt.Errorf("unmarshal definitions for reference validation: %w", err)
+	}
+	return walkReferences(value, definitions)
+}
+
+func walkReferences(value interface{}, definitions spec.Definitions) error {
+	switch typed := value.(type) {
+	case []interface{}:
+		for _, item := range typed {
+			if err := walkReferences(item, definitions); err != nil {
+				return err
+			}
+		}
+	case map[string]interface{}:
+		for key, item := range typed {
+			if key == "$ref" {
+				if err := validateReference(item, definitions); err != nil {
+					return err
+				}
+			}
+			if err := walkReferences(item, definitions); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func validateReference(value interface{}, definitions spec.Definitions) error {
+	ref, ok := value.(string)
+	// A schema may itself describe an object with a property named "$ref".
+	// Such a property has a schema object as its value and is not an OpenAPI
+	// reference keyword.
+	if !ok {
+		return nil
+	}
+	const prefix = "#/definitions/"
+	if !strings.HasPrefix(ref, prefix) {
+		return fmt.Errorf("OpenAPI definition contains unsupported reference %q", ref)
+	}
+	name := strings.TrimPrefix(ref, prefix)
+	name = strings.ReplaceAll(strings.ReplaceAll(name, "~1", "/"), "~0", "~")
+	if _, found := definitions[name]; !found {
+		return fmt.Errorf("OpenAPI definition references missing definition %q", name)
+	}
+	return nil
+}
+
+func writeBundle(path string, bundle *builtinopenapi.Bundle) error {
+	jsonBytes, err := json.Marshal(bundle)
+	if err != nil {
+		return fmt.Errorf("marshal bundle: %w", err)
+	}
+	return writeGzip(path, jsonBytes)
+}
+
+func writeGzip(path string, contents []byte) (resultErr error) {
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return fmt.Errorf("create output directory %q: %w", dir, err)
+	}
+	tmp, err := os.CreateTemp(dir, ".openapi-bundle-*")
+	if err != nil {
+		return fmt.Errorf("create temporary output: %w", err)
+	}
+	tmpName := tmp.Name()
+	tmpClosed := false
+	defer func() {
+		if !tmpClosed {
+			if err := tmp.Close(); err != nil {
+				resultErr = errors.Join(resultErr, fmt.Errorf("close temporary output: %w", err))
+			}
+		}
+		if err := os.Remove(tmpName); err != nil && !errors.Is(err, os.ErrNotExist) {
+			resultErr = errors.Join(resultErr, fmt.Errorf("remove temporary output: %w", err))
+		}
+	}()
+
+	writer, err := gzip.NewWriterLevel(tmp, gzip.BestCompression)
+	if err != nil {
+		return fmt.Errorf("create gzip writer: %w", err)
+	}
+	writerClosed := false
+	defer func() {
+		if !writerClosed {
+			if err := writer.Close(); err != nil {
+				resultErr = errors.Join(resultErr, fmt.Errorf("close gzip writer: %w", err))
+			}
+		}
+	}()
+	writer.Header.ModTime = time.Time{}
+	writer.Header.Name = ""
+	writer.Header.Comment = ""
+	writer.Header.Extra = nil
+	writer.Header.OS = 255
+
+	if _, err := writer.Write(contents); err != nil {
+		return fmt.Errorf("write compressed output: %w", err)
+	}
+	closeWriterErr := writer.Close()
+	writerClosed = true
+	if closeWriterErr != nil {
+		return fmt.Errorf("close gzip writer: %w", closeWriterErr)
+	}
+	if err := tmp.Chmod(0o644); err != nil {
+		return fmt.Errorf("set output permissions: %w", err)
+	}
+	closeTempErr := tmp.Close()
+	tmpClosed = true
+	if closeTempErr != nil {
+		return fmt.Errorf("close temporary output: %w", closeTempErr)
+	}
+	if err := os.Rename(tmpName, path); err != nil {
+		return fmt.Errorf("replace output %q: %w", path, err)
+	}
+	return nil
+}

kyaml/openapi/cmd/openapi-bundle/main_test.go

@@ -0,0 +1,149 @@
+// Copyright 2026 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"bytes"
+	"compress/gzip"
+	"encoding/json"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/kustomize/kyaml/openapi/internal/builtinopenapi"
+)
+
+func TestGeneratedBundleIsCurrentAndDeterministic(t *testing.T) {
+	source := filepath.Join("..", "..", "kubernetesapi", "v1_21_2", "swagger.pb.gz")
+	checkedIn := filepath.Join("..", "..", "kubernetesapi", "data",
+		"kubernetes-openapi-union-v1.21.2.bundle-v1.json.gz")
+	tempDir := t.TempDir()
+	first := filepath.Join(tempDir, "first.json.gz")
+	second := filepath.Join(tempDir, "second.json.gz")
+	legacy := filepath.Join(tempDir, "swagger.pb.gz")
+
+	for i, output := range []string{first, second} {
+		legacyOutput := ""
+		if i == 0 {
+			legacyOutput = legacy
+		}
+		require.NoError(t, run(options{
+			input:             source,
+			output:            output,
+			legacyProtoOutput: legacyOutput,
+			kubernetesVersion: "v1.21.2",
+		}))
+	}
+
+	want, err := os.ReadFile(checkedIn)
+	require.NoError(t, err)
+	got, err := os.ReadFile(first)
+	require.NoError(t, err)
+	again, err := os.ReadFile(second)
+	require.NoError(t, err)
+	require.Equal(t, want, got, "checked-in bundle is stale")
+	require.Equal(t, got, again, "bundle generation is not deterministic")
+	sourceArchive, err := os.ReadFile(source)
+	require.NoError(t, err)
+	legacyArchive, err := os.ReadFile(legacy)
+	require.NoError(t, err)
+	require.Equal(t, sourceArchive, legacyArchive, "compiler input archive is not deterministic")
+
+	reader, err := gzip.NewReader(bytes.NewReader(got))
+	require.NoError(t, err)
+	require.True(t, reader.ModTime.IsZero())
+	require.Empty(t, reader.Name)
+	require.Empty(t, reader.Comment)
+	decoder := json.NewDecoder(reader)
+	var bundle builtinopenapi.Bundle
+	require.NoError(t, decoder.Decode(&bundle))
+	var trailing interface{}
+	require.ErrorIs(t, decoder.Decode(&trailing), io.EOF)
+	require.NoError(t, reader.Close())
+	require.NoError(t, bundle.Validate())
+	require.Len(t, bundle.Definitions, 618)
+	require.Len(t, bundle.Resources, 275)
+	require.Equal(t, "5d171b55e9601912807a870d73ffe70bb306f5889a00e76986042a0f2d7b6bc2",
+		bundle.Sources[0].SHA256)
+}
+
+func TestWriteGzipUsesStableHeader(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "data.gz")
+	require.NoError(t, writeGzip(path, []byte("data")))
+	b, err := os.ReadFile(path)
+	require.NoError(t, err)
+	reader, err := gzip.NewReader(bytes.NewReader(b))
+	require.NoError(t, err)
+	require.Equal(t, time.Time{}, reader.ModTime)
+	require.Empty(t, reader.Name)
+	require.Empty(t, reader.Comment)
+	require.Equal(t, byte(255), reader.OS)
+	require.NoError(t, reader.Close())
+}
+
+func TestReadInputWithLimit(t *testing.T) {
+	const limit = int64(4)
+	testDir := t.TempDir()
+
+	write := func(t *testing.T, name string, contents []byte) string {
+		t.Helper()
+		path := filepath.Join(testDir, name)
+		require.NoError(t, os.WriteFile(path, contents, 0o600))
+		return path
+	}
+	gzipContents := func(t *testing.T, contents []byte) []byte {
+		t.Helper()
+		var buffer bytes.Buffer
+		writer := gzip.NewWriter(&buffer)
+		_, err := writer.Write(contents)
+		require.NoError(t, err)
+		require.NoError(t, writer.Close())
+		return buffer.Bytes()
+	}
+
+	t.Run("raw at limit", func(t *testing.T) {
+		path := write(t, "raw", []byte("data"))
+		got, err := readInputWithLimit(path, limit)
+		require.NoError(t, err)
+		require.Equal(t, []byte("data"), got)
+	})
+
+	t.Run("raw exceeds limit", func(t *testing.T) {
+		path := write(t, "raw-large", []byte("large"))
+		_, err := readInputWithLimit(path, limit)
+		require.ErrorContains(t, err, "input")
+		require.ErrorContains(t, err, "exceeds 4 bytes")
+	})
+
+	t.Run("gzip at limit", func(t *testing.T) {
+		path := write(t, "gzip", gzipContents(t, []byte("data")))
+		got, err := readInputWithLimit(path, limit)
+		require.NoError(t, err)
+		require.Equal(t, []byte("data"), got)
+	})
+
+	t.Run("gzip exceeds limit", func(t *testing.T) {
+		path := write(t, "gzip-large", gzipContents(t, []byte("large")))
+		_, err := readInputWithLimit(path, limit)
+		require.ErrorContains(t, err, "decompressed input")
+		require.ErrorContains(t, err, "exceeds 4 bytes")
+	})
+
+	t.Run("invalid gzip header", func(t *testing.T) {
+		path := write(t, "gzip-invalid-header", []byte{0x1f, 0x8b})
+		_, err := readInputWithLimit(path, limit)
+		require.ErrorContains(t, err, "open gzip input")
+	})
+
+	t.Run("invalid gzip body", func(t *testing.T) {
+		contents := gzipContents(t, []byte("data"))
+		contents[len(contents)-1]++
+		path := write(t, "gzip-invalid-body", contents)
+		_, err := readInputWithLimit(path, limit)
+		require.ErrorContains(t, err, "read decompressed input")
+	})
+}

kyaml/openapi/internal/builtinopenapi/bundle.go

@@ -0,0 +1,223 @@
+// Copyright 2026 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package builtinopenapi defines the on-disk format of the compiled built-in
+// Kubernetes OpenAPI bundle.
+package builtinopenapi
+
+import (
+	"encoding/hex"
+	"fmt"
+	"sort"
+
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+const (
+	// FormatVersion is the version of the bundle's JSON representation.
+	FormatVersion = 1
+
+	// SelectionPolicy identifies how schemas from Kubernetes releases are
+	// selected. A single-release bundle is the degenerate case of this policy.
+	SelectionPolicy = "latest-wins-fill-missing"
+
+	gvkExtension = "x-kubernetes-group-version-kind"
+)
+
+// Scope describes whether a Kubernetes resource is namespace or cluster
+// scoped. An empty Scope means that the source OpenAPI document did not expose
+// a resource path from which scope could be determined.
+type Scope string
+
+const (
+	ScopeUnknown    Scope = ""
+	ScopeNamespaced Scope = "Namespaced"
+	ScopeCluster    Scope = "Cluster"
+)
+
+// Coverage identifies the Kubernetes release range represented by a bundle.
+type Coverage struct {
+	Floor   string `json:"floor"`
+	Ceiling string `json:"ceiling"`
+}
+
+// Source identifies one OpenAPI input used to compile a bundle.
+type Source struct {
+	KubernetesVersion string `json:"kubernetesVersion"`
+	SHA256            string `json:"sha256"`
+}
+
+// Resource maps a GVK to its root definition and, when known, its scope.
+// Definition may be empty for a GVK that was present in an API path but not in
+// the OpenAPI definitions.
+type Resource struct {
+	APIVersion string `json:"apiVersion"`
+	Kind       string `json:"kind"`
+	Definition string `json:"definition,omitempty"`
+	Scope      Scope  `json:"scope,omitempty"`
+}
+
+// Bundle is the compiled representation consumed by kyaml at runtime.
+type Bundle struct {
+	FormatVersion   int              `json:"formatVersion"`
+	Coverage        Coverage         `json:"coverage"`
+	SelectionPolicy string           `json:"selectionPolicy"`
+	Sources         []Source         `json:"sources"`
+	Definitions     spec.Definitions `json:"definitions"`
+	Resources       []Resource       `json:"resources"`
+}
+
+// Validate checks invariants required by the runtime loader.
+func (b *Bundle) Validate() error {
+	if b.FormatVersion != FormatVersion {
+		return fmt.Errorf("unsupported built-in OpenAPI bundle format %d", b.FormatVersion)
+	}
+	if b.Coverage.Floor == "" || b.Coverage.Ceiling == "" {
+		return fmt.Errorf("built-in OpenAPI bundle coverage is incomplete")
+	}
+	if b.SelectionPolicy != SelectionPolicy {
+		return fmt.Errorf("unsupported built-in OpenAPI selection policy %q", b.SelectionPolicy)
+	}
+	if len(b.Sources) == 0 {
+		return fmt.Errorf("built-in OpenAPI bundle has no sources")
+	}
+	for _, source := range b.Sources {
+		if source.KubernetesVersion == "" {
+			return fmt.Errorf("built-in OpenAPI bundle has a source without a Kubernetes version")
+		}
+		if len(source.SHA256) != 64 {
+			return fmt.Errorf("built-in OpenAPI source %q has an invalid SHA-256", source.KubernetesVersion)
+		}
+		if _, err := hex.DecodeString(source.SHA256); err != nil {
+			return fmt.Errorf("built-in OpenAPI source %q has an invalid SHA-256", source.KubernetesVersion)
+		}
+	}
+	if len(b.Definitions) == 0 {
+		return fmt.Errorf("built-in OpenAPI bundle has no definitions")
+	}
+	if len(b.Resources) == 0 {
+		return fmt.Errorf("built-in OpenAPI bundle has no resources")
+	}
+
+	resourcesByGVK := make(map[string]Resource, len(b.Resources))
+	for i, resource := range b.Resources {
+		if resource.APIVersion == "" || resource.Kind == "" {
+			return fmt.Errorf("built-in OpenAPI resource %d has an incomplete GVK", i)
+		}
+		switch resource.Scope {
+		case ScopeUnknown, ScopeNamespaced, ScopeCluster:
+		default:
+			return fmt.Errorf("built-in OpenAPI resource %s/%s has invalid scope %q",
+				resource.APIVersion, resource.Kind, resource.Scope)
+		}
+		if resource.Definition != "" {
+			if _, found := b.Definitions[resource.Definition]; !found {
+				return fmt.Errorf("built-in OpenAPI resource %s/%s references missing definition %q",
+					resource.APIVersion, resource.Kind, resource.Definition)
+			}
+		}
+		key := resourceKey(resource.APIVersion, resource.Kind)
+		if _, found := resourcesByGVK[key]; found {
+			return fmt.Errorf("built-in OpenAPI resource %s/%s is duplicated",
+				resource.APIVersion, resource.Kind)
+		}
+		resourcesByGVK[key] = resource
+		if i > 0 && lessResource(resource, b.Resources[i-1]) {
+			return fmt.Errorf("built-in OpenAPI resources are not sorted")
+		}
+	}
+	return validateDefinitionResources(b.Definitions, resourcesByGVK)
+}
+
+func validateDefinitionResources(definitions spec.Definitions, resourcesByGVK map[string]Resource) error {
+	definitionsByGVK := make(map[string]string)
+	for definitionName, definition := range definitions {
+		extension, found := definition.Extensions[gvkExtension]
+		if !found {
+			continue
+		}
+		entries, ok := extension.([]interface{})
+		if !ok {
+			return fmt.Errorf("built-in OpenAPI definition %q has malformed %s extension: expected an array",
+				definitionName, gvkExtension)
+		}
+		for i, entry := range entries {
+			apiVersion, kind, err := parseGVK(entry)
+			if err != nil {
+				return fmt.Errorf("built-in OpenAPI definition %q has malformed %s extension entry %d: %w",
+					definitionName, gvkExtension, i, err)
+			}
+			key := resourceKey(apiVersion, kind)
+			if previousDefinition, found := definitionsByGVK[key]; found && previousDefinition != definitionName {
+				return fmt.Errorf("built-in OpenAPI GVK %s/%s is advertised by definitions %q and %q",
+					apiVersion, kind, previousDefinition, definitionName)
+			}
+			definitionsByGVK[key] = definitionName
+
+			resource, found := resourcesByGVK[key]
+			if !found {
+				return fmt.Errorf("built-in OpenAPI definition %q advertises GVK %s/%s without a resource mapping",
+					definitionName, apiVersion, kind)
+			}
+			if resource.Definition != definitionName {
+				return fmt.Errorf("built-in OpenAPI resource %s/%s references definition %q, but definition %q advertises it",
+					apiVersion, kind, resource.Definition, definitionName)
+			}
+		}
+	}
+
+	for _, resource := range resourcesByGVK {
+		if resource.Definition == "" {
+			continue
+		}
+		definitionName, found := definitionsByGVK[resourceKey(resource.APIVersion, resource.Kind)]
+		if !found {
+			return fmt.Errorf("built-in OpenAPI resource %s/%s references definition %q, but that definition does not advertise the GVK",
+				resource.APIVersion, resource.Kind, resource.Definition)
+		}
+		if definitionName != resource.Definition {
+			return fmt.Errorf("built-in OpenAPI resource %s/%s references definition %q, but definition %q advertises it",
+				resource.APIVersion, resource.Kind, resource.Definition, definitionName)
+		}
+	}
+	return nil
+}
+
+func parseGVK(value interface{}) (string, string, error) {
+	entry, ok := value.(map[string]interface{})
+	if !ok {
+		return "", "", fmt.Errorf("expected an object")
+	}
+	version, versionOK := entry["version"].(string)
+	kind, kindOK := entry["kind"].(string)
+	if !versionOK || version == "" || !kindOK || kind == "" {
+		return "", "", fmt.Errorf("version and kind must be non-empty strings")
+	}
+	groupValue, hasGroup := entry["group"]
+	group, groupOK := groupValue.(string)
+	if hasGroup && !groupOK {
+		return "", "", fmt.Errorf("group must be a string")
+	}
+	if group != "" {
+		return group + "/" + version, kind, nil
+	}
+	return version, kind, nil
+}
+
+func resourceKey(apiVersion, kind string) string {
+	return apiVersion + "\x00" + kind
+}
+
+// SortResources orders resources deterministically for serialization.
+func SortResources(resources []Resource) {
+	sort.Slice(resources, func(i, j int) bool {
+		return lessResource(resources[i], resources[j])
+	})
+}
+
+func lessResource(left, right Resource) bool {
+	if left.APIVersion != right.APIVersion {
+		return left.APIVersion < right.APIVersion
+	}
+	return left.Kind < right.Kind
+}

kyaml/openapi/internal/builtinopenapi/bundle_test.go

@@ -0,0 +1,128 @@
+// Copyright 2026 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package builtinopenapi
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+func TestBundleValidate(t *testing.T) {
+	valid := func() Bundle {
+		definition := spec.Schema{}
+		definition.Extensions = spec.Extensions{
+			gvkExtension: []interface{}{
+				map[string]interface{}{"group": "apps", "version": "v1", "kind": "Deployment"},
+			},
+		}
+		return Bundle{
+			FormatVersion:   FormatVersion,
+			Coverage:        Coverage{Floor: "v1.21.2", Ceiling: "v1.21.2"},
+			SelectionPolicy: SelectionPolicy,
+			Sources: []Source{{
+				KubernetesVersion: "v1.21.2",
+				SHA256:            "5d171b55e9601912807a870d73ffe70bb306f5889a00e76986042a0f2d7b6bc2",
+			}},
+			Definitions: spec.Definitions{"definition": definition},
+			Resources: []Resource{{
+				APIVersion: "apps/v1",
+				Kind:       "Deployment",
+				Definition: "definition",
+				Scope:      ScopeNamespaced,
+			}},
+		}
+	}
+
+	tests := map[string]func(*Bundle){
+		"format":   func(bundle *Bundle) { bundle.FormatVersion++ },
+		"coverage": func(bundle *Bundle) { bundle.Coverage.Floor = "" },
+		"policy":   func(bundle *Bundle) { bundle.SelectionPolicy = "unknown" },
+		"source":   func(bundle *Bundle) { bundle.Sources[0].SHA256 = "short" },
+		"source hex": func(bundle *Bundle) {
+			bundle.Sources[0].SHA256 = "zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"
+		},
+		"definition": func(bundle *Bundle) { bundle.Resources[0].Definition = "missing" },
+		"no definitions": func(bundle *Bundle) {
+			bundle.Definitions = nil
+		},
+		"no resources": func(bundle *Bundle) {
+			bundle.Resources = nil
+		},
+		"scope": func(bundle *Bundle) { bundle.Resources[0].Scope = "invalid" },
+		"duplicate": func(bundle *Bundle) {
+			bundle.Resources = append(bundle.Resources, bundle.Resources[0])
+		},
+		"duplicate with different definition": func(bundle *Bundle) {
+			secondDefinition := bundle.Definitions["definition"]
+			bundle.Definitions["second-definition"] = secondDefinition
+			duplicate := bundle.Resources[0]
+			duplicate.Definition = "second-definition"
+			bundle.Resources = append(bundle.Resources, duplicate)
+		},
+		"GVK advertised by different definitions": func(bundle *Bundle) {
+			secondDefinition := bundle.Definitions["definition"]
+			bundle.Definitions["second-definition"] = secondDefinition
+		},
+		"order": func(bundle *Bundle) {
+			bundle.Resources = append([]Resource{{APIVersion: "v1", Kind: "Pod"}}, bundle.Resources...)
+		},
+		"malformed definition extension type": func(bundle *Bundle) {
+			definition := bundle.Definitions["definition"]
+			definition.Extensions[gvkExtension] = map[string]interface{}{}
+			bundle.Definitions["definition"] = definition
+		},
+		"malformed definition extension entry": func(bundle *Bundle) {
+			definition := bundle.Definitions["definition"]
+			definition.Extensions[gvkExtension] = []interface{}{map[string]interface{}{"version": "v1"}}
+			bundle.Definitions["definition"] = definition
+		},
+		"malformed definition extension group": func(bundle *Bundle) {
+			definition := bundle.Definitions["definition"]
+			definition.Extensions[gvkExtension] = []interface{}{
+				map[string]interface{}{"group": 1, "version": "v1", "kind": "Deployment"},
+			}
+			bundle.Definitions["definition"] = definition
+		},
+		"resource GVK absent from definition extension": func(bundle *Bundle) {
+			definition := bundle.Definitions["definition"]
+			definition.Extensions[gvkExtension] = []interface{}{}
+			bundle.Definitions["definition"] = definition
+		},
+		"definition GVK absent from resources": func(bundle *Bundle) {
+			definition := bundle.Definitions["definition"]
+			definition.Extensions[gvkExtension] = []interface{}{
+				map[string]interface{}{"group": "apps", "version": "v1", "kind": "Deployment"},
+				map[string]interface{}{"group": "apps", "version": "v1", "kind": "StatefulSet"},
+			}
+			bundle.Definitions["definition"] = definition
+		},
+	}
+
+	require.NoError(t, func() error { bundle := valid(); return bundle.Validate() }())
+	for name, mutate := range tests {
+		t.Run(name, func(t *testing.T) {
+			bundle := valid()
+			mutate(&bundle)
+			require.Error(t, bundle.Validate())
+		})
+	}
+}
+
+func TestLessResourceUsesOnlyGVK(t *testing.T) {
+	left := Resource{APIVersion: "apps/v1", Kind: "Deployment", Definition: "z"}
+	right := Resource{APIVersion: "apps/v1", Kind: "Deployment", Definition: "a"}
+	require.False(t, lessResource(left, right))
+	require.False(t, lessResource(right, left))
+
+	require.True(t, lessResource(
+		Resource{APIVersion: "apps/v1", Kind: "Deployment"},
+		Resource{APIVersion: "apps/v1", Kind: "StatefulSet"},
+	))
+	require.True(t, lessResource(
+		Resource{APIVersion: "apps/v1", Kind: "Deployment"},
+		Resource{APIVersion: "batch/v1", Kind: "CronJob"},
+	))
+}

kyaml/openapi/internal/embeddedasset/asset.go

@@ -0,0 +1,147 @@
+// Copyright 2026 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package embeddedasset provides helpers that preserve the legacy generated
+// asset API exposed by the OpenAPI packages.
+package embeddedasset
+
+import (
+	"bytes"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+// File describes one embedded asset.
+type File struct {
+	// Path is the full slash-separated virtual path used to look up the asset.
+	Path       string
+	Data       []byte
+	Compressed bool
+	Size       int64
+	Mode       os.FileMode
+	ModTime    time.Time
+}
+
+// Asset returns a fresh copy of the uncompressed asset data.
+func Asset(file File, name string) ([]byte, error) {
+	if canonical(name) != file.Path {
+		return nil, fmt.Errorf("Asset %s not found", name)
+	}
+	if !file.Compressed {
+		return bytes.Clone(file.Data), nil
+	}
+	reader, err := gzip.NewReader(bytes.NewReader(file.Data))
+	if err != nil {
+		return nil, fmt.Errorf("read %q: %w", name, err)
+	}
+	b, readErr := io.ReadAll(io.LimitReader(reader, file.Size+1))
+	closeErr := reader.Close()
+	if readErr != nil {
+		return nil, fmt.Errorf("read %q: %w", name, readErr)
+	}
+	if closeErr != nil {
+		return nil, fmt.Errorf("read %q: %w", name, closeErr)
+	}
+	if int64(len(b)) != file.Size {
+		return nil, fmt.Errorf("read %q: expected %d bytes, got %d", name, file.Size, len(b))
+	}
+	return b, nil
+}
+
+// MustAsset is like Asset but panics on error.
+func MustAsset(file File, name string) []byte {
+	b, err := Asset(file, name)
+	if err != nil {
+		panic("asset: Asset(" + name + "): " + err.Error())
+	}
+	return b
+}
+
+// AssetInfo returns metadata for an embedded asset.
+func AssetInfo(file File, name string) (os.FileInfo, error) {
+	if canonical(name) != file.Path {
+		return nil, fmt.Errorf("AssetInfo %s not found", name)
+	}
+	return fileInfo{file: file}, nil
+}
+
+// AssetDir returns the immediate children of a directory in the asset path.
+func AssetDir(file File, name string) ([]string, error) {
+	name = canonical(name)
+	parts := strings.Split(file.Path, "/")
+	if name == "" {
+		return []string{parts[0]}, nil
+	}
+	dirParts := strings.Split(name, "/")
+	if len(dirParts) >= len(parts) {
+		return nil, fmt.Errorf("Asset %s not found", name)
+	}
+	for i := range dirParts {
+		if dirParts[i] != parts[i] {
+			return nil, fmt.Errorf("Asset %s not found", name)
+		}
+	}
+	return []string{parts[len(dirParts)]}, nil
+}
+
+// RestoreAsset restores an asset under dir.
+func RestoreAsset(file File, dir, name string) error {
+	b, err := Asset(file, name)
+	if err != nil {
+		return err
+	}
+	info, err := AssetInfo(file, name)
+	if err != nil {
+		return err
+	}
+	target := filePath(dir, name)
+	if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
+		return fmt.Errorf("create asset directory: %w", err)
+	}
+	if err := os.WriteFile(target, b, info.Mode()); err != nil {
+		return fmt.Errorf("write asset %q: %w", name, err)
+	}
+	if err := os.Chtimes(target, info.ModTime(), info.ModTime()); err != nil {
+		return fmt.Errorf("restore timestamps for asset %q: %w", name, err)
+	}
+	return nil
+}
+
+// RestoreAssets restores an asset or directory recursively under dir.
+func RestoreAssets(file File, dir, name string) error {
+	children, err := AssetDir(file, name)
+	if err != nil {
+		return RestoreAsset(file, dir, name)
+	}
+	for _, child := range children {
+		if err := RestoreAssets(file, dir, filepath.Join(name, child)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+type fileInfo struct {
+	file File
+}
+
+func (info fileInfo) Name() string       { return path.Base(info.file.Path) }
+func (info fileInfo) Size() int64        { return info.file.Size }
+func (info fileInfo) Mode() os.FileMode  { return info.file.Mode }
+func (info fileInfo) ModTime() time.Time { return info.file.ModTime }
+func (info fileInfo) IsDir() bool        { return false }
+func (info fileInfo) Sys() interface{}   { return nil }
+
+func canonical(name string) string {
+	return strings.ReplaceAll(name, "\\", "/")
+}
+
+func filePath(dir, name string) string {
+	return filepath.Join(append([]string{dir}, strings.Split(canonical(name), "/")...)...)
+}

kyaml/openapi/internal/embeddedasset/asset_test.go

@@ -0,0 +1,202 @@
+// Copyright 2026 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package embeddedasset
+
+import (
+	"bytes"
+	"compress/gzip"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+const testAssetPath = "root/nested/asset.txt"
+
+var testModTime = time.Unix(1700000000, 0) //nolint:gochecknoglobals
+
+func TestAsset(t *testing.T) {
+	contents := []byte("asset contents")
+	for name, compressed := range map[string]bool{
+		"raw":        false,
+		"compressed": true,
+	} {
+		t.Run(name, func(t *testing.T) {
+			data := contents
+			if compressed {
+				data = gzipData(t, contents)
+			}
+			file := newTestFile(data, int64(len(contents)), compressed)
+
+			got, err := Asset(file, testAssetPath)
+			require.NoError(t, err)
+			require.Equal(t, contents, got)
+
+			got[0] ^= 0xff
+			again, err := Asset(file, "root\\nested\\asset.txt")
+			require.NoError(t, err)
+			require.Equal(t, contents, again, "Asset must return a fresh byte slice")
+		})
+	}
+
+	_, err := Asset(newTestFile(nil, 0, false), "missing")
+	require.ErrorContains(t, err, "Asset missing not found")
+}
+
+func TestAssetRejectsInvalidCompressedData(t *testing.T) {
+	t.Run("invalid gzip", func(t *testing.T) {
+		file := newTestFile([]byte("not gzip"), 1, true)
+		_, err := Asset(file, testAssetPath)
+		require.ErrorContains(t, err, "read \"root/nested/asset.txt\"")
+	})
+
+	t.Run("invalid gzip body", func(t *testing.T) {
+		data := gzipData(t, []byte("asset contents"))
+		data[len(data)-1] ^= 0xff
+		file := newTestFile(data, int64(len("asset contents")), true)
+		_, err := Asset(file, testAssetPath)
+		require.ErrorContains(t, err, "read \"root/nested/asset.txt\"")
+	})
+
+	t.Run("declared size too small", func(t *testing.T) {
+		contents := []byte("asset contents")
+		file := newTestFile(gzipData(t, contents), int64(len(contents)-1), true)
+		_, err := Asset(file, testAssetPath)
+		require.ErrorContains(t, err, "expected 13 bytes, got 14")
+	})
+
+	t.Run("declared size too large", func(t *testing.T) {
+		contents := []byte("asset contents")
+		file := newTestFile(gzipData(t, contents), int64(len(contents)+1), true)
+		_, err := Asset(file, testAssetPath)
+		require.ErrorContains(t, err, "expected 15 bytes, got 14")
+	})
+}
+
+func TestMustAsset(t *testing.T) {
+	contents := []byte("asset contents")
+	file := newTestFile(contents, int64(len(contents)), false)
+	require.Equal(t, contents, MustAsset(file, testAssetPath))
+	require.Panics(t, func() {
+		MustAsset(file, "missing")
+	})
+}
+
+func TestAssetInfo(t *testing.T) {
+	contents := []byte("asset contents")
+	file := newTestFile(contents, int64(len(contents)), false)
+
+	info, err := AssetInfo(file, "root\\nested\\asset.txt")
+	require.NoError(t, err)
+	require.Equal(t, "asset.txt", info.Name())
+	require.Equal(t, int64(len(contents)), info.Size())
+	require.Equal(t, os.FileMode(0o640), info.Mode())
+	require.Equal(t, testModTime, info.ModTime())
+	require.False(t, info.IsDir())
+	require.Nil(t, info.Sys())
+
+	_, err = AssetInfo(file, "missing")
+	require.ErrorContains(t, err, "AssetInfo missing not found")
+}
+
+func TestAssetDir(t *testing.T) {
+	file := newTestFile(nil, 0, false)
+	tests := []struct {
+		name     string
+		path     string
+		expected []string
+		wantErr  bool
+	}{
+		{name: "root", path: "", expected: []string{"root"}},
+		{name: "first level", path: "root", expected: []string{"nested"}},
+		{name: "nested", path: "root/nested", expected: []string{"asset.txt"}},
+		{name: "backslashes", path: "root\\nested", expected: []string{"asset.txt"}},
+		{name: "file", path: testAssetPath, wantErr: true},
+		{name: "missing", path: "missing", wantErr: true},
+		{name: "trailing slash", path: "root/nested/", wantErr: true},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			children, err := AssetDir(file, test.path)
+			if test.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, test.expected, children)
+		})
+	}
+}
+
+func TestRestoreAsset(t *testing.T) {
+	contents := []byte("asset contents")
+	file := newTestFile(contents, int64(len(contents)), false)
+	dir := t.TempDir()
+
+	require.NoError(t, RestoreAsset(file, dir, "root\\nested\\asset.txt"))
+	restored, err := os.ReadFile(filepath.Join(dir, "root", "nested", "asset.txt"))
+	require.NoError(t, err)
+	require.Equal(t, contents, restored)
+
+	require.Error(t, RestoreAsset(file, dir, "missing"))
+}
+
+func TestRestoreAssets(t *testing.T) {
+	contents := []byte("asset contents")
+	file := newTestFile(contents, int64(len(contents)), false)
+
+	for _, name := range []string{"", "root", testAssetPath} {
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			require.NoError(t, RestoreAssets(file, dir, name))
+			restored, err := os.ReadFile(filepath.Join(dir, "root", "nested", "asset.txt"))
+			require.NoError(t, err)
+			require.Equal(t, contents, restored)
+		})
+	}
+
+	require.Error(t, RestoreAssets(file, t.TempDir(), "missing"))
+}
+
+func TestCanonical(t *testing.T) {
+	tests := map[string]string{
+		"":                        "",
+		"root/nested/asset.txt":   "root/nested/asset.txt",
+		"root\\nested\\asset.txt": "root/nested/asset.txt",
+		"root/nested\\asset.txt":  "root/nested/asset.txt",
+	}
+	for input, expected := range tests {
+		require.Equal(t, expected, canonical(input))
+	}
+}
+
+func TestFilePath(t *testing.T) {
+	dir := t.TempDir()
+	expected := filepath.Join(dir, "root", "nested", "asset.txt")
+	require.Equal(t, expected, filePath(dir, "root/nested/asset.txt"))
+	require.Equal(t, expected, filePath(dir, "root\\nested\\asset.txt"))
+}
+
+func newTestFile(data []byte, size int64, compressed bool) File {
+	return File{
+		Path:       testAssetPath,
+		Data:       data,
+		Compressed: compressed,
+		Size:       size,
+		Mode:       0o640,
+		ModTime:    testModTime,
+	}
+}
+
+func gzipData(t *testing.T, data []byte) []byte {
+	t.Helper()
+	var buffer bytes.Buffer
+	writer := gzip.NewWriter(&buffer)
+	_, err := writer.Write(data)
+	require.NoError(t, err)
+	require.NoError(t, writer.Close())
+	return buffer.Bytes()
+}

kyaml/openapi/kubernetesapi/openapiinfo.go

@@ -1,18 +1,22 @@
 // Copyright 2020 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated by ./scripts/makeOpenApiInfoDotGo.sh; DO NOT EDIT.
+// Package kubernetesapi preserves access to the legacy built-in Kubernetes
-
+// OpenAPI assets. New code should use the parent openapi package.
 package kubernetesapi
 
 import (
 	"sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi/v1_21_2"
 )
 
+// Info describes the Kubernetes release represented by the legacy asset map.
 const Info = "{title:Kubernetes,version:v1.21.2}"
 
-var OpenAPIMustAsset = map[string]func(string) []byte{
+// OpenAPIMustAsset maps supported Kubernetes releases to their legacy asset
+// loaders.
+var OpenAPIMustAsset = map[string]func(string) []byte{ //nolint:gochecknoglobals // Retained for API compatibility.
 	"v1.21.2": v1_21_2.MustAsset,
 }
 
+// DefaultOpenAPI is the default release exposed by the legacy asset map.
 const DefaultOpenAPI = "v1.21.2"

kyaml/openapi/kubernetesapi/openapiinfo_test.go

@@ -0,0 +1,17 @@
+// Copyright 2026 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kubernetesapi
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/kustomize/kyaml/openapi"
+)
+
+func TestLegacyMetadataMatchesBuiltinBundle(t *testing.T) {
+	require.Equal(t, openapi.DefaultOpenAPI, DefaultOpenAPI)
+	require.Equal(t, openapi.BuiltinSchemaInfo, Info)
+	require.Contains(t, OpenAPIMustAsset, DefaultOpenAPI)
+}

kyaml/openapi/kubernetesapi/v1_21_2/swagger_test.go

@@ -0,0 +1,43 @@
+// Copyright 2026 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package v1_21_2 //nolint:revive // The package name is part of the public API.
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAssetCompatibility(t *testing.T) {
+	b, err := Asset(assetName)
+	require.NoError(t, err)
+	digest := sha256.Sum256(b)
+	require.Equal(t, "5d171b55e9601912807a870d73ffe70bb306f5889a00e76986042a0f2d7b6bc2",
+		hex.EncodeToString(digest[:]))
+	info, err := AssetInfo(assetName)
+	require.NoError(t, err)
+	require.Equal(t, int64(3469475), info.Size())
+	require.Equal(t, "swagger.pb", info.Name())
+
+	backslashName := "kubernetesapi\\v1_21_2\\swagger.pb"
+	_, err = Asset(backslashName)
+	require.NoError(t, err)
+	children, err := AssetDir("kubernetesapi/v1_21_2")
+	require.NoError(t, err)
+	require.Equal(t, []string{"swagger.pb"}, children)
+	_, err = AssetDir(assetName)
+	require.Error(t, err)
+
+	b[0] ^= 0xff
+	again := MustAsset(assetName)
+	require.NotEqual(t, b[0], again[0], "Asset must return a fresh byte slice")
+	_, err = Asset("missing")
+	require.Error(t, err)
+}
+
+func TestAssetNames(t *testing.T) {
+	require.Equal(t, []string{assetName}, AssetNames())
+}

kyaml/openapi/kustomizationapi/swagger.go

@@ -1,248 +1,57 @@
 // Copyright 2019 The Kubernetes Authors.
 // SPDX-License-Identifier: Apache-2.0
 
-// Code generated for package kustomizationapi by go-bindata DO NOT EDIT. (@generated)
+// Package kustomizationapi exposes the embedded Kustomization OpenAPI schema.
-// sources:
-// kustomizationapi/swagger.json
 package kustomizationapi
 
 import (
-	"bytes"
+	_ "embed"
-	"compress/gzip"
-	"fmt"
-	"io"
 	"os"
-	"path/filepath"
-	"strings"
 	"time"
+
+	"sigs.k8s.io/kustomize/kyaml/openapi/internal/embeddedasset"
 )
 
-func bindataRead(data []byte, name string) ([]byte, error) {
+const assetName = "kustomizationapi/swagger.json"
-	gz, err := gzip.NewReader(bytes.NewBuffer(data))
-	if err != nil {
-		return nil, fmt.Errorf("Read %q: %v", name, err)
-	}
 
-	var buf bytes.Buffer
+//go:embed swagger.json
-	_, err = io.Copy(&buf, gz)
+var swaggerJSON []byte
-	clErr := gz.Close()
 
-	if err != nil {
+var asset = embeddedasset.File{ //nolint:gochecknoglobals
-		return nil, fmt.Errorf("Read %q: %v", name, err)
+	Path:    assetName,
-	}
+	Data:    swaggerJSON,
-	if clErr != nil {
+	Size:    int64(len(swaggerJSON)),
-		return nil, err
+	Mode:    0o644,
-	}
+	ModTime: time.Unix(1615228558, 0),
-
-	return buf.Bytes(), nil
-}
-
-type asset struct {
-	bytes []byte
-	info  os.FileInfo
-}
-
-type bindataFileInfo struct {
-	name    string
-	size    int64
-	mode    os.FileMode
-	modTime time.Time
-}
-
-// Name return file name
-func (fi bindataFileInfo) Name() string {
-	return fi.name
-}
-
-// Size return file size
-func (fi bindataFileInfo) Size() int64 {
-	return fi.size
-}
-
-// Mode return file mode
-func (fi bindataFileInfo) Mode() os.FileMode {
-	return fi.mode
-}
-
-// ModTime return file modify time
-func (fi bindataFileInfo) ModTime() time.Time {
-	return fi.modTime
-}
-
-// IsDir return file whether a directory
-func (fi bindataFileInfo) IsDir() bool {
-	return fi.mode&os.ModeDir != 0
-}
-
-// Sys return file is sys mode
-func (fi bindataFileInfo) Sys() interface{} {
-	return nil
-}
-
-var _kustomizationapiSwaggerJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xe4\x56\xc1\x6e\xdb\x30\x0c\xbd\xe7\x2b\x04\x6d\xc7\xd8\x45\x6e\x43\x6e\xc3\x0e\x3b\x14\x05\x0a\x74\xb7\xa1\x07\xc6\xa1\x5d\xce\x8e\xa4\x51\xb4\xb1\x6c\xc8\xbf\x0f\xd6\x62\xd7\x4a\xec\x75\x0b\x1a\xac\x4b\x0f\x06\x0c\x99\x7c\x4f\xe4\x7b\x24\xfc\x63\xa6\x94\x5e\x63\x4e\x86\x84\xac\xf1\x7a\xa9\xda\x23\xa5\x34\xd9\xb4\x7c\xe7\x53\x70\x94\x82\x73\x3e\x6d\x16\xe9\x07\x6b\x72\x2a\x6e\xc0\xbd\xe7\xe2\x31\x52\x29\xed\xd8\x3a\x64\x21\x1c\x9e\x2a\xa5\x3f\xa2\x41\x06\xb1\x7c\x90\x10\x3e\xbe\x65\xcc\xf5\x52\xe9\x37\x57\x03\xfe\xab\x11\xda\x18\xa5\x87\xd8\xed\xdf\x76\xf3\xee\x1a\xb0\x5e\x07\x14\xa8\x6e\x87\x17\xca\xa1\xf2\xd8\x07\xc9\xd6\x61\x4b\x6b\x57\x5f\x30\x13\xdd\x9f\x7f\x4b\xca\x7a\x85\x6c\x50\xd0\x27\x05\xdb\xda\x25\x0d\xb2\x27\x6b\x92\x92\xcc\x5a\x2f\xd5\xe7\x9e\x3a\xaa\x23\xc4\xb6\x88\x65\xed\xc5\x6e\xe8\x3b\xa6\x59\x68\x54\x28\x84\x6c\x4f\x11\xa2\xf7\x58\x3a\xee\x65\x14\xb2\xa7\x6d\xa3\x9a\xc5\x0a\x05\x16\xc7\x45\xdf\xcf\x06\xa5\x8f\x69\x75\x87\x19\xa3\xbc\x0c\xa1\x1e\xab\xeb\xba\x1f\xe1\x77\x8a\x78\x61\x32\xc5\xa5\x08\x3c\x10\xe0\xf9\xd5\x9d\xd2\x6b\x52\x60\x03\x1b\xf4\x0e\xb2\x3f\x6f\xfe\x3c\x4e\x3e\x25\x6f\x85\x0f\xd0\x90\xe5\x53\x72\xaf\x9b\x5b\x20\xbe\xb3\x35\x67\x78\xba\x23\x63\x94\x0b\x71\x56\x2c\xfe\xf3\x9b\xeb\x7a\x7f\x19\x90\x5f\x50\xbd\xb9\x18\xbf\xd6\xc4\x18\x17\xa4\x3f\x6d\x1d\xde\xa0\x40\xc7\x74\x3f\x7f\xca\x8c\x59\xb7\xfb\xfa\x4a\x0e\x05\x26\xc1\xcd\xa1\xea\x7f\xa3\x7b\xbc\x5d\x07\x20\xbb\xf9\x98\x11\x81\x19\xb6\x71\x27\x23\x4d\x1d\x48\xf6\x90\x6c\x90\x0b\x4c\x4a\xdc\xb6\x29\x61\x26\x9e\xca\xf0\xc2\x20\x58\x84\x84\x90\x3d\xee\x75\x1f\x56\xc5\xd9\x9a\x31\xd8\x44\x2f\xb2\x13\xff\xf5\x30\xc6\xc3\x72\x86\x61\x9c\xd8\x83\x93\xc3\x55\x91\x20\x43\x75\xb4\x33\x27\x5c\x34\xb5\x8b\x7f\x6f\x90\x51\x1b\xe7\x54\x1d\xaf\xea\xf3\xd3\xa2\x69\xfe\x0d\xeb\xeb\xf8\x8f\x89\x0d\x78\xaa\xc1\x67\xed\xb3\xfb\x19\x00\x00\xff\xff\x2f\x39\x79\xd0\x6e\x0c\x00\x00")
-
-func kustomizationapiSwaggerJsonBytes() ([]byte, error) {
-	return bindataRead(
-		_kustomizationapiSwaggerJson,
-		"kustomizationapi/swagger.json",
-	)
-}
-
-func kustomizationapiSwaggerJson() (*asset, error) {
-	bytes, err := kustomizationapiSwaggerJsonBytes()
-	if err != nil {
-		return nil, err
-	}
-
-	info := bindataFileInfo{name: "kustomizationapi/swagger.json", size: 3182, mode: os.FileMode(420), modTime: time.Unix(1615228558, 0)}
-	a := &asset{bytes: bytes, info: info}
-	return a, nil
 }
 
 // Asset loads and returns the asset for the given name.
-// It returns an error if the asset could not be found or
-// could not be loaded.
 func Asset(name string) ([]byte, error) {
-	cannonicalName := strings.Replace(name, "\\", "/", -1)
+	return embeddedasset.Asset(asset, name) //nolint:wrapcheck // Preserve legacy error text.
-	if f, ok := _bindata[cannonicalName]; ok {
-		a, err := f()
-		if err != nil {
-			return nil, fmt.Errorf("Asset %s can't read by error: %v", name, err)
-		}
-		return a.bytes, nil
-	}
-	return nil, fmt.Errorf("Asset %s not found", name)
 }
 
 // MustAsset is like Asset but panics when Asset would return an error.
-// It simplifies safe initialization of global variables.
+func MustAsset(name string) []byte { return embeddedasset.MustAsset(asset, name) }
-func MustAsset(name string) []byte {
-	a, err := Asset(name)
-	if err != nil {
-		panic("asset: Asset(" + name + "): " + err.Error())
-	}
-
-	return a
-}
 
 // AssetInfo loads and returns the asset info for the given name.
-// It returns an error if the asset could not be found or
-// could not be loaded.
 func AssetInfo(name string) (os.FileInfo, error) {
-	cannonicalName := strings.Replace(name, "\\", "/", -1)
+	return embeddedasset.AssetInfo(asset, name) //nolint:wrapcheck // Preserve legacy error text.
-	if f, ok := _bindata[cannonicalName]; ok {
-		a, err := f()
-		if err != nil {
-			return nil, fmt.Errorf("AssetInfo %s can't read by error: %v", name, err)
-		}
-		return a.info, nil
-	}
-	return nil, fmt.Errorf("AssetInfo %s not found", name)
 }
 
 // AssetNames returns the names of the assets.
-func AssetNames() []string {
+func AssetNames() []string { return []string{assetName} }
-	names := make([]string, 0, len(_bindata))
-	for name := range _bindata {
-		names = append(names, name)
-	}
-	return names
-}
 
-// _bindata is a table, holding each asset generator, mapped to its name.
+// AssetDir returns the file names below an embedded directory.
-var _bindata = map[string]func() (*asset, error){
-	"kustomizationapi/swagger.json": kustomizationapiSwaggerJson,
-}
-
-// AssetDir returns the file names below a certain
-// directory embedded in the file by go-bindata.
-// For example if you run go-bindata on data/... and data contains the
-// following hierarchy:
-//     data/
-//       foo.txt
-//       img/
-//         a.png
-//         b.png
-// then AssetDir("data") would return []string{"foo.txt", "img"}
-// AssetDir("data/img") would return []string{"a.png", "b.png"}
-// AssetDir("foo.txt") and AssetDir("notexist") would return an error
-// AssetDir("") will return []string{"data"}.
 func AssetDir(name string) ([]string, error) {
-	node := _bintree
+	return embeddedasset.AssetDir(asset, name) //nolint:wrapcheck // Preserve legacy error text.
-	if len(name) != 0 {
-		cannonicalName := strings.Replace(name, "\\", "/", -1)
-		pathList := strings.Split(cannonicalName, "/")
-		for _, p := range pathList {
-			node = node.Children[p]
-			if node == nil {
-				return nil, fmt.Errorf("Asset %s not found", name)
-			}
-		}
-	}
-	if node.Func != nil {
-		return nil, fmt.Errorf("Asset %s not found", name)
-	}
-	rv := make([]string, 0, len(node.Children))
-	for childName := range node.Children {
-		rv = append(rv, childName)
-	}
-	return rv, nil
 }
 
-type bintree struct {
+// RestoreAsset restores an asset under the given directory.
-	Func     func() (*asset, error)
-	Children map[string]*bintree
-}
-
-var _bintree = &bintree{nil, map[string]*bintree{
-	"kustomizationapi": &bintree{nil, map[string]*bintree{
-		"swagger.json": &bintree{kustomizationapiSwaggerJson, map[string]*bintree{}},
-	}},
-}}
-
-// RestoreAsset restores an asset under the given directory
 func RestoreAsset(dir, name string) error {
-	data, err := Asset(name)
+	return embeddedasset.RestoreAsset(asset, dir, name) //nolint:wrapcheck // Preserve the compatibility API.
-	if err != nil {
-		return err
-	}
-	info, err := AssetInfo(name)
-	if err != nil {
-		return err
-	}
-	err = os.MkdirAll(_filePath(dir, filepath.Dir(name)), os.FileMode(0755))
-	if err != nil {
-		return err
-	}
-	err = os.WriteFile(_filePath(dir, name), data, info.Mode())
-	if err != nil {
-		return err
-	}
-	err = os.Chtimes(_filePath(dir, name), info.ModTime(), info.ModTime())
-	if err != nil {
-		return err
-	}
-	return nil
 }
 
-// RestoreAssets restores an asset under the given directory recursively
+// RestoreAssets restores an asset under the given directory recursively.
 func RestoreAssets(dir, name string) error {
-	children, err := AssetDir(name)
+	return embeddedasset.RestoreAssets(asset, dir, name) //nolint:wrapcheck // Preserve the compatibility API.
-	// File
-	if err != nil {
-		return RestoreAsset(dir, name)
-	}
-	// Dir
-	for _, child := range children {
-		err = RestoreAssets(dir, filepath.Join(name, child))
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func _filePath(dir, name string) string {
-	cannonicalName := strings.Replace(name, "\\", "/", -1)
-	return filepath.Join(append([]string{dir}, strings.Split(cannonicalName, "/")...)...)
 }

kyaml/openapi/kustomizationapi/swagger_test.go

@@ -0,0 +1,45 @@
+// Copyright 2026 The Kubernetes Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package kustomizationapi
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAssetCompatibility(t *testing.T) {
+	b, err := Asset(assetName)
+	require.NoError(t, err)
+	if runtime.GOOS != "windows" {
+		digest := sha256.Sum256(b)
+		require.Equal(t, "65c5ffdbaa33a1a6db954c0e9524d5ae3ec5ef5af9d2ca17da0577868d887531",
+			hex.EncodeToString(digest[:]))
+	}
+	info, err := AssetInfo(assetName)
+	require.NoError(t, err)
+	require.Equal(t, int64(len(b)), info.Size())
+	require.Equal(t, "swagger.json", info.Name())
+
+	_, err = Asset("kustomizationapi\\swagger.json")
+	require.NoError(t, err)
+	children, err := AssetDir("kustomizationapi")
+	require.NoError(t, err)
+	require.Equal(t, []string{"swagger.json"}, children)
+	_, err = AssetDir(assetName)
+	require.Error(t, err)
+
+	b[0] ^= 0xff
+	again := MustAsset(assetName)
+	require.NotEqual(t, b[0], again[0], "Asset must return a fresh byte slice")
+	_, err = Asset("missing")
+	require.Error(t, err)
+}
+
+func TestAssetNames(t *testing.T) {
+	require.Equal(t, []string{assetName}, AssetNames())
+}

kyaml/openapi/openapi.go

@@ -4,20 +4,19 @@
 package openapi
 
 import (
+	"bytes"
+	"compress/gzip"
 	"encoding/json"
 	"fmt"
+	"io"
 	"os"
-	"path/filepath"
 	"reflect"
 	"strings"
 	"sync"
 
-	openapi_v2 "github.com/google/gnostic-models/openapiv2"
-	"google.golang.org/protobuf/proto"
 	"k8s.io/kube-openapi/pkg/validation/spec"
 	"sigs.k8s.io/kustomize/kyaml/errors"
-	"sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi"
+	"sigs.k8s.io/kustomize/kyaml/openapi/internal/builtinopenapi"
-	"sigs.k8s.io/kustomize/kyaml/openapi/kustomizationapi"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 	k8syaml "sigs.k8s.io/yaml"
 )
@@ -80,11 +79,23 @@ type openapiData struct {
 	defaultBuiltInSchemaParseStatus schemaParseStatus
 }
 
+// format is retained for compatibility with the exported JsonOrYaml and Proto
+// constants. Built-in schemas are now loaded from compiled bundles instead of
+// selecting a parser with this type.
 type format string
 
 const (
+	// JsonOrYaml identifies the legacy JSON-or-YAML OpenAPI input format.
+	//
+	// Deprecated: Use AddSchema to load a custom JSON or YAML schema. Built-in
+	// schemas are loaded from compiled bundles.
 	JsonOrYaml format = "jsonOrYaml"
-	Proto      format = "proto"
+	// Proto identifies the legacy protobuf OpenAPI input format.
+	//
+	// Deprecated: Built-in schemas are loaded from compiled bundles and no
+	// longer select a protobuf parser. Use AddSchema with JSON or YAML for a
+	// custom schema.
+	Proto format = "proto"
 )
 
 // precomputedIsNamespaceScoped precomputes IsNamespaceScoped for known types. This avoids Schema creation,
@@ -303,7 +314,7 @@ func schemaUsingField(object *yaml.RNode, field string) (*spec.Schema, error) {
 
 // AddSchema parses s, and adds definitions from s to the global schema.
 func AddSchema(s []byte) error {
-	return parse(s, JsonOrYaml)
+	return parse(s)
 }
 
 // ResetOpenAPI resets the openapi data to empty
@@ -579,11 +590,7 @@ func (rs *ResourceSchema) PatchStrategyAndKey() (string, string) {
 const (
 	// kubernetesOpenAPIDefaultVersion is the latest version number of the statically compiled in
 	// OpenAPI schema for kubernetes built-in types
-	kubernetesOpenAPIDefaultVersion = kubernetesapi.DefaultOpenAPI
+	kubernetesOpenAPIDefaultVersion = DefaultOpenAPI
-
-	// kustomizationAPIAssetName is the name of the asset containing the statically compiled in
-	// OpenAPI definitions for Kustomization built-in types
-	kustomizationAPIAssetName = "kustomizationapi/swagger.json"
 
 	// kubernetesGVKExtensionKey is the key to lookup the kubernetes group version kind extension
 	// -- the extension is an array of objects containing a gvk
@@ -639,7 +646,7 @@ func SetSchema(openAPIField map[string]string, schema []byte, reset bool) error
 	if kubernetesOpenAPIVersion == "" {
 		return nil
 	}
-	if _, ok := kubernetesapi.OpenAPIMustAsset[kubernetesOpenAPIVersion]; !ok {
+	if !hasBuiltinOpenAPIVersion(kubernetesOpenAPIVersion) {
 		return fmt.Errorf("the specified OpenAPI version is not built in")
 	}
 
@@ -676,7 +683,7 @@ func initSchema() {
 
 	// TODO(natasha41575): Accept proto-formatted schema files
 	if customSchema != nil {
-		err := parse(customSchema, JsonOrYaml)
+		err := parse(customSchema)
 		if err != nil {
 			panic(fmt.Errorf("invalid schema file: %w", err))
 		}
@@ -694,57 +701,99 @@ func initSchema() {
 		globalSchema.defaultBuiltInSchemaParseStatus = schemaParsed
 	}
 
-	if err := parse(kustomizationapi.MustAsset(kustomizationAPIAssetName), JsonOrYaml); err != nil {
+	if err := parse(builtinKustomizationOpenAPI); err != nil {
 		// this should never happen
 		panic(err)
 	}
 }
 
-// parseBuiltinSchema calls parse to parse the json or proto schemas
+// parseBuiltinSchema decodes and indexes the compiled built-in schema bundle.
 func parseBuiltinSchema(version string) {
 	if globalSchema.noUseBuiltInSchema {
 		// don't parse the built in schema
 		return
 	}
-	// parse the swagger, this should never fail
+	if !hasBuiltinOpenAPIVersion(version) {
-	assetName := filepath.Join(
+		panic(fmt.Errorf("the specified OpenAPI version is not built in"))
-		"kubernetesapi",
+	}
-		strings.ReplaceAll(version, ".", "_"),
+	if err := parseBuiltinBundle(builtinKubernetesOpenAPIBundle); err != nil {
-		"swagger.pb")
-
-	if err := parse(kubernetesapi.OpenAPIMustAsset[version](assetName), Proto); err != nil {
 		// this should never happen
 		panic(err)
 	}
 }
 
-// parse parses and indexes a single json or proto schema
+// parseBuiltinBundle parses and indexes the compiled built-in schema bundle.
-func parse(b []byte, format format) error {
+func parseBuiltinBundle(compressed []byte) error {
-	var swagger spec.Swagger
+	bundle, err := decodeBuiltinBundle(compressed)
-	switch {
+	if err != nil {
-	case format == Proto:
+		return err
-		doc := &openapi_v2.Document{}
+	}
-		// We parse protobuf and get an openapi_v2.Document here.
+
-		if err := proto.Unmarshal(b, doc); err != nil {
+	AddDefinitions(bundle.Definitions)
-			return fmt.Errorf("openapi proto unmarshalling failed: %w", err)
+	if globalSchema.namespaceabilityByResourceType == nil {
+		globalSchema.namespaceabilityByResourceType = make(map[yaml.TypeMeta]bool)
+	}
+	for _, resource := range bundle.Resources {
+		typeMeta := yaml.TypeMeta{APIVersion: resource.APIVersion, Kind: resource.Kind}
+		switch resource.Scope {
+		case builtinopenapi.ScopeUnknown:
+		case builtinopenapi.ScopeNamespaced:
+			globalSchema.namespaceabilityByResourceType[typeMeta] = true
+		case builtinopenapi.ScopeCluster:
+			globalSchema.namespaceabilityByResourceType[typeMeta] = false
 		}
-		// convert the openapi_v2.Document back to Swagger
+	}
-		_, err := swagger.FromGnostic(doc)
+	return nil
+}
+
+func decodeBuiltinBundle(compressed []byte) (result *builtinopenapi.Bundle, retErr error) {
+	reader, err := gzip.NewReader(bytes.NewReader(compressed))
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	defer func() {
+		if closeErr := reader.Close(); closeErr != nil {
+			result = nil
+			closeErr = fmt.Errorf("close gzip reader: %w", closeErr)
+			if retErr != nil {
+				retErr = fmt.Errorf("%w; %w", retErr, closeErr)
+			} else {
+				retErr = closeErr
+			}
+		}
+	}()
+
+	decoder := json.NewDecoder(reader)
+	var bundle builtinopenapi.Bundle
+	if err := decoder.Decode(&bundle); err != nil {
+		return nil, errors.Wrap(err)
+	}
+	// Force the gzip reader to EOF so its checksum is verified, and reject any
+	// second JSON value in the artifact.
+	var trailing interface{}
+	if err := decoder.Decode(&trailing); err == nil {
+		return nil, fmt.Errorf("built-in OpenAPI bundle contains multiple JSON values")
+	} else if err != io.EOF {
+		return nil, errors.Wrap(err)
+	}
+	if err := bundle.Validate(); err != nil {
+		return nil, fmt.Errorf("validate built-in OpenAPI bundle: %w", err)
+	}
+	return &bundle, nil
+}
+
+// parse parses and indexes a single JSON or YAML OpenAPI schema.
+func parse(b []byte) error {
+	var swagger spec.Swagger
+	if len(b) > 0 && b[0] != byte('{') {
+		var err error
+		b, err = k8syaml.YAMLToJSON(b)
 		if err != nil {
 			return errors.Wrap(err)
 		}
-
+	}
-	case format == JsonOrYaml:
+	if err := swagger.UnmarshalJSON(b); err != nil {
-		if len(b) > 0 && b[0] != byte('{') {
+		return errors.Wrap(err)
-			var err error
-			b, err = k8syaml.YAMLToJSON(b)
-			if err != nil {
-				return errors.Wrap(err)
-			}
-		}
-		if err := swagger.UnmarshalJSON(b); err != nil {
-			return errors.Wrap(err)
-		}
 	}
 
 	AddDefinitions(swagger.Definitions)

kyaml/openapi/openapi_benchmark_test.go

@@ -4,35 +4,32 @@
 package openapi
 
 import (
-	"path/filepath"
-	"strings"
 	"testing"
 
-	openapi_v2 "github.com/google/gnostic-models/openapiv2"
-	"google.golang.org/protobuf/proto"
-	"sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
-func BenchmarkProtoUnmarshal(t *testing.B) {
+func BenchmarkBuiltinBundleDecode(b *testing.B) {
-	version := kubernetesOpenAPIDefaultVersion
+	b.ReportAllocs()
-
+	for i := 0; i < b.N; i++ {
-	// parse the swagger, this should never fail
+		if _, err := decodeBuiltinBundle(builtinKubernetesOpenAPIBundle); err != nil {
-	assetName := filepath.Join(
+			b.Fatalf("decodeBuiltinBundle failed: %v", err)
-		"kubernetesapi",
-		strings.ReplaceAll(version, ".", "_"),
-		"swagger.pb")
-
-	b := kubernetesapi.OpenAPIMustAsset[version](assetName)
-
-	for i := 0; i < t.N; i++ {
-		// We parse protobuf and get an openapiv2.Document here.
-		if err := proto.Unmarshal(b, &openapi_v2.Document{}); err != nil {
-			t.Fatalf("proto.Unmarshal failed: %v", err)
 		}
 	}
 }
 
+func BenchmarkFirstSchemaLookup(b *testing.B) {
+	b.ReportAllocs()
+	typeMeta := yaml.TypeMeta{APIVersion: "apps/v1", Kind: "Deployment"}
+	for i := 0; i < b.N; i++ {
+		ResetOpenAPI()
+		if schema := SchemaForResourceType(typeMeta); schema == nil {
+			b.Fatal("Deployment schema was not found")
+		}
+	}
+	ResetOpenAPI()
+}
+
 func BenchmarkPrecomputedIsNamespaceScoped(b *testing.B) {
 	testcases := map[string]yaml.TypeMeta{
 		"namespace scoped": {APIVersion: "apps/v1", Kind: "ControllerRevision"},

kyaml/openapi/scripts/fetchSchemaFromCluster.sh

@@ -1,20 +0,0 @@
-#!/bin/bash
-# Copyright 2020 The Kubernetes Authors.
-# SPDX-License-Identifier: Apache-2.0
-
-MYGOBIN=$(go env GOBIN)
-MYGOBIN="${MYGOBIN:-$(go env GOPATH)/bin}"
-VERSION=$1
-
-cp $HOME/.kube/config /tmp/kubeconfig.txt | true
-$MYGOBIN/kind create cluster --image kindest/node:$VERSION --name=getopenapidata
-
-# TODO (natasha41575) Add a `kustomize openapi fetch --proto` option
-kubectl proxy &
-sleep 5
-curl -k -H "Accept: application/com.github.proto-openapi.spec.v2@v1.0+protobuf" http://localhost:8001/openapi/v2 > /tmp/new_swagger.pb
-
-$MYGOBIN/kind delete cluster --name=getopenapidata
-cp /tmp/kubeconfig.txt $HOME/.kube/config | true
-mkdir -p kubernetesapi/"${VERSION//./_}"
-cp /tmp/new_swagger.pb kubernetesapi/"${VERSION//./_}"/swagger.pb

kyaml/openapi/scripts/generateSwaggerDotGo.sh

@@ -1,12 +0,0 @@
-#!/bin/bash
-# Copyright 2020 The Kubernetes Authors.
-# SPDX-License-Identifier: Apache-2.0
-
-MYGOBIN=$(go env GOBIN)
-MYGOBIN="${MYGOBIN:-$(go env GOPATH)/bin}"
-VERSION=$1
-
-$MYGOBIN/go-bindata \
-  --pkg "${VERSION//./_}" \
-  -o kubernetesapi/"${VERSION//./_}"/swagger.go \
-  kubernetesapi/"${VERSION//./_}"/swagger.pb

kyaml/openapi/scripts/makeOpenApiInfoDotGo.sh

@@ -1,81 +0,0 @@
-#!/bin/bash
-# Copyright 2020 The Kubernetes Authors.
-# SPDX-License-Identifier: Apache-2.0
-
-# This will read from the directory kubernetesapi
-# and use subdirectory names to generate
-# kubernetesapi/openapiinfo.go
-#
-# This script should only be run after the
-# swagger.json and swagger.go files are generated.
-
-set -e
-
-if ! command -v jq &> /dev/null ; then
-    echo Please install jq
-    echo on ubuntu: sudo apt-get install jq
-    exit 1
-fi
-
-info_list=()
-version_list=()
-
-V=`ls kubernetesapi | grep v.*`
-for VERSION in $V
-do
-  openapiinfo="{title:Kubernetes,version:${VERSION//_/.}}"
-  info_list+=( $openapiinfo )
-  version_list+=( ${VERSION} )
-done
-
-
-# add imports to openapiinfo.go
-cat <<EOF >kubernetesapi/openapiinfo.go
-// Copyright 2020 The Kubernetes Authors.
-// SPDX-License-Identifier: Apache-2.0
-
-// Code generated by $0; DO NOT EDIT.
-
-package kubernetesapi
-
-import (
-EOF
-
-for version in ${version_list[@]}
-do
-  cat <<EOF >>kubernetesapi/openapiinfo.go
-  "sigs.k8s.io/kustomize/kyaml/openapi/kubernetesapi/$version"
-EOF
-done
-
-# add info string for `kustomize openapi info` command
-OPEN_API_INFO=`echo ${info_list[@]} | sed 's/ /\\\n/g'`
-cat <<EOF >>kubernetesapi/openapiinfo.go
-)
-
-const Info = "$OPEN_API_INFO"
-EOF
-
-# add map for `initSchema` in openapi.go to use
-cat <<EOF >>kubernetesapi/openapiinfo.go
-
-var OpenAPIMustAsset = map[string]func(string)[]byte{
-EOF
-
-latest=""
-for version in ${version_list[@]}
-do
-  latest=$version
-  cat <<EOF >>kubernetesapi/openapiinfo.go
-  "${version//_/.}": $version.MustAsset,
-EOF
-done
-
-# add latest version to be used as a default
-cat <<EOF >>kubernetesapi/openapiinfo.go
-}
-
-const DefaultOpenAPI = "${latest//_/.}"
-EOF
-
-gofmt -s -w kubernetesapi/openapiinfo.go