evictor wiring server->clients->cache

pkg/server/clientcache_evictor.go

@@ -0,0 +1,87 @@
+/*
+Copyright 2026 The kcp Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package server
+
+import (
+	"context"
+	"sync"
+
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/klog/v2"
+
+	"github.com/kcp-dev/logicalcluster/v3"
+	corev1alpha1 "github.com/kcp-dev/sdk/apis/core/v1alpha1"
+	corev1alpha1informers "github.com/kcp-dev/sdk/client/informers/externalversions/core/v1alpha1"
+)
+
+type evictable interface {
+	Evict(logicalcluster.Path)
+}
+
+// clientCacheEvictor forwards LogicalCluster deletions to its registered evictables.
+type clientCacheEvictor struct {
+	lock       sync.Mutex
+	evictables []evictable
+}
+
+func newClientCacheEvictor() *clientCacheEvictor {
+	return &clientCacheEvictor{}
+}
+
+// Register adds c to the set notified on LogicalCluster deletion. Safe to
+// call before or after Run.
+func (e *clientCacheEvictor) Register(c evictable) {
+	if c == nil {
+		return
+	}
+	e.lock.Lock()
+	defer e.lock.Unlock()
+	e.evictables = append(e.evictables, c)
+}
+
+// Run starts the clientCacheEvictor process.
+func (e *clientCacheEvictor) Run(ctx context.Context, informer corev1alpha1informers.LogicalClusterClusterInformer) {
+	logger := klog.FromContext(ctx)
+	_, _ = informer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		DeleteFunc: func(obj any) {
+			lc, ok := obj.(*corev1alpha1.LogicalCluster)
+			if !ok {
+				tombstone, tok := obj.(cache.DeletedFinalStateUnknown)
+				if !tok {
+					return
+				}
+				lc, ok = tombstone.Obj.(*corev1alpha1.LogicalCluster)
+				if !ok {
+					return
+				}
+			}
+			name := logicalcluster.From(lc)
+			if name == "" {
+				return
+			}
+			logger.V(4).Info("evicting per-cluster client caches", "logicalcluster", name)
+			path := name.Path()
+			e.lock.Lock()
+			snapshot := make([]evictable, len(e.evictables))
+			copy(snapshot, e.evictables)
+			e.lock.Unlock()
+			for _, c := range snapshot {
+				c.Evict(path)
+			}
+		},
+	})
+}

pkg/server/config.go

@@ -113,6 +113,9 @@ type ExtraConfig struct {
 	kcpAdminToken, shardAdminToken, userToken string
 	shardAdminTokenHash                       []byte
 
+	// ClientCacheEvictor forwards LogicalCluster deletions to clients.
+	ClientCacheEvictor *clientCacheEvictor
+
 	// clients
 	DynamicClusterClient                kcpdynamic.ClusterInterface
 	KubeClusterClient                   kcpkubernetesclientset.ClusterInterface
@@ -210,6 +213,7 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 	c := &Config{
 		Options: opts,
 	}
+	c.ClientCacheEvictor = newClientCacheEvictor()
 
 	if opts.Extra.ProfilerAddress != "" {
 		//nolint:errcheck,gosec
@@ -256,6 +260,7 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 	if err != nil {
 		return nil, err
 	}
+	c.ClientCacheEvictor.Register(c.KubeClusterClient)
 	cacheClientConfig, err := c.Options.Cache.Client.RestConfig(rest.CopyConfig(c.GenericConfig.LoopbackClientConfig))
 	if err != nil {
 		return nil, err
@@ -266,10 +271,12 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 		return nil, err
 	}
 	c.KcpCacheClusterClient = cacheKcpClusterClient
+	c.ClientCacheEvictor.Register(cacheKcpClusterClient)
 	cacheKubeClusterClient, err := kcpkubernetesclientset.NewForConfig(cacheClientConfig)
 	if err != nil {
 		return nil, err
 	}
+	c.ClientCacheEvictor.Register(cacheKubeClusterClient)
 	c.CacheKcpSharedInformerFactory = kcpinformers.NewSharedInformerFactoryWithOptions(
 		cacheKcpClusterClient,
 		resyncPeriod,
@@ -282,6 +289,7 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 	if err != nil {
 		return nil, err
 	}
+	c.ClientCacheEvictor.Register(c.CacheDynamicClient)
 
 	// Setup kcp * informers, but those will need the identities for the APIExports used to make the APIs available.
 	// The identities are not known before we can get them from the APIExports via the loopback client or from the root shard in case this is a non-root shard,
@@ -302,13 +310,15 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 		if err != nil {
 			return nil, err
 		}
+		c.ClientCacheEvictor.Register(c.RootShardKcpClusterClient)
 
 		c.IdentityConfig = rest.CopyConfig(c.GenericConfig.LoopbackClientConfig)
 		c.IdentityConfig.Wrap(kcpShardIdentityRoundTripper)
 		c.KcpClusterClient, err = kcpclientset.NewForConfig(c.IdentityConfig) // this is now generic to be used for all kcp API groups
 		if err != nil {
 			return nil, err
 		}
+		c.ClientCacheEvictor.Register(c.KcpClusterClient)
 	} else {
 		// The informers here are not used before the informers are actually started (i.e. no race).
 
@@ -317,6 +327,7 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 		if err != nil {
 			return nil, err
 		}
+		c.ClientCacheEvictor.Register(c.KcpClusterClient)
 		c.RootShardKcpClusterClient = c.KcpClusterClient
 	}
 
@@ -326,6 +337,7 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 	if err != nil {
 		return nil, err
 	}
+	c.ClientCacheEvictor.Register(informerKcpClient)
 	c.KcpSharedInformerFactory = kcpinformers.NewSharedInformerFactoryWithOptions(
 		informerKcpClient,
 		resyncPeriod,
@@ -334,6 +346,7 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 	if err != nil {
 		return nil, err
 	}
+	c.ClientCacheEvictor.Register(c.DeepSARClient)
 
 	c.LogicalClusterAdminConfig = rest.CopyConfig(c.GenericConfig.LoopbackClientConfig)
 	if len(c.Options.Extra.LogicalClusterAdminKubeconfig) > 0 {
@@ -355,6 +368,7 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 	if err != nil {
 		return nil, err
 	}
+	c.ClientCacheEvictor.Register(externalKubeClient)
 	opts.Extra.ServiceAccountCache.SetKubeShardClient(externalKubeClient)
 	opts.Extra.ServiceAccountCache.SetInformers(c.KcpSharedInformerFactory)
 
@@ -363,6 +377,7 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 	if err != nil {
 		return nil, err
 	}
+	c.ClientCacheEvictor.Register(c.ApiExtensionsClusterClient)
 	c.ApiExtensionsSharedInformerFactory = kcpapiextensionsinformers.NewSharedInformerFactoryWithOptions(
 		c.ApiExtensionsClusterClient,
 		resyncPeriod,
@@ -372,6 +387,7 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 	if err != nil {
 		return nil, err
 	}
+	c.ClientCacheEvictor.Register(c.CacheApiExtensionsClusterClient)
 	c.CacheApiExtensionsSharedInformerFactory = kcpapiextensionsinformers.NewSharedInformerFactoryWithOptions(
 		c.CacheApiExtensionsClusterClient,
 		resyncPeriod,
@@ -382,6 +398,7 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 	if err != nil {
 		return nil, err
 	}
+	c.ClientCacheEvictor.Register(c.DynamicClusterClient)
 
 	if err := opts.Authorization.ApplyTo(ctx, c.GenericConfig, c.KubeSharedInformerFactory, c.CacheKubeSharedInformerFactory, c.KcpSharedInformerFactory, c.CacheKcpSharedInformerFactory); err != nil {
 		return nil, err
@@ -406,11 +423,13 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 	if err != nil {
 		return nil, err
 	}
+	c.ClientCacheEvictor.Register(c.BootstrapApiExtensionsClusterClient)
 
 	c.BootstrapDynamicClusterClient, err = kcpdynamic.NewForConfig(bootstrapConfig)
 	if err != nil {
 		return nil, err
 	}
+	c.ClientCacheEvictor.Register(c.BootstrapDynamicClusterClient)
 
 	if err := opts.GenericControlPlane.Audit.ApplyTo(c.GenericConfig); err != nil {
 		return nil, err
@@ -479,6 +498,7 @@ func NewConfig(ctx context.Context, opts kcpserveroptions.CompletedOptions) (*Co
 		if err != nil {
 			return nil, fmt.Errorf("failed to create external kcp client for workspace authentication: %w", err)
 		}
+		c.ClientCacheEvictor.Register(externalKcpClient)
 
 		wacCache := shardlookup.NewTTLCache[*tenancyv1alpha1.WorkspaceAuthenticationConfiguration]()
 		wacCache.StartWithContext(ctx)