bug: something is spamming bound CRD resolution for CachedResource/CachedResourceEndpointSlice

[gman0]

Describe the bug

Logs filled with:

I0619 13:43:58.104639 1104199 apiextensions.go:199] "skipping local CRD because it came in via APIBindings or system CRDs" workspace="system:bound-crds" customresourcedefinition.workspace="system:bound-crds" customresourcedefinition.namespace="" customresourcedefinition.name="065a805e-3d20-450c-abd2-473341f487eb" customresourcedefinition.apiVersion=""
I0619 13:43:58.104655 1104199 apiextensions.go:199] "skipping local CRD because it came in via APIBindings or system CRDs" workspace="system:bound-crds" customresourcedefinition.workspace="system:bound-crds" customresourcedefinition.namespace="" customresourcedefinition.name="8deef0ec-ec47-473e-9a2c-c3c037168410" customresourcedefinition.apiVersion=""
I0619 13:43:58.104675 1104199 apiextensions.go:199] "skipping local CRD because it came in via APIBindings or system CRDs" workspace="system:bound-crds" customresourcedefinition.workspace="system:bound-crds" customresourcedefinition.namespace="" customresourcedefinition.name="065a805e-3d20-450c-abd2-473341f487eb" customresourcedefinition.apiVersion=""
I0619 13:43:58.104680 1104199 apiextensions.go:199] "skipping local CRD because it came in via APIBindings or system CRDs" workspace="system:bound-crds" customresourcedefinition.workspace="system:bound-crds" customresourcedefinition.namespace="" customresourcedefinition.name="8deef0ec-ec47-473e-9a2c-c3c037168410" customresourcedefinition.apiVersion=""
...
I0619 13:45:00.912209 1104199 apiextensions.go:159] "skipping APIBinding CRD because it came in via system CRDs" workspace="system:shard" customresourcedefinition.workspace="system:bound-crds" customresourcedefinition.namespace="" customresourcedefinition.name="8deef0ec-ec47-473e-9a2c-c3c037168410" customresourcedefinition.apiVersion=""

Steps To Reproduce

Run kcp start @ main (v0.31.2). Check logs. Bisecting when did this start happening.

Expected Behaviour

Whoever is doing those lookups, stop it pls.

Additional Context

Captured logs of kcp start &> kcp.log running for some minutes.

cat kcp.log | rg --only-matching 'skipping.*$' | rg --only-matching 'customresourcedefinition.name="([^"]*)"' | sort | uniq -c

     47 customresourcedefinition.name="065a805e-3d20-450c-abd2-473341f487eb"
     50 customresourcedefinition.name="8deef0ec-ec47-473e-9a2c-c3c037168410"

Inspecting CRDs:

./etcdctl.sh get --keys-only --from-key '""' | rg '065a805e-3d20-450c-abd2-473341f487eb|8deef0ec-ec47-473e-9a2c-c3c037168410'

/registry/apiextensions.k8s.io/customresourcedefinitions/system:bound-crds/065a805e-3d20-450c-abd2-473341f487eb
/registry/apiextensions.k8s.io/customresourcedefinitions/system:bound-crds/8deef0ec-ec47-473e-9a2c-c3c037168410

CRD 065a805e-3d20-450c-abd2-473341f487eb:

./etcdctl.sh get /registry/apiextensions.k8s.io/customresourcedefinitions/system:bound-crds/065a805e-3d20-450c-abd2-473341f487eb 2> /dev/null | tail -n+2 | jq | rg '"(group|plural)": "'

    "group": "cache.kcp.io",
      "plural": "cachedresources",
      "plural": "cachedresources",

CRD 8deef0ec-ec47-473e-9a2c-c3c037168410:

./etcdctl.sh get /registry/apiextensions.k8s.io/customresourcedefinitions/system:bound-crds/8deef0ec-ec47-473e-9a2c-c3c037168410 2> /dev/null | tail -n+2 | jq | rg '"(group|plural)": "'

    "group": "cache.kcp.io",
      "plural": "cachedresourceendpointslices",
      "plural": "cachedresourceendpointslices",

[gman0]

Must have been something very recent that landed in main. v0.31.2 is good. And this keeps happening regardless of feature flags passed.

[gman0]

4a3299147b6ba0d3df931864f6b7299b52b2da70 is the first bad commit
commit 4a3299147b6ba0d3df931864f6b7299b52b2da70 (HEAD)
Author: Nelo-T. Wallus <n.wallus@sap.com>
Date:   Mon Jun 15 09:38:52 2026 +0200

    Honour MAP feature gate

 pkg/admission/mutatingadmissionpolicy/mutating_admission_policy.go | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

🤷

[gman0]

The high frequency is caused by MAP doing Admit() on Lease objects. Then, somewhere along the callstack the bound CRDs are being re-listed by the apiBindingAwareCRDClusterLister.

[ntnn]

Don't think this is entirely solved. It will be less because it now only happens when a MAP is actually polling the OpenAPI Endpoint