diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 578b58086c..03de411cce 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -23,17 +23,17 @@ jobs:
           - ""
           - tools/setup-envtest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # tag=v5.0.0
       - name: Calculate go version
         id: vars
         run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
       - name: Set up Go
-        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # tag=v5.0.2
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
         with:
           go-version: ${{ steps.vars.outputs.go_version }}
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # tag=v6.1.0
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # tag=v8.0.0
         with:
-          version: v1.57.2
-          args: --out-format=colored-line-number
+          version: v2.3.0
+          args: --output.text.print-linter-name=true --output.text.colors=true --timeout 10m
           working-directory: ${{matrix.working-directory}}
diff --git a/.github/workflows/ossf-scorecard.yaml b/.github/workflows/ossf-scorecard.yaml
index 0ee6b13784..671dbc88bd 100644
--- a/.github/workflows/ossf-scorecard.yaml
+++ b/.github/workflows/ossf-scorecard.yaml
@@ -26,12 +26,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # tag=v5.0.0
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # tag=v2.4.0
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # tag=v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif
@@ -43,7 +43,7 @@ jobs:
 
       # Upload the results as artifacts.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # tag=v4.3.6
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # tag=v4.6.2
         with:
           name: SARIF file
           path: results.sarif
diff --git a/.github/workflows/pr-dependabot.yaml b/.github/workflows/pr-dependabot.yaml
index a9bfb64317..b51cab0d8c 100644
--- a/.github/workflows/pr-dependabot.yaml
+++ b/.github/workflows/pr-dependabot.yaml
@@ -19,12 +19,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # tag=v5.0.0
     - name: Calculate go version
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # tag=v5.0.2
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
     - name: Update all modules
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 8e1d9dfad5..353a0a1c5c 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -14,20 +14,22 @@ jobs:
     name: Upload binaries to release
     runs-on: ubuntu-latest
     steps:
+    - name: Set env
+      run:  echo "RELEASE_TAG=${GITHUB_REF:10}" >> $GITHUB_ENV
     - name: Check out code
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # tag=v5.0.0
     - name: Calculate go version
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # tag=v5.0.2
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
     - name: Generate release binaries
       run: |
         make release
     - name: Release
-      uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # tag=v2.0.8
+      uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # tag=v2.3.2
       with:
         draft: false
         files: tools/setup-envtest/out/*
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index e24f962101..2168d72516 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -1,17 +1,18 @@
+name: PR title verifier
+
 on:
   pull_request_target:
-    types: [opened, edited, reopened, synchronize]
-
-permissions:
-  checks: write # Allow access to checks to write check runs.
+    types: [opened, edited, synchronize, reopened]
 
 jobs:
   verify:
     runs-on: ubuntu-latest
-    name: verify PR contents
+
     steps:
-    - name: Verifier action
-      id: verifier
-      uses: kubernetes-sigs/kubebuilder-release-tools@012269a88fa4c034a0acf1ba84c26b195c0dbab4 # tag=v0.4.3
-      with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # tag=v5.0.0
+
+      - name: Check if PR title is valid
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          ./hack/verify-pr-title.sh "${PR_TITLE}"
diff --git a/.golangci.yml b/.golangci.yml
index 4c43665e2b..1741432a01 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,26 +1,28 @@
+version: "2"
+run:
+  go: "1.24"
+  timeout: 10m
+  allow-parallel-runners: true
 linters:
-  disable-all: true
+  default: none
   enable:
     - asasalint
     - asciicheck
     - bidichk
     - bodyclose
+    - copyloopvar
     - dogsled
     - dupl
     - errcheck
     - errchkjson
     - errorlint
     - exhaustive
-    - exportloopref
+    - forbidigo
     - ginkgolinter
     - goconst
     - gocritic
     - gocyclo
-    - gofmt
-    - goimports
     - goprintffuncname
-    - gosec
-    - gosimple
     - govet
     - importas
     - ineffassign
@@ -32,141 +34,161 @@ linters:
     - prealloc
     - revive
     - staticcheck
-    - stylecheck
     - tagliatelle
-    - typecheck
     - unconvert
     - unparam
     - unused
     - whitespace
-
-linters-settings:
-  govet:
-    enable-all: true
-    disable:
-      - fieldalignment
-      - shadow
-  importas:
-    no-unaliased: true
-    alias:
-      # Kubernetes
-      - pkg: k8s.io/api/core/v1
-        alias: corev1
-      - pkg: k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1
-        alias: apiextensionsv1
-      - pkg: k8s.io/apimachinery/pkg/apis/meta/v1
-        alias: metav1
-      - pkg: k8s.io/apimachinery/pkg/api/errors
-        alias: apierrors
-      - pkg: k8s.io/apimachinery/pkg/util/errors
-        alias: kerrors
-      # Controller Runtime
-      - pkg: sigs.k8s.io/controller-runtime
-        alias: ctrl
-  revive:
+  settings:
+    forbidigo:
+        forbid:
+          - pattern: context.Background
+            msg: Use ginkgos SpecContext or go testings t.Context instead
+          - pattern: context.TODO
+            msg: Use ginkgos SpecContext or go testings t.Context instead
+    govet:
+      disable:
+        - fieldalignment
+        - shadow
+      enable-all: true
+    importas:
+      alias:
+        - pkg: k8s.io/api/core/v1
+          alias: corev1
+        - pkg: k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1
+          alias: apiextensionsv1
+        - pkg: k8s.io/apimachinery/pkg/apis/meta/v1
+          alias: metav1
+        - pkg: k8s.io/apimachinery/pkg/api/errors
+          alias: apierrors
+        - pkg: k8s.io/apimachinery/pkg/util/errors
+          alias: kerrors
+        - pkg: sigs.k8s.io/controller-runtime
+          alias: ctrl
+      no-unaliased: true
+    revive:
+      rules:
+        # The following rules are recommended https://github.com/mgechev/revive#recommended-configuration
+        - name: blank-imports
+        - name: context-as-argument
+        - name: context-keys-type
+        - name: dot-imports
+        - name: error-return
+        - name: error-strings
+        - name: error-naming
+        - name: exported
+        - name: if-return
+        - name: increment-decrement
+        - name: var-naming
+        - name: var-declaration
+        - name: range
+        - name: receiver-naming
+        - name: time-naming
+        - name: unexported-return
+        - name: indent-error-flow
+        - name: errorf
+        - name: superfluous-else
+        - name: unreachable-code
+        - name: redefines-builtin-id
+        #
+        # Rules in addition to the recommended configuration above.
+        #
+        - name: bool-literal-in-expr
+        - name: constant-logical-expr
+  exclusions:
+    generated: strict
+    paths:
+      - zz_generated.*\.go$
+      - .*conversion.*\.go$
     rules:
-      # The following rules are recommended https://github.com/mgechev/revive#recommended-configuration
-      - name: blank-imports
-      - name: context-as-argument
-      - name: context-keys-type
-      - name: dot-imports
-      - name: error-return
-      - name: error-strings
-      - name: error-naming
-      - name: exported
-      - name: if-return
-      - name: increment-decrement
-      - name: var-naming
-      - name: var-declaration
-      - name: range
-      - name: receiver-naming
-      - name: time-naming
-      - name: unexported-return
-      - name: indent-error-flow
-      - name: errorf
-      - name: superfluous-else
-      - name: unreachable-code
-      - name: redefines-builtin-id
-      #
-      # Rules in addition to the recommended configuration above.
-      #
-      - name: bool-literal-in-expr
-      - name: constant-logical-expr
-
+      - linters:
+          - forbidigo
+        path-except: _test\.go
+      - linters:
+          - gosec
+        text: 'G108: Profiling endpoint is automatically exposed on /debug/pprof'
+      - linters:
+          - revive
+        text: 'exported: exported method .*\.(Reconcile|SetupWithManager|SetupWebhookWithManager) should have comment or be unexported'
+      - linters:
+          - errcheck
+        text: Error return value of .((os\.)?std(out|err)\..*|.*Close|.*Flush|os\.Remove(All)?|.*print(f|ln)?|os\.(Un)?Setenv). is not checked
+      - linters:
+          - staticcheck
+        text: 'SA1019: .*The component config package has been deprecated and will be removed in a future release.'
+      # With Go 1.16, the new embed directive can be used with an un-named import,
+      # revive (previously, golint) only allows these to be imported in a main.go, which wouldn't work for us.
+      # This directive allows the embed package to be imported with an underscore everywhere.
+      - linters:
+          - revive
+        source: _ "embed"
+      # Exclude some packages or code to require comments, for example test code, or fake clients.
+      - linters:
+          - revive
+        text: exported (method|function|type|const) (.+) should have comment or be unexported
+        source: (func|type).*Fake.*
+      - linters:
+          - revive
+        path: fake_\.go
+        text: exported (method|function|type|const) (.+) should have comment or be unexported
+      # Disable unparam "always receives" which might not be really
+      # useful when building libraries.
+      - linters:
+          - unparam
+        text: always receives
+      # Dot imports for gomega and ginkgo are allowed
+      # within test files.
+      - path: _test\.go
+        text: should not use dot imports
+      - path: _test\.go
+        text: cyclomatic complexity
+      - path: _test\.go
+        text: 'G107: Potential HTTP request made with variable url'
+      # Append should be able to assign to a different var/slice.
+      - linters:
+          - gocritic
+        text: 'appendAssign: append result not assigned to the same slice'
+      - linters:
+          - gocritic
+        text: 'singleCaseSwitch: should rewrite switch statement to if statement'
+      # It considers all file access to a filename that comes from a variable problematic,
+      # which is naiv at best.
+      - linters:
+          - gosec
+        text: 'G304: Potential file inclusion via variable'
+      - linters:
+          - dupl
+        path: _test\.go
+      - linters:
+          - revive
+        path: .*/internal/.*
+      - linters:
+          - unused
+        # Seems to incorrectly trigger on the two implementations that are only
+        # used through an interface and not directly..?
+        # Likely same issue as https://github.com/dominikh/go-tools/issues/1616
+        path: pkg/controller/priorityqueue/metrics\.go
+      # The following are being worked on to remove their exclusion. This list should be reduced or go away all together over time.
+      # If it is decided they will not be addressed they should be moved above this comment.
+      - path: (.+)\.go$
+        text: Subprocess launch(ed with variable|ing should be audited)
+      - linters:
+          - gosec
+        path: (.+)\.go$
+        text: (G204|G104|G307)
+      - linters:
+          - staticcheck
+        path: (.+)\.go$
+        text: (ST1000|QF1008)
 issues:
-  max-same-issues: 0
   max-issues-per-linter: 0
-  # We are disabling default golangci exclusions because we want to help reviewers to focus on reviewing the most relevant
-  # changes in PRs and avoid nitpicking.
-  exclude-use-default: false
-  # List of regexps of issue texts to exclude, empty list by default.
-  exclude:
-    # The following are being worked on to remove their exclusion. This list should be reduced or go away all together over time.
-    # If it is decided they will not be addressed they should be moved above this comment.
-    - Subprocess launch(ed with variable|ing should be audited)
-    - (G204|G104|G307)
-    - "ST1000: at least one file in a package should have a package comment"
-  exclude-files:
-    - "zz_generated.*\\.go$"
-    - ".*conversion.*\\.go$"
-  exclude-rules:
-    - linters:
-        - gosec
-      text: "G108: Profiling endpoint is automatically exposed on /debug/pprof"
-    - linters:
-        - revive
-      text: "exported: exported method .*\\.(Reconcile|SetupWithManager|SetupWebhookWithManager) should have comment or be unexported"
-    - linters:
-        - errcheck
-      text: Error return value of .((os\.)?std(out|err)\..*|.*Close|.*Flush|os\.Remove(All)?|.*print(f|ln)?|os\.(Un)?Setenv). is not checked
-    - linters:
-        - staticcheck
-      text: "SA1019: .*The component config package has been deprecated and will be removed in a future release."
-    # With Go 1.16, the new embed directive can be used with an un-named import,
-    # revive (previously, golint) only allows these to be imported in a main.go, which wouldn't work for us.
-    # This directive allows the embed package to be imported with an underscore everywhere.
-    - linters:
-        - revive
-      source: _ "embed"
-    # Exclude some packages or code to require comments, for example test code, or fake clients.
-    - linters:
-        - revive
-      text: exported (method|function|type|const) (.+) should have comment or be unexported
-      source: (func|type).*Fake.*
-    - linters:
-        - revive
-      text: exported (method|function|type|const) (.+) should have comment or be unexported
-      path: fake_\.go
-    # Disable unparam "always receives" which might not be really
-    # useful when building libraries.
-    - linters:
-        - unparam
-      text: always receives
-    # Dot imports for gomega and ginkgo are allowed
-    # within test files.
-    - path: _test\.go
-      text: should not use dot imports
-    - path: _test\.go
-      text: cyclomatic complexity
-    - path: _test\.go
-      text: "G107: Potential HTTP request made with variable url"
-    # Append should be able to assign to a different var/slice.
-    - linters:
-        - gocritic
-      text: "appendAssign: append result not assigned to the same slice"
-    - linters:
-        - gocritic
-      text: "singleCaseSwitch: should rewrite switch statement to if statement"
-    # It considers all file access to a filename that comes from a variable problematic,
-    # which is naiv at best.
-    - linters:
-        - gosec
-      text: "G304: Potential file inclusion via variable"
-    - linters:
-        - dupl
-      path: _test\.go
-
-run:
-  go: "1.22"
-  timeout: 10m
-  allow-parallel-runners: true
+  max-same-issues: 0
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: strict
+    paths:
+      - zz_generated.*\.go$
+      - .*conversion.*\.go$
diff --git a/.gomodcheck.yaml b/.gomodcheck.yaml
index 75c5261fde..3608de331d 100644
--- a/.gomodcheck.yaml
+++ b/.gomodcheck.yaml
@@ -12,3 +12,6 @@ excludedModules:
   # --- test dependencies:
   - github.com/onsi/ginkgo/v2
   - github.com/onsi/gomega
+
+  # --- We want a newer version with generics support for this
+  - github.com/google/btree
diff --git a/Makefile b/Makefile
index 9d92b97730..b8e9cfa877 100644
--- a/Makefile
+++ b/Makefile
@@ -27,7 +27,7 @@ SHELL:=/usr/bin/env bash
 #
 # Go.
 #
-GO_VERSION ?= 1.22.5
+GO_VERSION ?= 1.24.0
 
 # Use GOPROXY environment variable if set
 GOPROXY := $(shell go env GOPROXY)
@@ -88,7 +88,7 @@ GO_APIDIFF_PKG := github.com/joelanford/go-apidiff
 $(GO_APIDIFF): # Build go-apidiff from tools folder.
 	GOBIN=$(TOOLS_BIN_DIR) $(GO_INSTALL) $(GO_APIDIFF_PKG) $(GO_APIDIFF_BIN) $(GO_APIDIFF_VER)
 
-CONTROLLER_GEN_VER := v0.14.0
+CONTROLLER_GEN_VER := v0.17.1
 CONTROLLER_GEN_BIN := controller-gen
 CONTROLLER_GEN := $(abspath $(TOOLS_BIN_DIR)/$(CONTROLLER_GEN_BIN)-$(CONTROLLER_GEN_VER))
 CONTROLLER_GEN_PKG := sigs.k8s.io/controller-tools/cmd/controller-gen
@@ -99,7 +99,7 @@ $(CONTROLLER_GEN): # Build controller-gen from tools folder.
 GOLANGCI_LINT_BIN := golangci-lint
 GOLANGCI_LINT_VER := $(shell cat .github/workflows/golangci-lint.yml | grep [[:space:]]version: | sed 's/.*version: //')
 GOLANGCI_LINT := $(abspath $(TOOLS_BIN_DIR)/$(GOLANGCI_LINT_BIN)-$(GOLANGCI_LINT_VER))
-GOLANGCI_LINT_PKG := github.com/golangci/golangci-lint/cmd/golangci-lint
+GOLANGCI_LINT_PKG := github.com/golangci/golangci-lint/v2/cmd/golangci-lint
 
 $(GOLANGCI_LINT): # Build golangci-lint from tools folder.
 	GOBIN=$(TOOLS_BIN_DIR) $(GO_INSTALL) $(GOLANGCI_LINT_PKG) $(GOLANGCI_LINT_BIN) $(GOLANGCI_LINT_VER)
@@ -174,7 +174,7 @@ release-binary: $(RELEASE_DIR)
 		-v "$$(pwd):/workspace$(DOCKER_VOL_OPTS)" \
 		-w /workspace/tools/setup-envtest \
 		golang:$(GO_VERSION) \
-		go build -a -trimpath -ldflags "-extldflags '-static'" \
+		go build -a -trimpath -ldflags "-X 'sigs.k8s.io/controller-runtime/tools/setup-envtest/version.version=$(RELEASE_TAG)' -extldflags '-static'" \
 		-o ./out/$(RELEASE_BINARY) ./
 
 ## --------------------------------------
diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES
index e465c3d5b0..47bf6eedf3 100644
--- a/OWNERS_ALIASES
+++ b/OWNERS_ALIASES
@@ -4,8 +4,10 @@ aliases:
   # active folks who can be contacted to perform admin-related
   # tasks on the repo, or otherwise approve any PRS.
   controller-runtime-admins:
-  - vincepri
+  - alvaroaleman
   - joelanford
+  - sbueringer
+  - vincepri
 
   # non-admin folks who have write-access and can approve any PRs in the repo
   controller-runtime-maintainers:
@@ -24,6 +26,8 @@ aliases:
   controller-runtime-reviewers:
   - varshaprasad96
   - inteon
+  - JoelSpeed
+  - troy0820
 
   # folks who may have context on ancient history,
   # but are no longer directly involved
diff --git a/README.md b/README.md
index 7b4f345044..54bacad42e 100644
--- a/README.md
+++ b/README.md
@@ -25,9 +25,9 @@ The full documentation can be found at [VERSIONING.md](VERSIONING.md), but TL;DR
 
 Users:
 
-- We follow [Semantic Versioning (semver)](https://semver.org)
-- Use releases with your dependency management to ensure that you get compatible code
-- The main branch contains all the latest code, some of which may break compatibility (so "normal" `go get` is not recommended)
+- We stick to a zero major version
+- We publish a minor version for each Kubernetes minor release and allow breaking changes between minor versions
+- We publish patch versions as needed and we don't allow breaking changes in them
 
 Contributors:
 
@@ -53,6 +53,8 @@ Compatible k8s.io/*, client-go and minimum Go versions can be looked up in our [
 
 |          | k8s.io/*, client-go | minimum Go version |
 |----------|:-------------------:|:------------------:|
+| CR v0.21 |        v0.33        |        1.24        |
+| CR v0.20 |        v0.32        |        1.23        |
 | CR v0.19 |        v0.31        |        1.22        |
 | CR v0.18 |        v0.30        |        1.22        |
 | CR v0.17 |        v0.29        |        1.21        |
@@ -67,9 +69,6 @@ See [FAQ.md](FAQ.md)
 
 Learn how to engage with the Kubernetes community on the [community page](http://kubernetes.io/community/).
 
-controller-runtime is a subproject of the [kubebuilder](https://github.com/kubernetes-sigs/kubebuilder) project
-in sig apimachinery.
-
 You can reach the maintainers of this project at:
 
 - Slack channel: [#controller-runtime](https://kubernetes.slack.com/archives/C02MRBMN00Z)
diff --git a/VERSIONING.md b/VERSIONING.md
index 2c0f2f9b2d..7ad6b142cc 100644
--- a/VERSIONING.md
+++ b/VERSIONING.md
@@ -7,6 +7,16 @@ For the purposes of the aforementioned guidelines, controller-runtime
 counts as a "library project", but otherwise follows the guidelines
 exactly.
 
+We stick to a major version of zero and create a minor version for
+each Kubernetes minor version and we allow breaking changes in our
+minor versions. We create patch releases as needed and don't allow
+breaking changes in them.
+
+Publishing a non-zero major version is pointless for us, as the k8s.io/*
+libraries we heavily depend on do breaking changes but use the same
+versioning scheme as described above. Consequently, a project can only
+ever depend on one controller-runtime version.
+
 [guidelines]: https://sigs.k8s.io/kubebuilder-release-tools/VERSIONING.md
 
 ## Compatibility and Release Support
diff --git a/alias.go b/alias.go
index 3e1ccdcf08..01ba012dcc 100644
--- a/alias.go
+++ b/alias.go
@@ -77,6 +77,9 @@ var (
 	// If --kubeconfig is set, will use the kubeconfig file at that location.  Otherwise will assume running
 	// in cluster and use the cluster provided kubeconfig.
 	//
+	// The returned `*rest.Config` has client-side ratelimting disabled as we can rely on API priority and
+	// fairness. Set its QPS to a value equal or bigger than 0 to re-enable it.
+	//
 	// Will log an error and exit if there is an error creating the rest.Config.
 	GetConfigOrDie = config.GetConfigOrDie
 
@@ -84,6 +87,9 @@ var (
 	// If --kubeconfig is set, will use the kubeconfig file at that location.  Otherwise will assume running
 	// in cluster and use the cluster provided kubeconfig.
 	//
+	// The returned `*rest.Config` has client-side ratelimting disabled as we can rely on API priority and
+	// fairness. Set its QPS to a value equal or bigger than 0 to re-enable it.
+	//
 	// Config precedence
 	//
 	// * --kubeconfig flag pointing at a file
diff --git a/designs/cache_options.md b/designs/cache_options.md
index 94dadffaeb..bdd29c0481 100644
--- a/designs/cache_options.md
+++ b/designs/cache_options.md
@@ -66,7 +66,7 @@ type ByObject struct {
   // An empty map prevents this.
   //
   // This must be unset for cluster-scoped objects.
-  Namespaces map[string]*Config
+  Namespaces map[string]Config
 
   // Config will be used for cluster-scoped objects and to default
   // Config in the Namespaces field.
@@ -79,7 +79,7 @@ type ByObject struct {
 type Options struct {
   // ByObject specifies per-object cache settings. If unset for a given
   // object, this will fall through to Default* settings.
-  ByObject map[client.Object]*ByObject
+  ByObject map[client.Object]ByObject
 
   // DefaultNamespaces maps namespace names to cache settings. If set, it
   // will be used for all objects that have a nil Namespaces setting.
@@ -91,7 +91,7 @@ type Options struct {
   //
   // The options in the Config that are nil will be defaulted from
   // the respective Default* settings.
-  DefaultNamespaces map[string]*Config
+  DefaultNamespaces map[string]Config
 
   // DefaultLabelSelector is the label selector that will be used as
   // the default field label selector for everything that doesn't
@@ -158,14 +158,14 @@ type Options struct {
 
 ```
 cache.Options{
-  ByObject: map[client.Object]*cache.ByObject{
+  ByObject: map[client.Object]cache.ByObject{
     &corev1.ConfigMap{}: {
-      Namespaces: map[string]*cache.Config{
+      Namespaces: map[string]cache.Config{
         "public":      {},
         "kube-system": {},
       },
     },
-    &corev1.Secret{}: {Namespaces: map[string]*Config{
+    &corev1.Secret{}: {Namespaces: map[string]Config{
         "operator": {},
     }},
   },
@@ -176,9 +176,9 @@ cache.Options{
 
 ```
 cache.Options{
-  ByObject: map[client.Object]*cache.ByObject{
+  ByObject: map[client.Object]cache.ByObject{
     &corev1.ConfigMap{}: {
-      Namespaces: map[string]*cache.Config{
+      Namespaces: map[string]cache.Config{
         cache.AllNamespaces: nil,                   // No selector for all namespaces...
         "operator": {LabelSelector: labelSelector}, // except for the operator namespace
       },
@@ -192,13 +192,13 @@ cache.Options{
 
 ```
 cache.Options{
-  ByObject: map[client.Object]*cache.ByObject{
-    &appsv1.Deployment: {Namespaces: map[string]*cache.Config{
-       cache.AllNamespaces: nil,
+  ByObject: map[client.Object]cache.ByObject{
+    &appsv1.Deployment: {Namespaces: map[string]cache.Config{
+       cache.AllNamespaces: {}},
     }},
   },
-  DefaultNamespaces: map[string]*cache.Config{
-      "operator": nil,
+  DefaultNamespaces: map[string]cache.Config{
+      "operator": {}},
   },
 }
 ```
@@ -207,7 +207,7 @@ cache.Options{
 
 ```
 cache.Options{
-  ByObject: map[client.Object]*cache.ByObject{
+  ByObject: map[client.Object]cache.ByObject{
     &corev1.Node: {LabelSelector: labels.Everything()},
   },
   DefaultLabelSelector: myLabelSelector,
@@ -218,9 +218,9 @@ cache.Options{
 
 ```
 cache.Options{
-  DefaultNamespaces: map[string]*cache.Config{
-    "foo": nil,
-    "bar": nil,
+  DefaultNamespaces: map[string]cache.Config{
+    "foo": {},
+    "bar": {},
   }
 }
 ```
diff --git a/designs/priorityqueue.md b/designs/priorityqueue.md
new file mode 100644
index 0000000000..ef1f7588a6
--- /dev/null
+++ b/designs/priorityqueue.md
@@ -0,0 +1,110 @@
+Priority Queue
+===================
+
+This document describes the motivation behind implementing a priority queue
+in controller-runtime and its design details.
+
+## Motivation
+
+1. Controllers reconcile all objects during startup to account for changes in
+   the reconciliation logic. Some controllers also periodically re-reconcile
+   everything to account for out of band changes they do not get notified for,
+   this is for example common for controllers managing cloud resources. In both
+   these cases, the reconciliation of new or changed objects gets delayed,
+   resulting in poor user experience. [Example][0]
+2. There may be application-specific reason why some events are more important
+   than others, [Example][1]
+
+## Proposed changes
+
+Implement a priority queue in controller-runtime that exposes the following
+interface:
+
+```go
+type PriorityQueue[T comparable] interface {
+    // AddWithOpts adds one or more items to the workqueue. Items
+    // in the workqueue are de-duplicated, so there will only ever
+    // be one entry for a given key.
+    // Adding an item that is already there may update its wait
+    // period to the lowest of existing and new wait period or
+    // its priority to the highest of existing and new priority.
+    AddWithOpts(o AddOpts, items ...T)
+
+    // GetWithPriority returns an item and its priority. It allows
+    // a controller to re-use the priority if it enqueues an item
+    // again.
+    GetWithPriority() (item T, priority int, shutdown bool)
+
+    // workqueue.TypedRateLimitingInterface is kept for backwards
+    // compatibility.
+    workqueue.TypedRateLimitingInterface[T]
+}
+
+type AddOpts struct {
+    // After is a duration after which the object will be available for
+    // reconciliation. If the object is already in the workqueue, the
+    // lowest of existing and new After period will be used.
+    After time.Duration
+
+    // Ratelimited specifies if the ratelimiter should be used to
+    // determine a wait period. If the object is already in the
+    // workqueue, the lowest of existing and new wait period will be
+    // used.
+    RateLimited bool
+
+    // Priority specifies the priority of the object. Objects with higher
+    // priority are returned before objects with lower priority. If the
+    // object is already in the workqueue, the priority will be updated
+    // to the highest of existing and new priority.
+    //
+    // The default value is 0.
+    Priority int
+}
+```
+
+In order to fix the issue described in point one of the motivation section,
+we have to be able to differentiate events stemming from the initial list
+during startup and from resyncs from other events. For events from the initial
+list, the informer emits a `Create` event whereas for `Resync` it emits an `Update`
+event. The suggestion is to use a heuristic for `Create` events, if the object
+in there is older than one minute, it is assumed to be from the initial `List`.
+For the `Resync`, we simply check if the `ResourceVersion` is unchanged.
+In both these cases, we will lower the priority to `LowPriority`/`-100`.
+This gives some room for use-cases where people want to use a priority that
+is lower than default (`0`) but higher than what we use in the wrapper.
+
+```go
+// WithLowPriorityWhenUnchanged wraps an existing handler and will
+// reduce the priority of events stemming from the initial listwatch
+// or cache resyncs to LowPriority.
+func WithLowPriorityWhenUnchanged[object client.Object, request comparable](u TypedEventHandler[object, request]) TypedEventHandler[object, request]{
+}
+```
+
+```go
+// LowPriority is the priority set by WithLowPriorityWhenUnchanged
+const LowPriority = -100
+```
+
+The issue described in point two of the motivation section ("application-specific
+reasons to prioritize some events") will always require implementation of a custom
+handler or eventsource in order to inject the appropriate priority.
+
+## Implementation stages
+
+In order to safely roll this out to all controller-runtime users, it is suggested to
+divide the implementation into two stages: Initially, we will add the priority queue
+but mark it as experimental and all usage of it requires explicit opt-in by setting
+a boolean on the manager or configuring `NewQueue` in a controllers opts. There will
+be no breaking changes required for this, but sources or handlers that want to make
+use of the new queue will have to use type assertions.
+
+After we've gained some confidence that the implementation is useful and correct, we
+will make it the default. Doing so entails breaking the `source.Source` and the
+`handler.Handler` interfaces as well as the `controller.Options` struct to refer to
+the new workqueue interface. We will wait at least one minor release after introducing
+the `PriorityQueue` before doing this.
+
+
+* [0]: https://youtu.be/AYNaaXlV8LQ?si=i2Pfo7Ske6rTrPLS
+* [1]: https://github.com/cilium/cilium/blob/a17d6945b29c177209af3d985bd82cce49eed4a1/operator/pkg/ciliumendpointslice/controller.go#L73
diff --git a/doc.go b/doc.go
index 0319bc3ff8..75d1d908c5 100644
--- a/doc.go
+++ b/doc.go
@@ -87,7 +87,7 @@ limitations under the License.
 // during writes (nor does it promise sequential create/get coherence), and code
 // should not assume a get immediately following a create/update will return
 // the updated resource. Caches may also have indexes, which can be created via
-// a FieldIndexer (pkg/client) obtained from the manager.  Indexes can used to
+// a FieldIndexer (pkg/client) obtained from the manager.  Indexes can be used to
 // quickly and easily look up all objects with certain fields set.  Reconcilers
 // may retrieve event recorders (pkg/recorder) to emit events using the
 // manager.
diff --git a/examples/builtins/controller.go b/examples/builtins/controller.go
index 6c8c5d935f..443283140a 100644
--- a/examples/builtins/controller.go
+++ b/examples/builtins/controller.go
@@ -21,7 +21,7 @@ import (
 	"fmt"
 
 	appsv1 "k8s.io/api/apps/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
@@ -43,13 +43,13 @@ func (r *reconcileReplicaSet) Reconcile(ctx context.Context, request reconcile.R
 	// Fetch the ReplicaSet from the cache
 	rs := &appsv1.ReplicaSet{}
 	err := r.client.Get(ctx, request.NamespacedName, rs)
-	if errors.IsNotFound(err) {
+	if apierrors.IsNotFound(err) {
 		log.Error(nil, "Could not find ReplicaSet")
 		return reconcile.Result{}, nil
 	}
 
 	if err != nil {
-		return reconcile.Result{}, fmt.Errorf("could not fetch ReplicaSet: %+v", err)
+		return reconcile.Result{}, fmt.Errorf("could not fetch ReplicaSet: %+w", err)
 	}
 
 	// Print the ReplicaSet
@@ -67,7 +67,7 @@ func (r *reconcileReplicaSet) Reconcile(ctx context.Context, request reconcile.R
 	rs.Labels["hello"] = "world"
 	err = r.client.Update(ctx, rs)
 	if err != nil {
-		return reconcile.Result{}, fmt.Errorf("could not write ReplicaSet: %+v", err)
+		return reconcile.Result{}, fmt.Errorf("could not write ReplicaSet: %+w", err)
 	}
 
 	return reconcile.Result{}, nil
diff --git a/examples/builtins/main.go b/examples/builtins/main.go
index 5a6e313f7b..3a47814d8c 100644
--- a/examples/builtins/main.go
+++ b/examples/builtins/main.go
@@ -22,23 +22,19 @@ import (
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
-	"sigs.k8s.io/controller-runtime/pkg/builder"
+
+	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client/config"
-	"sigs.k8s.io/controller-runtime/pkg/controller"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
-	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 )
 
-func init() {
-	log.SetLogger(zap.New())
-}
-
 func main() {
-	entryLog := log.Log.WithName("entrypoint")
+	ctrl.SetLogger(zap.New())
+	entryLog := ctrl.Log.WithName("entrypoint")
 
 	// Setup a Manager
 	entryLog.Info("setting up manager")
@@ -50,28 +46,21 @@ func main() {
 
 	// Setup a new controller to reconcile ReplicaSets
 	entryLog.Info("Setting up controller")
-	c, err := controller.New("foo-controller", mgr, controller.Options{
-		Reconciler: &reconcileReplicaSet{client: mgr.GetClient()},
-	})
-	if err != nil {
-		entryLog.Error(err, "unable to set up individual controller")
-		os.Exit(1)
-	}
 
-	// Watch ReplicaSets and enqueue ReplicaSet object key
-	if err := c.Watch(source.Kind(mgr.GetCache(), &appsv1.ReplicaSet{}, &handler.TypedEnqueueRequestForObject[*appsv1.ReplicaSet]{})); err != nil {
-		entryLog.Error(err, "unable to watch ReplicaSets")
-		os.Exit(1)
-	}
-
-	// Watch Pods and enqueue owning ReplicaSet key
-	if err := c.Watch(source.Kind(mgr.GetCache(), &corev1.Pod{},
-		handler.TypedEnqueueRequestForOwner[*corev1.Pod](mgr.GetScheme(), mgr.GetRESTMapper(), &appsv1.ReplicaSet{}, handler.OnlyControllerOwner()))); err != nil {
-		entryLog.Error(err, "unable to watch Pods")
+	err = ctrl.
+		NewControllerManagedBy(mgr).
+		Named("foo-controller").
+		WatchesRawSource(source.Kind(mgr.GetCache(), &appsv1.ReplicaSet{},
+			&handler.TypedEnqueueRequestForObject[*appsv1.ReplicaSet]{})).
+		WatchesRawSource(source.Kind(mgr.GetCache(), &corev1.Pod{},
+			handler.TypedEnqueueRequestForOwner[*corev1.Pod](mgr.GetScheme(), mgr.GetRESTMapper(), &appsv1.ReplicaSet{}, handler.OnlyControllerOwner()))).
+		Complete(&reconcileReplicaSet{client: mgr.GetClient()})
+	if err != nil {
+		entryLog.Error(err, "could not create controller")
 		os.Exit(1)
 	}
 
-	if err := builder.WebhookManagedBy(mgr).
+	if err := ctrl.NewWebhookManagedBy(mgr).
 		For(&corev1.Pod{}).
 		WithDefaulter(&podAnnotator{}).
 		WithValidator(&podValidator{}).
diff --git a/examples/crd/main.go b/examples/crd/main.go
index 1f6cd5fac2..0bf65c9890 100644
--- a/examples/crd/main.go
+++ b/examples/crd/main.go
@@ -65,7 +65,7 @@ func (r *reconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Resu
 	if podFound {
 		shouldStop := chaospod.Spec.NextStop.Time.Before(time.Now())
 		if !shouldStop {
-			return ctrl.Result{RequeueAfter: chaospod.Spec.NextStop.Sub(time.Now()) + 1*time.Second}, nil
+			return ctrl.Result{RequeueAfter: time.Until(chaospod.Spec.NextStop.Time) + 1*time.Second}, nil
 		}
 
 		if err := r.Delete(ctx, &pod); err != nil {
diff --git a/examples/crd/pkg/groupversion_info.go b/examples/crd/pkg/groupversion_info.go
index 04953dd939..31dfbbc779 100644
--- a/examples/crd/pkg/groupversion_info.go
+++ b/examples/crd/pkg/groupversion_info.go
@@ -20,13 +20,10 @@ package pkg
 
 import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
-	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/scheme"
 )
 
 var (
-	log = logf.Log.WithName("chaospod-resource")
-
 	// SchemeGroupVersion is group version used to register these objects
 	SchemeGroupVersion = schema.GroupVersion{Group: "chaosapps.metamagical.io", Version: "v1"}
 
diff --git a/examples/multiclustersync/main.go b/examples/multiclustersync/main.go
index 0b80f24193..e06b754222 100644
--- a/examples/multiclustersync/main.go
+++ b/examples/multiclustersync/main.go
@@ -105,7 +105,7 @@ func run() error {
 		clients[targetClusterName] = targetCluster.GetClient()
 	}
 
-	if err := b.Complete(&secretSyncReconcier{
+	if err := b.Complete(&secretSyncReconciler{
 		source:  mgr.GetClient(),
 		targets: clients,
 	}); err != nil {
@@ -125,14 +125,14 @@ type request struct {
 	clusterName string
 }
 
-// secretSyncReconcier is a simple reconciler that keeps all secrets in the source namespace of a given
+// secretSyncReconciler is a simple reconciler that keeps all secrets in the source namespace of a given
 // source cluster in sync with the secrets in the target namespace of all target clusters.
-type secretSyncReconcier struct {
+type secretSyncReconciler struct {
 	source  client.Client
 	targets map[string]client.Client
 }
 
-func (s *secretSyncReconcier) Reconcile(ctx context.Context, req request) (reconcile.Result, error) {
+func (s *secretSyncReconciler) Reconcile(ctx context.Context, req request) (reconcile.Result, error) {
 	targetClient, found := s.targets[req.clusterName]
 	if !found {
 		return reconcile.Result{}, reconcile.TerminalError(fmt.Errorf("target cluster %s not found", req.clusterName))
diff --git a/examples/priorityqueue/main.go b/examples/priorityqueue/main.go
new file mode 100644
index 0000000000..8dacdcc9a3
--- /dev/null
+++ b/examples/priorityqueue/main.go
@@ -0,0 +1,77 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"time"
+
+	"go.uber.org/zap/zapcore"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
+	kubeconfig "sigs.k8s.io/controller-runtime/pkg/client/config"
+	"sigs.k8s.io/controller-runtime/pkg/config"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+)
+
+func init() {
+}
+
+func main() {
+	if err := run(); err != nil {
+		fmt.Fprintf(os.Stderr, "%v\n", err)
+		os.Exit(1)
+	}
+}
+
+func run() error {
+	log.SetLogger(zap.New(func(o *zap.Options) {
+		o.Level = zapcore.Level(-5)
+	}))
+
+	// Setup a Manager
+	mgr, err := manager.New(kubeconfig.GetConfigOrDie(), manager.Options{
+		Controller: config.Controller{UsePriorityQueue: ptr.To(true)},
+	})
+	if err != nil {
+		return fmt.Errorf("failed to set up controller-manager: %w", err)
+	}
+
+	if err := builder.ControllerManagedBy(mgr).
+		For(&corev1.ConfigMap{}).
+		Complete(reconcile.Func(func(ctx context.Context, r reconcile.Request) (reconcile.Result, error) {
+			log.FromContext(ctx).Info("Reconciling")
+			time.Sleep(10 * time.Second)
+
+			return reconcile.Result{}, nil
+		})); err != nil {
+		return fmt.Errorf("failed to set up controller: %w", err)
+	}
+
+	if err := mgr.Start(signals.SetupSignalHandler()); err != nil {
+		return fmt.Errorf("failed to start manager: %w", err)
+	}
+
+	return nil
+}
diff --git a/examples/scratch-env/go.mod b/examples/scratch-env/go.mod
index dceb4d12aa..546c7c39ee 100644
--- a/examples/scratch-env/go.mod
+++ b/examples/scratch-env/go.mod
@@ -1,10 +1,10 @@
 module sigs.k8s.io/controller-runtime/examples/scratch-env
 
-go 1.22.0
+go 1.24.0
 
 require (
-	github.com/spf13/pflag v1.0.5
-	go.uber.org/zap v1.26.0
+	github.com/spf13/pflag v1.0.6
+	go.uber.org/zap v1.27.0
 	sigs.k8s.io/controller-runtime v0.0.0-00010101000000-000000000000
 )
 
@@ -12,58 +12,59 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
-	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
-	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/imdario/mergo v0.3.6 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/prometheus/client_golang v1.19.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.22.0 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.55.0 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc // indirect
-	golang.org/x/net v0.26.0 // indirect
-	golang.org/x/oauth2 v0.21.0 // indirect
-	golang.org/x/sys v0.21.0 // indirect
-	golang.org/x/term v0.21.0 // indirect
-	golang.org/x/text v0.16.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.38.0 // indirect
+	golang.org/x/oauth2 v0.27.0 // indirect
+	golang.org/x/sync v0.12.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/term v0.30.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/protobuf v1.34.2 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.31.0 // indirect
-	k8s.io/apiextensions-apiserver v0.31.0 // indirect
-	k8s.io/apimachinery v0.31.0 // indirect
-	k8s.io/client-go v0.31.0 // indirect
+	k8s.io/api v0.34.1 // indirect
+	k8s.io/apiextensions-apiserver v0.34.1 // indirect
+	k8s.io/apimachinery v0.34.1 // indirect
+	k8s.io/client-go v0.34.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
-	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
 replace sigs.k8s.io/controller-runtime => ../..
diff --git a/examples/scratch-env/go.sum b/examples/scratch-env/go.sum
index 89d30c15c1..012b88f447 100644
--- a/examples/scratch-env/go.sum
+++ b/examples/scratch-env/go.sum
@@ -7,55 +7,53 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
-github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k=
 github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ=
-github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
-github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
-github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
-github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
+github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
 github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
-github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
+github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
-github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/imdario/mergo v0.3.6 h1:xTNEAn+kxVO7dTZGu0CegyqKZmoWFI0rF8UxjlB2d28=
-github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -63,45 +61,49 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
-github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
-github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
-github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
+github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
+github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
+github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.19.1 h1:wZWJDwK+NameRJuPGDhlnFgx8e8HN3XHQeLaYJFJBOE=
-github.com/prometheus/client_golang v1.19.1/go.mod h1:mP78NwGzrVks5S2H6ab8+ZZGJLZUq1hoULYBAYBw1Ho=
+github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
+github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
-github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
+github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -110,53 +112,57 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
-go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc h1:mCRnTeVUjcrhlRmO0VK8a6k6Rrf6TF9htwo2pJVSjIU=
-golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
-golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
-golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
-golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
+golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
+golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
-golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
-golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
-golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
-golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
+golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
-google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -164,29 +170,28 @@ gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSP
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.31.0 h1:b9LiSjR2ym/SzTOlfMHm1tr7/21aD7fSkqgD/CVJBCo=
-k8s.io/api v0.31.0/go.mod h1:0YiFF+JfFxMM6+1hQei8FY8M7s1Mth+z/q7eF1aJkTE=
-k8s.io/apiextensions-apiserver v0.31.0 h1:fZgCVhGwsclj3qCw1buVXCV6khjRzKC5eCFt24kyLSk=
-k8s.io/apiextensions-apiserver v0.31.0/go.mod h1:b9aMDEYaEe5sdK+1T0KU78ApR/5ZVp4i56VacZYEHxk=
-k8s.io/apimachinery v0.31.0 h1:m9jOiSr3FoSSL5WO9bjm1n6B9KROYYgNZOb4tyZ1lBc=
-k8s.io/apimachinery v0.31.0/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
-k8s.io/client-go v0.31.0 h1:QqEJzNjbN2Yv1H79SsS+SWnXkBgVu4Pj3CJQgbx0gI8=
-k8s.io/client-go v0.31.0/go.mod h1:Y9wvC76g4fLjmU0BA+rV+h2cncoadjvjjkkIGoTLcGU=
+k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
+k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
+k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
+k8s.io/apiextensions-apiserver v0.34.1/go.mod h1:hP9Rld3zF5Ay2Of3BeEpLAToP+l4s5UlxiHfqRaRcMc=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
+k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
-k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
-k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
-k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/go.mod b/go.mod
index 3fd1aa9562..4d998fe2fc 100644
--- a/go.mod
+++ b/go.mod
@@ -1,100 +1,103 @@
 module sigs.k8s.io/controller-runtime
 
-go 1.22.0
+go 1.24.0
 
 require (
-	github.com/evanphx/json-patch/v5 v5.9.0
-	github.com/fsnotify/fsnotify v1.7.0
+	github.com/evanphx/json-patch/v5 v5.9.11
+	github.com/fsnotify/fsnotify v1.9.0
 	github.com/go-logr/logr v1.4.2
 	github.com/go-logr/zapr v1.3.0
-	github.com/google/go-cmp v0.6.0
+	github.com/google/btree v1.1.3
+	github.com/google/go-cmp v0.7.0
 	github.com/google/gofuzz v1.2.0
-	github.com/onsi/ginkgo/v2 v2.19.0
-	github.com/onsi/gomega v1.33.1
-	github.com/prometheus/client_golang v1.19.1
+	github.com/onsi/ginkgo/v2 v2.22.0
+	github.com/onsi/gomega v1.36.1
+	github.com/prometheus/client_golang v1.22.0
 	github.com/prometheus/client_model v0.6.1
 	go.uber.org/goleak v1.3.0
-	go.uber.org/zap v1.26.0
-	golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc
-	golang.org/x/mod v0.17.0
-	golang.org/x/sys v0.21.0
+	go.uber.org/zap v1.27.0
+	golang.org/x/mod v0.21.0
+	golang.org/x/sync v0.12.0
+	golang.org/x/sys v0.31.0
 	gomodules.xyz/jsonpatch/v2 v2.4.0
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // Using v4 to match upstream
-	k8s.io/api v0.31.0
-	k8s.io/apiextensions-apiserver v0.31.0
-	k8s.io/apimachinery v0.31.0
-	k8s.io/apiserver v0.31.0
-	k8s.io/client-go v0.31.0
+	k8s.io/api v0.34.1
+	k8s.io/apiextensions-apiserver v0.34.1
+	k8s.io/apimachinery v0.34.1
+	k8s.io/apiserver v0.34.1
+	k8s.io/client-go v0.34.1
 	k8s.io/klog/v2 v2.130.1
-	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
-	sigs.k8s.io/yaml v1.4.0
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
+	cel.dev/expr v0.24.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
-	github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/cel-go v0.20.1 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af // indirect
+	github.com/google/cel-go v0.26.0 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
-	github.com/imdario/mergo v0.3.6 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/prometheus/common v0.55.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/spf13/cobra v1.8.1 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/stoewer/go-strcase v1.2.0 // indirect
+	github.com/spf13/cobra v1.9.1 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect
-	go.opentelemetry.io/otel v1.28.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect
-	go.opentelemetry.io/otel/metric v1.28.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.28.0 // indirect
-	go.opentelemetry.io/otel/trace v1.28.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
+	go.opentelemetry.io/otel v1.35.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.34.0 // indirect
+	go.opentelemetry.io/otel/trace v1.35.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/net v0.26.0 // indirect
-	golang.org/x/oauth2 v0.21.0 // indirect
-	golang.org/x/sync v0.7.0 // indirect
-	golang.org/x/term v0.21.0 // indirect
-	golang.org/x/text v0.16.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
-	google.golang.org/grpc v1.65.0 // indirect
-	google.golang.org/protobuf v1.34.2 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
+	golang.org/x/net v0.38.0 // indirect
+	golang.org/x/oauth2 v0.27.0 // indirect
+	golang.org/x/term v0.30.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
+	golang.org/x/tools v0.26.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/grpc v1.72.1 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/component-base v0.31.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
-	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	k8s.io/component-base v0.34.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
+	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
 )
diff --git a/go.sum b/go.sum
index cb957a9e14..d6278d8a7d 100644
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,7 @@
+cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
 github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
 github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
@@ -10,24 +10,23 @@ github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK3
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
-github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/evanphx/json-patch v0.5.2 h1:xVCHIVMUu1wtM/VkR9jVZ45N3FhZfYMMYGorLCR8P3k=
 github.com/evanphx/json-patch v0.5.2/go.mod h1:ZWS5hhDbVDyob71nXKNL0+PWn6ToqBHMikGIFbs31qQ=
-github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
-github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
+github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
+github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
-github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -35,39 +34,37 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
 github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
-github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/cel-go v0.20.1 h1:nDx9r8S3L4pE61eDdt8igGj8rf5kjYR3ILxWIpWNi84=
-github.com/google/cel-go v0.20.1/go.mod h1:kWcIzTsPX0zmQ+H3TirHstLLf9ep5QTsZBN9u4dOYLg=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
+github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+github.com/google/cel-go v0.26.0 h1:DPGjXackMpJWH680oGY4lZhYjIameYmR+/6RBdDGmaI=
+github.com/google/cel-go v0.26.0/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
-github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
-github.com/imdario/mergo v0.3.6 h1:xTNEAn+kxVO7dTZGu0CegyqKZmoWFI0rF8UxjlB2d28=
-github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
@@ -76,6 +73,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -83,132 +82,143 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
-github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
-github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
-github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
+github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
+github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.36.1 h1:bJDPBO7ibjxcbHMgSCoo4Yj18UWbKDlLwX1x9sybDcw=
+github.com/onsi/gomega v1.36.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.19.1 h1:wZWJDwK+NameRJuPGDhlnFgx8e8HN3XHQeLaYJFJBOE=
-github.com/prometheus/client_golang v1.19.1/go.mod h1:mP78NwGzrVks5S2H6ab8+ZZGJLZUq1hoULYBAYBw1Ho=
+github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
+github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
-github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
+github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
-github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stoewer/go-strcase v1.2.0 h1:Z2iHWqGXH00XYgqDmNgQbIBxf3wrNq0F3feEy0ainaU=
-github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
+github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 h1:4K4tsIXefpVJtvA/8srF4V4y0akAoPHkIslgAkjixJA=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0/go.mod h1:jjdQuTGVsXV4vSs+CJ2qYDeDPf9yIJV23qlIzBm73Vg=
-go.opentelemetry.io/otel v1.28.0 h1:/SqNcYk+idO0CxKEUOtKQClMK/MimZihKYMruSMViUo=
-go.opentelemetry.io/otel v1.28.0/go.mod h1:q68ijF8Fc8CnMHKyzqL6akLO46ePnjkgfIMIjUIX9z4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 h1:qFffATk0X+HD+f1Z8lswGiOQYKHRlzfmdJm0wEaVrFA=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0/go.mod h1:MOiCmryaYtc+V0Ei+Tx9o5S1ZjA7kzLucuVuyzBZloQ=
-go.opentelemetry.io/otel/metric v1.28.0 h1:f0HGvSl1KRAU1DLgLGFjrwVyismPlnuU6JD6bOeuA5Q=
-go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s=
-go.opentelemetry.io/otel/sdk v1.28.0 h1:b9d7hIry8yZsgtbmM0DKyPWMMUMlK9NEKuIG4aBqWyE=
-go.opentelemetry.io/otel/sdk v1.28.0/go.mod h1:oYj7ClPUA7Iw3m+r7GeEjz0qckQRJK2B8zjcZEfu7Pg=
-go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+lkx9g=
-go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI=
-go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
-go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 h1:tgJ0uaNS4c98WRNUEx5U3aDlrDOI5Rs+1Vifcw4DJ8U=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0/go.mod h1:U7HYyW0zt/a9x5J1Kjs+r1f/d4ZHnYFclhYY2+YbeoE=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
+go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
+go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
+go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
+go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
+go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
-go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc h1:mCRnTeVUjcrhlRmO0VK8a6k6Rrf6TF9htwo2pJVSjIU=
-golang.org/x/exp v0.0.0-20230515195305-f3d0a9c9a5cc/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
+golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
-golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
-golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
-golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
+golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
+golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
-golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
-golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
-golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
-golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
+golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157 h1:7whR9kGa5LUwFtpLm2ArCEejtnxlGeLbAyjFY8sGNFw=
-google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157/go.mod h1:99sLkeliLXfdj2J75X3Ho+rrVCaJze0uwN7zDDkjPVU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
-google.golang.org/grpc v1.65.0 h1:bs/cUb4lp1G5iImFFd3u5ixQzweKizoZJAwBNLR42lc=
-google.golang.org/grpc v1.65.0/go.mod h1:WgYC2ypjlB0EiQi6wdKixMqukr6lBc0Vo+oOgjrM5ZQ=
-google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
-google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb h1:p31xT4yrYrSM/G4Sn2+TNUkVhFCbG9y8itM2S6Th950=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:jbe3Bkdp+Dh2IrslsFCklNhweNTBgSYanP1UXhJDhKg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb h1:TLPQVbx1GJ8VKZxz52VAxl1EBgKXXbTiU9Fc5fZeLn4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
+google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
+google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -216,36 +226,34 @@ gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSP
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.31.0 h1:b9LiSjR2ym/SzTOlfMHm1tr7/21aD7fSkqgD/CVJBCo=
-k8s.io/api v0.31.0/go.mod h1:0YiFF+JfFxMM6+1hQei8FY8M7s1Mth+z/q7eF1aJkTE=
-k8s.io/apiextensions-apiserver v0.31.0 h1:fZgCVhGwsclj3qCw1buVXCV6khjRzKC5eCFt24kyLSk=
-k8s.io/apiextensions-apiserver v0.31.0/go.mod h1:b9aMDEYaEe5sdK+1T0KU78ApR/5ZVp4i56VacZYEHxk=
-k8s.io/apimachinery v0.31.0 h1:m9jOiSr3FoSSL5WO9bjm1n6B9KROYYgNZOb4tyZ1lBc=
-k8s.io/apimachinery v0.31.0/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
-k8s.io/apiserver v0.31.0 h1:p+2dgJjy+bk+B1Csz+mc2wl5gHwvNkC9QJV+w55LVrY=
-k8s.io/apiserver v0.31.0/go.mod h1:KI9ox5Yu902iBnnyMmy7ajonhKnkeZYJhTZ/YI+WEMk=
-k8s.io/client-go v0.31.0 h1:QqEJzNjbN2Yv1H79SsS+SWnXkBgVu4Pj3CJQgbx0gI8=
-k8s.io/client-go v0.31.0/go.mod h1:Y9wvC76g4fLjmU0BA+rV+h2cncoadjvjjkkIGoTLcGU=
-k8s.io/component-base v0.31.0 h1:/KIzGM5EvPNQcYgwq5NwoQBaOlVFrghoVGr8lG6vNRs=
-k8s.io/component-base v0.31.0/go.mod h1:TYVuzI1QmN4L5ItVdMSXKvH7/DtvIuas5/mm8YT3rTo=
+k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
+k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
+k8s.io/apiextensions-apiserver v0.34.1 h1:NNPBva8FNAPt1iSVwIE0FsdrVriRXMsaWFMqJbII2CI=
+k8s.io/apiextensions-apiserver v0.34.1/go.mod h1:hP9Rld3zF5Ay2Of3BeEpLAToP+l4s5UlxiHfqRaRcMc=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/apiserver v0.34.1 h1:U3JBGdgANK3dfFcyknWde1G6X1F4bg7PXuvlqt8lITA=
+k8s.io/apiserver v0.34.1/go.mod h1:eOOc9nrVqlBI1AFCvVzsob0OxtPZUCPiUJL45JOTBG0=
+k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
+k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
+k8s.io/component-base v0.34.1 h1:v7xFgG+ONhytZNFpIz5/kecwD+sUhVE6HU7qQUiRM4A=
+k8s.io/component-base v0.34.1/go.mod h1:mknCpLlTSKHzAQJJnnHVKqjxR7gBeHRv0rPXA7gdtQ0=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
-k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
-k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
-k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 h1:2770sDpzrjjsAtVhSeUFseziht227YAWYHLGNM8QPwY=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/apidiff.sh b/hack/apidiff.sh
index 5fe967aa37..a15342d16a 100755
--- a/hack/apidiff.sh
+++ b/hack/apidiff.sh
@@ -23,6 +23,8 @@ source $(dirname ${BASH_SOURCE})/common.sh
 REPO_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 cd "${REPO_ROOT}"
 
+export GOTOOLCHAIN="go$(make --silent go-version)"
+
 header_text "verifying api diff"
 echo "*** Running go-apidiff ***"
 APIDIFF_OLD_COMMIT="${PULL_BASE_SHA}" make verify-apidiff
diff --git a/hack/check-everything.sh b/hack/check-everything.sh
index 2467e2504a..84db032176 100755
--- a/hack/check-everything.sh
+++ b/hack/check-everything.sh
@@ -24,11 +24,13 @@ source ${hack_dir}/common.sh
 tmp_root=/tmp
 kb_root_dir=$tmp_root/kubebuilder
 
+export GOTOOLCHAIN="go$(make --silent go-version)"
+
 # Run verification scripts.
 ${hack_dir}/verify.sh
 
 # Envtest.
-ENVTEST_K8S_VERSION=${ENVTEST_K8S_VERSION:-"1.28.0"}
+ENVTEST_K8S_VERSION=${ENVTEST_K8S_VERSION:-"1.32.0"}
 
 header_text "installing envtest tools@${ENVTEST_K8S_VERSION} with setup-envtest if necessary"
 tmp_bin=/tmp/cr-tests-bin
diff --git a/hack/verify-pr-title.sh b/hack/verify-pr-title.sh
new file mode 100755
index 0000000000..a556b0172b
--- /dev/null
+++ b/hack/verify-pr-title.sh
@@ -0,0 +1,54 @@
+#!/bin/bash
+
+# Copyright 2024 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Define regex patterns
+WIP_REGEX="^\W?WIP\W"
+TAG_REGEX="^\[[[:alnum:]\._-]*\]"
+PR_TITLE="$1"
+
+# Trim WIP and tags from title
+trimmed_title=$(echo "$PR_TITLE" | sed -E "s/$WIP_REGEX//" | sed -E "s/$TAG_REGEX//" | xargs)
+
+# Normalize common emojis in text form to actual emojis
+trimmed_title=$(echo "$trimmed_title" | sed -E "s/:warning:/⚠/g")
+trimmed_title=$(echo "$trimmed_title" | sed -E "s/:sparkles:/✨/g")
+trimmed_title=$(echo "$trimmed_title" | sed -E "s/:bug:/🐛/g")
+trimmed_title=$(echo "$trimmed_title" | sed -E "s/:book:/📖/g")
+trimmed_title=$(echo "$trimmed_title" | sed -E "s/:rocket:/🚀/g")
+trimmed_title=$(echo "$trimmed_title" | sed -E "s/:seedling:/🌱/g")
+
+# Check PR type prefix
+if [[ "$trimmed_title" =~ ^(⚠|✨|🐛|📖|🚀|🌱) ]]; then
+    echo "PR title is valid: $trimmed_title"
+else
+    echo "Error: No matching PR type indicator found in title."
+    echo "You need to have one of these as the prefix of your PR title:"
+    echo "- Breaking change: ⚠ (:warning:)"
+    echo "- Non-breaking feature: ✨ (:sparkles:)"
+    echo "- Patch fix: 🐛 (:bug:)"
+    echo "- Docs: 📖 (:book:)"
+    echo "- Release: 🚀 (:rocket:)"
+    echo "- Infra/Tests/Other: 🌱 (:seedling:)"
+    exit 1
+fi
+
+# Check that PR title does not contain Issue or PR number
+if [[ "$trimmed_title" =~ \#[0-9]+ ]]; then
+    echo "Error: PR title should not contain issue or PR number."
+    echo "Issue numbers belong in the PR body as either \"Fixes #XYZ\" (if it closes the issue or PR), or something like \"Related to #XYZ\" (if it's just related)."
+    exit 1
+fi
+
diff --git a/pkg/builder/controller_test.go b/pkg/builder/controller_test.go
index cbeb1c43bc..b1c9c3de3b 100644
--- a/pkg/builder/controller_test.go
+++ b/pkg/builder/controller_test.go
@@ -402,7 +402,7 @@ var _ = Describe("application", func() {
 	})
 
 	Describe("Start with ControllerManagedBy", func() {
-		It("should Reconcile Owns objects", func() {
+		It("should Reconcile Owns objects", func(ctx SpecContext) {
 			m, err := manager.New(cfg, manager.Options{})
 			Expect(err).NotTo(HaveOccurred())
 
@@ -411,12 +411,10 @@ var _ = Describe("application", func() {
 				Named("deployment-0").
 				Owns(&appsv1.ReplicaSet{})
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			doReconcileTest(ctx, "3", m, false, bldr)
 		})
 
-		It("should Reconcile Owns objects for every owner", func() {
+		It("should Reconcile Owns objects for every owner", func(ctx SpecContext) {
 			m, err := manager.New(cfg, manager.Options{})
 			Expect(err).NotTo(HaveOccurred())
 
@@ -425,12 +423,10 @@ var _ = Describe("application", func() {
 				Named("deployment-1").
 				Owns(&appsv1.ReplicaSet{}, MatchEveryOwner)
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			doReconcileTest(ctx, "12", m, false, bldr)
 		})
 
-		It("should Reconcile Watches objects", func() {
+		It("should Reconcile Watches objects", func(ctx SpecContext) {
 			m, err := manager.New(cfg, manager.Options{})
 			Expect(err).NotTo(HaveOccurred())
 
@@ -441,12 +437,10 @@ var _ = Describe("application", func() {
 					handler.EnqueueRequestForOwner(m.GetScheme(), m.GetRESTMapper(), &appsv1.Deployment{}, handler.OnlyControllerOwner()),
 				)
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			doReconcileTest(ctx, "4", m, true, bldr)
 		})
 
-		It("should Reconcile without For", func() {
+		It("should Reconcile without For", func(ctx SpecContext) {
 			m, err := manager.New(cfg, manager.Options{})
 			Expect(err).NotTo(HaveOccurred())
 
@@ -460,14 +454,12 @@ var _ = Describe("application", func() {
 					handler.EnqueueRequestForOwner(m.GetScheme(), m.GetRESTMapper(), &appsv1.Deployment{}, handler.OnlyControllerOwner()),
 				)
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			doReconcileTest(ctx, "9", m, true, bldr)
 		})
 	})
 
 	Describe("Set custom predicates", func() {
-		It("should execute registered predicates only for assigned kind", func() {
+		It("should execute registered predicates only for assigned kind", func(ctx SpecContext) {
 			m, err := manager.New(cfg, manager.Options{})
 			Expect(err).NotTo(HaveOccurred())
 
@@ -517,8 +509,6 @@ var _ = Describe("application", func() {
 				Owns(&appsv1.ReplicaSet{}, WithPredicates(replicaSetPrct)).
 				WithEventFilter(allPrct)
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			doReconcileTest(ctx, "5", m, true, bldr)
 
 			Expect(deployPrctExecuted).To(BeTrue(), "Deploy predicated should be called at least once")
@@ -537,17 +527,14 @@ var _ = Describe("application", func() {
 			Expect(err).NotTo(HaveOccurred())
 		})
 
-		It("should support multiple controllers watching the same metadata kind", func() {
+		It("should support multiple controllers watching the same metadata kind", func(ctx SpecContext) {
 			bldr1 := ControllerManagedBy(mgr).For(&appsv1.Deployment{}, OnlyMetadata).Named("deployment-4")
 			bldr2 := ControllerManagedBy(mgr).For(&appsv1.Deployment{}, OnlyMetadata).Named("deployment-5")
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
 			doReconcileTest(ctx, "6", mgr, true, bldr1, bldr2)
 		})
 
-		It("should support watching For, Owns, and Watch as metadata", func() {
+		It("should support watching For, Owns, and Watch as metadata", func(ctx SpecContext) {
 			statefulSetMaps := make(chan *metav1.PartialObjectMetadata)
 
 			bldr := ControllerManagedBy(mgr).
@@ -571,8 +558,6 @@ var _ = Describe("application", func() {
 					}),
 					OnlyMetadata)
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			doReconcileTest(ctx, "8", mgr, true, bldr)
 
 			By("Creating a new stateful set")
@@ -601,7 +586,7 @@ var _ = Describe("application", func() {
 					},
 				},
 			}
-			err := mgr.GetClient().Create(context.TODO(), set)
+			err := mgr.GetClient().Create(ctx, set)
 			Expect(err).NotTo(HaveOccurred())
 
 			By("Checking that the mapping function has been called")
diff --git a/pkg/builder/webhook.go b/pkg/builder/webhook.go
index 81d8f74056..6263f030a0 100644
--- a/pkg/builder/webhook.go
+++ b/pkg/builder/webhook.go
@@ -20,6 +20,7 @@ import (
 	"errors"
 	"net/http"
 	"net/url"
+	"regexp"
 	"strings"
 
 	"github.com/go-logr/logr"
@@ -36,15 +37,19 @@ import (
 
 // WebhookBuilder builds a Webhook.
 type WebhookBuilder struct {
-	apiType         runtime.Object
-	customDefaulter admission.CustomDefaulter
-	customValidator admission.CustomValidator
-	gvk             schema.GroupVersionKind
-	mgr             manager.Manager
-	config          *rest.Config
-	recoverPanic    *bool
-	logConstructor  func(base logr.Logger, req *admission.Request) logr.Logger
-	err             error
+	apiType                   runtime.Object
+	customDefaulter           admission.CustomDefaulter
+	customDefaulterOpts       []admission.DefaulterOption
+	customValidator           admission.CustomValidator
+	customPath                string
+	customValidatorCustomPath string
+	customDefaulterCustomPath string
+	gvk                       schema.GroupVersionKind
+	mgr                       manager.Manager
+	config                    *rest.Config
+	recoverPanic              *bool
+	logConstructor            func(base logr.Logger, req *admission.Request) logr.Logger
+	err                       error
 }
 
 // WebhookManagedBy returns a new webhook builder.
@@ -65,9 +70,11 @@ func (blder *WebhookBuilder) For(apiType runtime.Object) *WebhookBuilder {
 	return blder
 }
 
-// WithDefaulter takes an admission.CustomDefaulter interface, a MutatingWebhook will be wired for this type.
-func (blder *WebhookBuilder) WithDefaulter(defaulter admission.CustomDefaulter) *WebhookBuilder {
+// WithDefaulter takes an admission.CustomDefaulter interface, a MutatingWebhook with the provided opts (admission.DefaulterOption)
+// will be wired for this type.
+func (blder *WebhookBuilder) WithDefaulter(defaulter admission.CustomDefaulter, opts ...admission.DefaulterOption) *WebhookBuilder {
 	blder.customDefaulter = defaulter
+	blder.customDefaulterOpts = opts
 	return blder
 }
 
@@ -90,6 +97,27 @@ func (blder *WebhookBuilder) RecoverPanic(recoverPanic bool) *WebhookBuilder {
 	return blder
 }
 
+// WithCustomPath overrides the webhook's default path by the customPath
+//
+// Deprecated: WithCustomPath should not be used anymore.
+// Please use WithValidatorCustomPath or WithDefaulterCustomPath instead.
+func (blder *WebhookBuilder) WithCustomPath(customPath string) *WebhookBuilder {
+	blder.customPath = customPath
+	return blder
+}
+
+// WithValidatorCustomPath overrides the path of the Validator.
+func (blder *WebhookBuilder) WithValidatorCustomPath(customPath string) *WebhookBuilder {
+	blder.customValidatorCustomPath = customPath
+	return blder
+}
+
+// WithDefaulterCustomPath overrides the path of the Defaulter.
+func (blder *WebhookBuilder) WithDefaulterCustomPath(customPath string) *WebhookBuilder {
+	blder.customDefaulterCustomPath = customPath
+	return blder
+}
+
 // Complete builds the webhook.
 func (blder *WebhookBuilder) Complete() error {
 	// Set the Config
@@ -128,6 +156,10 @@ func (blder *WebhookBuilder) setLogConstructor() {
 	}
 }
 
+func (blder *WebhookBuilder) isThereCustomPathConflict() bool {
+	return (blder.customPath != "" && blder.customDefaulter != nil && blder.customValidator != nil) || (blder.customPath != "" && blder.customDefaulterCustomPath != "") || (blder.customPath != "" && blder.customValidatorCustomPath != "")
+}
+
 func (blder *WebhookBuilder) registerWebhooks() error {
 	typ, err := blder.getType()
 	if err != nil {
@@ -139,9 +171,27 @@ func (blder *WebhookBuilder) registerWebhooks() error {
 		return err
 	}
 
+	if blder.isThereCustomPathConflict() {
+		return errors.New("only one of CustomDefaulter or CustomValidator should be set when using WithCustomPath. Otherwise, WithDefaulterCustomPath() and WithValidatorCustomPath() should be used")
+	}
+	if blder.customPath != "" {
+		// isThereCustomPathConflict() already checks for potential conflicts.
+		// Since we are sure that only one of customDefaulter or customValidator will be used,
+		// we can set both customDefaulterCustomPath and validatingCustomPath.
+		blder.customDefaulterCustomPath = blder.customPath
+		blder.customValidatorCustomPath = blder.customPath
+	}
+
 	// Register webhook(s) for type
-	blder.registerDefaultingWebhook()
-	blder.registerValidatingWebhook()
+	err = blder.registerDefaultingWebhook()
+	if err != nil {
+		return err
+	}
+
+	err = blder.registerValidatingWebhook()
+	if err != nil {
+		return err
+	}
 
 	err = blder.registerConversionWebhook()
 	if err != nil {
@@ -151,11 +201,18 @@ func (blder *WebhookBuilder) registerWebhooks() error {
 }
 
 // registerDefaultingWebhook registers a defaulting webhook if necessary.
-func (blder *WebhookBuilder) registerDefaultingWebhook() {
+func (blder *WebhookBuilder) registerDefaultingWebhook() error {
 	mwh := blder.getDefaultingWebhook()
 	if mwh != nil {
 		mwh.LogConstructor = blder.logConstructor
 		path := generateMutatePath(blder.gvk)
+		if blder.customDefaulterCustomPath != "" {
+			generatedCustomPath, err := generateCustomPath(blder.customDefaulterCustomPath)
+			if err != nil {
+				return err
+			}
+			path = generatedCustomPath
+		}
 
 		// Checking if the path is already registered.
 		// If so, just skip it.
@@ -166,35 +223,34 @@ func (blder *WebhookBuilder) registerDefaultingWebhook() {
 			blder.mgr.GetWebhookServer().Register(path, mwh)
 		}
 	}
+
+	return nil
 }
 
 func (blder *WebhookBuilder) getDefaultingWebhook() *admission.Webhook {
 	if defaulter := blder.customDefaulter; defaulter != nil {
-		w := admission.WithCustomDefaulter(blder.mgr.GetScheme(), blder.apiType, defaulter)
+		w := admission.WithCustomDefaulter(blder.mgr.GetScheme(), blder.apiType, defaulter, blder.customDefaulterOpts...)
 		if blder.recoverPanic != nil {
 			w = w.WithRecoverPanic(*blder.recoverPanic)
 		}
 		return w
 	}
-	if defaulter, ok := blder.apiType.(admission.Defaulter); ok {
-		w := admission.DefaultingWebhookFor(blder.mgr.GetScheme(), defaulter)
-		if blder.recoverPanic != nil {
-			w = w.WithRecoverPanic(*blder.recoverPanic)
-		}
-		return w
-	}
-	log.Info(
-		"skip registering a mutating webhook, object does not implement admission.Defaulter or WithDefaulter wasn't called",
-		"GVK", blder.gvk)
 	return nil
 }
 
 // registerValidatingWebhook registers a validating webhook if necessary.
-func (blder *WebhookBuilder) registerValidatingWebhook() {
+func (blder *WebhookBuilder) registerValidatingWebhook() error {
 	vwh := blder.getValidatingWebhook()
 	if vwh != nil {
 		vwh.LogConstructor = blder.logConstructor
 		path := generateValidatePath(blder.gvk)
+		if blder.customValidatorCustomPath != "" {
+			generatedCustomPath, err := generateCustomPath(blder.customValidatorCustomPath)
+			if err != nil {
+				return err
+			}
+			path = generatedCustomPath
+		}
 
 		// Checking if the path is already registered.
 		// If so, just skip it.
@@ -205,6 +261,8 @@ func (blder *WebhookBuilder) registerValidatingWebhook() {
 			blder.mgr.GetWebhookServer().Register(path, vwh)
 		}
 	}
+
+	return nil
 }
 
 func (blder *WebhookBuilder) getValidatingWebhook() *admission.Webhook {
@@ -215,16 +273,6 @@ func (blder *WebhookBuilder) getValidatingWebhook() *admission.Webhook {
 		}
 		return w
 	}
-	if validator, ok := blder.apiType.(admission.Validator); ok {
-		w := admission.ValidatingWebhookFor(blder.mgr.GetScheme(), validator)
-		if blder.recoverPanic != nil {
-			w = w.WithRecoverPanic(*blder.recoverPanic)
-		}
-		return w
-	}
-	log.Info(
-		"skip registering a validating webhook, object does not implement admission.Validator or WithValidator wasn't called",
-		"GVK", blder.gvk)
 	return nil
 }
 
@@ -271,3 +319,14 @@ func generateValidatePath(gvk schema.GroupVersionKind) string {
 	return "/validate-" + strings.ReplaceAll(gvk.Group, ".", "-") + "-" +
 		gvk.Version + "-" + strings.ToLower(gvk.Kind)
 }
+
+const webhookPathStringValidation = `^((/[a-zA-Z0-9-_]+)+|/)$`
+
+var validWebhookPathRegex = regexp.MustCompile(webhookPathStringValidation)
+
+func generateCustomPath(customPath string) (string, error) {
+	if !validWebhookPathRegex.MatchString(customPath) {
+		return "", errors.New("customPath \"" + customPath + "\" does not match this regex: " + webhookPathStringValidation)
+	}
+	return customPath, nil
+}
diff --git a/pkg/builder/webhook_test.go b/pkg/builder/webhook_test.go
index 4574d5cc77..eb70af2e0a 100644
--- a/pkg/builder/webhook_test.go
+++ b/pkg/builder/webhook_test.go
@@ -47,6 +47,8 @@ const (
   "apiVersion":"admission.k8s.io/`
 
 	svcBaseAddr = "http://svc-name.svc-ns.svc"
+
+	customPath = "/custom-path"
 )
 
 var _ = Describe("webhook", func() {
@@ -77,7 +79,7 @@ func runTests(admissionReviewVersion string) {
 		close(stop)
 	})
 
-	It("should scaffold a defaulting webhook if the type implements the Defaulter interface", func() {
+	It("should scaffold a custom defaulting webhook", func(specCtx SpecContext) {
 		By("creating a controller manager")
 		m, err := manager.New(cfg, manager.Options{})
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
@@ -90,6 +92,10 @@ func runTests(admissionReviewVersion string) {
 
 		err = WebhookManagedBy(m).
 			For(&TestDefaulter{}).
+			WithDefaulter(&TestCustomDefaulter{}).
+			WithLogConstructor(func(base logr.Logger, req *admission.Request) logr.Logger {
+				return admission.DefaultLogConstructor(testingLogger, req)
+			}).
 			Complete()
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		svr := m.GetWebhookServer()
@@ -99,16 +105,17 @@ func runTests(admissionReviewVersion string) {
   "request":{
     "uid":"07e52e8d-4513-11e9-a716-42010a800270",
     "kind":{
-      "group":"",
+      "group":"foo.test.org",
       "version":"v1",
       "kind":"TestDefaulter"
     },
     "resource":{
-      "group":"",
+      "group":"foo.test.org",
       "version":"v1",
       "resource":"testdefaulter"
     },
     "namespace":"default",
+    "name":"foo",
     "operation":"CREATE",
     "object":{
       "replica":1
@@ -117,7 +124,7 @@ func runTests(admissionReviewVersion string) {
   }
 }`)
 
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(specCtx)
 		cancel()
 		err = svr.Start(ctx)
 		if err != nil && !os.IsNotExist(err) {
@@ -135,6 +142,7 @@ func runTests(admissionReviewVersion string) {
 		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":true`))
 		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"patch":`))
 		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":200`))
+		EventuallyWithOffset(1, logBuffer).Should(gbytes.Say(`"msg":"Defaulting object","object":{"name":"foo","namespace":"default"},"namespace":"default","name":"foo","resource":{"group":"foo.test.org","version":"v1","resource":"testdefaulter"},"user":"","requestID":"07e52e8d-4513-11e9-a716-42010a800270"`))
 
 		By("sending a request to a validating webhook path that doesn't exist")
 		path = generateValidatePath(testDefaulterGVK)
@@ -147,7 +155,86 @@ func runTests(admissionReviewVersion string) {
 		ExpectWithOffset(1, w.Code).To(Equal(http.StatusNotFound))
 	})
 
-	It("should scaffold a defaulting webhook which recovers from panics", func() {
+	It("should scaffold a custom defaulting webhook with a custom path", func(specCtx SpecContext) {
+		By("creating a controller manager")
+		m, err := manager.New(cfg, manager.Options{})
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+
+		By("registering the type in the Scheme")
+		builder := scheme.Builder{GroupVersion: testDefaulterGVK.GroupVersion()}
+		builder.Register(&TestDefaulter{}, &TestDefaulterList{})
+		err = builder.AddToScheme(m.GetScheme())
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+
+		customPath := "/custom-defaulting-path"
+		err = WebhookManagedBy(m).
+			For(&TestDefaulter{}).
+			WithDefaulter(&TestCustomDefaulter{}).
+			WithLogConstructor(func(base logr.Logger, req *admission.Request) logr.Logger {
+				return admission.DefaultLogConstructor(testingLogger, req)
+			}).
+			WithDefaulterCustomPath(customPath).
+			Complete()
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+		svr := m.GetWebhookServer()
+		ExpectWithOffset(1, svr).NotTo(BeNil())
+
+		reader := strings.NewReader(admissionReviewGV + admissionReviewVersion + `",
+  "request":{
+    "uid":"07e52e8d-4513-11e9-a716-42010a800270",
+    "kind":{
+      "group":"foo.test.org",
+      "version":"v1",
+      "kind":"TestDefaulter"
+    },
+    "resource":{
+      "group":"foo.test.org",
+      "version":"v1",
+      "resource":"testdefaulter"
+    },
+    "namespace":"default",
+    "name":"foo",
+    "operation":"CREATE",
+    "object":{
+      "replica":1
+    },
+    "oldObject":null
+  }
+}`)
+
+		ctx, cancel := context.WithCancel(specCtx)
+		cancel()
+		err = svr.Start(ctx)
+		if err != nil && !os.IsNotExist(err) {
+			ExpectWithOffset(1, err).NotTo(HaveOccurred())
+		}
+
+		By("sending a request to a mutating webhook path that have been overriten by a custom path")
+		path, err := generateCustomPath(customPath)
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+		req := httptest.NewRequest("POST", svcBaseAddr+path, reader)
+		req.Header.Add("Content-Type", "application/json")
+		w := httptest.NewRecorder()
+		svr.WebhookMux().ServeHTTP(w, req)
+		ExpectWithOffset(1, w.Code).To(Equal(http.StatusOK))
+		By("sanity checking the response contains reasonable fields")
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":true`))
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"patch":`))
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":200`))
+		EventuallyWithOffset(1, logBuffer).Should(gbytes.Say(`"msg":"Defaulting object","object":{"name":"foo","namespace":"default"},"namespace":"default","name":"foo","resource":{"group":"foo.test.org","version":"v1","resource":"testdefaulter"},"user":"","requestID":"07e52e8d-4513-11e9-a716-42010a800270"`))
+
+		By("sending a request to a mutating webhook path")
+		path = generateMutatePath(testDefaulterGVK)
+		_, err = reader.Seek(0, 0)
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+		req = httptest.NewRequest("POST", svcBaseAddr+path, reader)
+		req.Header.Add("Content-Type", "application/json")
+		w = httptest.NewRecorder()
+		svr.WebhookMux().ServeHTTP(w, req)
+		ExpectWithOffset(1, w.Code).To(Equal(http.StatusNotFound))
+	})
+
+	It("should scaffold a custom defaulting webhook which recovers from panics", func(specCtx SpecContext) {
 		By("creating a controller manager")
 		m, err := manager.New(cfg, manager.Options{})
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
@@ -159,7 +246,9 @@ func runTests(admissionReviewVersion string) {
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
 		err = WebhookManagedBy(m).
-			For(&TestDefaulter{Panic: true}).
+			For(&TestDefaulter{}).
+			WithDefaulter(&TestCustomDefaulter{}).
+			RecoverPanic(true).
 			// RecoverPanic defaults to true.
 			Complete()
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
@@ -189,7 +278,7 @@ func runTests(admissionReviewVersion string) {
   }
 }`)
 
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(specCtx)
 		cancel()
 		err = svr.Start(ctx)
 		if err != nil && !os.IsNotExist(err) {
@@ -209,20 +298,20 @@ func runTests(admissionReviewVersion string) {
 		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"message":"panic: fake panic test [recovered]`))
 	})
 
-	It("should scaffold a defaulting webhook with a custom defaulter", func() {
+	It("should scaffold a custom validating webhook", func(specCtx SpecContext) {
 		By("creating a controller manager")
 		m, err := manager.New(cfg, manager.Options{})
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
 		By("registering the type in the Scheme")
-		builder := scheme.Builder{GroupVersion: testDefaulterGVK.GroupVersion()}
-		builder.Register(&TestDefaulter{}, &TestDefaulterList{})
+		builder := scheme.Builder{GroupVersion: testValidatorGVK.GroupVersion()}
+		builder.Register(&TestValidator{}, &TestValidatorList{})
 		err = builder.AddToScheme(m.GetScheme())
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
 		err = WebhookManagedBy(m).
-			WithDefaulter(&TestCustomDefaulter{}).
-			For(&TestDefaulter{}).
+			For(&TestValidator{}).
+			WithValidator(&TestCustomValidator{}).
 			WithLogConstructor(func(base logr.Logger, req *admission.Request) logr.Logger {
 				return admission.DefaultLogConstructor(testingLogger, req)
 			}).
@@ -237,55 +326,56 @@ func runTests(admissionReviewVersion string) {
     "kind":{
       "group":"foo.test.org",
       "version":"v1",
-      "kind":"TestDefaulter"
+      "kind":"TestValidator"
     },
     "resource":{
       "group":"foo.test.org",
       "version":"v1",
-      "resource":"testdefaulter"
+      "resource":"testvalidator"
     },
     "namespace":"default",
     "name":"foo",
-    "operation":"CREATE",
+    "operation":"UPDATE",
     "object":{
       "replica":1
     },
-    "oldObject":null
+    "oldObject":{
+      "replica":2
+    }
   }
 }`)
 
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(specCtx)
 		cancel()
 		err = svr.Start(ctx)
 		if err != nil && !os.IsNotExist(err) {
 			ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		}
 
-		By("sending a request to a mutating webhook path")
-		path := generateMutatePath(testDefaulterGVK)
+		By("sending a request to a mutating webhook path that doesn't exist")
+		path := generateMutatePath(testValidatorGVK)
 		req := httptest.NewRequest("POST", svcBaseAddr+path, reader)
 		req.Header.Add("Content-Type", "application/json")
 		w := httptest.NewRecorder()
 		svr.WebhookMux().ServeHTTP(w, req)
-		ExpectWithOffset(1, w.Code).To(Equal(http.StatusOK))
-		By("sanity checking the response contains reasonable fields")
-		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":true`))
-		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"patch":`))
-		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":200`))
-		EventuallyWithOffset(1, logBuffer).Should(gbytes.Say(`"msg":"Defaulting object","object":{"name":"foo","namespace":"default"},"namespace":"default","name":"foo","resource":{"group":"foo.test.org","version":"v1","resource":"testdefaulter"},"user":"","requestID":"07e52e8d-4513-11e9-a716-42010a800270"`))
+		ExpectWithOffset(1, w.Code).To(Equal(http.StatusNotFound))
 
-		By("sending a request to a validating webhook path that doesn't exist")
-		path = generateValidatePath(testDefaulterGVK)
+		By("sending a request to a validating webhook path")
+		path = generateValidatePath(testValidatorGVK)
 		_, err = reader.Seek(0, 0)
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		req = httptest.NewRequest("POST", svcBaseAddr+path, reader)
 		req.Header.Add("Content-Type", "application/json")
 		w = httptest.NewRecorder()
 		svr.WebhookMux().ServeHTTP(w, req)
-		ExpectWithOffset(1, w.Code).To(Equal(http.StatusNotFound))
+		ExpectWithOffset(1, w.Code).To(Equal(http.StatusOK))
+		By("sanity checking the response contains reasonable field")
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":false`))
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":403`))
+		EventuallyWithOffset(1, logBuffer).Should(gbytes.Say(`"msg":"Validating object","object":{"name":"foo","namespace":"default"},"namespace":"default","name":"foo","resource":{"group":"foo.test.org","version":"v1","resource":"testvalidator"},"user":"","requestID":"07e52e8d-4513-11e9-a716-42010a800270"`))
 	})
 
-	It("should scaffold a validating webhook if the type implements the Validator interface", func() {
+	It("should scaffold a custom validating webhook with a custom path", func(specCtx SpecContext) {
 		By("creating a controller manager")
 		m, err := manager.New(cfg, manager.Options{})
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
@@ -296,8 +386,14 @@ func runTests(admissionReviewVersion string) {
 		err = builder.AddToScheme(m.GetScheme())
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
+		customPath := "/custom-validating-path"
 		err = WebhookManagedBy(m).
 			For(&TestValidator{}).
+			WithValidator(&TestCustomValidator{}).
+			WithLogConstructor(func(base logr.Logger, req *admission.Request) logr.Logger {
+				return admission.DefaultLogConstructor(testingLogger, req)
+			}).
+			WithValidatorCustomPath(customPath).
 			Complete()
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		svr := m.GetWebhookServer()
@@ -307,16 +403,17 @@ func runTests(admissionReviewVersion string) {
   "request":{
     "uid":"07e52e8d-4513-11e9-a716-42010a800270",
     "kind":{
-      "group":"",
+      "group":"foo.test.org",
       "version":"v1",
       "kind":"TestValidator"
     },
     "resource":{
-      "group":"",
+      "group":"foo.test.org",
       "version":"v1",
       "resource":"testvalidator"
     },
     "namespace":"default",
+    "name":"foo",
     "operation":"UPDATE",
     "object":{
       "replica":1
@@ -327,36 +424,38 @@ func runTests(admissionReviewVersion string) {
   }
 }`)
 
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(specCtx)
 		cancel()
 		err = svr.Start(ctx)
 		if err != nil && !os.IsNotExist(err) {
 			ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		}
 
-		By("sending a request to a mutating webhook path that doesn't exist")
-		path := generateMutatePath(testValidatorGVK)
+		By("sending a request to a valiting webhook path that have been overriten by a custom path")
+		path, err := generateCustomPath(customPath)
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+		_, err = reader.Seek(0, 0)
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		req := httptest.NewRequest("POST", svcBaseAddr+path, reader)
 		req.Header.Add("Content-Type", "application/json")
 		w := httptest.NewRecorder()
 		svr.WebhookMux().ServeHTTP(w, req)
-		ExpectWithOffset(1, w.Code).To(Equal(http.StatusNotFound))
+		ExpectWithOffset(1, w.Code).To(Equal(http.StatusOK))
+		By("sanity checking the response contains reasonable field")
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":false`))
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":403`))
+		EventuallyWithOffset(1, logBuffer).Should(gbytes.Say(`"msg":"Validating object","object":{"name":"foo","namespace":"default"},"namespace":"default","name":"foo","resource":{"group":"foo.test.org","version":"v1","resource":"testvalidator"},"user":"","requestID":"07e52e8d-4513-11e9-a716-42010a800270"`))
 
 		By("sending a request to a validating webhook path")
 		path = generateValidatePath(testValidatorGVK)
-		_, err = reader.Seek(0, 0)
-		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		req = httptest.NewRequest("POST", svcBaseAddr+path, reader)
 		req.Header.Add("Content-Type", "application/json")
 		w = httptest.NewRecorder()
 		svr.WebhookMux().ServeHTTP(w, req)
-		ExpectWithOffset(1, w.Code).To(Equal(http.StatusOK))
-		By("sanity checking the response contains reasonable field")
-		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":false`))
-		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":403`))
+		ExpectWithOffset(1, w.Code).To(Equal(http.StatusNotFound))
 	})
 
-	It("should scaffold a validating webhook which recovers from panics", func() {
+	It("should scaffold a custom validating webhook which recovers from panics", func(specCtx SpecContext) {
 		By("creating a controller manager")
 		m, err := manager.New(cfg, manager.Options{})
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
@@ -368,7 +467,8 @@ func runTests(admissionReviewVersion string) {
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
 		err = WebhookManagedBy(m).
-			For(&TestValidator{Panic: true}).
+			For(&TestValidator{}).
+			WithValidator(&TestCustomValidator{}).
 			RecoverPanic(true).
 			Complete()
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
@@ -397,7 +497,7 @@ func runTests(admissionReviewVersion string) {
   }
 }`)
 
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(specCtx)
 		cancel()
 		err = svr.Start(ctx)
 		if err != nil && !os.IsNotExist(err) {
@@ -419,8 +519,10 @@ func runTests(admissionReviewVersion string) {
 		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"message":"panic: fake panic test [recovered]`))
 	})
 
-	It("should scaffold a validating webhook with a custom validator", func() {
+	It("should scaffold a custom validating webhook to validate deletes", func(specCtx SpecContext) {
 		By("creating a controller manager")
+		ctx, cancel := context.WithCancel(specCtx)
+
 		m, err := manager.New(cfg, manager.Options{})
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
@@ -431,11 +533,8 @@ func runTests(admissionReviewVersion string) {
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
 		err = WebhookManagedBy(m).
-			WithValidator(&TestCustomValidator{}).
 			For(&TestValidator{}).
-			WithLogConstructor(func(base logr.Logger, req *admission.Request) logr.Logger {
-				return admission.DefaultLogConstructor(testingLogger, req)
-			}).
+			WithValidator(&TestCustomValidator{}).
 			Complete()
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		svr := m.GetWebhookServer()
@@ -445,70 +544,110 @@ func runTests(admissionReviewVersion string) {
   "request":{
     "uid":"07e52e8d-4513-11e9-a716-42010a800270",
     "kind":{
-      "group":"foo.test.org",
+      "group":"",
       "version":"v1",
       "kind":"TestValidator"
     },
     "resource":{
-      "group":"foo.test.org",
+      "group":"",
       "version":"v1",
       "resource":"testvalidator"
     },
     "namespace":"default",
-    "name":"foo",
-    "operation":"UPDATE",
-    "object":{
-      "replica":1
-    },
+    "operation":"DELETE",
+    "object":null,
     "oldObject":{
-      "replica":2
+      "replica":1
     }
   }
 }`)
 
-		ctx, cancel := context.WithCancel(context.Background())
 		cancel()
 		err = svr.Start(ctx)
 		if err != nil && !os.IsNotExist(err) {
 			ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		}
 
-		By("sending a request to a mutating webhook path that doesn't exist")
-		path := generateMutatePath(testValidatorGVK)
+		By("sending a request to a validating webhook path to check for failed delete")
+		path := generateValidatePath(testValidatorGVK)
 		req := httptest.NewRequest("POST", svcBaseAddr+path, reader)
 		req.Header.Add("Content-Type", "application/json")
 		w := httptest.NewRecorder()
 		svr.WebhookMux().ServeHTTP(w, req)
-		ExpectWithOffset(1, w.Code).To(Equal(http.StatusNotFound))
+		ExpectWithOffset(1, w.Code).To(Equal(http.StatusOK))
+		By("sanity checking the response contains reasonable field")
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":false`))
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":403`))
 
-		By("sending a request to a validating webhook path")
+		reader = strings.NewReader(admissionReviewGV + admissionReviewVersion + `",
+  "request":{
+    "uid":"07e52e8d-4513-11e9-a716-42010a800270",
+    "kind":{
+      "group":"",
+      "version":"v1",
+      "kind":"TestValidator"
+    },
+    "resource":{
+      "group":"",
+      "version":"v1",
+      "resource":"testvalidator"
+    },
+    "namespace":"default",
+    "operation":"DELETE",
+    "object":null,
+    "oldObject":{
+      "replica":0
+    }
+  }
+}`)
+		By("sending a request to a validating webhook path with correct request")
 		path = generateValidatePath(testValidatorGVK)
-		_, err = reader.Seek(0, 0)
-		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		req = httptest.NewRequest("POST", svcBaseAddr+path, reader)
 		req.Header.Add("Content-Type", "application/json")
 		w = httptest.NewRecorder()
 		svr.WebhookMux().ServeHTTP(w, req)
 		ExpectWithOffset(1, w.Code).To(Equal(http.StatusOK))
 		By("sanity checking the response contains reasonable field")
-		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":false`))
-		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":403`))
-		EventuallyWithOffset(1, logBuffer).Should(gbytes.Say(`"msg":"Validating object","object":{"name":"foo","namespace":"default"},"namespace":"default","name":"foo","resource":{"group":"foo.test.org","version":"v1","resource":"testvalidator"},"user":"","requestID":"07e52e8d-4513-11e9-a716-42010a800270"`))
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":true`))
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":200`))
 	})
 
-	It("should scaffold defaulting and validating webhooks if the type implements both Defaulter and Validator interfaces", func() {
+	It("should send an error when trying to register a webhook with more than one For", func() {
 		By("creating a controller manager")
 		m, err := manager.New(cfg, manager.Options{})
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
 		By("registering the type in the Scheme")
 		builder := scheme.Builder{GroupVersion: testDefaultValidatorGVK.GroupVersion()}
+		builder.Register(&TestDefaulter{}, &TestDefaulterList{})
+		err = builder.AddToScheme(m.GetScheme())
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+
+		err = WebhookManagedBy(m).
+			For(&TestDefaulter{}).
+			For(&TestDefaulter{}).
+			Complete()
+		Expect(err).To(HaveOccurred())
+	})
+
+	It("should scaffold a custom defaulting and validating webhook", func(specCtx SpecContext) {
+		By("creating a controller manager")
+		m, err := manager.New(cfg, manager.Options{})
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+
+		By("registering the type in the Scheme")
+		builder := scheme.Builder{GroupVersion: testValidatorGVK.GroupVersion()}
 		builder.Register(&TestDefaultValidator{}, &TestDefaultValidatorList{})
 		err = builder.AddToScheme(m.GetScheme())
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
 		err = WebhookManagedBy(m).
 			For(&TestDefaultValidator{}).
+			WithDefaulter(&TestCustomDefaultValidator{}).
+			WithValidator(&TestCustomDefaultValidator{}).
+			WithLogConstructor(func(base logr.Logger, req *admission.Request) logr.Logger {
+				return admission.DefaultLogConstructor(testingLogger, req)
+			}).
 			Complete()
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		svr := m.GetWebhookServer()
@@ -518,25 +657,28 @@ func runTests(admissionReviewVersion string) {
   "request":{
     "uid":"07e52e8d-4513-11e9-a716-42010a800270",
     "kind":{
-      "group":"",
+      "group":"foo.test.org",
       "version":"v1",
       "kind":"TestDefaultValidator"
     },
     "resource":{
-      "group":"",
+      "group":"foo.test.org",
       "version":"v1",
       "resource":"testdefaultvalidator"
     },
     "namespace":"default",
-    "operation":"CREATE",
+    "name":"foo",
+    "operation":"UPDATE",
     "object":{
       "replica":1
     },
-    "oldObject":null
+    "oldObject":{
+      "replica":2
+    }
   }
 }`)
 
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(specCtx)
 		cancel()
 		err = svr.Start(ctx)
 		if err != nil && !os.IsNotExist(err) {
@@ -550,10 +692,11 @@ func runTests(admissionReviewVersion string) {
 		w := httptest.NewRecorder()
 		svr.WebhookMux().ServeHTTP(w, req)
 		ExpectWithOffset(1, w.Code).To(Equal(http.StatusOK))
-		By("sanity checking the response contains reasonable field")
+		By("sanity checking the response contains reasonable fields")
 		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":true`))
 		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"patch":`))
 		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":200`))
+		EventuallyWithOffset(1, logBuffer).Should(gbytes.Say(`"msg":"Defaulting object","object":{"name":"foo","namespace":"default"},"namespace":"default","name":"foo","resource":{"group":"foo.test.org","version":"v1","resource":"testdefaultvalidator"},"user":"","requestID":"07e52e8d-4513-11e9-a716-42010a800270"`))
 
 		By("sending a request to a validating webhook path")
 		path = generateValidatePath(testDefaultValidatorGVK)
@@ -565,25 +708,33 @@ func runTests(admissionReviewVersion string) {
 		svr.WebhookMux().ServeHTTP(w, req)
 		ExpectWithOffset(1, w.Code).To(Equal(http.StatusOK))
 		By("sanity checking the response contains reasonable field")
-		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":true`))
-		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":200`))
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":false`))
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":403`))
+		EventuallyWithOffset(1, logBuffer).Should(gbytes.Say(`"msg":"Validating object","object":{"name":"foo","namespace":"default"},"namespace":"default","name":"foo","resource":{"group":"foo.test.org","version":"v1","resource":"testdefaultvalidator"},"user":"","requestID":"07e52e8d-4513-11e9-a716-42010a800270"`))
 	})
 
-	It("should scaffold a validating webhook if the type implements the Validator interface to validate deletes", func() {
+	It("should scaffold a custom defaulting and validating webhook with a custom path for each of them", func(specCtx SpecContext) {
 		By("creating a controller manager")
-		ctx, cancel := context.WithCancel(context.Background())
-
 		m, err := manager.New(cfg, manager.Options{})
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
 		By("registering the type in the Scheme")
 		builder := scheme.Builder{GroupVersion: testValidatorGVK.GroupVersion()}
-		builder.Register(&TestValidator{}, &TestValidatorList{})
+		builder.Register(&TestDefaultValidator{}, &TestDefaultValidatorList{})
 		err = builder.AddToScheme(m.GetScheme())
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
+		validatingCustomPath := "/custom-validating-path"
+		defaultingCustomPath := "/custom-defaulting-path"
 		err = WebhookManagedBy(m).
-			For(&TestValidator{}).
+			For(&TestDefaultValidator{}).
+			WithDefaulter(&TestCustomDefaultValidator{}).
+			WithValidator(&TestCustomDefaultValidator{}).
+			WithLogConstructor(func(base logr.Logger, req *admission.Request) logr.Logger {
+				return admission.DefaultLogConstructor(testingLogger, req)
+			}).
+			WithValidatorCustomPath(validatingCustomPath).
+			WithDefaulterCustomPath(defaultingCustomPath).
 			Complete()
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		svr := m.GetWebhookServer()
@@ -593,90 +744,149 @@ func runTests(admissionReviewVersion string) {
   "request":{
     "uid":"07e52e8d-4513-11e9-a716-42010a800270",
     "kind":{
-      "group":"",
+      "group":"foo.test.org",
       "version":"v1",
-      "kind":"TestValidator"
+      "kind":"TestDefaultValidator"
     },
     "resource":{
-      "group":"",
+      "group":"foo.test.org",
       "version":"v1",
-      "resource":"testvalidator"
+      "resource":"testdefaultvalidator"
     },
     "namespace":"default",
-    "operation":"DELETE",
-    "object":null,
-    "oldObject":{
+    "name":"foo",
+    "operation":"UPDATE",
+    "object":{
       "replica":1
+    },
+    "oldObject":{
+      "replica":2
     }
   }
 }`)
 
+		ctx, cancel := context.WithCancel(specCtx)
 		cancel()
 		err = svr.Start(ctx)
 		if err != nil && !os.IsNotExist(err) {
 			ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		}
 
-		By("sending a request to a validating webhook path to check for failed delete")
-		path := generateValidatePath(testValidatorGVK)
+		By("sending a request to a mutating webhook path that have been overriten by the custom path")
+		path, err := generateCustomPath(defaultingCustomPath)
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 		req := httptest.NewRequest("POST", svcBaseAddr+path, reader)
 		req.Header.Add("Content-Type", "application/json")
 		w := httptest.NewRecorder()
 		svr.WebhookMux().ServeHTTP(w, req)
 		ExpectWithOffset(1, w.Code).To(Equal(http.StatusOK))
+		By("sanity checking the response contains reasonable fields")
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":true`))
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"patch":`))
+		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":200`))
+		EventuallyWithOffset(1, logBuffer).Should(gbytes.Say(`"msg":"Defaulting object","object":{"name":"foo","namespace":"default"},"namespace":"default","name":"foo","resource":{"group":"foo.test.org","version":"v1","resource":"testdefaultvalidator"},"user":"","requestID":"07e52e8d-4513-11e9-a716-42010a800270"`))
+
+		By("sending a request to a mutating webhook path")
+		path = generateMutatePath(testDefaultValidatorGVK)
+		_, err = reader.Seek(0, 0)
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+		req = httptest.NewRequest("POST", svcBaseAddr+path, reader)
+		req.Header.Add("Content-Type", "application/json")
+		w = httptest.NewRecorder()
+		svr.WebhookMux().ServeHTTP(w, req)
+		ExpectWithOffset(1, w.Code).To(Equal(http.StatusNotFound))
+
+		By("sending a request to a valiting webhook path that have been overriten by a custom path")
+		path, err = generateCustomPath(validatingCustomPath)
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+		_, err = reader.Seek(0, 0)
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+		req = httptest.NewRequest("POST", svcBaseAddr+path, reader)
+		req.Header.Add("Content-Type", "application/json")
+		w = httptest.NewRecorder()
+		svr.WebhookMux().ServeHTTP(w, req)
+		ExpectWithOffset(1, w.Code).To(Equal(http.StatusOK))
 		By("sanity checking the response contains reasonable field")
 		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":false`))
 		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":403`))
+		EventuallyWithOffset(1, logBuffer).Should(gbytes.Say(`"msg":"Validating object","object":{"name":"foo","namespace":"default"},"namespace":"default","name":"foo","resource":{"group":"foo.test.org","version":"v1","resource":"testdefaultvalidator"},"user":"","requestID":"07e52e8d-4513-11e9-a716-42010a800270"`))
 
-		reader = strings.NewReader(admissionReviewGV + admissionReviewVersion + `",
-  "request":{
-    "uid":"07e52e8d-4513-11e9-a716-42010a800270",
-    "kind":{
-      "group":"",
-      "version":"v1",
-      "kind":"TestValidator"
-    },
-    "resource":{
-      "group":"",
-      "version":"v1",
-      "resource":"testvalidator"
-    },
-    "namespace":"default",
-    "operation":"DELETE",
-    "object":null,
-    "oldObject":{
-      "replica":0
-    }
-  }
-}`)
-		By("sending a request to a validating webhook path with correct request")
+		By("sending a request to a validating webhook path")
 		path = generateValidatePath(testValidatorGVK)
 		req = httptest.NewRequest("POST", svcBaseAddr+path, reader)
 		req.Header.Add("Content-Type", "application/json")
 		w = httptest.NewRecorder()
 		svr.WebhookMux().ServeHTTP(w, req)
-		ExpectWithOffset(1, w.Code).To(Equal(http.StatusOK))
-		By("sanity checking the response contains reasonable field")
-		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"allowed":true`))
-		ExpectWithOffset(1, w.Body).To(ContainSubstring(`"code":200`))
+		ExpectWithOffset(1, w.Code).To(Equal(http.StatusNotFound))
 	})
 
-	It("should send an error when trying to register a webhook with more than one For", func() {
+	It("should not scaffold a custom defaulting and a custom validating webhook with the same custom path", func() {
 		By("creating a controller manager")
 		m, err := manager.New(cfg, manager.Options{})
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
 		By("registering the type in the Scheme")
-		builder := scheme.Builder{GroupVersion: testDefaulterGVK.GroupVersion()}
-		builder.Register(&TestDefaulter{}, &TestDefaulterList{})
+		builder := scheme.Builder{GroupVersion: testValidatorGVK.GroupVersion()}
+		builder.Register(&TestDefaultValidator{}, &TestDefaultValidatorList{})
+		err = builder.AddToScheme(m.GetScheme())
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+
+		err = WebhookManagedBy(m).
+			For(&TestDefaultValidator{}).
+			WithDefaulter(&TestCustomDefaultValidator{}).
+			WithValidator(&TestCustomDefaultValidator{}).
+			WithLogConstructor(func(base logr.Logger, req *admission.Request) logr.Logger {
+				return admission.DefaultLogConstructor(testingLogger, req)
+			}).
+			WithCustomPath(customPath).
+			Complete()
+		ExpectWithOffset(1, err).To(HaveOccurred())
+	})
+
+	It("should not scaffold a custom defaulting when setting a custom path and a defaulting custom path", func() {
+		By("creating a controller manager")
+		m, err := manager.New(cfg, manager.Options{})
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+
+		By("registering the type in the Scheme")
+		builder := scheme.Builder{GroupVersion: testValidatorGVK.GroupVersion()}
+		builder.Register(&TestDefaultValidator{}, &TestDefaultValidatorList{})
 		err = builder.AddToScheme(m.GetScheme())
 		ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
 		err = WebhookManagedBy(m).
 			For(&TestDefaulter{}).
-			For(&TestDefaulter{}).
+			WithDefaulter(&TestCustomDefaulter{}).
+			WithLogConstructor(func(base logr.Logger, req *admission.Request) logr.Logger {
+				return admission.DefaultLogConstructor(testingLogger, req)
+			}).
+			WithDefaulterCustomPath(customPath).
+			WithCustomPath(customPath).
 			Complete()
-		Expect(err).To(HaveOccurred())
+		ExpectWithOffset(1, err).To(HaveOccurred())
+	})
+
+	It("should not scaffold a custom defaulting when setting a custom path and a validating custom path", func() {
+		By("creating a controller manager")
+		m, err := manager.New(cfg, manager.Options{})
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+
+		By("registering the type in the Scheme")
+		builder := scheme.Builder{GroupVersion: testValidatorGVK.GroupVersion()}
+		builder.Register(&TestDefaultValidator{}, &TestDefaultValidatorList{})
+		err = builder.AddToScheme(m.GetScheme())
+		ExpectWithOffset(1, err).NotTo(HaveOccurred())
+
+		err = WebhookManagedBy(m).
+			For(&TestValidator{}).
+			WithValidator(&TestCustomValidator{}).
+			WithLogConstructor(func(base logr.Logger, req *admission.Request) logr.Logger {
+				return admission.DefaultLogConstructor(testingLogger, req)
+			}).
+			WithDefaulterCustomPath(customPath).
+			WithCustomPath(customPath).
+			Complete()
+		ExpectWithOffset(1, err).To(HaveOccurred())
 	})
 }
 
@@ -712,15 +922,6 @@ type TestDefaulterList struct{}
 func (*TestDefaulterList) GetObjectKind() schema.ObjectKind { return nil }
 func (*TestDefaulterList) DeepCopyObject() runtime.Object   { return nil }
 
-func (d *TestDefaulter) Default() {
-	if d.Panic {
-		panic("fake panic test")
-	}
-	if d.Replica < 2 {
-		d.Replica = 2
-	}
-}
-
 // TestValidator.
 var _ runtime.Object = &TestValidator{}
 
@@ -753,46 +954,11 @@ type TestValidatorList struct{}
 func (*TestValidatorList) GetObjectKind() schema.ObjectKind { return nil }
 func (*TestValidatorList) DeepCopyObject() runtime.Object   { return nil }
 
-var _ admission.Validator = &TestValidator{}
-
-func (v *TestValidator) ValidateCreate() (admission.Warnings, error) {
-	if v.Panic {
-		panic("fake panic test")
-	}
-	if v.Replica < 0 {
-		return nil, errors.New("number of replica should be greater than or equal to 0")
-	}
-	return nil, nil
-}
-
-func (v *TestValidator) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	if v.Panic {
-		panic("fake panic test")
-	}
-	if v.Replica < 0 {
-		return nil, errors.New("number of replica should be greater than or equal to 0")
-	}
-	if oldObj, ok := old.(*TestValidator); !ok {
-		return nil, fmt.Errorf("the old object is expected to be %T", oldObj)
-	} else if v.Replica < oldObj.Replica {
-		return nil, fmt.Errorf("new replica %v should not be fewer than old replica %v", v.Replica, oldObj.Replica)
-	}
-	return nil, nil
-}
-
-func (v *TestValidator) ValidateDelete() (admission.Warnings, error) {
-	if v.Panic {
-		panic("fake panic test")
-	}
-	if v.Replica > 0 {
-		return nil, errors.New("number of replica should be less than or equal to 0 to delete")
-	}
-	return nil, nil
-}
-
 // TestDefaultValidator.
 var _ runtime.Object = &TestDefaultValidator{}
 
+const testDefaultValidatorKind = "TestDefaultValidator"
+
 type TestDefaultValidator struct {
 	metav1.TypeMeta
 	metav1.ObjectMeta
@@ -822,37 +988,7 @@ type TestDefaultValidatorList struct{}
 func (*TestDefaultValidatorList) GetObjectKind() schema.ObjectKind { return nil }
 func (*TestDefaultValidatorList) DeepCopyObject() runtime.Object   { return nil }
 
-func (dv *TestDefaultValidator) Default() {
-	if dv.Replica < 2 {
-		dv.Replica = 2
-	}
-}
-
-var _ admission.Validator = &TestDefaultValidator{}
-
-func (dv *TestDefaultValidator) ValidateCreate() (admission.Warnings, error) {
-	if dv.Replica < 0 {
-		return nil, errors.New("number of replica should be greater than or equal to 0")
-	}
-	return nil, nil
-}
-
-func (dv *TestDefaultValidator) ValidateUpdate(old runtime.Object) (admission.Warnings, error) {
-	if dv.Replica < 0 {
-		return nil, errors.New("number of replica should be greater than or equal to 0")
-	}
-	return nil, nil
-}
-
-func (dv *TestDefaultValidator) ValidateDelete() (admission.Warnings, error) {
-	if dv.Replica > 0 {
-		return nil, errors.New("number of replica should be less than or equal to 0 to delete")
-	}
-	return nil, nil
-}
-
 // TestCustomDefaulter.
-
 type TestCustomDefaulter struct{}
 
 func (*TestCustomDefaulter) Default(ctx context.Context, obj runtime.Object) error {
@@ -866,6 +1002,10 @@ func (*TestCustomDefaulter) Default(ctx context.Context, obj runtime.Object) err
 	}
 
 	d := obj.(*TestDefaulter) //nolint:ifshort
+	if d.Panic {
+		panic("fake panic test")
+	}
+
 	if d.Replica < 2 {
 		d.Replica = 2
 	}
@@ -889,6 +1029,9 @@ func (*TestCustomValidator) ValidateCreate(ctx context.Context, obj runtime.Obje
 	}
 
 	v := obj.(*TestValidator) //nolint:ifshort
+	if v.Panic {
+		panic("fake panic test")
+	}
 	if v.Replica < 0 {
 		return nil, errors.New("number of replica should be greater than or equal to 0")
 	}
@@ -934,3 +1077,85 @@ func (*TestCustomValidator) ValidateDelete(ctx context.Context, obj runtime.Obje
 }
 
 var _ admission.CustomValidator = &TestCustomValidator{}
+
+// TestCustomDefaultValidator for default
+type TestCustomDefaultValidator struct{}
+
+func (*TestCustomDefaultValidator) Default(ctx context.Context, obj runtime.Object) error {
+	logf.FromContext(ctx).Info("Defaulting object")
+	req, err := admission.RequestFromContext(ctx)
+	if err != nil {
+		return fmt.Errorf("expected admission.Request in ctx: %w", err)
+	}
+	if req.Kind.Kind != testDefaultValidatorKind {
+		return fmt.Errorf("expected Kind TestDefaultValidator got %q", req.Kind.Kind)
+	}
+
+	d := obj.(*TestDefaultValidator) //nolint:ifshort
+
+	if d.Replica < 2 {
+		d.Replica = 2
+	}
+	return nil
+}
+
+var _ admission.CustomDefaulter = &TestCustomDefaulter{}
+
+// TestCustomDefaultValidator for validation
+
+func (*TestCustomDefaultValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
+	logf.FromContext(ctx).Info("Validating object")
+	req, err := admission.RequestFromContext(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("expected admission.Request in ctx: %w", err)
+	}
+	if req.Kind.Kind != testDefaultValidatorKind {
+		return nil, fmt.Errorf("expected Kind TestDefaultValidator got %q", req.Kind.Kind)
+	}
+
+	v := obj.(*TestDefaultValidator) //nolint:ifshort
+	if v.Replica < 0 {
+		return nil, errors.New("number of replica should be greater than or equal to 0")
+	}
+	return nil, nil
+}
+
+func (*TestCustomDefaultValidator) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error) {
+	logf.FromContext(ctx).Info("Validating object")
+	req, err := admission.RequestFromContext(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("expected admission.Request in ctx: %w", err)
+	}
+	if req.Kind.Kind != testDefaultValidatorKind {
+		return nil, fmt.Errorf("expected Kind TestDefaultValidator got %q", req.Kind.Kind)
+	}
+
+	v := newObj.(*TestDefaultValidator)
+	old := oldObj.(*TestDefaultValidator)
+	if v.Replica < 0 {
+		return nil, errors.New("number of replica should be greater than or equal to 0")
+	}
+	if v.Replica < old.Replica {
+		return nil, fmt.Errorf("new replica %v should not be fewer than old replica %v", v.Replica, old.Replica)
+	}
+	return nil, nil
+}
+
+func (*TestCustomDefaultValidator) ValidateDelete(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
+	logf.FromContext(ctx).Info("Validating object")
+	req, err := admission.RequestFromContext(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("expected admission.Request in ctx: %w", err)
+	}
+	if req.Kind.Kind != testDefaultValidatorKind {
+		return nil, fmt.Errorf("expected Kind TestDefaultValidator got %q", req.Kind.Kind)
+	}
+
+	v := obj.(*TestDefaultValidator) //nolint:ifshort
+	if v.Replica > 0 {
+		return nil, errors.New("number of replica should be less than or equal to 0 to delete")
+	}
+	return nil, nil
+}
+
+var _ admission.CustomValidator = &TestCustomValidator{}
diff --git a/pkg/cache/cache.go b/pkg/cache/cache.go
index 706f9c6cdd..a7e491855a 100644
--- a/pkg/cache/cache.go
+++ b/pkg/cache/cache.go
@@ -19,11 +19,12 @@ package cache
 import (
 	"context"
 	"fmt"
+	"maps"
 	"net/http"
+	"slices"
 	"sort"
 	"time"
 
-	"golang.org/x/exp/maps"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -112,6 +113,10 @@ type Informer interface {
 	// the handler again and an error if the handler cannot be added.
 	AddEventHandlerWithResyncPeriod(handler toolscache.ResourceEventHandler, resyncPeriod time.Duration) (toolscache.ResourceEventHandlerRegistration, error)
 
+	// AddEventHandlerWithOptions is a variant of AddEventHandlerWithResyncPeriod where
+	// all optional parameters are passed in as a struct.
+	AddEventHandlerWithOptions(handler toolscache.ResourceEventHandler, options toolscache.HandlerOptions) (toolscache.ResourceEventHandlerRegistration, error)
+
 	// RemoveEventHandler removes a previously added event handler given by
 	// its registration handle.
 	// This function is guaranteed to be idempotent and thread-safe.
@@ -167,6 +172,15 @@ type Options struct {
 	// is "done" with an object, and would otherwise not requeue it, i.e., we
 	// recommend the `Reconcile` function return `reconcile.Result{RequeueAfter: t}`,
 	// instead of `reconcile.Result{}`.
+	//
+	// SyncPeriod will locally trigger an artificial Update event with the same
+	// object in both ObjectOld and ObjectNew for everything that is in the
+	// cache.
+	//
+	// Predicates or Handlers that expect ObjectOld and ObjectNew to be different
+	// (such as GenerationChangedPredicate) will filter out this event, preventing
+	// it from triggering a reconciliation.
+	// SyncPeriod does not sync between the local cache and the server.
 	SyncPeriod *time.Duration
 
 	// ReaderFailOnMissingInformer configures the cache to return a ErrResourceNotCached error when a user
@@ -206,11 +220,11 @@ type Options struct {
 	// to reduce the caches memory usage.
 	DefaultTransform toolscache.TransformFunc
 
-	// DefaultWatchErrorHandler will be used to the WatchErrorHandler which is called
+	// DefaultWatchErrorHandler will be used to set the WatchErrorHandler which is called
 	// whenever ListAndWatch drops the connection with an error.
 	//
 	// After calling this handler, the informer will backoff and retry.
-	DefaultWatchErrorHandler toolscache.WatchErrorHandler
+	DefaultWatchErrorHandler toolscache.WatchErrorHandlerWithContext
 
 	// DefaultUnsafeDisableDeepCopy is the default for UnsafeDisableDeepCopy
 	// for everything that doesn't specify this.
@@ -222,12 +236,25 @@ type Options struct {
 	// DefaultNamespaces.
 	DefaultUnsafeDisableDeepCopy *bool
 
+	// DefaultEnableWatchBookmarks requests watch events with type "BOOKMARK".
+	// Servers that do not implement bookmarks may ignore this flag and
+	// bookmarks are sent at the server's discretion. Clients should not
+	// assume bookmarks are returned at any specific interval, nor may they
+	// assume the server will send any BOOKMARK event during a session.
+	//
+	// This will be used for all object types, unless it is set in ByObject or
+	// DefaultNamespaces.
+	//
+	// Defaults to true.
+	DefaultEnableWatchBookmarks *bool
+
 	// ByObject restricts the cache's ListWatch to the desired fields per GVK at the specified object.
 	// If unset, this will fall through to the Default* settings.
 	ByObject map[client.Object]ByObject
 
-	// newInformer allows overriding of NewSharedIndexInformer for testing.
-	newInformer *func(toolscache.ListerWatcher, runtime.Object, time.Duration, toolscache.Indexers) toolscache.SharedIndexInformer
+	// NewInformer allows overriding of NewSharedIndexInformer, for example for testing
+	// or if someone wants to write their own Informer.
+	NewInformer func(toolscache.ListerWatcher, runtime.Object, time.Duration, toolscache.Indexers) toolscache.SharedIndexInformer
 }
 
 // ByObject offers more fine-grained control over the cache's ListWatch by object.
@@ -272,6 +299,15 @@ type ByObject struct {
 	// Be very careful with this, when enabled you must DeepCopy any object before mutating it,
 	// otherwise you will mutate the object in the cache.
 	UnsafeDisableDeepCopy *bool
+
+	// EnableWatchBookmarks requests watch events with type "BOOKMARK".
+	// Servers that do not implement bookmarks may ignore this flag and
+	// bookmarks are sent at the server's discretion. Clients should not
+	// assume bookmarks are returned at any specific interval, nor may they
+	// assume the server will send any BOOKMARK event during a session.
+	//
+	// Defaults to true.
+	EnableWatchBookmarks *bool
 }
 
 // Config describes all potential options for a given watch.
@@ -298,6 +334,15 @@ type Config struct {
 	// UnsafeDisableDeepCopy specifies if List and Get requests against the
 	// cache should not DeepCopy. A nil value allows to default this.
 	UnsafeDisableDeepCopy *bool
+
+	// EnableWatchBookmarks requests watch events with type "BOOKMARK".
+	// Servers that do not implement bookmarks may ignore this flag and
+	// bookmarks are sent at the server's discretion. Clients should not
+	// assume bookmarks are returned at any specific interval, nor may they
+	// assume the server will send any BOOKMARK event during a session.
+	//
+	// Defaults to true.
+	EnableWatchBookmarks *bool
 }
 
 // NewCacheFunc - Function for creating a new cache from the options and a rest config.
@@ -367,6 +412,7 @@ func optionDefaultsToConfig(opts *Options) Config {
 		FieldSelector:         opts.DefaultFieldSelector,
 		Transform:             opts.DefaultTransform,
 		UnsafeDisableDeepCopy: opts.DefaultUnsafeDisableDeepCopy,
+		EnableWatchBookmarks:  opts.DefaultEnableWatchBookmarks,
 	}
 }
 
@@ -376,6 +422,7 @@ func byObjectToConfig(byObject ByObject) Config {
 		FieldSelector:         byObject.Field,
 		Transform:             byObject.Transform,
 		UnsafeDisableDeepCopy: byObject.UnsafeDisableDeepCopy,
+		EnableWatchBookmarks:  byObject.EnableWatchBookmarks,
 	}
 }
 
@@ -398,7 +445,8 @@ func newCache(restConfig *rest.Config, opts Options) newCacheFunc {
 				Transform:             config.Transform,
 				WatchErrorHandler:     opts.DefaultWatchErrorHandler,
 				UnsafeDisableDeepCopy: ptr.Deref(config.UnsafeDisableDeepCopy, false),
-				NewInformer:           opts.newInformer,
+				EnableWatchBookmarks:  ptr.Deref(config.EnableWatchBookmarks, true),
+				NewInformer:           opts.NewInformer,
 			}),
 			readerFailOnMissingInformer: opts.ReaderFailOnMissingInformer,
 		}
@@ -434,6 +482,8 @@ func defaultOpts(config *rest.Config, opts Options) (Options, error) {
 		}
 	}
 
+	opts.ByObject = maps.Clone(opts.ByObject)
+	opts.DefaultNamespaces = maps.Clone(opts.DefaultNamespaces)
 	for obj, byObject := range opts.ByObject {
 		isNamespaced, err := apiutil.IsObjectNamespaced(obj, opts.Scheme, opts.Mapper)
 		if err != nil {
@@ -445,6 +495,8 @@ func defaultOpts(config *rest.Config, opts Options) (Options, error) {
 
 		if isNamespaced && byObject.Namespaces == nil {
 			byObject.Namespaces = maps.Clone(opts.DefaultNamespaces)
+		} else {
+			byObject.Namespaces = maps.Clone(byObject.Namespaces)
 		}
 
 		// Default the namespace-level configs first, because they need to use the undefaulted type-level config
@@ -452,7 +504,6 @@ func defaultOpts(config *rest.Config, opts Options) (Options, error) {
 		for namespace, config := range byObject.Namespaces {
 			// 1. Default from the undefaulted type-level config
 			config = defaultConfig(config, byObjectToConfig(byObject))
-
 			// 2. Default from the namespace-level config. This was defaulted from the global default config earlier, but
 			//    might not have an entry for the current namespace.
 			if defaultNamespaceSettings, hasDefaultNamespace := opts.DefaultNamespaces[namespace]; hasDefaultNamespace {
@@ -465,7 +516,7 @@ func defaultOpts(config *rest.Config, opts Options) (Options, error) {
 			if namespace == metav1.NamespaceAll {
 				config.FieldSelector = fields.AndSelectors(
 					appendIfNotNil(
-						namespaceAllSelector(maps.Keys(byObject.Namespaces)),
+						namespaceAllSelector(slices.Collect(maps.Keys(byObject.Namespaces))),
 						config.FieldSelector,
 					)...,
 				)
@@ -482,6 +533,7 @@ func defaultOpts(config *rest.Config, opts Options) (Options, error) {
 			byObject.Field = defaultedConfig.FieldSelector
 			byObject.Transform = defaultedConfig.Transform
 			byObject.UnsafeDisableDeepCopy = defaultedConfig.UnsafeDisableDeepCopy
+			byObject.EnableWatchBookmarks = defaultedConfig.EnableWatchBookmarks
 		}
 
 		opts.ByObject[obj] = byObject
@@ -495,7 +547,7 @@ func defaultOpts(config *rest.Config, opts Options) (Options, error) {
 		if namespace == metav1.NamespaceAll {
 			cfg.FieldSelector = fields.AndSelectors(
 				appendIfNotNil(
-					namespaceAllSelector(maps.Keys(opts.DefaultNamespaces)),
+					namespaceAllSelector(slices.Collect(maps.Keys(opts.DefaultNamespaces))),
 					cfg.FieldSelector,
 				)...,
 			)
@@ -523,7 +575,9 @@ func defaultConfig(toDefault, defaultFrom Config) Config {
 	if toDefault.UnsafeDisableDeepCopy == nil {
 		toDefault.UnsafeDisableDeepCopy = defaultFrom.UnsafeDisableDeepCopy
 	}
-
+	if toDefault.EnableWatchBookmarks == nil {
+		toDefault.EnableWatchBookmarks = defaultFrom.EnableWatchBookmarks
+	}
 	return toDefault
 }
 
diff --git a/pkg/cache/cache_test.go b/pkg/cache/cache_test.go
index 7a21c87c37..2364eec3e1 100644
--- a/pkg/cache/cache_test.go
+++ b/pkg/cache/cache_test.go
@@ -55,7 +55,7 @@ const testNamespaceThree = "test-namespace-3"
 
 // TODO(community): Pull these helper functions into testenv.
 // Restart policy is included to allow indexing on that field.
-func createPodWithLabels(name, namespace string, restartPolicy corev1.RestartPolicy, labels map[string]string) client.Object {
+func createPodWithLabels(ctx context.Context, name, namespace string, restartPolicy corev1.RestartPolicy, labels map[string]string) client.Object {
 	three := int64(3)
 	if labels == nil {
 		labels = map[string]string{}
@@ -75,12 +75,12 @@ func createPodWithLabels(name, namespace string, restartPolicy corev1.RestartPol
 	}
 	cl, err := client.New(cfg, client.Options{})
 	Expect(err).NotTo(HaveOccurred())
-	err = cl.Create(context.Background(), pod)
+	err = cl.Create(ctx, pod)
 	Expect(err).NotTo(HaveOccurred())
 	return pod
 }
 
-func createSvc(name, namespace string, cl client.Client) client.Object {
+func createSvc(ctx context.Context, name, namespace string, cl client.Client) client.Object {
 	svc := &corev1.Service{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
@@ -90,31 +90,31 @@ func createSvc(name, namespace string, cl client.Client) client.Object {
 			Ports: []corev1.ServicePort{{Port: 1}},
 		},
 	}
-	err := cl.Create(context.Background(), svc)
+	err := cl.Create(ctx, svc)
 	Expect(err).NotTo(HaveOccurred())
 	return svc
 }
 
-func createSA(name, namespace string, cl client.Client) client.Object {
+func createSA(ctx context.Context, name, namespace string, cl client.Client) client.Object {
 	sa := &corev1.ServiceAccount{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
 			Namespace: namespace,
 		},
 	}
-	err := cl.Create(context.Background(), sa)
+	err := cl.Create(ctx, sa)
 	Expect(err).NotTo(HaveOccurred())
 	return sa
 }
 
-func createPod(name, namespace string, restartPolicy corev1.RestartPolicy) client.Object {
-	return createPodWithLabels(name, namespace, restartPolicy, nil)
+func createPod(ctx context.Context, name, namespace string, restartPolicy corev1.RestartPolicy) client.Object {
+	return createPodWithLabels(ctx, name, namespace, restartPolicy, nil)
 }
 
-func deletePod(pod client.Object) {
+func deletePod(ctx context.Context, pod client.Object) {
 	cl, err := client.New(cfg, client.Options{})
 	Expect(err).NotTo(HaveOccurred())
-	err = cl.Delete(context.Background(), pod)
+	err = cl.Delete(ctx, pod)
 	Expect(err).NotTo(HaveOccurred())
 }
 
@@ -130,16 +130,16 @@ var _ = Describe("Informer Cache with ReaderFailOnMissingInformer", func() {
 var _ = Describe("Multi-Namespace Informer Cache", func() {
 	CacheTest(cache.New, cache.Options{
 		DefaultNamespaces: map[string]cache.Config{
-			testNamespaceOne: {},
-			testNamespaceTwo: {},
-			"default":        {},
+			cache.AllNamespaces: {FieldSelector: fields.OneTermEqualSelector("metadata.namespace", testNamespaceOne)},
+			testNamespaceTwo:    {},
+			"default":           {},
 		},
 	})
 	NonBlockingGetTest(cache.New, cache.Options{
 		DefaultNamespaces: map[string]cache.Config{
-			testNamespaceOne: {},
-			testNamespaceTwo: {},
-			"default":        {},
+			cache.AllNamespaces: {FieldSelector: fields.OneTermEqualSelector("metadata.namespace", testNamespaceOne)},
+			testNamespaceTwo:    {},
+			"default":           {},
 		},
 	})
 })
@@ -156,7 +156,6 @@ var _ = Describe("Informer Cache without global DeepCopy", func() {
 var _ = Describe("Cache with transformers", func() {
 	var (
 		informerCache       cache.Cache
-		informerCacheCtx    context.Context
 		informerCacheCancel context.CancelFunc
 		knownPod1           client.Object
 		knownPod2           client.Object
@@ -177,28 +176,31 @@ var _ = Describe("Cache with transformers", func() {
 		return ""
 	}
 
-	BeforeEach(func() {
-		informerCacheCtx, informerCacheCancel = context.WithCancel(context.Background())
+	BeforeEach(func(ctx SpecContext) {
+		var informerCacheCtx context.Context
+		// Has to be derived from context.Background as it has to stay valid past the
+		// BeforeEach.
+		informerCacheCtx, informerCacheCancel = context.WithCancel(context.Background()) //nolint:forbidigo
 		Expect(cfg).NotTo(BeNil())
 
 		By("creating three pods")
 		cl, err := client.New(cfg, client.Options{})
 		Expect(err).NotTo(HaveOccurred())
-		err = ensureNode(testNodeOne, cl)
+		err = ensureNode(ctx, testNodeOne, cl)
 		Expect(err).NotTo(HaveOccurred())
-		err = ensureNamespace(testNamespaceOne, cl)
+		err = ensureNamespace(ctx, testNamespaceOne, cl)
 		Expect(err).NotTo(HaveOccurred())
-		err = ensureNamespace(testNamespaceTwo, cl)
+		err = ensureNamespace(ctx, testNamespaceTwo, cl)
 		Expect(err).NotTo(HaveOccurred())
-		err = ensureNamespace(testNamespaceThree, cl)
+		err = ensureNamespace(ctx, testNamespaceThree, cl)
 		Expect(err).NotTo(HaveOccurred())
 		// Includes restart policy since these objects are indexed on this field.
-		knownPod1 = createPod("test-pod-1", testNamespaceOne, corev1.RestartPolicyNever)
-		knownPod2 = createPod("test-pod-2", testNamespaceTwo, corev1.RestartPolicyAlways)
-		knownPod3 = createPodWithLabels("test-pod-3", testNamespaceTwo, corev1.RestartPolicyOnFailure, map[string]string{"common-label": "common"})
-		knownPod4 = createPodWithLabels("test-pod-4", testNamespaceThree, corev1.RestartPolicyNever, map[string]string{"common-label": "common"})
-		knownPod5 = createPod("test-pod-5", testNamespaceOne, corev1.RestartPolicyNever)
-		knownPod6 = createPod("test-pod-6", testNamespaceTwo, corev1.RestartPolicyAlways)
+		knownPod1 = createPod(ctx, "test-pod-1", testNamespaceOne, corev1.RestartPolicyNever)
+		knownPod2 = createPod(ctx, "test-pod-2", testNamespaceTwo, corev1.RestartPolicyAlways)
+		knownPod3 = createPodWithLabels(ctx, "test-pod-3", testNamespaceTwo, corev1.RestartPolicyOnFailure, map[string]string{"common-label": "common"})
+		knownPod4 = createPodWithLabels(ctx, "test-pod-4", testNamespaceThree, corev1.RestartPolicyNever, map[string]string{"common-label": "common"})
+		knownPod5 = createPod(ctx, "test-pod-5", testNamespaceOne, corev1.RestartPolicyNever)
+		knownPod6 = createPod(ctx, "test-pod-6", testNamespaceTwo, corev1.RestartPolicyAlways)
 
 		podGVK := schema.GroupVersionKind{
 			Kind:    "Pod",
@@ -265,26 +267,26 @@ var _ = Describe("Cache with transformers", func() {
 			defer GinkgoRecover()
 			Expect(informerCache.Start(ctx)).To(Succeed())
 		}(informerCacheCtx)
-		Expect(informerCache.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+		Expect(informerCache.WaitForCacheSync(ctx)).To(BeTrue())
 	})
 
-	AfterEach(func() {
+	AfterEach(func(ctx SpecContext) {
 		By("cleaning up created pods")
-		deletePod(knownPod1)
-		deletePod(knownPod2)
-		deletePod(knownPod3)
-		deletePod(knownPod4)
-		deletePod(knownPod5)
-		deletePod(knownPod6)
+		deletePod(ctx, knownPod1)
+		deletePod(ctx, knownPod2)
+		deletePod(ctx, knownPod3)
+		deletePod(ctx, knownPod4)
+		deletePod(ctx, knownPod5)
+		deletePod(ctx, knownPod6)
 
 		informerCacheCancel()
 	})
 
 	Context("with structured objects", func() {
-		It("should apply transformers to explicitly specified GVKS", func() {
+		It("should apply transformers to explicitly specified GVKS", func(ctx SpecContext) {
 			By("listing pods")
 			out := corev1.PodList{}
-			Expect(informerCache.List(context.Background(), &out)).To(Succeed())
+			Expect(informerCache.List(ctx, &out)).To(Succeed())
 
 			By("verifying that the returned pods were transformed")
 			for i := 0; i < len(out.Items); i++ {
@@ -292,11 +294,11 @@ var _ = Describe("Cache with transformers", func() {
 			}
 		})
 
-		It("should apply default transformer to objects when none is specified", func() {
+		It("should apply default transformer to objects when none is specified", func(ctx SpecContext) {
 			By("getting the Kubernetes service")
 			svc := &corev1.Service{}
 			svcKey := client.ObjectKey{Namespace: "default", Name: "kubernetes"}
-			Expect(informerCache.Get(context.Background(), svcKey, svc)).To(Succeed())
+			Expect(informerCache.Get(ctx, svcKey, svc)).To(Succeed())
 
 			By("verifying that the returned service was transformed")
 			Expect(getTransformValue(svc)).To(BeIdenticalTo("default"))
@@ -304,7 +306,7 @@ var _ = Describe("Cache with transformers", func() {
 	})
 
 	Context("with unstructured objects", func() {
-		It("should apply transformers to explicitly specified GVKS", func() {
+		It("should apply transformers to explicitly specified GVKS", func(ctx SpecContext) {
 			By("listing pods")
 			out := unstructured.UnstructuredList{}
 			out.SetGroupVersionKind(schema.GroupVersionKind{
@@ -312,7 +314,7 @@ var _ = Describe("Cache with transformers", func() {
 				Version: "v1",
 				Kind:    "PodList",
 			})
-			Expect(informerCache.List(context.Background(), &out)).To(Succeed())
+			Expect(informerCache.List(ctx, &out)).To(Succeed())
 
 			By("verifying that the returned pods were transformed")
 			for i := 0; i < len(out.Items); i++ {
@@ -320,7 +322,7 @@ var _ = Describe("Cache with transformers", func() {
 			}
 		})
 
-		It("should apply default transformer to objects when none is specified", func() {
+		It("should apply default transformer to objects when none is specified", func(ctx SpecContext) {
 			By("getting the Kubernetes service")
 			svc := &unstructured.Unstructured{}
 			svc.SetGroupVersionKind(schema.GroupVersionKind{
@@ -329,7 +331,7 @@ var _ = Describe("Cache with transformers", func() {
 				Kind:    "Service",
 			})
 			svcKey := client.ObjectKey{Namespace: "default", Name: "kubernetes"}
-			Expect(informerCache.Get(context.Background(), svcKey, svc)).To(Succeed())
+			Expect(informerCache.Get(ctx, svcKey, svc)).To(Succeed())
 
 			By("verifying that the returned service was transformed")
 			Expect(getTransformValue(svc)).To(BeIdenticalTo("default"))
@@ -337,7 +339,7 @@ var _ = Describe("Cache with transformers", func() {
 	})
 
 	Context("with metadata-only objects", func() {
-		It("should apply transformers to explicitly specified GVKS", func() {
+		It("should apply transformers to explicitly specified GVKS", func(ctx SpecContext) {
 			By("listing pods")
 			out := metav1.PartialObjectMetadataList{}
 			out.SetGroupVersionKind(schema.GroupVersionKind{
@@ -345,14 +347,14 @@ var _ = Describe("Cache with transformers", func() {
 				Version: "v1",
 				Kind:    "PodList",
 			})
-			Expect(informerCache.List(context.Background(), &out)).To(Succeed())
+			Expect(informerCache.List(ctx, &out)).To(Succeed())
 
 			By("verifying that the returned pods were transformed")
 			for i := 0; i < len(out.Items); i++ {
 				Expect(getTransformValue(&out.Items[i])).To(BeIdenticalTo("explicit"))
 			}
 		})
-		It("should apply default transformer to objects when none is specified", func() {
+		It("should apply default transformer to objects when none is specified", func(ctx SpecContext) {
 			By("getting the Kubernetes service")
 			svc := &metav1.PartialObjectMetadata{}
 			svc.SetGroupVersionKind(schema.GroupVersionKind{
@@ -361,7 +363,7 @@ var _ = Describe("Cache with transformers", func() {
 				Kind:    "Service",
 			})
 			svcKey := client.ObjectKey{Namespace: "default", Name: "kubernetes"}
-			Expect(informerCache.Get(context.Background(), svcKey, svc)).To(Succeed())
+			Expect(informerCache.Get(ctx, svcKey, svc)).To(Succeed())
 
 			By("verifying that the returned service was transformed")
 			Expect(getTransformValue(svc)).To(BeIdenticalTo("default"))
@@ -373,22 +375,24 @@ var _ = Describe("Cache with selectors", func() {
 	defer GinkgoRecover()
 	var (
 		informerCache       cache.Cache
-		informerCacheCtx    context.Context
 		informerCacheCancel context.CancelFunc
 	)
 
-	BeforeEach(func() {
-		informerCacheCtx, informerCacheCancel = context.WithCancel(context.Background())
+	BeforeEach(func(ctx SpecContext) {
+		var informerCacheCtx context.Context
+		// Has to be derived from context.Background as it has to stay valid past the
+		// BeforeEach.
+		informerCacheCtx, informerCacheCancel = context.WithCancel(context.Background()) //nolint:forbidigo
 		Expect(cfg).NotTo(BeNil())
 		cl, err := client.New(cfg, client.Options{})
 		Expect(err).NotTo(HaveOccurred())
-		err = ensureNamespace(testNamespaceOne, cl)
+		err = ensureNamespace(ctx, testNamespaceOne, cl)
 		Expect(err).NotTo(HaveOccurred())
-		err = ensureNamespace(testNamespaceTwo, cl)
+		err = ensureNamespace(ctx, testNamespaceTwo, cl)
 		Expect(err).NotTo(HaveOccurred())
 		for idx, namespace := range []string{testNamespaceOne, testNamespaceTwo} {
-			_ = createSA("test-sa-"+strconv.Itoa(idx), namespace, cl)
-			_ = createSvc("test-svc-"+strconv.Itoa(idx), namespace, cl)
+			_ = createSA(ctx, "test-sa-"+strconv.Itoa(idx), namespace, cl)
+			_ = createSvc(ctx, "test-svc-"+strconv.Itoa(idx), namespace, cl)
 		}
 
 		opts := cache.Options{
@@ -412,8 +416,7 @@ var _ = Describe("Cache with selectors", func() {
 		Expect(informerCache.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
 	})
 
-	AfterEach(func() {
-		ctx := context.Background()
+	AfterEach(func(ctx SpecContext) {
 		cl, err := client.New(cfg, client.Options{})
 		Expect(err).NotTo(HaveOccurred())
 		for idx, namespace := range []string{testNamespaceOne, testNamespaceTwo} {
@@ -425,17 +428,17 @@ var _ = Describe("Cache with selectors", func() {
 		informerCacheCancel()
 	})
 
-	It("Should list serviceaccounts and find exactly one in namespace "+testNamespaceOne, func() {
+	It("Should list serviceaccounts and find exactly one in namespace "+testNamespaceOne, func(ctx SpecContext) {
 		var sas corev1.ServiceAccountList
-		err := informerCache.List(informerCacheCtx, &sas)
+		err := informerCache.List(ctx, &sas)
 		Expect(err).NotTo(HaveOccurred())
 		Expect(sas.Items).To(HaveLen(1))
 		Expect(sas.Items[0].Namespace).To(Equal(testNamespaceOne))
 	})
 
-	It("Should list services and find exactly one in namespace "+testNamespaceTwo, func() {
+	It("Should list services and find exactly one in namespace "+testNamespaceTwo, func(ctx SpecContext) {
 		var svcs corev1.ServiceList
-		err := informerCache.List(informerCacheCtx, &svcs)
+		err := informerCache.List(ctx, &svcs)
 		Expect(err).NotTo(HaveOccurred())
 		Expect(svcs.Items).To(HaveLen(1))
 		Expect(svcs.Items[0].Namespace).To(Equal(testNamespaceTwo))
@@ -446,13 +449,15 @@ func CacheTestReaderFailOnMissingInformer(createCacheFunc func(config *rest.Conf
 	Describe("Cache test with ReaderFailOnMissingInformer = true", func() {
 		var (
 			informerCache       cache.Cache
-			informerCacheCtx    context.Context
 			informerCacheCancel context.CancelFunc
 			errNotCached        *cache.ErrResourceNotCached
 		)
 
-		BeforeEach(func() {
-			informerCacheCtx, informerCacheCancel = context.WithCancel(context.Background())
+		BeforeEach(func(ctx SpecContext) {
+			var informerCacheCtx context.Context
+			// Has to be derived from context.Background as it has to stay valid past the
+			// BeforeEach.
+			informerCacheCtx, informerCacheCancel = context.WithCancel(context.Background()) //nolint:forbidigo
 			Expect(cfg).NotTo(BeNil())
 			By("creating the informer cache")
 			var err error
@@ -464,7 +469,7 @@ func CacheTestReaderFailOnMissingInformer(createCacheFunc func(config *rest.Conf
 				defer GinkgoRecover()
 				Expect(informerCache.Start(ctx)).To(Succeed())
 			}(informerCacheCtx)
-			Expect(informerCache.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+			Expect(informerCache.WaitForCacheSync(ctx)).To(BeTrue())
 		})
 
 		AfterEach(func() {
@@ -473,27 +478,27 @@ func CacheTestReaderFailOnMissingInformer(createCacheFunc func(config *rest.Conf
 
 		Describe("as a Reader", func() {
 			Context("with structured objects", func() {
-				It("should not be able to list objects that haven't been watched previously", func() {
+				It("should not be able to list objects that haven't been watched previously", func(ctx SpecContext) {
 					By("listing all services in the cluster")
 					listObj := &corev1.ServiceList{}
-					Expect(errors.As(informerCache.List(context.Background(), listObj), &errNotCached)).To(BeTrue())
+					Expect(errors.As(informerCache.List(ctx, listObj), &errNotCached)).To(BeTrue())
 				})
 
-				It("should not be able to get objects that haven't been watched previously", func() {
+				It("should not be able to get objects that haven't been watched previously", func(ctx SpecContext) {
 					By("getting the Kubernetes service")
 					svc := &corev1.Service{}
 					svcKey := client.ObjectKey{Namespace: "default", Name: "kubernetes"}
-					Expect(errors.As(informerCache.Get(context.Background(), svcKey, svc), &errNotCached)).To(BeTrue())
+					Expect(errors.As(informerCache.Get(ctx, svcKey, svc), &errNotCached)).To(BeTrue())
 				})
 
-				It("should be able to list objects that are configured to be watched", func() {
+				It("should be able to list objects that are configured to be watched", func(ctx SpecContext) {
 					By("indicating that we need to watch services")
-					_, err := informerCache.GetInformer(context.Background(), &corev1.Service{})
+					_, err := informerCache.GetInformer(ctx, &corev1.Service{})
 					Expect(err).ToNot(HaveOccurred())
 
 					By("listing all services in the cluster")
 					svcList := &corev1.ServiceList{}
-					Expect(informerCache.List(context.Background(), svcList)).To(Succeed())
+					Expect(informerCache.List(ctx, svcList)).To(Succeed())
 
 					By("verifying that the returned service looks reasonable")
 					Expect(svcList.Items).To(HaveLen(1))
@@ -501,15 +506,15 @@ func CacheTestReaderFailOnMissingInformer(createCacheFunc func(config *rest.Conf
 					Expect(svcList.Items[0].Namespace).To(Equal("default"))
 				})
 
-				It("should be able to get objects that are configured to be watched", func() {
+				It("should be able to get objects that are configured to be watched", func(ctx SpecContext) {
 					By("indicating that we need to watch services")
-					_, err := informerCache.GetInformer(context.Background(), &corev1.Service{})
+					_, err := informerCache.GetInformer(ctx, &corev1.Service{})
 					Expect(err).ToNot(HaveOccurred())
 
 					By("getting the Kubernetes service")
 					svc := &corev1.Service{}
 					svcKey := client.ObjectKey{Namespace: "default", Name: "kubernetes"}
-					Expect(informerCache.Get(context.Background(), svcKey, svc)).To(Succeed())
+					Expect(informerCache.Get(ctx, svcKey, svc)).To(Succeed())
 
 					By("verifying that the returned service looks reasonable")
 					Expect(svc.Name).To(Equal("kubernetes"))
@@ -524,34 +529,31 @@ func NonBlockingGetTest(createCacheFunc func(config *rest.Config, opts cache.Opt
 	Describe("non-blocking get test", func() {
 		var (
 			informerCache       cache.Cache
-			informerCacheCtx    context.Context
 			informerCacheCancel context.CancelFunc
 		)
-		BeforeEach(func() {
-			informerCacheCtx, informerCacheCancel = context.WithCancel(context.Background())
+		BeforeEach(func(ctx SpecContext) {
+			var informerCacheCtx context.Context
+			// Has to be derived from context.Background as it has to stay valid past the
+			// BeforeEach.
+			informerCacheCtx, informerCacheCancel = context.WithCancel(context.Background()) //nolint:forbidigo
 			Expect(cfg).NotTo(BeNil())
 
 			By("creating expected namespaces")
 			cl, err := client.New(cfg, client.Options{})
 			Expect(err).NotTo(HaveOccurred())
-			err = ensureNode(testNodeOne, cl)
+			err = ensureNode(ctx, testNodeOne, cl)
 			Expect(err).NotTo(HaveOccurred())
-			err = ensureNamespace(testNamespaceOne, cl)
+			err = ensureNamespace(ctx, testNamespaceOne, cl)
 			Expect(err).NotTo(HaveOccurred())
-			err = ensureNamespace(testNamespaceTwo, cl)
+			err = ensureNamespace(ctx, testNamespaceTwo, cl)
 			Expect(err).NotTo(HaveOccurred())
-			err = ensureNamespace(testNamespaceThree, cl)
+			err = ensureNamespace(ctx, testNamespaceThree, cl)
 			Expect(err).NotTo(HaveOccurred())
 
 			By("creating the informer cache")
-			v := reflect.ValueOf(&opts).Elem()
-			newInformerField := v.FieldByName("newInformer")
-			newFakeInformer := func(_ kcache.ListerWatcher, _ runtime.Object, _ time.Duration, _ kcache.Indexers) kcache.SharedIndexInformer {
+			opts.NewInformer = func(_ kcache.ListerWatcher, _ runtime.Object, _ time.Duration, _ kcache.Indexers) kcache.SharedIndexInformer {
 				return &controllertest.FakeInformer{Synced: false}
 			}
-			reflect.NewAt(newInformerField.Type(), newInformerField.Addr().UnsafePointer()).
-				Elem().
-				Set(reflect.ValueOf(&newFakeInformer))
 			informerCache, err = createCacheFunc(cfg, opts)
 			Expect(err).NotTo(HaveOccurred())
 			By("running the cache and waiting for it to sync")
@@ -560,7 +562,7 @@ func NonBlockingGetTest(createCacheFunc func(config *rest.Config, opts cache.Opt
 				defer GinkgoRecover()
 				Expect(informerCache.Start(ctx)).To(Succeed())
 			}(informerCacheCtx)
-			Expect(informerCache.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+			Expect(informerCache.WaitForCacheSync(ctx)).To(BeTrue())
 		})
 
 		AfterEach(func() {
@@ -569,7 +571,7 @@ func NonBlockingGetTest(createCacheFunc func(config *rest.Config, opts cache.Opt
 		})
 
 		Describe("as an Informer", func() {
-			It("should be able to get informer for the object without blocking", func() {
+			It("should be able to get informer for the object without blocking", func(specCtx SpecContext) {
 				By("getting a shared index informer for a pod")
 				pod := &corev1.Pod{
 					ObjectMeta: metav1.ObjectMeta{
@@ -586,7 +588,7 @@ func NonBlockingGetTest(createCacheFunc func(config *rest.Config, opts cache.Opt
 					},
 				}
 
-				ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+				ctx, cancel := context.WithTimeout(specCtx, 5*time.Second)
 				defer cancel()
 				sii, err := informerCache.GetInformer(ctx, pod, cache.BlockUntilSynced(false))
 				Expect(err).NotTo(HaveOccurred())
@@ -601,7 +603,6 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 	Describe("Cache test", func() {
 		var (
 			informerCache       cache.Cache
-			informerCacheCtx    context.Context
 			informerCacheCancel context.CancelFunc
 			knownPod1           client.Object
 			knownPod2           client.Object
@@ -611,30 +612,33 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 			knownPod6           client.Object
 		)
 
-		BeforeEach(func() {
-			informerCacheCtx, informerCacheCancel = context.WithCancel(context.Background())
+		BeforeEach(func(ctx SpecContext) {
+			var informerCacheCtx context.Context
+			// Has to be derived from context.Background as it has to stay valid past the
+			// BeforeEach.
+			informerCacheCtx, informerCacheCancel = context.WithCancel(context.Background()) //nolint:forbidigo
 			Expect(cfg).NotTo(BeNil())
 
 			By("creating three pods")
 			cl, err := client.New(cfg, client.Options{})
 			Expect(err).NotTo(HaveOccurred())
-			err = ensureNode(testNodeOne, cl)
+			err = ensureNode(ctx, testNodeOne, cl)
 			Expect(err).NotTo(HaveOccurred())
-			err = ensureNode(testNodeTwo, cl)
+			err = ensureNode(ctx, testNodeTwo, cl)
 			Expect(err).NotTo(HaveOccurred())
-			err = ensureNamespace(testNamespaceOne, cl)
+			err = ensureNamespace(ctx, testNamespaceOne, cl)
 			Expect(err).NotTo(HaveOccurred())
-			err = ensureNamespace(testNamespaceTwo, cl)
+			err = ensureNamespace(ctx, testNamespaceTwo, cl)
 			Expect(err).NotTo(HaveOccurred())
-			err = ensureNamespace(testNamespaceThree, cl)
+			err = ensureNamespace(ctx, testNamespaceThree, cl)
 			Expect(err).NotTo(HaveOccurred())
 			// Includes restart policy since these objects are indexed on this field.
-			knownPod1 = createPod("test-pod-1", testNamespaceOne, corev1.RestartPolicyNever)
-			knownPod2 = createPod("test-pod-2", testNamespaceTwo, corev1.RestartPolicyAlways)
-			knownPod3 = createPodWithLabels("test-pod-3", testNamespaceTwo, corev1.RestartPolicyOnFailure, map[string]string{"common-label": "common"})
-			knownPod4 = createPodWithLabels("test-pod-4", testNamespaceThree, corev1.RestartPolicyNever, map[string]string{"common-label": "common"})
-			knownPod5 = createPod("test-pod-5", testNamespaceOne, corev1.RestartPolicyNever)
-			knownPod6 = createPod("test-pod-6", testNamespaceTwo, corev1.RestartPolicyAlways)
+			knownPod1 = createPod(ctx, "test-pod-1", testNamespaceOne, corev1.RestartPolicyNever)
+			knownPod2 = createPod(ctx, "test-pod-2", testNamespaceTwo, corev1.RestartPolicyAlways)
+			knownPod3 = createPodWithLabels(ctx, "test-pod-3", testNamespaceTwo, corev1.RestartPolicyOnFailure, map[string]string{"common-label": "common"})
+			knownPod4 = createPodWithLabels(ctx, "test-pod-4", testNamespaceThree, corev1.RestartPolicyNever, map[string]string{"common-label": "common"})
+			knownPod5 = createPod(ctx, "test-pod-5", testNamespaceOne, corev1.RestartPolicyNever)
+			knownPod6 = createPod(ctx, "test-pod-6", testNamespaceTwo, corev1.RestartPolicyAlways)
 
 			podGVK := schema.GroupVersionKind{
 				Kind:    "Pod",
@@ -657,27 +661,27 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 				defer GinkgoRecover()
 				Expect(informerCache.Start(ctx)).To(Succeed())
 			}(informerCacheCtx)
-			Expect(informerCache.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+			Expect(informerCache.WaitForCacheSync(ctx)).To(BeTrue())
 		})
 
-		AfterEach(func() {
+		AfterEach(func(ctx SpecContext) {
 			By("cleaning up created pods")
-			deletePod(knownPod1)
-			deletePod(knownPod2)
-			deletePod(knownPod3)
-			deletePod(knownPod4)
-			deletePod(knownPod5)
-			deletePod(knownPod6)
+			deletePod(ctx, knownPod1)
+			deletePod(ctx, knownPod2)
+			deletePod(ctx, knownPod3)
+			deletePod(ctx, knownPod4)
+			deletePod(ctx, knownPod5)
+			deletePod(ctx, knownPod6)
 
 			informerCacheCancel()
 		})
 
 		Describe("as a Reader", func() {
 			Context("with structured objects", func() {
-				It("should be able to list objects that haven't been watched previously", func() {
+				It("should be able to list objects that haven't been watched previously", func(ctx SpecContext) {
 					By("listing all services in the cluster")
 					listObj := &corev1.ServiceList{}
-					Expect(informerCache.List(context.Background(), listObj)).To(Succeed())
+					Expect(informerCache.List(ctx, listObj)).To(Succeed())
 
 					By("verifying that the returned list contains the Kubernetes service")
 					// NB: kubernetes default service is automatically created in testenv.
@@ -693,22 +697,22 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					Expect(hasKubeService).To(BeTrue())
 				})
 
-				It("should be able to get objects that haven't been watched previously", func() {
+				It("should be able to get objects that haven't been watched previously", func(ctx SpecContext) {
 					By("getting the Kubernetes service")
 					svc := &corev1.Service{}
 					svcKey := client.ObjectKey{Namespace: "default", Name: "kubernetes"}
-					Expect(informerCache.Get(context.Background(), svcKey, svc)).To(Succeed())
+					Expect(informerCache.Get(ctx, svcKey, svc)).To(Succeed())
 
 					By("verifying that the returned service looks reasonable")
 					Expect(svc.Name).To(Equal("kubernetes"))
 					Expect(svc.Namespace).To(Equal("default"))
 				})
 
-				It("should support filtering by labels in a single namespace", func() {
+				It("should support filtering by labels in a single namespace", func(ctx SpecContext) {
 					By("listing pods with a particular label")
 					// NB: each pod has a "test-label": <pod-name>
 					out := corev1.PodList{}
-					Expect(informerCache.List(context.Background(), &out,
+					Expect(informerCache.List(ctx, &out,
 						client.InNamespace(testNamespaceTwo),
 						client.MatchingLabels(map[string]string{"test-label": "test-pod-2"}))).To(Succeed())
 
@@ -719,16 +723,16 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					Expect(actual.Labels["test-label"]).To(Equal("test-pod-2"))
 				})
 
-				It("should support filtering by labels from multiple namespaces", func() {
+				It("should support filtering by labels from multiple namespaces", func(ctx SpecContext) {
 					By("creating another pod with the same label but different namespace")
-					anotherPod := createPod("test-pod-2", testNamespaceOne, corev1.RestartPolicyAlways)
-					defer deletePod(anotherPod)
+					anotherPod := createPod(ctx, "test-pod-2", testNamespaceOne, corev1.RestartPolicyAlways)
+					defer deletePod(ctx, anotherPod)
 
 					By("listing pods with a particular label")
 					// NB: each pod has a "test-label": <pod-name>
 					out := corev1.PodList{}
 					labels := map[string]string{"test-label": "test-pod-2"}
-					Expect(informerCache.List(context.Background(), &out, client.MatchingLabels(labels))).To(Succeed())
+					Expect(informerCache.List(ctx, &out, client.MatchingLabels(labels))).To(Succeed())
 
 					By("verifying multiple pods with the same label in different namespaces are returned")
 					Expect(out.Items).NotTo(BeEmpty())
@@ -739,10 +743,10 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 				})
 
 				if !isPodDisableDeepCopy(opts) {
-					It("should be able to list objects with GVK populated", func() {
+					It("should be able to list objects with GVK populated", func(ctx SpecContext) {
 						By("listing pods")
 						out := &corev1.PodList{}
-						Expect(informerCache.List(context.Background(), out)).To(Succeed())
+						Expect(informerCache.List(ctx, out)).To(Succeed())
 
 						By("verifying that the returned pods have GVK populated")
 						Expect(out.Items).NotTo(BeEmpty())
@@ -753,10 +757,10 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					})
 				}
 
-				It("should be able to list objects by namespace", func() {
+				It("should be able to list objects by namespace", func(ctx SpecContext) {
 					By("listing pods in test-namespace-1")
 					listObj := &corev1.PodList{}
-					Expect(informerCache.List(context.Background(), listObj,
+					Expect(informerCache.List(ctx, listObj,
 						client.InNamespace(testNamespaceOne))).To(Succeed())
 
 					By("verifying that the returned pods are in test-namespace-1")
@@ -768,11 +772,11 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 				})
 
 				if !isPodDisableDeepCopy(opts) {
-					It("should deep copy the object unless told otherwise", func() {
+					It("should deep copy the object unless told otherwise", func(ctx SpecContext) {
 						By("retrieving a specific pod from the cache")
 						out := &corev1.Pod{}
 						podKey := client.ObjectKey{Name: "test-pod-2", Namespace: testNamespaceTwo}
-						Expect(informerCache.Get(context.Background(), podKey, out)).To(Succeed())
+						Expect(informerCache.Get(ctx, podKey, out)).To(Succeed())
 
 						By("verifying the retrieved pod is equal to a known pod")
 						Expect(out).To(Equal(knownPod2))
@@ -784,13 +788,13 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Expect(out).NotTo(Equal(knownPod2))
 					})
 				} else {
-					It("should not deep copy the object if UnsafeDisableDeepCopy is enabled", func() {
+					It("should not deep copy the object if UnsafeDisableDeepCopy is enabled", func(ctx SpecContext) {
 						By("getting a specific pod from the cache twice")
 						podKey := client.ObjectKey{Name: "test-pod-2", Namespace: testNamespaceTwo}
 						out1 := &corev1.Pod{}
-						Expect(informerCache.Get(context.Background(), podKey, out1)).To(Succeed())
+						Expect(informerCache.Get(ctx, podKey, out1)).To(Succeed())
 						out2 := &corev1.Pod{}
-						Expect(informerCache.Get(context.Background(), podKey, out2)).To(Succeed())
+						Expect(informerCache.Get(ctx, podKey, out2)).To(Succeed())
 
 						By("verifying the pointer fields in pod have the same addresses")
 						Expect(out1).To(Equal(out2))
@@ -798,9 +802,9 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 
 						By("listing pods from the cache twice")
 						outList1 := &corev1.PodList{}
-						Expect(informerCache.List(context.Background(), outList1, client.InNamespace(testNamespaceOne))).To(Succeed())
+						Expect(informerCache.List(ctx, outList1, client.InNamespace(testNamespaceOne))).To(Succeed())
 						outList2 := &corev1.PodList{}
-						Expect(informerCache.List(context.Background(), outList2, client.InNamespace(testNamespaceOne))).To(Succeed())
+						Expect(informerCache.List(ctx, outList2, client.InNamespace(testNamespaceOne))).To(Succeed())
 
 						By("verifying the pointer fields in pod have the same addresses")
 						Expect(outList1.Items).To(HaveLen(len(outList2.Items)))
@@ -815,68 +819,81 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					})
 				}
 
-				It("should return an error if the object is not found", func() {
+				It("should return an error if the object is not found", func(ctx SpecContext) {
 					By("getting a service that does not exists")
 					svc := &corev1.Service{}
 					svcKey := client.ObjectKey{Namespace: testNamespaceOne, Name: "unknown"}
 
 					By("verifying that an error is returned")
-					err := informerCache.Get(context.Background(), svcKey, svc)
+					err := informerCache.Get(ctx, svcKey, svc)
 					Expect(err).To(HaveOccurred())
 					Expect(apierrors.IsNotFound(err)).To(BeTrue())
 				})
 
-				It("should return an error if getting object in unwatched namespace", func() {
+				It("should return an error if getting object in unwatched namespace", func(ctx SpecContext) {
 					By("getting a service that does not exists")
 					svc := &corev1.Service{}
 					svcKey := client.ObjectKey{Namespace: "unknown", Name: "unknown"}
 
 					By("verifying that an error is returned")
-					err := informerCache.Get(context.Background(), svcKey, svc)
+					err := informerCache.Get(ctx, svcKey, svc)
 					Expect(err).To(HaveOccurred())
 				})
 
-				It("should return an error when context is cancelled", func() {
+				It("should return an error when context is cancelled", func(specCtx SpecContext) {
 					By("cancelling the context")
-					informerCacheCancel()
+					ctx := cancelledCtx(specCtx)
 
 					By("listing pods in test-namespace-1 with a cancelled context")
 					listObj := &corev1.PodList{}
-					err := informerCache.List(informerCacheCtx, listObj, client.InNamespace(testNamespaceOne))
+					err := informerCache.List(ctx, listObj, client.InNamespace(testNamespaceOne))
 
 					By("verifying that an error is returned")
 					Expect(err).To(HaveOccurred())
 					Expect(apierrors.IsTimeout(err)).To(BeTrue())
 				})
 
-				It("should set the Limit option and limit number of objects to Limit when List is called", func() {
+				It("should set the Limit option and limit number of objects to Limit when List is called", func(ctx SpecContext) {
 					opts := &client.ListOptions{Limit: int64(3)}
 					By("verifying that only Limit (3) number of objects are retrieved from the cache")
 					listObj := &corev1.PodList{}
-					Expect(informerCache.List(context.Background(), listObj, opts)).To(Succeed())
+					Expect(informerCache.List(ctx, listObj, opts)).To(Succeed())
 					Expect(listObj.Items).Should(HaveLen(3))
 				})
 
-				It("should return a limited result set matching the correct label", func() {
+				It("should return a limited result set matching the correct label", func(ctx SpecContext) {
 					listObj := &corev1.PodList{}
 					labelOpt := client.MatchingLabels(map[string]string{"common-label": "common"})
 					limitOpt := client.Limit(1)
 					By("verifying that only Limit (1) number of objects are retrieved from the cache")
-					Expect(informerCache.List(context.Background(), listObj, labelOpt, limitOpt)).To(Succeed())
+					Expect(informerCache.List(ctx, listObj, labelOpt, limitOpt)).To(Succeed())
 					Expect(listObj.Items).Should(HaveLen(1))
 				})
 
-				It("should return an error if the continue list options is set", func() {
+				It("should return an error if pagination is used", func(ctx SpecContext) {
+					listObj := &corev1.PodList{}
+					By("verifying that the first list works and returns a sentinel continue")
+					err := informerCache.List(ctx, listObj)
+					Expect(err).ToNot(HaveOccurred())
+					Expect(listObj.Continue).To(Equal("continue-not-supported"))
+
+					By("verifying that an error is returned")
+					err = informerCache.List(ctx, listObj, client.Continue(listObj.Continue))
+					Expect(err).To(HaveOccurred())
+					Expect(err.Error()).To(Equal("continue list option is not supported by the cache"))
+				})
+
+				It("should return an error if the continue list options is set", func(ctx SpecContext) {
 					listObj := &corev1.PodList{}
 					continueOpt := client.Continue("token")
 					By("verifying that an error is returned")
-					err := informerCache.List(context.Background(), listObj, continueOpt)
+					err := informerCache.List(ctx, listObj, continueOpt)
 					Expect(err).To(HaveOccurred())
 				})
 			})
 
 			Context("with unstructured objects", func() {
-				It("should be able to list objects that haven't been watched previously", func() {
+				It("should be able to list objects that haven't been watched previously", func(ctx SpecContext) {
 					By("listing all services in the cluster")
 					listObj := &unstructured.UnstructuredList{}
 					listObj.SetGroupVersionKind(schema.GroupVersionKind{
@@ -884,7 +901,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "ServiceList",
 					})
-					err := informerCache.List(context.Background(), listObj)
+					err := informerCache.List(ctx, listObj)
 					Expect(err).To(Succeed())
 
 					By("verifying that the returned list contains the Kubernetes service")
@@ -900,7 +917,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					}
 					Expect(hasKubeService).To(BeTrue())
 				})
-				It("should be able to get objects that haven't been watched previously", func() {
+				It("should be able to get objects that haven't been watched previously", func(ctx SpecContext) {
 					By("getting the Kubernetes service")
 					svc := &unstructured.Unstructured{}
 					svc.SetGroupVersionKind(schema.GroupVersionKind{
@@ -909,14 +926,14 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Kind:    "Service",
 					})
 					svcKey := client.ObjectKey{Namespace: "default", Name: "kubernetes"}
-					Expect(informerCache.Get(context.Background(), svcKey, svc)).To(Succeed())
+					Expect(informerCache.Get(ctx, svcKey, svc)).To(Succeed())
 
 					By("verifying that the returned service looks reasonable")
 					Expect(svc.GetName()).To(Equal("kubernetes"))
 					Expect(svc.GetNamespace()).To(Equal("default"))
 				})
 
-				It("should support filtering by labels in a single namespace", func() {
+				It("should support filtering by labels in a single namespace", func(ctx SpecContext) {
 					By("listing pods with a particular label")
 					// NB: each pod has a "test-label": <pod-name>
 					out := unstructured.UnstructuredList{}
@@ -925,7 +942,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "PodList",
 					})
-					err := informerCache.List(context.Background(), &out,
+					err := informerCache.List(ctx, &out,
 						client.InNamespace(testNamespaceTwo),
 						client.MatchingLabels(map[string]string{"test-label": "test-pod-2"}))
 					Expect(err).To(Succeed())
@@ -937,10 +954,10 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					Expect(actual.GetLabels()["test-label"]).To(Equal("test-pod-2"))
 				})
 
-				It("should support filtering by labels from multiple namespaces", func() {
+				It("should support filtering by labels from multiple namespaces", func(ctx SpecContext) {
 					By("creating another pod with the same label but different namespace")
-					anotherPod := createPod("test-pod-2", testNamespaceOne, corev1.RestartPolicyAlways)
-					defer deletePod(anotherPod)
+					anotherPod := createPod(ctx, "test-pod-2", testNamespaceOne, corev1.RestartPolicyAlways)
+					defer deletePod(ctx, anotherPod)
 
 					By("listing pods with a particular label")
 					// NB: each pod has a "test-label": <pod-name>
@@ -951,7 +968,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Kind:    "PodList",
 					})
 					labels := map[string]string{"test-label": "test-pod-2"}
-					err := informerCache.List(context.Background(), &out, client.MatchingLabels(labels))
+					err := informerCache.List(ctx, &out, client.MatchingLabels(labels))
 					Expect(err).To(Succeed())
 
 					By("verifying multiple pods with the same label in different namespaces are returned")
@@ -962,7 +979,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					}
 				})
 
-				It("should be able to list objects by namespace", func() {
+				It("should be able to list objects by namespace", func(ctx SpecContext) {
 					By("listing pods in test-namespace-1")
 					listObj := &unstructured.UnstructuredList{}
 					listObj.SetGroupVersionKind(schema.GroupVersionKind{
@@ -970,7 +987,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "PodList",
 					})
-					err := informerCache.List(context.Background(), listObj, client.InNamespace(testNamespaceOne))
+					err := informerCache.List(ctx, listObj, client.InNamespace(testNamespaceOne))
 					Expect(err).To(Succeed())
 
 					By("verifying that the returned pods are in test-namespace-1")
@@ -1008,7 +1025,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 				}
 
 				for _, tc := range cacheRestrictSubTests {
-					It("should be able to restrict cache to a namespace "+tc.nameSuffix, func() {
+					It("should be able to restrict cache to a namespace "+tc.nameSuffix, func(ctx SpecContext) {
 						By("creating a namespaced cache")
 						namespacedCache, err := cache.New(cfg, tc.cacheOpts)
 						Expect(err).NotTo(HaveOccurred())
@@ -1016,9 +1033,9 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						By("running the cache and waiting for it to sync")
 						go func() {
 							defer GinkgoRecover()
-							Expect(namespacedCache.Start(informerCacheCtx)).To(Succeed())
+							Expect(namespacedCache.Start(ctx)).To(Succeed())
 						}()
-						Expect(namespacedCache.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+						Expect(namespacedCache.WaitForCacheSync(ctx)).To(BeTrue())
 
 						By("listing pods in all namespaces")
 						out := &unstructured.UnstructuredList{}
@@ -1027,13 +1044,15 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 							Version: "v1",
 							Kind:    "PodList",
 						})
-						Expect(namespacedCache.List(context.Background(), out)).To(Succeed())
-
-						By("verifying the returned pod is from the watched namespace")
-						Expect(out.Items).NotTo(BeEmpty())
-						Expect(out.Items).Should(HaveLen(2))
-						for _, item := range out.Items {
-							Expect(item.GetNamespace()).To(Equal(testNamespaceOne))
+						for range 2 {
+							Expect(namespacedCache.List(ctx, out)).To(Succeed())
+
+							By("verifying the returned pod is from the watched namespace")
+							Expect(out.Items).NotTo(BeEmpty())
+							Expect(out.Items).Should(HaveLen(2))
+							for _, item := range out.Items {
+								Expect(item.GetNamespace()).To(Equal(testNamespaceOne))
+							}
 						}
 						By("listing all nodes - should still be able to list a cluster-scoped resource")
 						nodeList := &unstructured.UnstructuredList{}
@@ -1042,7 +1061,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 							Version: "v1",
 							Kind:    "NodeList",
 						})
-						Expect(namespacedCache.List(context.Background(), nodeList)).To(Succeed())
+						Expect(namespacedCache.List(ctx, nodeList)).To(Succeed())
 
 						By("verifying the node list is not empty")
 						Expect(nodeList.Items).NotTo(BeEmpty())
@@ -1057,16 +1076,16 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 
 						By("verifying that getting the node works with an empty namespace")
 						key1 := client.ObjectKey{Namespace: "", Name: testNodeOne}
-						Expect(namespacedCache.Get(context.Background(), key1, node)).To(Succeed())
+						Expect(namespacedCache.Get(ctx, key1, node)).To(Succeed())
 
 						By("verifying that the namespace is ignored when getting a cluster-scoped resource")
 						key2 := client.ObjectKey{Namespace: "random", Name: testNodeOne}
-						Expect(namespacedCache.Get(context.Background(), key2, node)).To(Succeed())
+						Expect(namespacedCache.Get(ctx, key2, node)).To(Succeed())
 					})
 				}
 
 				if !isPodDisableDeepCopy(opts) {
-					It("should deep copy the object unless told otherwise", func() {
+					It("should deep copy the object unless told otherwise", func(ctx SpecContext) {
 						By("retrieving a specific pod from the cache")
 						out := &unstructured.Unstructured{}
 						out.SetGroupVersionKind(schema.GroupVersionKind{
@@ -1078,7 +1097,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Expect(kscheme.Scheme.Convert(knownPod2, uKnownPod2, nil)).To(Succeed())
 
 						podKey := client.ObjectKey{Name: "test-pod-2", Namespace: testNamespaceTwo}
-						Expect(informerCache.Get(context.Background(), podKey, out)).To(Succeed())
+						Expect(informerCache.Get(ctx, podKey, out)).To(Succeed())
 
 						By("verifying the retrieved pod is equal to a known pod")
 						Expect(out).To(Equal(uKnownPod2))
@@ -1091,15 +1110,15 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Expect(out).NotTo(Equal(knownPod2))
 					})
 				} else {
-					It("should not deep copy the object if UnsafeDisableDeepCopy is enabled", func() {
+					It("should not deep copy the object if UnsafeDisableDeepCopy is enabled", func(ctx SpecContext) {
 						By("getting a specific pod from the cache twice")
 						podKey := client.ObjectKey{Name: "test-pod-2", Namespace: testNamespaceTwo}
 						out1 := &unstructured.Unstructured{}
 						out1.SetGroupVersionKind(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"})
-						Expect(informerCache.Get(context.Background(), podKey, out1)).To(Succeed())
+						Expect(informerCache.Get(ctx, podKey, out1)).To(Succeed())
 						out2 := &unstructured.Unstructured{}
 						out2.SetGroupVersionKind(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"})
-						Expect(informerCache.Get(context.Background(), podKey, out2)).To(Succeed())
+						Expect(informerCache.Get(ctx, podKey, out2)).To(Succeed())
 
 						By("verifying the pointer fields in pod have the same addresses")
 						Expect(out1).To(Equal(out2))
@@ -1108,10 +1127,10 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						By("listing pods from the cache twice")
 						outList1 := &unstructured.UnstructuredList{}
 						outList1.SetGroupVersionKind(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "PodList"})
-						Expect(informerCache.List(context.Background(), outList1, client.InNamespace(testNamespaceOne))).To(Succeed())
+						Expect(informerCache.List(ctx, outList1, client.InNamespace(testNamespaceOne))).To(Succeed())
 						outList2 := &unstructured.UnstructuredList{}
 						outList2.SetGroupVersionKind(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "PodList"})
-						Expect(informerCache.List(context.Background(), outList2, client.InNamespace(testNamespaceOne))).To(Succeed())
+						Expect(informerCache.List(ctx, outList2, client.InNamespace(testNamespaceOne))).To(Succeed())
 
 						By("verifying the pointer fields in pod have the same addresses")
 						Expect(outList1.Items).To(HaveLen(len(outList2.Items)))
@@ -1126,7 +1145,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					})
 				}
 
-				It("should return an error if the object is not found", func() {
+				It("should return an error if the object is not found", func(ctx SpecContext) {
 					By("getting a service that does not exists")
 					svc := &unstructured.Unstructured{}
 					svc.SetGroupVersionKind(schema.GroupVersionKind{
@@ -1137,20 +1156,20 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					svcKey := client.ObjectKey{Namespace: testNamespaceOne, Name: "unknown"}
 
 					By("verifying that an error is returned")
-					err := informerCache.Get(context.Background(), svcKey, svc)
+					err := informerCache.Get(ctx, svcKey, svc)
 					Expect(err).To(HaveOccurred())
 					Expect(apierrors.IsNotFound(err)).To(BeTrue())
 				})
-				It("should return an error if getting object in unwatched namespace", func() {
+				It("should return an error if getting object in unwatched namespace", func(ctx SpecContext) {
 					By("getting a service that does not exists")
 					svc := &corev1.Service{}
 					svcKey := client.ObjectKey{Namespace: "unknown", Name: "unknown"}
 
 					By("verifying that an error is returned")
-					err := informerCache.Get(context.Background(), svcKey, svc)
+					err := informerCache.Get(ctx, svcKey, svc)
 					Expect(err).To(HaveOccurred())
 				})
-				It("test multinamespaced cache for cluster scoped resources", func() {
+				It("test multinamespaced cache for cluster scoped resources", func(ctx SpecContext) {
 					By("creating a multinamespaced cache to watch specific namespaces")
 					m, err := cache.New(cfg, cache.Options{
 						DefaultNamespaces: map[string]cache.Config{
@@ -1163,16 +1182,16 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					By("running the cache and waiting it for sync")
 					go func() {
 						defer GinkgoRecover()
-						Expect(m.Start(informerCacheCtx)).To(Succeed())
+						Expect(m.Start(ctx)).To(Succeed())
 					}()
-					Expect(m.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+					Expect(m.WaitForCacheSync(ctx)).To(BeTrue())
 
 					By("should be able to fetch cluster scoped resource")
 					node := &corev1.Node{}
 
 					By("verifying that getting the node works with an empty namespace")
 					key1 := client.ObjectKey{Namespace: "", Name: testNodeOne}
-					Expect(m.Get(context.Background(), key1, node)).To(Succeed())
+					Expect(m.Get(ctx, key1, node)).To(Succeed())
 
 					By("verifying if the cluster scoped resources are not duplicated")
 					nodeList := &unstructured.UnstructuredList{}
@@ -1181,22 +1200,41 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "NodeList",
 					})
-					Expect(m.List(context.Background(), nodeList)).To(Succeed())
+					Expect(m.List(ctx, nodeList)).To(Succeed())
 
 					By("verifying the node list is not empty")
 					Expect(nodeList.Items).NotTo(BeEmpty())
 					Expect(len(nodeList.Items)).To(BeEquivalentTo(2))
 				})
-				It("should return an error if the continue list options is set", func() {
+
+				It("should return an error if pagination is used", func(ctx SpecContext) {
+					nodeList := &unstructured.UnstructuredList{}
+					nodeList.SetGroupVersionKind(schema.GroupVersionKind{
+						Group:   "",
+						Version: "v1",
+						Kind:    "NodeList",
+					})
+					By("verifying that the first list works and returns a sentinel continue")
+					err := informerCache.List(ctx, nodeList)
+					Expect(err).ToNot(HaveOccurred())
+					Expect(nodeList.GetContinue()).To(Equal("continue-not-supported"))
+
+					By("verifying that an error is returned")
+					err = informerCache.List(ctx, nodeList, client.Continue(nodeList.GetContinue()))
+					Expect(err).To(HaveOccurred())
+					Expect(err.Error()).To(Equal("continue list option is not supported by the cache"))
+				})
+
+				It("should return an error if the continue list options is set", func(ctx SpecContext) {
 					podList := &unstructured.Unstructured{}
 					continueOpt := client.Continue("token")
 					By("verifying that an error is returned")
-					err := informerCache.List(context.Background(), podList, continueOpt)
+					err := informerCache.List(ctx, podList, continueOpt)
 					Expect(err).To(HaveOccurred())
 				})
 			})
 			Context("with metadata-only objects", func() {
-				It("should be able to list objects that haven't been watched previously", func() {
+				It("should be able to list objects that haven't been watched previously", func(ctx SpecContext) {
 					By("listing all services in the cluster")
 					listObj := &metav1.PartialObjectMetadataList{}
 					listObj.SetGroupVersionKind(schema.GroupVersionKind{
@@ -1204,7 +1242,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "ServiceList",
 					})
-					err := informerCache.List(context.Background(), listObj)
+					err := informerCache.List(ctx, listObj)
 					Expect(err).To(Succeed())
 
 					By("verifying that the returned list contains the Kubernetes service")
@@ -1220,7 +1258,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					}
 					Expect(hasKubeService).To(BeTrue())
 				})
-				It("should be able to get objects that haven't been watched previously", func() {
+				It("should be able to get objects that haven't been watched previously", func(ctx SpecContext) {
 					By("getting the Kubernetes service")
 					svc := &metav1.PartialObjectMetadata{}
 					svc.SetGroupVersionKind(schema.GroupVersionKind{
@@ -1229,14 +1267,14 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Kind:    "Service",
 					})
 					svcKey := client.ObjectKey{Namespace: "default", Name: "kubernetes"}
-					Expect(informerCache.Get(context.Background(), svcKey, svc)).To(Succeed())
+					Expect(informerCache.Get(ctx, svcKey, svc)).To(Succeed())
 
 					By("verifying that the returned service looks reasonable")
 					Expect(svc.GetName()).To(Equal("kubernetes"))
 					Expect(svc.GetNamespace()).To(Equal("default"))
 				})
 
-				It("should support filtering by labels in a single namespace", func() {
+				It("should support filtering by labels in a single namespace", func(ctx SpecContext) {
 					By("listing pods with a particular label")
 					// NB: each pod has a "test-label": <pod-name>
 					out := metav1.PartialObjectMetadataList{}
@@ -1245,7 +1283,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "PodList",
 					})
-					err := informerCache.List(context.Background(), &out,
+					err := informerCache.List(ctx, &out,
 						client.InNamespace(testNamespaceTwo),
 						client.MatchingLabels(map[string]string{"test-label": "test-pod-2"}))
 					Expect(err).To(Succeed())
@@ -1257,10 +1295,10 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					Expect(actual.GetLabels()["test-label"]).To(Equal("test-pod-2"))
 				})
 
-				It("should support filtering by labels from multiple namespaces", func() {
+				It("should support filtering by labels from multiple namespaces", func(ctx SpecContext) {
 					By("creating another pod with the same label but different namespace")
-					anotherPod := createPod("test-pod-2", testNamespaceOne, corev1.RestartPolicyAlways)
-					defer deletePod(anotherPod)
+					anotherPod := createPod(ctx, "test-pod-2", testNamespaceOne, corev1.RestartPolicyAlways)
+					defer deletePod(ctx, anotherPod)
 
 					By("listing pods with a particular label")
 					// NB: each pod has a "test-label": <pod-name>
@@ -1271,7 +1309,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Kind:    "PodList",
 					})
 					labels := map[string]string{"test-label": "test-pod-2"}
-					err := informerCache.List(context.Background(), &out, client.MatchingLabels(labels))
+					err := informerCache.List(ctx, &out, client.MatchingLabels(labels))
 					Expect(err).To(Succeed())
 
 					By("verifying multiple pods with the same label in different namespaces are returned")
@@ -1282,7 +1320,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					}
 				})
 
-				It("should be able to list objects by namespace", func() {
+				It("should be able to list objects by namespace", func(ctx SpecContext) {
 					By("listing pods in test-namespace-1")
 					listObj := &metav1.PartialObjectMetadataList{}
 					listObj.SetGroupVersionKind(schema.GroupVersionKind{
@@ -1290,7 +1328,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "PodList",
 					})
-					err := informerCache.List(context.Background(), listObj, client.InNamespace(testNamespaceOne))
+					err := informerCache.List(ctx, listObj, client.InNamespace(testNamespaceOne))
 					Expect(err).To(Succeed())
 
 					By("verifying that the returned pods are in test-namespace-1")
@@ -1301,7 +1339,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					}
 				})
 
-				It("should be able to restrict cache to a namespace", func() {
+				It("should be able to restrict cache to a namespace", func(ctx SpecContext) {
 					By("creating a namespaced cache")
 					namespacedCache, err := cache.New(cfg, cache.Options{DefaultNamespaces: map[string]cache.Config{testNamespaceOne: {}}})
 					Expect(err).NotTo(HaveOccurred())
@@ -1309,9 +1347,9 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					By("running the cache and waiting for it to sync")
 					go func() {
 						defer GinkgoRecover()
-						Expect(namespacedCache.Start(informerCacheCtx)).To(Succeed())
+						Expect(namespacedCache.Start(ctx)).To(Succeed())
 					}()
-					Expect(namespacedCache.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+					Expect(namespacedCache.WaitForCacheSync(ctx)).To(BeTrue())
 
 					By("listing pods in all namespaces")
 					out := &metav1.PartialObjectMetadataList{}
@@ -1320,7 +1358,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "PodList",
 					})
-					Expect(namespacedCache.List(context.Background(), out)).To(Succeed())
+					Expect(namespacedCache.List(ctx, out)).To(Succeed())
 
 					By("verifying the returned pod is from the watched namespace")
 					Expect(out.Items).NotTo(BeEmpty())
@@ -1335,7 +1373,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "NodeList",
 					})
-					Expect(namespacedCache.List(context.Background(), nodeList)).To(Succeed())
+					Expect(namespacedCache.List(ctx, nodeList)).To(Succeed())
 
 					By("verifying the node list is not empty")
 					Expect(nodeList.Items).NotTo(BeEmpty())
@@ -1350,14 +1388,14 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 
 					By("verifying that getting the node works with an empty namespace")
 					key1 := client.ObjectKey{Namespace: "", Name: testNodeOne}
-					Expect(namespacedCache.Get(context.Background(), key1, node)).To(Succeed())
+					Expect(namespacedCache.Get(ctx, key1, node)).To(Succeed())
 
 					By("verifying that the namespace is ignored when getting a cluster-scoped resource")
 					key2 := client.ObjectKey{Namespace: "random", Name: testNodeOne}
-					Expect(namespacedCache.Get(context.Background(), key2, node)).To(Succeed())
+					Expect(namespacedCache.Get(ctx, key2, node)).To(Succeed())
 				})
 
-				It("should be able to restrict cache to a namespace for namespaced object and to given selectors for non namespaced object", func() {
+				It("should be able to restrict cache to a namespace for namespaced object and to given selectors for non namespaced object", func(ctx SpecContext) {
 					By("creating a namespaced cache")
 					namespacedCache, err := cache.New(cfg, cache.Options{
 						DefaultNamespaces: map[string]cache.Config{testNamespaceOne: {}},
@@ -1372,9 +1410,9 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					By("running the cache and waiting for it to sync")
 					go func() {
 						defer GinkgoRecover()
-						Expect(namespacedCache.Start(informerCacheCtx)).To(Succeed())
+						Expect(namespacedCache.Start(ctx)).To(Succeed())
 					}()
-					Expect(namespacedCache.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+					Expect(namespacedCache.WaitForCacheSync(ctx)).To(BeTrue())
 
 					By("listing pods in all namespaces")
 					out := &metav1.PartialObjectMetadataList{}
@@ -1383,7 +1421,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "PodList",
 					})
-					Expect(namespacedCache.List(context.Background(), out)).To(Succeed())
+					Expect(namespacedCache.List(ctx, out)).To(Succeed())
 
 					By("verifying the returned pod is from the watched namespace")
 					Expect(out.Items).NotTo(BeEmpty())
@@ -1398,7 +1436,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "NodeList",
 					})
-					Expect(namespacedCache.List(context.Background(), nodeList)).To(Succeed())
+					Expect(namespacedCache.List(ctx, nodeList)).To(Succeed())
 
 					By("verifying the node list is not empty")
 					Expect(nodeList.Items).NotTo(BeEmpty())
@@ -1413,21 +1451,21 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 
 					By("verifying that getting the node works with an empty namespace")
 					key1 := client.ObjectKey{Namespace: "", Name: testNodeTwo}
-					Expect(namespacedCache.Get(context.Background(), key1, node)).To(Succeed())
+					Expect(namespacedCache.Get(ctx, key1, node)).To(Succeed())
 
 					By("verifying that the namespace is ignored when getting a cluster-scoped resource")
 					key2 := client.ObjectKey{Namespace: "random", Name: testNodeTwo}
-					Expect(namespacedCache.Get(context.Background(), key2, node)).To(Succeed())
+					Expect(namespacedCache.Get(ctx, key2, node)).To(Succeed())
 
 					By("verifying that an error is returned for node with not matching label")
 					key3 := client.ObjectKey{Namespace: "", Name: testNodeOne}
-					err = namespacedCache.Get(context.Background(), key3, node)
+					err = namespacedCache.Get(ctx, key3, node)
 					Expect(err).To(HaveOccurred())
 					Expect(apierrors.IsNotFound(err)).To(BeTrue())
 				})
 
 				if !isPodDisableDeepCopy(opts) {
-					It("should deep copy the object unless told otherwise", func() {
+					It("should deep copy the object unless told otherwise", func(ctx SpecContext) {
 						By("retrieving a specific pod from the cache")
 						out := &metav1.PartialObjectMetadata{}
 						out.SetGroupVersionKind(schema.GroupVersionKind{
@@ -1444,7 +1482,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						})
 
 						podKey := client.ObjectKey{Name: "test-pod-2", Namespace: testNamespaceTwo}
-						Expect(informerCache.Get(context.Background(), podKey, out)).To(Succeed())
+						Expect(informerCache.Get(ctx, podKey, out)).To(Succeed())
 
 						By("verifying the retrieved pod is equal to a known pod")
 						Expect(out).To(Equal(uKnownPod2))
@@ -1456,15 +1494,15 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Expect(out).NotTo(Equal(knownPod2))
 					})
 				} else {
-					It("should not deep copy the object if UnsafeDisableDeepCopy is enabled", func() {
+					It("should not deep copy the object if UnsafeDisableDeepCopy is enabled", func(ctx SpecContext) {
 						By("getting a specific pod from the cache twice")
 						podKey := client.ObjectKey{Name: "test-pod-2", Namespace: testNamespaceTwo}
 						out1 := &metav1.PartialObjectMetadata{}
 						out1.SetGroupVersionKind(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"})
-						Expect(informerCache.Get(context.Background(), podKey, out1)).To(Succeed())
+						Expect(informerCache.Get(ctx, podKey, out1)).To(Succeed())
 						out2 := &metav1.PartialObjectMetadata{}
 						out2.SetGroupVersionKind(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"})
-						Expect(informerCache.Get(context.Background(), podKey, out2)).To(Succeed())
+						Expect(informerCache.Get(ctx, podKey, out2)).To(Succeed())
 
 						By("verifying the pods have the same pointer addresses")
 						By("verifying the pointer fields in pod have the same addresses")
@@ -1474,10 +1512,10 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						By("listing pods from the cache twice")
 						outList1 := &metav1.PartialObjectMetadataList{}
 						outList1.SetGroupVersionKind(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "PodList"})
-						Expect(informerCache.List(context.Background(), outList1, client.InNamespace(testNamespaceOne))).To(Succeed())
+						Expect(informerCache.List(ctx, outList1, client.InNamespace(testNamespaceOne))).To(Succeed())
 						outList2 := &metav1.PartialObjectMetadataList{}
 						outList2.SetGroupVersionKind(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "PodList"})
-						Expect(informerCache.List(context.Background(), outList2, client.InNamespace(testNamespaceOne))).To(Succeed())
+						Expect(informerCache.List(ctx, outList2, client.InNamespace(testNamespaceOne))).To(Succeed())
 
 						By("verifying the pointer fields in pod have the same addresses")
 						Expect(outList1.Items).To(HaveLen(len(outList2.Items)))
@@ -1492,7 +1530,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					})
 				}
 
-				It("should return an error if the object is not found", func() {
+				It("should return an error if the object is not found", func(ctx SpecContext) {
 					By("getting a service that does not exists")
 					svc := &metav1.PartialObjectMetadata{}
 					svc.SetGroupVersionKind(schema.GroupVersionKind{
@@ -1503,25 +1541,43 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					svcKey := client.ObjectKey{Namespace: testNamespaceOne, Name: "unknown"}
 
 					By("verifying that an error is returned")
-					err := informerCache.Get(context.Background(), svcKey, svc)
+					err := informerCache.Get(ctx, svcKey, svc)
 					Expect(err).To(HaveOccurred())
 					Expect(apierrors.IsNotFound(err)).To(BeTrue())
 				})
-				It("should return an error if getting object in unwatched namespace", func() {
+				It("should return an error if getting object in unwatched namespace", func(ctx SpecContext) {
 					By("getting a service that does not exists")
 					svc := &corev1.Service{}
 					svcKey := client.ObjectKey{Namespace: "unknown", Name: "unknown"}
 
 					By("verifying that an error is returned")
-					err := informerCache.Get(context.Background(), svcKey, svc)
+					err := informerCache.Get(ctx, svcKey, svc)
 					Expect(err).To(HaveOccurred())
 				})
+
+				It("should return an error if pagination is used", func(ctx SpecContext) {
+					nodeList := &metav1.PartialObjectMetadataList{}
+					nodeList.SetGroupVersionKind(schema.GroupVersionKind{
+						Group:   "",
+						Version: "v1",
+						Kind:    "NodeList",
+					})
+					By("verifying that the first list works and returns a sentinel continue")
+					err := informerCache.List(ctx, nodeList)
+					Expect(err).ToNot(HaveOccurred())
+					Expect(nodeList.GetContinue()).To(Equal("continue-not-supported"))
+
+					By("verifying that an error is returned")
+					err = informerCache.List(ctx, nodeList, client.Continue(nodeList.GetContinue()))
+					Expect(err).To(HaveOccurred())
+					Expect(err.Error()).To(Equal("continue list option is not supported by the cache"))
+				})
 			})
 			type selectorsTestCase struct {
 				options      cache.Options
 				expectedPods []string
 			}
-			DescribeTable(" and cache with selectors", func(tc selectorsTestCase) {
+			DescribeTable(" and cache with selectors", func(ctx SpecContext, tc selectorsTestCase) {
 				By("creating the cache")
 				informer, err := cache.New(cfg, tc.options)
 				Expect(err).NotTo(HaveOccurred())
@@ -1529,13 +1585,13 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 				By("running the cache and waiting for it to sync")
 				go func() {
 					defer GinkgoRecover()
-					Expect(informer.Start(informerCacheCtx)).To(Succeed())
+					Expect(informer.Start(ctx)).To(Succeed())
 				}()
-				Expect(informer.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+				Expect(informer.WaitForCacheSync(ctx)).To(BeTrue())
 
 				By("Checking with structured")
 				obtainedStructuredPodList := corev1.PodList{}
-				Expect(informer.List(context.Background(), &obtainedStructuredPodList)).To(Succeed())
+				Expect(informer.List(ctx, &obtainedStructuredPodList)).To(Succeed())
 				Expect(obtainedStructuredPodList.Items).Should(WithTransform(func(pods []corev1.Pod) []string {
 					obtainedPodNames := []string{}
 					for _, pod := range pods {
@@ -1544,7 +1600,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					return obtainedPodNames
 				}, ConsistOf(tc.expectedPods)))
 				for _, pod := range obtainedStructuredPodList.Items {
-					Expect(informer.Get(context.Background(), client.ObjectKeyFromObject(&pod), &pod)).To(Succeed()) //nolint:gosec // We don't retain the pointer
+					Expect(informer.Get(ctx, client.ObjectKeyFromObject(&pod), &pod)).To(Succeed())
 				}
 
 				By("Checking with unstructured")
@@ -1554,7 +1610,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					Version: "v1",
 					Kind:    "PodList",
 				})
-				err = informer.List(context.Background(), &obtainedUnstructuredPodList)
+				err = informer.List(ctx, &obtainedUnstructuredPodList)
 				Expect(err).To(Succeed())
 				Expect(obtainedUnstructuredPodList.Items).Should(WithTransform(func(pods []unstructured.Unstructured) []string {
 					obtainedPodNames := []string{}
@@ -1564,7 +1620,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					return obtainedPodNames
 				}, ConsistOf(tc.expectedPods)))
 				for _, pod := range obtainedUnstructuredPodList.Items {
-					Expect(informer.Get(context.Background(), client.ObjectKeyFromObject(&pod), &pod)).To(Succeed()) //nolint:gosec // We don't retain the pointer
+					Expect(informer.Get(ctx, client.ObjectKeyFromObject(&pod), &pod)).To(Succeed())
 				}
 
 				By("Checking with metadata")
@@ -1574,7 +1630,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					Version: "v1",
 					Kind:    "PodList",
 				})
-				err = informer.List(context.Background(), &obtainedMetadataPodList)
+				err = informer.List(ctx, &obtainedMetadataPodList)
 				Expect(err).To(Succeed())
 				Expect(obtainedMetadataPodList.Items).Should(WithTransform(func(pods []metav1.PartialObjectMetadata) []string {
 					obtainedPodNames := []string{}
@@ -1584,7 +1640,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					return obtainedPodNames
 				}, ConsistOf(tc.expectedPods)))
 				for _, pod := range obtainedMetadataPodList.Items {
-					Expect(informer.Get(context.Background(), client.ObjectKeyFromObject(&pod), &pod)).To(Succeed()) //nolint:gosec // We don't retain the pointer
+					Expect(informer.Get(ctx, client.ObjectKeyFromObject(&pod), &pod)).To(Succeed())
 				}
 			},
 				Entry("when selectors are empty it has to inform about all the pods", selectorsTestCase{
@@ -1869,14 +1925,14 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 			)
 		})
 		Describe("as an Informer", func() {
-			It("should error when starting the cache a second time", func() {
-				err := informerCache.Start(context.Background())
+			It("should error when starting the cache a second time", func(ctx SpecContext) {
+				err := informerCache.Start(ctx)
 				Expect(err).To(HaveOccurred())
-				Expect(err.Error()).To(ContainSubstring("Informer already started"))
+				Expect(err.Error()).To(ContainSubstring("informer already started"))
 			})
 
 			Context("with structured objects", func() {
-				It("should be able to get informer for the object", func() {
+				It("should be able to get informer for the object", func(ctx SpecContext) {
 					By("getting a shared index informer for a pod")
 					pod := &corev1.Pod{
 						ObjectMeta: metav1.ObjectMeta{
@@ -1892,7 +1948,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 							},
 						},
 					}
-					sii, err := informerCache.GetInformer(context.TODO(), pod)
+					sii, err := informerCache.GetInformer(ctx, pod)
 					Expect(err).NotTo(HaveOccurred())
 					Expect(sii).NotTo(BeNil())
 					Expect(sii.HasSynced()).To(BeTrue())
@@ -1907,13 +1963,13 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					By("adding an object")
 					cl, err := client.New(cfg, client.Options{})
 					Expect(err).NotTo(HaveOccurred())
-					Expect(cl.Create(context.Background(), pod)).To(Succeed())
-					defer deletePod(pod)
+					Expect(cl.Create(ctx, pod)).To(Succeed())
+					defer deletePod(ctx, pod)
 
 					By("verifying the object is received on the channel")
 					Eventually(out).Should(Receive(Equal(pod)))
 				})
-				It("should be able to stop and restart informers", func() {
+				It("should be able to stop and restart informers", func(ctx SpecContext) {
 					By("getting a shared index informer for a pod")
 					pod := &corev1.Pod{
 						ObjectMeta: metav1.ObjectMeta{
@@ -1929,18 +1985,18 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 							},
 						},
 					}
-					sii, err := informerCache.GetInformer(context.TODO(), pod)
+					sii, err := informerCache.GetInformer(ctx, pod)
 					Expect(err).NotTo(HaveOccurred())
 					Expect(sii).NotTo(BeNil())
 					Expect(sii.HasSynced()).To(BeTrue())
 
 					By("removing the existing informer")
-					Expect(informerCache.RemoveInformer(context.TODO(), pod)).To(Succeed())
+					Expect(informerCache.RemoveInformer(ctx, pod)).To(Succeed())
 					Eventually(sii.IsStopped).WithTimeout(5 * time.Second).Should(BeTrue())
 
 					By("recreating the informer")
 
-					sii2, err := informerCache.GetInformer(context.TODO(), pod)
+					sii2, err := informerCache.GetInformer(ctx, pod)
 					Expect(err).NotTo(HaveOccurred())
 					Expect(sii2).NotTo(BeNil())
 					Expect(sii2.HasSynced()).To(BeTrue())
@@ -1949,10 +2005,10 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					Expect(sii.IsStopped()).To(BeTrue())
 					Expect(sii2.IsStopped()).To(BeFalse())
 				})
-				It("should be able to get an informer by group/version/kind", func() {
+				It("should be able to get an informer by group/version/kind", func(ctx SpecContext) {
 					By("getting an shared index informer for gvk = core/v1/pod")
 					gvk := schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"}
-					sii, err := informerCache.GetInformerForKind(context.TODO(), gvk)
+					sii, err := informerCache.GetInformerForKind(ctx, gvk)
 					Expect(err).NotTo(HaveOccurred())
 					Expect(sii).NotTo(BeNil())
 					Expect(sii.HasSynced()).To(BeTrue())
@@ -1981,13 +2037,13 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 							},
 						},
 					}
-					Expect(cl.Create(context.Background(), pod)).To(Succeed())
-					defer deletePod(pod)
+					Expect(cl.Create(ctx, pod)).To(Succeed())
+					defer deletePod(ctx, pod)
 
 					By("verifying the object is received on the channel")
 					Eventually(out).Should(Receive(Equal(pod)))
 				})
-				It("should be able to index an object field then retrieve objects by that field", func() {
+				It("should be able to index an object field then retrieve objects by that field", func(ctx SpecContext) {
 					By("creating the cache")
 					informer, err := cache.New(cfg, cache.Options{})
 					Expect(err).NotTo(HaveOccurred())
@@ -1997,18 +2053,18 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					indexFunc := func(obj client.Object) []string {
 						return []string{string(obj.(*corev1.Pod).Spec.RestartPolicy)}
 					}
-					Expect(informer.IndexField(context.TODO(), pod, "spec.restartPolicy", indexFunc)).To(Succeed())
+					Expect(informer.IndexField(ctx, pod, "spec.restartPolicy", indexFunc)).To(Succeed())
 
 					By("running the cache and waiting for it to sync")
 					go func() {
 						defer GinkgoRecover()
-						Expect(informer.Start(informerCacheCtx)).To(Succeed())
+						Expect(informer.Start(ctx)).To(Succeed())
 					}()
-					Expect(informer.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+					Expect(informer.WaitForCacheSync(ctx)).To(BeTrue())
 
 					By("listing Pods with restartPolicyOnFailure")
 					listObj := &corev1.PodList{}
-					Expect(informer.List(context.Background(), listObj,
+					Expect(informer.List(ctx, listObj,
 						client.MatchingFields{"spec.restartPolicy": "OnFailure"})).To(Succeed())
 					By("verifying that the returned pods have correct restart policy")
 					Expect(listObj.Items).NotTo(BeEmpty())
@@ -2017,9 +2073,10 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					Expect(actual.Name).To(Equal("test-pod-3"))
 				})
 
-				It("should allow for get informer to be cancelled", func() {
+				It("should allow for get informer to be cancelled", func(specCtx SpecContext) {
 					By("creating a context and cancelling it")
-					informerCacheCancel()
+					ctx, cancel := context.WithCancel(specCtx)
+					cancel()
 
 					By("getting a shared index informer for a pod with a cancelled context")
 					pod := &corev1.Pod{
@@ -2036,25 +2093,26 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 							},
 						},
 					}
-					sii, err := informerCache.GetInformer(informerCacheCtx, pod)
+					sii, err := informerCache.GetInformer(ctx, pod)
 					Expect(err).To(HaveOccurred())
 					Expect(sii).To(BeNil())
 					Expect(apierrors.IsTimeout(err)).To(BeTrue())
 				})
 
-				It("should allow getting an informer by group/version/kind to be cancelled", func() {
+				It("should allow getting an informer by group/version/kind to be cancelled", func(specCtx SpecContext) {
 					By("creating a context and cancelling it")
-					informerCacheCancel()
+					ctx, cancel := context.WithCancel(specCtx)
+					cancel()
 
 					By("getting an shared index informer for gvk = core/v1/pod with a cancelled context")
 					gvk := schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"}
-					sii, err := informerCache.GetInformerForKind(informerCacheCtx, gvk)
+					sii, err := informerCache.GetInformerForKind(ctx, gvk)
 					Expect(err).To(HaveOccurred())
 					Expect(sii).To(BeNil())
 					Expect(apierrors.IsTimeout(err)).To(BeTrue())
 				})
 
-				It("should be able not to change indexer values after indexing cluster-scope objects", func() {
+				It("should be able not to change indexer values after indexing cluster-scope objects", func(ctx SpecContext) {
 					By("creating the cache")
 					informer, err := cache.New(cfg, cache.Options{})
 					Expect(err).NotTo(HaveOccurred())
@@ -2066,18 +2124,18 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					indexFunc := func(obj client.Object) []string {
 						return indexerValues
 					}
-					Expect(informer.IndexField(context.TODO(), ns, fieldName, indexFunc)).To(Succeed())
+					Expect(informer.IndexField(ctx, ns, fieldName, indexFunc)).To(Succeed())
 
 					By("running the cache and waiting for it to sync")
 					go func() {
 						defer GinkgoRecover()
-						Expect(informer.Start(informerCacheCtx)).To(Succeed())
+						Expect(informer.Start(ctx)).To(Succeed())
 					}()
-					Expect(informer.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+					Expect(informer.WaitForCacheSync(ctx)).To(BeTrue())
 
 					By("listing Namespaces with fixed indexer")
 					listObj := &corev1.NamespaceList{}
-					Expect(informer.List(context.Background(), listObj,
+					Expect(informer.List(ctx, listObj,
 						client.MatchingFields{fieldName: "a"})).To(Succeed())
 					Expect(listObj.Items).NotTo(BeZero())
 
@@ -2088,7 +2146,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					Expect(indexerValues[2]).To(Equal("c"))
 				})
 
-				It("should be able to matching fields with multiple indexes", func() {
+				It("should be able to matching fields with multiple indexes", func(ctx SpecContext) {
 					By("creating the cache")
 					informer, err := cache.New(cfg, cache.Options{})
 					Expect(err).NotTo(HaveOccurred())
@@ -2099,42 +2157,42 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					indexFunc1 := func(obj client.Object) []string {
 						return []string{obj.(*corev1.Pod).Labels["common-label"]}
 					}
-					Expect(informer.IndexField(context.TODO(), pod, fieldName1, indexFunc1)).To(Succeed())
+					Expect(informer.IndexField(ctx, pod, fieldName1, indexFunc1)).To(Succeed())
 					By("indexing pods with restart policy before starting")
 					fieldName2 := "indexByPolicy"
 					indexFunc2 := func(obj client.Object) []string {
 						return []string{string(obj.(*corev1.Pod).Spec.RestartPolicy)}
 					}
-					Expect(informer.IndexField(context.TODO(), pod, fieldName2, indexFunc2)).To(Succeed())
+					Expect(informer.IndexField(ctx, pod, fieldName2, indexFunc2)).To(Succeed())
 
 					By("running the cache and waiting for it to sync")
 					go func() {
 						defer GinkgoRecover()
-						Expect(informer.Start(informerCacheCtx)).To(Succeed())
+						Expect(informer.Start(ctx)).To(Succeed())
 					}()
-					Expect(informer.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+					Expect(informer.WaitForCacheSync(ctx)).To(BeTrue())
 
 					By("listing pods with label index")
 					listObj := &corev1.PodList{}
-					Expect(informer.List(context.Background(), listObj,
+					Expect(informer.List(ctx, listObj,
 						client.MatchingFields{fieldName1: "common"})).To(Succeed())
 					Expect(listObj.Items).To(HaveLen(2))
 
 					By("listing pods with restart policy index")
 					listObj = &corev1.PodList{}
-					Expect(informer.List(context.Background(), listObj,
+					Expect(informer.List(ctx, listObj,
 						client.MatchingFields{fieldName2: string(corev1.RestartPolicyNever)})).To(Succeed())
 					Expect(listObj.Items).To(HaveLen(3))
 
 					By("listing pods with both fixed indexers 1 and 2")
 					listObj = &corev1.PodList{}
-					Expect(informer.List(context.Background(), listObj,
+					Expect(informer.List(ctx, listObj,
 						client.MatchingFields{fieldName1: "common", fieldName2: string(corev1.RestartPolicyNever)})).To(Succeed())
 					Expect(listObj.Items).To(HaveLen(1))
 				})
 			})
 			Context("with unstructured objects", func() {
-				It("should be able to get informer for the object", func() {
+				It("should be able to get informer for the object", func(ctx SpecContext) {
 					By("getting a shared index informer for a pod")
 
 					pod := &unstructured.Unstructured{
@@ -2156,7 +2214,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "Pod",
 					})
-					sii, err := informerCache.GetInformer(context.TODO(), pod)
+					sii, err := informerCache.GetInformer(ctx, pod)
 					Expect(err).NotTo(HaveOccurred())
 					Expect(sii).NotTo(BeNil())
 					Expect(sii.HasSynced()).To(BeTrue())
@@ -2171,14 +2229,14 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					By("adding an object")
 					cl, err := client.New(cfg, client.Options{})
 					Expect(err).NotTo(HaveOccurred())
-					Expect(cl.Create(context.Background(), pod)).To(Succeed())
-					defer deletePod(pod)
+					Expect(cl.Create(ctx, pod)).To(Succeed())
+					defer deletePod(ctx, pod)
 
 					By("verifying the object is received on the channel")
 					Eventually(out).Should(Receive(Equal(pod)))
 				})
 
-				It("should be able to stop and restart informers", func() {
+				It("should be able to stop and restart informers", func(ctx SpecContext) {
 					By("getting a shared index informer for a pod")
 					pod := &unstructured.Unstructured{
 						Object: map[string]interface{}{
@@ -2199,18 +2257,17 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "Pod",
 					})
-					sii, err := informerCache.GetInformer(context.TODO(), pod)
+					sii, err := informerCache.GetInformer(ctx, pod)
 					Expect(err).NotTo(HaveOccurred())
 					Expect(sii).NotTo(BeNil())
 					Expect(sii.HasSynced()).To(BeTrue())
 
 					By("removing the existing informer")
-					Expect(informerCache.RemoveInformer(context.TODO(), pod)).To(Succeed())
+					Expect(informerCache.RemoveInformer(ctx, pod)).To(Succeed())
 					Eventually(sii.IsStopped).WithTimeout(5 * time.Second).Should(BeTrue())
 
 					By("recreating the informer")
-
-					sii2, err := informerCache.GetInformer(context.TODO(), pod)
+					sii2, err := informerCache.GetInformer(ctx, pod)
 					Expect(err).NotTo(HaveOccurred())
 					Expect(sii2).NotTo(BeNil())
 					Expect(sii2.HasSynced()).To(BeTrue())
@@ -2220,7 +2277,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					Expect(sii2.IsStopped()).To(BeFalse())
 				})
 
-				It("should be able to index an object field then retrieve objects by that field", func() {
+				It("should be able to index an object field then retrieve objects by that field", func(ctx SpecContext) {
 					By("creating the cache")
 					informer, err := cache.New(cfg, cache.Options{})
 					Expect(err).NotTo(HaveOccurred())
@@ -2243,14 +2300,14 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						}
 						return []string{fmt.Sprintf("%v", m["restartPolicy"])}
 					}
-					Expect(informer.IndexField(context.TODO(), pod, "spec.restartPolicy", indexFunc)).To(Succeed())
+					Expect(informer.IndexField(ctx, pod, "spec.restartPolicy", indexFunc)).To(Succeed())
 
 					By("running the cache and waiting for it to sync")
 					go func() {
 						defer GinkgoRecover()
-						Expect(informer.Start(informerCacheCtx)).To(Succeed())
+						Expect(informer.Start(ctx)).To(Succeed())
 					}()
-					Expect(informer.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+					Expect(informer.WaitForCacheSync(ctx)).To(BeTrue())
 
 					By("listing Pods with restartPolicyOnFailure")
 					listObj := &unstructured.UnstructuredList{}
@@ -2259,7 +2316,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "PodList",
 					})
-					err = informer.List(context.Background(), listObj,
+					err = informer.List(ctx, listObj,
 						client.MatchingFields{"spec.restartPolicy": "OnFailure"})
 					Expect(err).To(Succeed())
 
@@ -2270,9 +2327,9 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					Expect(actual.GetName()).To(Equal("test-pod-3"))
 				})
 
-				It("should allow for get informer to be cancelled", func() {
+				It("should allow for get informer to be cancelled", func(specCtx SpecContext) {
 					By("cancelling the context")
-					informerCacheCancel()
+					ctx := cancelledCtx(specCtx)
 
 					By("getting a shared index informer for a pod with a cancelled context")
 					pod := &unstructured.Unstructured{}
@@ -2283,14 +2340,14 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Version: "v1",
 						Kind:    "Pod",
 					})
-					sii, err := informerCache.GetInformer(informerCacheCtx, pod)
+					sii, err := informerCache.GetInformer(ctx, pod)
 					Expect(err).To(HaveOccurred())
 					Expect(sii).To(BeNil())
 					Expect(apierrors.IsTimeout(err)).To(BeTrue())
 				})
 			})
 			Context("with metadata-only objects", func() {
-				It("should be able to get informer for the object", func() {
+				It("should be able to get informer for the object", func(ctx SpecContext) {
 					By("getting a shared index informer for a pod")
 
 					pod := &corev1.Pod{
@@ -2316,7 +2373,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Kind:    "Pod",
 					})
 
-					sii, err := informerCache.GetInformer(context.TODO(), podMeta)
+					sii, err := informerCache.GetInformer(ctx, podMeta)
 					Expect(err).NotTo(HaveOccurred())
 					Expect(sii).NotTo(BeNil())
 					Expect(sii.HasSynced()).To(BeTrue())
@@ -2331,8 +2388,8 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					By("adding an object")
 					cl, err := client.New(cfg, client.Options{})
 					Expect(err).NotTo(HaveOccurred())
-					Expect(cl.Create(context.Background(), pod)).To(Succeed())
-					defer deletePod(pod)
+					Expect(cl.Create(ctx, pod)).To(Succeed())
+					defer deletePod(ctx, pod)
 					// re-copy the result in so that we can match on it properly
 					pod.ObjectMeta.DeepCopyInto(&podMeta.ObjectMeta)
 
@@ -2340,7 +2397,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					Eventually(out).Should(Receive(Equal(podMeta)))
 				})
 
-				It("should be able to index an object field then retrieve objects by that field", func() {
+				It("should be able to index an object field then retrieve objects by that field", func(ctx SpecContext) {
 					By("creating the cache")
 					informer, err := cache.New(cfg, cache.Options{})
 					Expect(err).NotTo(HaveOccurred())
@@ -2356,14 +2413,14 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						metadata := obj.(*metav1.PartialObjectMetadata)
 						return []string{metadata.Labels["test-label"]}
 					}
-					Expect(informer.IndexField(context.TODO(), pod, "metadata.labels.test-label", indexFunc)).To(Succeed())
+					Expect(informer.IndexField(ctx, pod, "metadata.labels.test-label", indexFunc)).To(Succeed())
 
 					By("running the cache and waiting for it to sync")
 					go func() {
 						defer GinkgoRecover()
-						Expect(informer.Start(informerCacheCtx)).To(Succeed())
+						Expect(informer.Start(ctx)).To(Succeed())
 					}()
-					Expect(informer.WaitForCacheSync(informerCacheCtx)).To(BeTrue())
+					Expect(informer.WaitForCacheSync(ctx)).To(BeTrue())
 
 					By("listing Pods with restartPolicyOnFailure")
 					listObj := &metav1.PartialObjectMetadataList{}
@@ -2373,7 +2430,7 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 						Kind:    "PodList",
 					}
 					listObj.SetGroupVersionKind(gvk)
-					err = informer.List(context.Background(), listObj,
+					err = informer.List(ctx, listObj,
 						client.MatchingFields{"metadata.labels.test-label": "test-pod-3"})
 					Expect(err).To(Succeed())
 
@@ -2394,10 +2451,9 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 					}))
 				})
 
-				It("should allow for get informer to be cancelled", func() {
+				It("should allow for get informer to be cancelled", func(specContext SpecContext) {
 					By("creating a context and cancelling it")
-					ctx, cancel := context.WithCancel(context.Background())
-					cancel()
+					ctx := cancelledCtx(specContext)
 
 					By("getting a shared index informer for a pod with a cancelled context")
 					pod := &metav1.PartialObjectMetadata{}
@@ -2415,27 +2471,43 @@ func CacheTest(createCacheFunc func(config *rest.Config, opts cache.Options) (ca
 				})
 			})
 		})
-		Describe("use UnsafeDisableDeepCopy list options", func() {
-			It("should be able to change object in informer cache", func() {
-				By("listing pods")
-				out := corev1.PodList{}
-				Expect(informerCache.List(context.Background(), &out, client.UnsafeDisableDeepCopy)).To(Succeed())
-				for _, item := range out.Items {
-					if strings.Compare(item.Name, "test-pod-3") == 0 { // test-pod-3 has labels
-						item.Labels["UnsafeDisableDeepCopy"] = "true"
-						break
+		Context("using UnsafeDisableDeepCopy", func() {
+			Describe("with ListOptions", func() {
+				It("should be able to change object in informer cache", func(ctx SpecContext) {
+					By("listing pods")
+					out := corev1.PodList{}
+					Expect(informerCache.List(ctx, &out, client.UnsafeDisableDeepCopy)).To(Succeed())
+					for _, item := range out.Items {
+						if strings.Compare(item.Name, "test-pod-3") == 0 { // test-pod-3 has labels
+							item.Labels["UnsafeDisableDeepCopy"] = "true"
+							break
+						}
 					}
-				}
 
-				By("verifying that the returned pods were changed")
-				out2 := corev1.PodList{}
-				Expect(informerCache.List(context.Background(), &out, client.UnsafeDisableDeepCopy)).To(Succeed())
-				for _, item := range out2.Items {
-					if strings.Compare(item.Name, "test-pod-3") == 0 {
-						Expect(item.Labels["UnsafeDisableDeepCopy"]).To(Equal("true"))
-						break
+					By("verifying that the returned pods were changed")
+					out2 := corev1.PodList{}
+					Expect(informerCache.List(ctx, &out, client.UnsafeDisableDeepCopy)).To(Succeed())
+					for _, item := range out2.Items {
+						if strings.Compare(item.Name, "test-pod-3") == 0 {
+							Expect(item.Labels["UnsafeDisableDeepCopy"]).To(Equal("true"))
+							break
+						}
 					}
-				}
+				})
+			})
+			Describe("with GetOptions", func() {
+				It("should be able to change object in informer cache", func(ctx SpecContext) {
+					out := corev1.Pod{}
+					podKey := client.ObjectKey{Name: "test-pod-2", Namespace: testNamespaceTwo}
+					Expect(informerCache.Get(ctx, podKey, &out, client.UnsafeDisableDeepCopy)).To(Succeed())
+
+					out.Labels["UnsafeDisableDeepCopy"] = "true"
+
+					By("verifying that the returned pod was changed")
+					out2 := corev1.Pod{}
+					Expect(informerCache.Get(ctx, podKey, &out2, client.UnsafeDisableDeepCopy)).To(Succeed())
+					Expect(out2.Labels["UnsafeDisableDeepCopy"]).To(Equal("true"))
+				})
 			})
 		})
 	})
@@ -2461,7 +2533,7 @@ var _ = Describe("TransformStripManagedFields", func() {
 })
 
 // ensureNamespace installs namespace of a given name if not exists.
-func ensureNamespace(namespace string, client client.Client) error {
+func ensureNamespace(ctx context.Context, namespace string, client client.Client) error {
 	ns := corev1.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: namespace,
@@ -2471,14 +2543,14 @@ func ensureNamespace(namespace string, client client.Client) error {
 			APIVersion: "v1",
 		},
 	}
-	err := client.Create(context.TODO(), &ns)
+	err := client.Create(ctx, &ns)
 	if apierrors.IsAlreadyExists(err) {
 		return nil
 	}
 	return err
 }
 
-func ensureNode(name string, client client.Client) error {
+func ensureNode(ctx context.Context, name string, client client.Client) error {
 	node := corev1.Node{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:   name,
@@ -2489,7 +2561,7 @@ func ensureNode(name string, client client.Client) error {
 			APIVersion: "v1",
 		},
 	}
-	err := client.Create(context.TODO(), &node)
+	err := client.Create(ctx, &node)
 	if apierrors.IsAlreadyExists(err) {
 		return nil
 	}
@@ -2511,3 +2583,9 @@ func isPodDisableDeepCopy(opts cache.Options) bool {
 	}
 	return false
 }
+
+func cancelledCtx(ctx context.Context) context.Context {
+	cancelCtx, cancel := context.WithCancel(ctx)
+	cancel()
+	return cancelCtx
+}
diff --git a/pkg/cache/defaulting_test.go b/pkg/cache/defaulting_test.go
index 3c01bf8404..d9d0dcceb3 100644
--- a/pkg/cache/defaulting_test.go
+++ b/pkg/cache/defaulting_test.go
@@ -18,6 +18,7 @@ package cache
 
 import (
 	"reflect"
+	"sync"
 	"testing"
 	"time"
 
@@ -224,6 +225,30 @@ func TestDefaultOpts(t *testing.T) {
 				return cmp.Diff(expected, o.ByObject[pod].UnsafeDisableDeepCopy)
 			},
 		},
+		{
+			name: "ByObject.EnableWatchBookmarks gets defaulted from DefaultEnableWatchBookmarks",
+			in: Options{
+				ByObject:                    map[client.Object]ByObject{pod: {}},
+				DefaultEnableWatchBookmarks: ptr.To(true),
+			},
+
+			verification: func(o Options) string {
+				expected := ptr.To(true)
+				return cmp.Diff(expected, o.ByObject[pod].EnableWatchBookmarks)
+			},
+		},
+		{
+			name: "ByObject.EnableWatchBookmarks doesn't get defaulted when set",
+			in: Options{
+				ByObject:                    map[client.Object]ByObject{pod: {EnableWatchBookmarks: ptr.To(false)}},
+				DefaultEnableWatchBookmarks: ptr.To(true),
+			},
+
+			verification: func(o Options) string {
+				expected := ptr.To(false)
+				return cmp.Diff(expected, o.ByObject[pod].EnableWatchBookmarks)
+			},
+		},
 		{
 			name: "DefaultNamespace label selector gets defaulted from DefaultLabelSelector",
 			in: Options{
@@ -408,6 +433,34 @@ func TestDefaultOpts(t *testing.T) {
 	}
 }
 
+func TestDefaultOptsRace(t *testing.T) {
+	opts := Options{
+		Mapper: &fakeRESTMapper{},
+		ByObject: map[client.Object]ByObject{
+			&corev1.Pod{}: {
+				Label: labels.SelectorFromSet(map[string]string{"from": "pod"}),
+				Namespaces: map[string]Config{"default": {
+					LabelSelector: labels.SelectorFromSet(map[string]string{"from": "pod"}),
+				}},
+			},
+		},
+		DefaultNamespaces: map[string]Config{"default": {}},
+	}
+
+	// Start go routines which re-use the above options struct.
+	wg := sync.WaitGroup{}
+	for range 2 {
+		wg.Add(1)
+		go func() {
+			_, _ = defaultOpts(&rest.Config{}, opts)
+			wg.Done()
+		}()
+	}
+
+	// Wait for the go routines to finish.
+	wg.Wait()
+}
+
 type fakeRESTMapper struct {
 	meta.RESTMapper
 }
diff --git a/pkg/cache/delegating_by_gvk_cache.go b/pkg/cache/delegating_by_gvk_cache.go
index 4db8208a63..46bd243c66 100644
--- a/pkg/cache/delegating_by_gvk_cache.go
+++ b/pkg/cache/delegating_by_gvk_cache.go
@@ -18,10 +18,11 @@ package cache
 
 import (
 	"context"
+	"maps"
+	"slices"
 	"strings"
 	"sync"
 
-	"golang.org/x/exp/maps"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -73,7 +74,7 @@ func (dbt *delegatingByGVKCache) GetInformerForKind(ctx context.Context, gvk sch
 }
 
 func (dbt *delegatingByGVKCache) Start(ctx context.Context) error {
-	allCaches := maps.Values(dbt.caches)
+	allCaches := slices.Collect(maps.Values(dbt.caches))
 	allCaches = append(allCaches, dbt.defaultCache)
 
 	wg := &sync.WaitGroup{}
@@ -100,7 +101,7 @@ func (dbt *delegatingByGVKCache) Start(ctx context.Context) error {
 
 func (dbt *delegatingByGVKCache) WaitForCacheSync(ctx context.Context) bool {
 	synced := true
-	for _, cache := range append(maps.Values(dbt.caches), dbt.defaultCache) {
+	for _, cache := range append(slices.Collect(maps.Values(dbt.caches)), dbt.defaultCache) {
 		if !cache.WaitForCacheSync(ctx) {
 			synced = false
 		}
diff --git a/pkg/cache/internal/cache_reader.go b/pkg/cache/internal/cache_reader.go
index 81ee960b73..eb6b544855 100644
--- a/pkg/cache/internal/cache_reader.go
+++ b/pkg/cache/internal/cache_reader.go
@@ -54,7 +54,10 @@ type CacheReader struct {
 }
 
 // Get checks the indexer for the object and writes a copy of it if found.
-func (c *CacheReader) Get(_ context.Context, key client.ObjectKey, out client.Object, _ ...client.GetOption) error {
+func (c *CacheReader) Get(_ context.Context, key client.ObjectKey, out client.Object, opts ...client.GetOption) error {
+	getOpts := client.GetOptions{}
+	getOpts.ApplyOptions(opts)
+
 	if c.scopeName == apimeta.RESTScopeNameRoot {
 		key.Namespace = ""
 	}
@@ -81,7 +84,7 @@ func (c *CacheReader) Get(_ context.Context, key client.ObjectKey, out client.Ob
 		return fmt.Errorf("cache contained %T, which is not an Object", obj)
 	}
 
-	if c.disableDeepCopy {
+	if c.disableDeepCopy || (getOpts.UnsafeDisableDeepCopy != nil && *getOpts.UnsafeDisableDeepCopy) {
 		// skip deep copy which might be unsafe
 		// you must DeepCopy any object before mutating it outside
 	} else {
@@ -97,7 +100,7 @@ func (c *CacheReader) Get(_ context.Context, key client.ObjectKey, out client.Ob
 		return fmt.Errorf("cache had type %s, but %s was asked for", objVal.Type(), outVal.Type())
 	}
 	reflect.Indirect(outVal).Set(reflect.Indirect(objVal))
-	if !c.disableDeepCopy {
+	if !c.disableDeepCopy && (getOpts.UnsafeDisableDeepCopy == nil || !*getOpts.UnsafeDisableDeepCopy) {
 		out.GetObjectKind().SetGroupVersionKind(c.groupVersionKind)
 	}
 
@@ -174,7 +177,13 @@ func (c *CacheReader) List(_ context.Context, out client.ObjectList, opts ...cli
 		}
 		runtimeObjs = append(runtimeObjs, outObj)
 	}
-	return apimeta.SetList(out, runtimeObjs)
+
+	if err := apimeta.SetList(out, runtimeObjs); err != nil {
+		return err
+	}
+
+	out.SetContinue("continue-not-supported")
+	return nil
 }
 
 func byIndexes(indexer cache.Indexer, requires fields.Requirements, namespace string) ([]interface{}, error) {
diff --git a/pkg/cache/internal/informers.go b/pkg/cache/internal/informers.go
index cd8c6774ca..f216be0d9e 100644
--- a/pkg/cache/internal/informers.go
+++ b/pkg/cache/internal/informers.go
@@ -25,21 +25,26 @@ import (
 	"sync"
 	"time"
 
+	"github.com/go-logr/logr"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/metadata"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/cache"
 	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
+	logf "sigs.k8s.io/controller-runtime/pkg/internal/log"
 	"sigs.k8s.io/controller-runtime/pkg/internal/syncs"
 )
 
+var log = logf.RuntimeLog.WithName("cache")
+
 // InformersOpts configures an InformerMap.
 type InformersOpts struct {
 	HTTPClient            *http.Client
@@ -47,18 +52,19 @@ type InformersOpts struct {
 	Mapper                meta.RESTMapper
 	ResyncPeriod          time.Duration
 	Namespace             string
-	NewInformer           *func(cache.ListerWatcher, runtime.Object, time.Duration, cache.Indexers) cache.SharedIndexInformer
+	NewInformer           func(cache.ListerWatcher, runtime.Object, time.Duration, cache.Indexers) cache.SharedIndexInformer
 	Selector              Selector
 	Transform             cache.TransformFunc
 	UnsafeDisableDeepCopy bool
-	WatchErrorHandler     cache.WatchErrorHandler
+	EnableWatchBookmarks  bool
+	WatchErrorHandler     cache.WatchErrorHandlerWithContext
 }
 
 // NewInformers creates a new InformersMap that can create informers under the hood.
 func NewInformers(config *rest.Config, options *InformersOpts) *Informers {
 	newInformer := cache.NewSharedIndexInformer
 	if options.NewInformer != nil {
-		newInformer = *options.NewInformer
+		newInformer = options.NewInformer
 	}
 	return &Informers{
 		config:     config,
@@ -78,6 +84,7 @@ func NewInformers(config *rest.Config, options *InformersOpts) *Informers {
 		selector:              options.Selector,
 		transform:             options.Transform,
 		unsafeDisableDeepCopy: options.UnsafeDisableDeepCopy,
+		enableWatchBookmarks:  options.EnableWatchBookmarks,
 		newInformer:           newInformer,
 		watchErrorHandler:     options.WatchErrorHandler,
 	}
@@ -103,7 +110,8 @@ func (c *Cache) Start(stop <-chan struct{}) {
 	// Stop on either the whole map stopping or just this informer being removed.
 	internalStop, cancel := syncs.MergeChans(stop, c.stop)
 	defer cancel()
-	c.Informer.Run(internalStop)
+	// Convert the stop channel to a context and then add the logger.
+	c.Informer.RunWithContext(logr.NewContext(wait.ContextForChannel(internalStop), log))
 }
 
 type tracker struct {
@@ -174,14 +182,15 @@ type Informers struct {
 	selector              Selector
 	transform             cache.TransformFunc
 	unsafeDisableDeepCopy bool
+	enableWatchBookmarks  bool
 
 	// NewInformer allows overriding of the shared index informer constructor for testing.
 	newInformer func(cache.ListerWatcher, runtime.Object, time.Duration, cache.Indexers) cache.SharedIndexInformer
 
-	// WatchErrorHandler allows the shared index informer's
+	// watchErrorHandler allows the shared index informer's
 	// watchErrorHandler to be set by overriding the options
 	// or to use the default watchErrorHandler
-	watchErrorHandler cache.WatchErrorHandler
+	watchErrorHandler cache.WatchErrorHandlerWithContext
 }
 
 // Start calls Run on each of the informers and sets started to true. Blocks on the context.
@@ -192,7 +201,7 @@ func (ip *Informers) Start(ctx context.Context) error {
 		defer ip.mu.Unlock()
 
 		if ip.started {
-			return errors.New("Informer already started") //nolint:stylecheck
+			return errors.New("informer already started") //nolint:stylecheck
 		}
 
 		// Set the context so it can be passed to informers that are added later
@@ -356,14 +365,16 @@ func (ip *Informers) addInformerToMap(gvk schema.GroupVersionKind, obj runtime.O
 		return nil, false, err
 	}
 	sharedIndexInformer := ip.newInformer(&cache.ListWatch{
-		ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+		ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
 			ip.selector.ApplyToList(&opts)
-			return listWatcher.ListFunc(opts)
+			return listWatcher.ListWithContextFunc(ctx, opts)
 		},
-		WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
-			ip.selector.ApplyToList(&opts)
+		WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
 			opts.Watch = true // Watch needs to be set to true separately
-			return listWatcher.WatchFunc(opts)
+			opts.AllowWatchBookmarks = ip.enableWatchBookmarks
+
+			ip.selector.ApplyToList(&opts)
+			return listWatcher.WatchFuncWithContext(ctx, opts)
 		},
 	}, obj, calculateResyncPeriod(ip.resync), cache.Indexers{
 		cache.NamespaceIndex: cache.MetaNamespaceIndexFunc,
@@ -371,7 +382,7 @@ func (ip *Informers) addInformerToMap(gvk schema.GroupVersionKind, obj runtime.O
 
 	// Set WatchErrorHandler on SharedIndexInformer if set
 	if ip.watchErrorHandler != nil {
-		if err := sharedIndexInformer.SetWatchErrorHandler(ip.watchErrorHandler); err != nil {
+		if err := sharedIndexInformer.SetWatchErrorHandlerWithContext(ip.watchErrorHandler); err != nil {
 			return nil, false, err
 		}
 	}
@@ -436,18 +447,21 @@ func (ip *Informers) makeListWatcher(gvk schema.GroupVersionKind, obj runtime.Ob
 		}
 		resources := dynamicClient.Resource(mapping.Resource)
 		return &cache.ListWatch{
-			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
 				if namespace != "" {
-					return resources.Namespace(namespace).List(ip.ctx, opts)
+					return resources.Namespace(namespace).List(ctx, opts)
 				}
-				return resources.List(ip.ctx, opts)
+				return resources.List(ctx, opts)
 			},
 			// Setup the watch function
-			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				opts.Watch = true // Watch needs to be set to true separately
+				opts.AllowWatchBookmarks = ip.enableWatchBookmarks
+
 				if namespace != "" {
-					return resources.Namespace(namespace).Watch(ip.ctx, opts)
+					return resources.Namespace(namespace).Watch(ctx, opts)
 				}
-				return resources.Watch(ip.ctx, opts)
+				return resources.Watch(ctx, opts)
 			},
 		}, nil
 	//
@@ -467,15 +481,15 @@ func (ip *Informers) makeListWatcher(gvk schema.GroupVersionKind, obj runtime.Ob
 		resources := metadataClient.Resource(mapping.Resource)
 
 		return &cache.ListWatch{
-			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
 				var (
 					list *metav1.PartialObjectMetadataList
 					err  error
 				)
 				if namespace != "" {
-					list, err = resources.Namespace(namespace).List(ip.ctx, opts)
+					list, err = resources.Namespace(namespace).List(ctx, opts)
 				} else {
-					list, err = resources.List(ip.ctx, opts)
+					list, err = resources.List(ctx, opts)
 				}
 				if list != nil {
 					for i := range list.Items {
@@ -485,11 +499,14 @@ func (ip *Informers) makeListWatcher(gvk schema.GroupVersionKind, obj runtime.Ob
 				return list, err
 			},
 			// Setup the watch function
-			WatchFunc: func(opts metav1.ListOptions) (watcher watch.Interface, err error) {
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watcher watch.Interface, err error) {
+				opts.Watch = true // Watch needs to be set to true separately
+				opts.AllowWatchBookmarks = ip.enableWatchBookmarks
+
 				if namespace != "" {
-					watcher, err = resources.Namespace(namespace).Watch(ip.ctx, opts)
+					watcher, err = resources.Namespace(namespace).Watch(ctx, opts)
 				} else {
-					watcher, err = resources.Watch(ip.ctx, opts)
+					watcher, err = resources.Watch(ctx, opts)
 				}
 				if err != nil {
 					return nil, err
@@ -501,7 +518,7 @@ func (ip *Informers) makeListWatcher(gvk schema.GroupVersionKind, obj runtime.Ob
 	// Structured.
 	//
 	default:
-		client, err := apiutil.RESTClientForGVK(gvk, false, ip.config, ip.codecs, ip.httpClient)
+		client, err := apiutil.RESTClientForGVK(gvk, false, false, ip.config, ip.codecs, ip.httpClient)
 		if err != nil {
 			return nil, err
 		}
@@ -511,7 +528,7 @@ func (ip *Informers) makeListWatcher(gvk schema.GroupVersionKind, obj runtime.Ob
 			return nil, err
 		}
 		return &cache.ListWatch{
-			ListFunc: func(opts metav1.ListOptions) (runtime.Object, error) {
+			ListWithContextFunc: func(ctx context.Context, opts metav1.ListOptions) (runtime.Object, error) {
 				// Build the request.
 				req := client.Get().Resource(mapping.Resource.Resource).VersionedParams(&opts, ip.paramCodec)
 				if namespace != "" {
@@ -520,20 +537,23 @@ func (ip *Informers) makeListWatcher(gvk schema.GroupVersionKind, obj runtime.Ob
 
 				// Create the resulting object, and execute the request.
 				res := listObj.DeepCopyObject()
-				if err := req.Do(ip.ctx).Into(res); err != nil {
+				if err := req.Do(ctx).Into(res); err != nil {
 					return nil, err
 				}
 				return res, nil
 			},
 			// Setup the watch function
-			WatchFunc: func(opts metav1.ListOptions) (watch.Interface, error) {
+			WatchFuncWithContext: func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+				opts.Watch = true // Watch needs to be set to true separately
+				opts.AllowWatchBookmarks = ip.enableWatchBookmarks
+
 				// Build the request.
 				req := client.Get().Resource(mapping.Resource.Resource).VersionedParams(&opts, ip.paramCodec)
 				if namespace != "" {
 					req.Namespace(namespace)
 				}
 				// Call the watch.
-				return req.Watch(ip.ctx)
+				return req.Watch(ctx)
 			},
 		}, nil
 	}
@@ -571,7 +591,7 @@ func newGVKFixupWatcher(gvk schema.GroupVersionKind, watcher watch.Interface) wa
 // hammer the apiserver with list requests simultaneously.
 func calculateResyncPeriod(resync time.Duration) time.Duration {
 	// the factor will fall into [0.9, 1.1)
-	factor := rand.Float64()/5.0 + 0.9 //nolint:gosec
+	factor := rand.Float64()/5.0 + 0.9
 	return time.Duration(float64(resync.Nanoseconds()) * factor)
 }
 
diff --git a/pkg/cache/multi_namespace_cache.go b/pkg/cache/multi_namespace_cache.go
index da69f40f65..d7d7b0e7c2 100644
--- a/pkg/cache/multi_namespace_cache.go
+++ b/pkg/cache/multi_namespace_cache.go
@@ -249,6 +249,10 @@ func (c *multiNamespaceCache) List(ctx context.Context, list client.ObjectList,
 	listOpts := client.ListOptions{}
 	listOpts.ApplyOptions(opts)
 
+	if listOpts.Continue != "" {
+		return fmt.Errorf("continue list option is not supported by the cache")
+	}
+
 	isNamespaced, err := apiutil.IsObjectNamespaced(list, c.Scheme, c.RESTMapper)
 	if err != nil {
 		return err
@@ -262,6 +266,9 @@ func (c *multiNamespaceCache) List(ctx context.Context, list client.ObjectList,
 	if listOpts.Namespace != corev1.NamespaceAll {
 		cache, ok := c.namespaceToCache[listOpts.Namespace]
 		if !ok {
+			if global, hasGlobal := c.namespaceToCache[AllNamespaces]; hasGlobal {
+				return global.List(ctx, list, opts...)
+			}
 			return fmt.Errorf("unable to list: %v because of unknown namespace for the cache", listOpts.Namespace)
 		}
 		return cache.List(ctx, list, opts...)
@@ -272,10 +279,7 @@ func (c *multiNamespaceCache) List(ctx context.Context, list client.ObjectList,
 		return err
 	}
 
-	allItems, err := apimeta.ExtractList(list)
-	if err != nil {
-		return err
-	}
+	allItems := []runtime.Object{}
 
 	limitSet := listOpts.Limit > 0
 
@@ -313,7 +317,12 @@ func (c *multiNamespaceCache) List(ctx context.Context, list client.ObjectList,
 	}
 	listAccessor.SetResourceVersion(resourceVersion)
 
-	return apimeta.SetList(list, allItems)
+	if err := apimeta.SetList(list, allItems); err != nil {
+		return err
+	}
+
+	list.SetContinue("continue-not-supported")
+	return nil
 }
 
 // multiNamespaceInformer knows how to handle interacting with the underlying informer across multiple namespaces.
@@ -325,18 +334,11 @@ type handlerRegistration struct {
 	handles map[string]toolscache.ResourceEventHandlerRegistration
 }
 
-type syncer interface {
-	HasSynced() bool
-}
-
 // HasSynced asserts that the handler has been called for the full initial state of the informer.
-// This uses syncer to be compatible between client-go 1.27+ and older versions when the interface changed.
 func (h handlerRegistration) HasSynced() bool {
-	for _, reg := range h.handles {
-		if s, ok := reg.(syncer); ok {
-			if !s.HasSynced() {
-				return false
-			}
+	for _, h := range h.handles {
+		if !h.HasSynced() {
+			return false
 		}
 	}
 	return true
@@ -378,6 +380,23 @@ func (i *multiNamespaceInformer) AddEventHandlerWithResyncPeriod(handler toolsca
 	return handles, nil
 }
 
+// AddEventHandlerWithOptions adds the handler with options to each namespaced informer.
+func (i *multiNamespaceInformer) AddEventHandlerWithOptions(handler toolscache.ResourceEventHandler, options toolscache.HandlerOptions) (toolscache.ResourceEventHandlerRegistration, error) {
+	handles := handlerRegistration{
+		handles: make(map[string]toolscache.ResourceEventHandlerRegistration, len(i.namespaceToInformer)),
+	}
+
+	for ns, informer := range i.namespaceToInformer {
+		registration, err := informer.AddEventHandlerWithOptions(handler, options)
+		if err != nil {
+			return nil, err
+		}
+		handles.handles[ns] = registration
+	}
+
+	return handles, nil
+}
+
 // RemoveEventHandler removes a previously added event handler given by its registration handle.
 func (i *multiNamespaceInformer) RemoveEventHandler(h toolscache.ResourceEventHandlerRegistration) error {
 	handles, ok := h.(handlerRegistration)
diff --git a/pkg/certwatcher/certwatcher.go b/pkg/certwatcher/certwatcher.go
index fe15fc0dd7..2362d020b8 100644
--- a/pkg/certwatcher/certwatcher.go
+++ b/pkg/certwatcher/certwatcher.go
@@ -17,13 +17,16 @@ limitations under the License.
 package certwatcher
 
 import (
+	"bytes"
 	"context"
 	"crypto/tls"
 	"fmt"
+	"os"
 	"sync"
 	"time"
 
 	"github.com/fsnotify/fsnotify"
+	"github.com/go-logr/logr"
 	kerrors "k8s.io/apimachinery/pkg/util/errors"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apimachinery/pkg/util/wait"
@@ -33,18 +36,25 @@ import (
 
 var log = logf.RuntimeLog.WithName("certwatcher")
 
-// CertWatcher watches certificate and key files for changes.  When either file
-// changes, it reads and parses both and calls an optional callback with the new
-// certificate.
+const defaultWatchInterval = 10 * time.Second
+
+// CertWatcher watches certificate and key files for changes.
+// It always returns the cached version,
+// but periodically reads and parses certificate and key for changes
+// and calls an optional callback with the new certificate.
 type CertWatcher struct {
 	sync.RWMutex
 
 	currentCert *tls.Certificate
 	watcher     *fsnotify.Watcher
+	interval    time.Duration
+	log         logr.Logger
 
 	certPath string
 	keyPath  string
 
+	cachedKeyPEMBlock []byte
+
 	// callback is a function to be invoked when the certificate changes.
 	callback func(tls.Certificate)
 }
@@ -56,6 +66,8 @@ func New(certPath, keyPath string) (*CertWatcher, error) {
 	cw := &CertWatcher{
 		certPath: certPath,
 		keyPath:  keyPath,
+		interval: defaultWatchInterval,
+		log:      log.WithValues("cert", certPath, "key", keyPath),
 	}
 
 	// Initial read of certificate and key.
@@ -71,6 +83,12 @@ func New(certPath, keyPath string) (*CertWatcher, error) {
 	return cw, nil
 }
 
+// WithWatchInterval sets the watch interval and returns the CertWatcher pointer
+func (cw *CertWatcher) WithWatchInterval(interval time.Duration) *CertWatcher {
+	cw.interval = interval
+	return cw
+}
+
 // RegisterCallback registers a callback to be invoked when the certificate changes.
 func (cw *CertWatcher) RegisterCallback(callback func(tls.Certificate)) {
 	cw.Lock()
@@ -112,12 +130,20 @@ func (cw *CertWatcher) Start(ctx context.Context) error {
 
 	go cw.Watch()
 
-	log.Info("Starting certificate watcher")
-
-	// Block until the context is done.
-	<-ctx.Done()
+	ticker := time.NewTicker(cw.interval)
+	defer ticker.Stop()
 
-	return cw.watcher.Close()
+	cw.log.Info("Starting certificate poll+watcher", "interval", cw.interval)
+	for {
+		select {
+		case <-ctx.Done():
+			return cw.watcher.Close()
+		case <-ticker.C:
+			if err := cw.ReadCertificate(); err != nil {
+				cw.log.Error(err, "failed read certificate")
+			}
+		}
+	}
 }
 
 // Watch reads events from the watcher's channel and reacts to changes.
@@ -131,34 +157,61 @@ func (cw *CertWatcher) Watch() {
 			}
 
 			cw.handleEvent(event)
-
 		case err, ok := <-cw.watcher.Errors:
 			// Channel is closed.
 			if !ok {
 				return
 			}
 
-			log.Error(err, "certificate watch error")
+			cw.log.Error(err, "certificate watch error")
 		}
 	}
 }
 
+// updateCachedCertificate checks if the new certificate differs from the cache,
+// updates it and returns the result if it was updated or not
+func (cw *CertWatcher) updateCachedCertificate(cert *tls.Certificate, keyPEMBlock []byte) bool {
+	cw.Lock()
+	defer cw.Unlock()
+
+	if cw.currentCert != nil &&
+		bytes.Equal(cw.currentCert.Certificate[0], cert.Certificate[0]) &&
+		bytes.Equal(cw.cachedKeyPEMBlock, keyPEMBlock) {
+		cw.log.V(7).Info("certificate already cached")
+		return false
+	}
+	cw.currentCert = cert
+	cw.cachedKeyPEMBlock = keyPEMBlock
+	return true
+}
+
 // ReadCertificate reads the certificate and key files from disk, parses them,
-// and updates the current certificate on the watcher.  If a callback is set, it
+// and updates the current certificate on the watcher if updated. If a callback is set, it
 // is invoked with the new certificate.
 func (cw *CertWatcher) ReadCertificate() error {
 	metrics.ReadCertificateTotal.Inc()
-	cert, err := tls.LoadX509KeyPair(cw.certPath, cw.keyPath)
+	certPEMBlock, err := os.ReadFile(cw.certPath)
+	if err != nil {
+		metrics.ReadCertificateErrors.Inc()
+		return err
+	}
+	keyPEMBlock, err := os.ReadFile(cw.keyPath)
 	if err != nil {
 		metrics.ReadCertificateErrors.Inc()
 		return err
 	}
 
-	cw.Lock()
-	cw.currentCert = &cert
-	cw.Unlock()
+	cert, err := tls.X509KeyPair(certPEMBlock, keyPEMBlock)
+	if err != nil {
+		metrics.ReadCertificateErrors.Inc()
+		return err
+	}
+
+	if !cw.updateCachedCertificate(&cert, keyPEMBlock) {
+		return nil
+	}
 
-	log.Info("Updated current TLS certificate")
+	cw.log.Info("Updated current TLS certificate")
 
 	// If a callback is registered, invoke it with the new certificate.
 	cw.RLock()
@@ -173,36 +226,26 @@ func (cw *CertWatcher) ReadCertificate() error {
 
 func (cw *CertWatcher) handleEvent(event fsnotify.Event) {
 	// Only care about events which may modify the contents of the file.
-	if !(isWrite(event) || isRemove(event) || isCreate(event) || isChmod(event)) {
-		return
-	}
-
-	log.V(1).Info("certificate event", "event", event)
-
-	// If the file was removed or renamed, re-add the watch to the previous name
-	if isRemove(event) || isChmod(event) {
+	switch {
+	case event.Op.Has(fsnotify.Write):
+	case event.Op.Has(fsnotify.Create):
+	case event.Op.Has(fsnotify.Chmod), event.Op.Has(fsnotify.Remove):
+		// If the file was removed or renamed, re-add the watch to the previous name
 		if err := cw.watcher.Add(event.Name); err != nil {
-			log.Error(err, "error re-watching file")
+			cw.log.Error(err, "error re-watching file")
 		}
+	default:
+		return
 	}
 
+	cw.log.V(1).Info("certificate event", "event", event)
 	if err := cw.ReadCertificate(); err != nil {
-		log.Error(err, "error re-reading certificate")
+		cw.log.Error(err, "error re-reading certificate")
 	}
 }
 
-func isWrite(event fsnotify.Event) bool {
-	return event.Op.Has(fsnotify.Write)
-}
-
-func isCreate(event fsnotify.Event) bool {
-	return event.Op.Has(fsnotify.Create)
-}
-
-func isRemove(event fsnotify.Event) bool {
-	return event.Op.Has(fsnotify.Remove)
-}
-
-func isChmod(event fsnotify.Event) bool {
-	return event.Op.Has(fsnotify.Chmod)
+// NeedLeaderElection indicates that the cert-manager
+// does not need leader election.
+func (cw *CertWatcher) NeedLeaderElection() bool {
+	return false
 }
diff --git a/pkg/certwatcher/certwatcher_suite_test.go b/pkg/certwatcher/certwatcher_suite_test.go
index 2d0f677685..d0d9a72a62 100644
--- a/pkg/certwatcher/certwatcher_suite_test.go
+++ b/pkg/certwatcher/certwatcher_suite_test.go
@@ -22,6 +22,7 @@ import (
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 )
diff --git a/pkg/certwatcher/certwatcher_test.go b/pkg/certwatcher/certwatcher_test.go
index 1fb247581f..9737925a6b 100644
--- a/pkg/certwatcher/certwatcher_test.go
+++ b/pkg/certwatcher/certwatcher_test.go
@@ -34,8 +34,10 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	"github.com/prometheus/client_golang/prometheus/testutil"
+
 	"sigs.k8s.io/controller-runtime/pkg/certwatcher"
 	"sigs.k8s.io/controller-runtime/pkg/certwatcher/metrics"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
 )
 
 var _ = Describe("CertWatcher", func() {
@@ -48,13 +50,14 @@ var _ = Describe("CertWatcher", func() {
 
 	var _ = Describe("certwatcher Start", func() {
 		var (
-			ctx       context.Context
-			ctxCancel context.CancelFunc
-			watcher   *certwatcher.CertWatcher
+			ctxCancel    context.CancelFunc
+			watcher      *certwatcher.CertWatcher
+			startWatcher func(interval time.Duration) (done <-chan struct{})
 		)
 
 		BeforeEach(func() {
-			ctx, ctxCancel = context.WithCancel(context.Background())
+			var ctx context.Context
+			ctx, ctxCancel = context.WithCancel(context.Background()) //nolint:forbidigo // the watcher outlives the BeforeEach
 
 			err := writeCerts(certPath, keyPath, "127.0.0.1")
 			Expect(err).ToNot(HaveOccurred())
@@ -73,32 +76,40 @@ var _ = Describe("CertWatcher", func() {
 
 			watcher, err = certwatcher.New(certPath, keyPath)
 			Expect(err).ToNot(HaveOccurred())
+
+			startWatcher = func(interval time.Duration) (done <-chan struct{}) {
+				doneCh := make(chan struct{})
+				go func() {
+					defer GinkgoRecover()
+					defer close(doneCh)
+					Expect(watcher.WithWatchInterval(interval).Start(ctx)).To(Succeed())
+				}()
+				// wait till we read first cert
+				Eventually(func() error {
+					err := watcher.ReadCertificate()
+					return err
+				}).Should(Succeed())
+				return doneCh
+			}
 		})
 
-		startWatcher := func() (done <-chan struct{}) {
-			doneCh := make(chan struct{})
-			go func() {
-				defer GinkgoRecover()
-				defer close(doneCh)
-				Expect(watcher.Start(ctx)).To(Succeed())
-			}()
-			// wait till we read first cert
-			Eventually(func() error {
-				err := watcher.ReadCertificate()
-				return err
-			}).Should(Succeed())
-			return doneCh
-		}
+		It("should not require LeaderElection", func() {
+			leaderElectionRunnable, isLeaderElectionRunnable := any(watcher).(manager.LeaderElectionRunnable)
+			Expect(isLeaderElectionRunnable).To(BeTrue())
+			Expect(leaderElectionRunnable.NeedLeaderElection()).To(BeFalse())
+		})
 
 		It("should read the initial cert/key", func() {
-			doneCh := startWatcher()
+			// This test verifies the initial read succeeded. So interval doesn't matter.
+			doneCh := startWatcher(10 * time.Second)
 
 			ctxCancel()
 			Eventually(doneCh, "4s").Should(BeClosed())
 		})
 
 		It("should reload currentCert when changed", func() {
-			doneCh := startWatcher()
+			// This test verifies fsnotify detects the cert change. So interval doesn't matter.
+			doneCh := startWatcher(10 * time.Second)
 			called := atomic.Int64{}
 			watcher.RegisterCallback(func(crt tls.Certificate) {
 				called.Add(1)
@@ -113,7 +124,7 @@ var _ = Describe("CertWatcher", func() {
 			Eventually(func() bool {
 				secondcert, _ := watcher.GetCertificate(nil)
 				first := firstcert.PrivateKey.(*rsa.PrivateKey)
-				return first.Equal(secondcert.PrivateKey)
+				return first.Equal(secondcert.PrivateKey) || firstcert.Leaf.SerialNumber == secondcert.Leaf.SerialNumber
 			}).ShouldNot(BeTrue())
 
 			ctxCancel()
@@ -122,7 +133,8 @@ var _ = Describe("CertWatcher", func() {
 		})
 
 		It("should reload currentCert when changed with rename", func() {
-			doneCh := startWatcher()
+			// This test verifies fsnotify detects the cert change. So interval doesn't matter.
+			doneCh := startWatcher(10 * time.Second)
 			called := atomic.Int64{}
 			watcher.RegisterCallback(func(crt tls.Certificate) {
 				called.Add(1)
@@ -143,7 +155,7 @@ var _ = Describe("CertWatcher", func() {
 			Eventually(func() bool {
 				secondcert, _ := watcher.GetCertificate(nil)
 				first := firstcert.PrivateKey.(*rsa.PrivateKey)
-				return first.Equal(secondcert.PrivateKey)
+				return first.Equal(secondcert.PrivateKey) || firstcert.Leaf.SerialNumber == secondcert.Leaf.SerialNumber
 			}).ShouldNot(BeTrue())
 
 			ctxCancel()
@@ -151,6 +163,34 @@ var _ = Describe("CertWatcher", func() {
 			Expect(called.Load()).To(BeNumerically(">=", 1))
 		})
 
+		It("should reload currentCert after move out", func() {
+			// This test verifies poll works, so we'll use 1s as interval (fsnotify doesn't detect this change).
+			doneCh := startWatcher(1 * time.Second)
+			called := atomic.Int64{}
+			watcher.RegisterCallback(func(crt tls.Certificate) {
+				called.Add(1)
+				Expect(crt.Certificate).ToNot(BeEmpty())
+			})
+
+			firstcert, _ := watcher.GetCertificate(nil)
+
+			Expect(os.Rename(certPath, certPath+".old")).To(Succeed())
+			Expect(os.Rename(keyPath, keyPath+".old")).To(Succeed())
+
+			err := writeCerts(certPath, keyPath, "192.168.0.3")
+			Expect(err).ToNot(HaveOccurred())
+
+			Eventually(func() bool {
+				secondcert, _ := watcher.GetCertificate(nil)
+				first := firstcert.PrivateKey.(*rsa.PrivateKey)
+				return first.Equal(secondcert.PrivateKey) || firstcert.Leaf.SerialNumber == secondcert.Leaf.SerialNumber
+			}, "10s", "1s").ShouldNot(BeTrue())
+
+			ctxCancel()
+			Eventually(doneCh, "4s").Should(BeClosed())
+			Expect(called.Load()).To(BeNumerically(">=", 1))
+		})
+
 		Context("prometheus metric read_certificate_total", func() {
 			var readCertificateTotalBefore float64
 			var readCertificateErrorsBefore float64
@@ -161,12 +201,13 @@ var _ = Describe("CertWatcher", func() {
 			})
 
 			It("should get updated on successful certificate read", func() {
-				doneCh := startWatcher()
+				// This test verifies fsnotify, so interval doesn't matter.
+				doneCh := startWatcher(10 * time.Second)
 
 				Eventually(func() error {
 					readCertificateTotalAfter := testutil.ToFloat64(metrics.ReadCertificateTotal)
-					if readCertificateTotalAfter != readCertificateTotalBefore+1.0 {
-						return fmt.Errorf("metric read certificate total expected: %v and got: %v", readCertificateTotalBefore+1.0, readCertificateTotalAfter)
+					if readCertificateTotalAfter < readCertificateTotalBefore+1.0 {
+						return fmt.Errorf("metric read certificate total expected at least: %v and got: %v", readCertificateTotalBefore+1.0, readCertificateTotalAfter)
 					}
 					return nil
 				}, "4s").Should(Succeed())
@@ -176,12 +217,13 @@ var _ = Describe("CertWatcher", func() {
 			})
 
 			It("should get updated on read certificate errors", func() {
-				doneCh := startWatcher()
+				// This test works with fsnotify, so interval doesn't matter.
+				doneCh := startWatcher(10 * time.Second)
 
 				Eventually(func() error {
 					readCertificateTotalAfter := testutil.ToFloat64(metrics.ReadCertificateTotal)
-					if readCertificateTotalAfter != readCertificateTotalBefore+1.0 {
-						return fmt.Errorf("metric read certificate total expected: %v and got: %v", readCertificateTotalBefore+1.0, readCertificateTotalAfter)
+					if readCertificateTotalAfter < readCertificateTotalBefore+1.0 {
+						return fmt.Errorf("metric read certificate total expected at least: %v and got: %v", readCertificateTotalBefore+1.0, readCertificateTotalAfter)
 					}
 					readCertificateTotalBefore = readCertificateTotalAfter
 					return nil
@@ -192,15 +234,15 @@ var _ = Describe("CertWatcher", func() {
 				// Note, we are checking two errors here, because os.Remove generates two fsnotify events: Chmod + Remove
 				Eventually(func() error {
 					readCertificateTotalAfter := testutil.ToFloat64(metrics.ReadCertificateTotal)
-					if readCertificateTotalAfter != readCertificateTotalBefore+2.0 {
-						return fmt.Errorf("metric read certificate total expected: %v and got: %v", readCertificateTotalBefore+2.0, readCertificateTotalAfter)
+					if readCertificateTotalAfter < readCertificateTotalBefore+2.0 {
+						return fmt.Errorf("metric read certificate total expected at least: %v and got: %v", readCertificateTotalBefore+2.0, readCertificateTotalAfter)
 					}
 					return nil
 				}, "4s").Should(Succeed())
 				Eventually(func() error {
 					readCertificateErrorsAfter := testutil.ToFloat64(metrics.ReadCertificateErrors)
-					if readCertificateErrorsAfter != readCertificateErrorsBefore+2.0 {
-						return fmt.Errorf("metric read certificate errors expected: %v and got: %v", readCertificateErrorsBefore+2.0, readCertificateErrorsAfter)
+					if readCertificateErrorsAfter < readCertificateErrorsBefore+2.0 {
+						return fmt.Errorf("metric read certificate errors expected at least: %v and got: %v", readCertificateErrorsBefore+2.0, readCertificateErrorsAfter)
 					}
 					return nil
 				}, "4s").Should(Succeed())
diff --git a/pkg/certwatcher/example_test.go b/pkg/certwatcher/example_test.go
index e322aeebfc..e85b2403cb 100644
--- a/pkg/certwatcher/example_test.go
+++ b/pkg/certwatcher/example_test.go
@@ -39,7 +39,7 @@ func Example() {
 		panic(err)
 	}
 
-	// Start goroutine with certwatcher running fsnotify against supplied certdir
+	// Start goroutine with certwatcher running against supplied cert
 	go func() {
 		if err := watcher.Start(ctx); err != nil {
 			panic(err)
diff --git a/pkg/certwatcher/metrics/metrics.go b/pkg/certwatcher/metrics/metrics.go
index 05869eff03..f128abbcf0 100644
--- a/pkg/certwatcher/metrics/metrics.go
+++ b/pkg/certwatcher/metrics/metrics.go
@@ -18,6 +18,7 @@ package metrics
 
 import (
 	"github.com/prometheus/client_golang/prometheus"
+
 	"sigs.k8s.io/controller-runtime/pkg/metrics"
 )
 
diff --git a/pkg/client/apiutil/apimachinery.go b/pkg/client/apiutil/apimachinery.go
index 1d4ce264c9..b132cb2d4d 100644
--- a/pkg/client/apiutil/apimachinery.go
+++ b/pkg/client/apiutil/apimachinery.go
@@ -161,15 +161,27 @@ func GVKForObject(obj runtime.Object, scheme *runtime.Scheme) (schema.GroupVersi
 // RESTClientForGVK constructs a new rest.Interface capable of accessing the resource associated
 // with the given GroupVersionKind. The REST client will be configured to use the negotiated serializer from
 // baseConfig, if set, otherwise a default serializer will be set.
-func RESTClientForGVK(gvk schema.GroupVersionKind, isUnstructured bool, baseConfig *rest.Config, codecs serializer.CodecFactory, httpClient *http.Client) (rest.Interface, error) {
+func RESTClientForGVK(
+	gvk schema.GroupVersionKind,
+	forceDisableProtoBuf bool,
+	isUnstructured bool,
+	baseConfig *rest.Config,
+	codecs serializer.CodecFactory,
+	httpClient *http.Client,
+) (rest.Interface, error) {
 	if httpClient == nil {
 		return nil, fmt.Errorf("httpClient must not be nil, consider using rest.HTTPClientFor(c) to create a client")
 	}
-	return rest.RESTClientForConfigAndClient(createRestConfig(gvk, isUnstructured, baseConfig, codecs), httpClient)
+	return rest.RESTClientForConfigAndClient(createRestConfig(gvk, forceDisableProtoBuf, isUnstructured, baseConfig, codecs), httpClient)
 }
 
 // createRestConfig copies the base config and updates needed fields for a new rest config.
-func createRestConfig(gvk schema.GroupVersionKind, isUnstructured bool, baseConfig *rest.Config, codecs serializer.CodecFactory) *rest.Config {
+func createRestConfig(gvk schema.GroupVersionKind,
+	forceDisableProtoBuf bool,
+	isUnstructured bool,
+	baseConfig *rest.Config,
+	codecs serializer.CodecFactory,
+) *rest.Config {
 	gv := gvk.GroupVersion()
 
 	cfg := rest.CopyConfig(baseConfig)
@@ -183,7 +195,7 @@ func createRestConfig(gvk schema.GroupVersionKind, isUnstructured bool, baseConf
 		cfg.UserAgent = rest.DefaultKubernetesUserAgent()
 	}
 	// TODO(FillZpp): In the long run, we want to check discovery or something to make sure that this is actually true.
-	if cfg.ContentType == "" && !isUnstructured {
+	if cfg.ContentType == "" && !forceDisableProtoBuf {
 		protobufSchemeLock.RLock()
 		if protobufScheme.Recognizes(gvk) {
 			cfg.ContentType = runtime.ContentTypeProtobuf
diff --git a/pkg/client/apiutil/apimachinery_test.go b/pkg/client/apiutil/apimachinery_test.go
index aac58167ab..122c5cc542 100644
--- a/pkg/client/apiutil/apimachinery_test.go
+++ b/pkg/client/apiutil/apimachinery_test.go
@@ -18,6 +18,7 @@ package apiutil_test
 
 import (
 	"context"
+	"strconv"
 	"testing"
 
 	gmg "github.com/onsi/gomega"
@@ -32,127 +33,129 @@ import (
 )
 
 func TestApiMachinery(t *testing.T) {
-	restCfg, tearDownFn := setupEnvtest(t)
-	defer tearDownFn(t)
-
-	// Details of the GVK registered at initialization.
-	initialGvk := metav1.GroupVersionKind{
-		Group:   "crew.example.com",
-		Version: "v1",
-		Kind:    "Driver",
-	}
+	for _, aggregatedDiscovery := range []bool{true, false} {
+		t.Run("aggregatedDiscovery="+strconv.FormatBool(aggregatedDiscovery), func(t *testing.T) {
+			restCfg := setupEnvtest(t, !aggregatedDiscovery)
 
-	// A set of GVKs to register at runtime with varying properties.
-	runtimeGvks := []struct {
-		name   string
-		gvk    metav1.GroupVersionKind
-		plural string
-	}{
-		{
-			name: "new Kind and Version added to existing Group",
-			gvk: metav1.GroupVersionKind{
-				Group:   "crew.example.com",
-				Version: "v1alpha1",
-				Kind:    "Passenger",
-			},
-			plural: "passengers",
-		},
-		{
-			name: "new Kind added to existing Group and Version",
-			gvk: metav1.GroupVersionKind{
+			// Details of the GVK registered at initialization.
+			initialGvk := metav1.GroupVersionKind{
 				Group:   "crew.example.com",
 				Version: "v1",
-				Kind:    "Garage",
-			},
-			plural: "garages",
-		},
-		{
-			name: "new GVK",
-			gvk: metav1.GroupVersionKind{
-				Group:   "inventory.example.com",
-				Version: "v1",
-				Kind:    "Taxi",
-			},
-			plural: "taxis",
-		},
-	}
+				Kind:    "Driver",
+			}
+
+			// A set of GVKs to register at runtime with varying properties.
+			runtimeGvks := []struct {
+				name   string
+				gvk    metav1.GroupVersionKind
+				plural string
+			}{
+				{
+					name: "new Kind and Version added to existing Group",
+					gvk: metav1.GroupVersionKind{
+						Group:   "crew.example.com",
+						Version: "v1alpha1",
+						Kind:    "Passenger",
+					},
+					plural: "passengers",
+				},
+				{
+					name: "new Kind added to existing Group and Version",
+					gvk: metav1.GroupVersionKind{
+						Group:   "crew.example.com",
+						Version: "v1",
+						Kind:    "Garage",
+					},
+					plural: "garages",
+				},
+				{
+					name: "new GVK",
+					gvk: metav1.GroupVersionKind{
+						Group:   "inventory.example.com",
+						Version: "v1",
+						Kind:    "Taxi",
+					},
+					plural: "taxis",
+				},
+			}
+
+			t.Run("IsGVKNamespaced should report scope for GVK registered at initialization", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				httpClient, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
 
-	t.Run("IsGVKNamespaced should report scope for GVK registered at initialization", func(t *testing.T) {
-		g := gmg.NewWithT(t)
-
-		httpClient, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		s := scheme.Scheme
-		err = apiextensionsv1.AddToScheme(s)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		// Query the scope of a GVK that was registered at initialization.
-		scope, err := apiutil.IsGVKNamespaced(
-			schema.GroupVersionKind(initialGvk),
-			lazyRestMapper,
-		)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(scope).To(gmg.BeTrue())
-	})
-
-	for _, runtimeGvk := range runtimeGvks {
-		t.Run("IsGVKNamespaced should report scope for "+runtimeGvk.name, func(t *testing.T) {
-			g := gmg.NewWithT(t)
-			ctx := context.Background()
-
-			httpClient, err := rest.HTTPClientFor(restCfg)
-			g.Expect(err).NotTo(gmg.HaveOccurred())
-
-			lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-			g.Expect(err).NotTo(gmg.HaveOccurred())
-
-			s := scheme.Scheme
-			err = apiextensionsv1.AddToScheme(s)
-			g.Expect(err).NotTo(gmg.HaveOccurred())
-
-			c, err := client.New(restCfg, client.Options{Scheme: s})
-			g.Expect(err).NotTo(gmg.HaveOccurred())
-
-			// Run a valid query to initialize cache.
-			scope, err := apiutil.IsGVKNamespaced(
-				schema.GroupVersionKind(initialGvk),
-				lazyRestMapper,
-			)
-			g.Expect(err).NotTo(gmg.HaveOccurred())
-			g.Expect(scope).To(gmg.BeTrue())
-
-			// Register a new CRD at runtime.
-			crd := newCRD(ctx, g, c, runtimeGvk.gvk.Group, runtimeGvk.gvk.Kind, runtimeGvk.plural)
-			version := crd.Spec.Versions[0]
-			version.Name = runtimeGvk.gvk.Version
-			version.Storage = true
-			version.Served = true
-			crd.Spec.Versions = []apiextensionsv1.CustomResourceDefinitionVersion{version}
-			crd.Spec.Scope = apiextensionsv1.NamespaceScoped
-
-			g.Expect(c.Create(ctx, crd)).To(gmg.Succeed())
-			t.Cleanup(func() {
-				g.Expect(c.Delete(ctx, crd)).To(gmg.Succeed())
-			})
+				lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				s := scheme.Scheme
+				err = apiextensionsv1.AddToScheme(s)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
 
-			// Wait until the CRD is registered.
-			g.Eventually(func(g gmg.Gomega) {
-				isRegistered, err := isCrdRegistered(restCfg, runtimeGvk.gvk)
+				// Query the scope of a GVK that was registered at initialization.
+				scope, err := apiutil.IsGVKNamespaced(
+					schema.GroupVersionKind(initialGvk),
+					lazyRestMapper,
+				)
 				g.Expect(err).NotTo(gmg.HaveOccurred())
-				g.Expect(isRegistered).To(gmg.BeTrue())
-			}).Should(gmg.Succeed(), "GVK should be available")
-
-			// Query the scope of the GVK registered at runtime.
-			scope, err = apiutil.IsGVKNamespaced(
-				schema.GroupVersionKind(runtimeGvk.gvk),
-				lazyRestMapper,
-			)
-			g.Expect(err).NotTo(gmg.HaveOccurred())
-			g.Expect(scope).To(gmg.BeTrue())
+				g.Expect(scope).To(gmg.BeTrue())
+			})
+
+			for _, runtimeGvk := range runtimeGvks {
+				t.Run("IsGVKNamespaced should report scope for "+runtimeGvk.name, func(t *testing.T) {
+					g := gmg.NewWithT(t)
+
+					httpClient, err := rest.HTTPClientFor(restCfg)
+					g.Expect(err).NotTo(gmg.HaveOccurred())
+
+					lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+					g.Expect(err).NotTo(gmg.HaveOccurred())
+
+					s := scheme.Scheme
+					err = apiextensionsv1.AddToScheme(s)
+					g.Expect(err).NotTo(gmg.HaveOccurred())
+
+					c, err := client.New(restCfg, client.Options{Scheme: s})
+					g.Expect(err).NotTo(gmg.HaveOccurred())
+
+					// Run a valid query to initialize cache.
+					scope, err := apiutil.IsGVKNamespaced(
+						schema.GroupVersionKind(initialGvk),
+						lazyRestMapper,
+					)
+					g.Expect(err).NotTo(gmg.HaveOccurred())
+					g.Expect(scope).To(gmg.BeTrue())
+
+					// Register a new CRD at runtime.
+					crd := newCRD(t.Context(), g, c, runtimeGvk.gvk.Group, runtimeGvk.gvk.Kind, runtimeGvk.plural)
+					version := crd.Spec.Versions[0]
+					version.Name = runtimeGvk.gvk.Version
+					version.Storage = true
+					version.Served = true
+					crd.Spec.Versions = []apiextensionsv1.CustomResourceDefinitionVersion{version}
+					crd.Spec.Scope = apiextensionsv1.NamespaceScoped
+
+					g.Expect(c.Create(t.Context(), crd)).To(gmg.Succeed())
+					t.Cleanup(func() {
+						g.Expect(c.Delete(context.Background(), crd)).To(gmg.Succeed()) //nolint:forbidigo //t.Context is cancelled in t.Cleanup
+					})
+
+					// Wait until the CRD is registered.
+					g.Eventually(func(g gmg.Gomega) {
+						isRegistered, err := isCrdRegistered(restCfg, runtimeGvk.gvk)
+						g.Expect(err).NotTo(gmg.HaveOccurred())
+						g.Expect(isRegistered).To(gmg.BeTrue())
+					}).Should(gmg.Succeed(), "GVK should be available")
+
+					// Query the scope of the GVK registered at runtime.
+					scope, err = apiutil.IsGVKNamespaced(
+						schema.GroupVersionKind(runtimeGvk.gvk),
+						lazyRestMapper,
+					)
+					g.Expect(err).NotTo(gmg.HaveOccurred())
+					g.Expect(scope).To(gmg.BeTrue())
+				})
+			}
 		})
 	}
 }
diff --git a/pkg/client/apiutil/restmapper.go b/pkg/client/apiutil/restmapper.go
index 927be22b4e..7a7a0d1145 100644
--- a/pkg/client/apiutil/restmapper.go
+++ b/pkg/client/apiutil/restmapper.go
@@ -28,6 +28,7 @@ import (
 	"k8s.io/client-go/discovery"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/restmapper"
+	"k8s.io/utils/ptr"
 )
 
 // NewDynamicRESTMapper returns a dynamic RESTMapper for cfg. The dynamic
@@ -41,6 +42,7 @@ func NewDynamicRESTMapper(cfg *rest.Config, httpClient *http.Client) (meta.RESTM
 	if err != nil {
 		return nil, err
 	}
+
 	return &mapper{
 		mapper:      restmapper.NewDiscoveryRESTMapper([]*restmapper.APIGroupResources{}),
 		client:      client,
@@ -53,11 +55,15 @@ func NewDynamicRESTMapper(cfg *rest.Config, httpClient *http.Client) (meta.RESTM
 // client for discovery information to do REST mappings.
 type mapper struct {
 	mapper      meta.RESTMapper
-	client      discovery.DiscoveryInterface
+	client      discovery.AggregatedDiscoveryInterface
 	knownGroups map[string]*restmapper.APIGroupResources
 	apiGroups   map[string]*metav1.APIGroup
 
+	initialDiscoveryDone bool
+
 	// mutex to provide thread-safe mapper reloading.
+	// It protects all fields in the mapper as well as methods
+	// that have the `Locked` suffix.
 	mu sync.RWMutex
 }
 
@@ -159,28 +165,42 @@ func (m *mapper) addKnownGroupAndReload(groupName string, versions ...string) er
 		versions = nil
 	}
 
+	m.mu.Lock()
+	defer m.mu.Unlock()
 	// If no specific versions are set by user, we will scan all available ones for the API group.
 	// This operation requires 2 requests: /api and /apis, but only once. For all subsequent calls
 	// this data will be taken from cache.
-	if len(versions) == 0 {
-		apiGroup, err := m.findAPIGroupByName(groupName)
+	//
+	// We always run this once, because if the server supports aggregated discovery, this will
+	// load everything with two api calls which we assume is overall cheaper.
+	if len(versions) == 0 || !m.initialDiscoveryDone {
+		apiGroup, didAggregatedDiscovery, err := m.findAPIGroupByNameAndMaybeAggregatedDiscoveryLocked(groupName)
 		if err != nil {
 			return err
 		}
-		if apiGroup != nil {
+		if apiGroup != nil && len(versions) == 0 {
 			for _, version := range apiGroup.Versions {
 				versions = append(versions, version.Version)
 			}
 		}
-	}
-
-	m.mu.Lock()
-	defer m.mu.Unlock()
 
-	// Create or fetch group resources from cache.
-	groupResources := &restmapper.APIGroupResources{
-		Group:              metav1.APIGroup{Name: groupName},
-		VersionedResources: make(map[string][]metav1.APIResource),
+		// No need to do anything further if aggregatedDiscovery is supported and we did a lookup
+		if didAggregatedDiscovery {
+			failedGroups := make(map[schema.GroupVersion]error)
+			for _, version := range versions {
+				if m.knownGroups[groupName] == nil || m.knownGroups[groupName].VersionedResources[version] == nil {
+					failedGroups[schema.GroupVersion{Group: groupName, Version: version}] = &meta.NoResourceMatchError{
+						PartialResource: schema.GroupVersionResource{
+							Group:   groupName,
+							Version: version,
+						}}
+				}
+			}
+			if len(failedGroups) > 0 {
+				return ptr.To(ErrResourceDiscoveryFailed(failedGroups))
+			}
+			return nil
+		}
 	}
 
 	// Update information for group resources about versioned resources.
@@ -194,13 +214,26 @@ func (m *mapper) addKnownGroupAndReload(groupName string, versions ...string) er
 		return fmt.Errorf("failed to get API group resources: %w", err)
 	}
 
-	if _, ok := m.knownGroups[groupName]; ok {
-		groupResources = m.knownGroups[groupName]
-	}
+	m.addGroupVersionResourcesToCacheAndReloadLocked(groupVersionResources)
+	return nil
+}
 
+// addGroupVersionResourcesToCacheAndReloadLocked does what the name suggests. The mutex must be held when
+// calling it.
+func (m *mapper) addGroupVersionResourcesToCacheAndReloadLocked(gvr map[schema.GroupVersion]*metav1.APIResourceList) {
 	// Update information for group resources about the API group by adding new versions.
-	// Ignore the versions that are already registered.
-	for groupVersion, resources := range groupVersionResources {
+	// Ignore the versions that are already registered
+	for groupVersion, resources := range gvr {
+		var groupResources *restmapper.APIGroupResources
+		if _, ok := m.knownGroups[groupVersion.Group]; ok {
+			groupResources = m.knownGroups[groupVersion.Group]
+		} else {
+			groupResources = &restmapper.APIGroupResources{
+				Group:              metav1.APIGroup{Name: groupVersion.Group},
+				VersionedResources: make(map[string][]metav1.APIResource),
+			}
+		}
+
 		version := groupVersion.Version
 
 		groupResources.VersionedResources[version] = resources.APIResources
@@ -213,61 +246,65 @@ func (m *mapper) addKnownGroupAndReload(groupName string, versions ...string) er
 		}
 
 		if !found {
-			groupResources.Group.Versions = append(groupResources.Group.Versions, metav1.GroupVersionForDiscovery{
-				GroupVersion: metav1.GroupVersion{Group: groupName, Version: version}.String(),
+			gv := metav1.GroupVersionForDiscovery{
+				GroupVersion: metav1.GroupVersion{Group: groupVersion.Group, Version: version}.String(),
 				Version:      version,
-			})
+			}
+
+			// Prepend if preferred version, else append. The upstream DiscoveryRestMappper assumes
+			// the first version is the preferred one: https://github.com/kubernetes/kubernetes/blob/ef54ac803b712137871c1a1f8d635d50e69ffa6c/staging/src/k8s.io/apimachinery/pkg/api/meta/restmapper.go#L458-L461
+			if group, ok := m.apiGroups[groupVersion.Group]; ok && group.PreferredVersion.Version == version {
+				groupResources.Group.Versions = append([]metav1.GroupVersionForDiscovery{gv}, groupResources.Group.Versions...)
+			} else {
+				groupResources.Group.Versions = append(groupResources.Group.Versions, gv)
+			}
 		}
-	}
 
-	// Update data in the cache.
-	m.knownGroups[groupName] = groupResources
+		// Update data in the cache.
+		m.knownGroups[groupVersion.Group] = groupResources
+	}
 
-	// Finally, update the group with received information and regenerate the mapper.
+	// Finally, reload the mapper.
 	updatedGroupResources := make([]*restmapper.APIGroupResources, 0, len(m.knownGroups))
 	for _, agr := range m.knownGroups {
 		updatedGroupResources = append(updatedGroupResources, agr)
 	}
 
 	m.mapper = restmapper.NewDiscoveryRESTMapper(updatedGroupResources)
-	return nil
 }
 
-// findAPIGroupByNameLocked returns API group by its name.
-func (m *mapper) findAPIGroupByName(groupName string) (*metav1.APIGroup, error) {
-	// Looking in the cache first.
-	{
-		m.mu.RLock()
-		group, ok := m.apiGroups[groupName]
-		m.mu.RUnlock()
-		if ok {
-			return group, nil
-		}
+// findAPIGroupByNameAndMaybeAggregatedDiscoveryLocked tries to find the passed apiGroup.
+// If the server supports aggregated discovery, it will always perform that.
+func (m *mapper) findAPIGroupByNameAndMaybeAggregatedDiscoveryLocked(groupName string) (_ *metav1.APIGroup, didAggregatedDiscovery bool, _ error) {
+	// Looking in the cache first
+	group, ok := m.apiGroups[groupName]
+	if ok {
+		return group, false, nil
 	}
 
 	// Update the cache if nothing was found.
-	apiGroups, err := m.client.ServerGroups()
+	apiGroups, maybeResources, _, err := m.client.GroupsAndMaybeResources()
 	if err != nil {
-		return nil, fmt.Errorf("failed to get server groups: %w", err)
+		return nil, false, fmt.Errorf("failed to get server groups: %w", err)
 	}
 	if len(apiGroups.Groups) == 0 {
-		return nil, fmt.Errorf("received an empty API groups list")
+		return nil, false, fmt.Errorf("received an empty API groups list")
 	}
 
-	m.mu.Lock()
+	m.initialDiscoveryDone = true
 	for i := range apiGroups.Groups {
 		group := &apiGroups.Groups[i]
 		m.apiGroups[group.Name] = group
 	}
-	m.mu.Unlock()
+	if len(maybeResources) > 0 {
+		didAggregatedDiscovery = true
+		m.addGroupVersionResourcesToCacheAndReloadLocked(maybeResources)
+	}
 
 	// Looking in the cache again.
-	m.mu.RLock()
-	defer m.mu.RUnlock()
-
 	// Don't return an error here if the API group is not present.
 	// The reloaded RESTMapper will take care of returning a NoMatchError.
-	return m.apiGroups[groupName], nil
+	return m.apiGroups[groupName], didAggregatedDiscovery, nil
 }
 
 // fetchGroupVersionResourcesLocked fetches the resources for the specified group and its versions.
@@ -283,10 +320,10 @@ func (m *mapper) fetchGroupVersionResourcesLocked(groupName string, versions ...
 		if apierrors.IsNotFound(err) {
 			// If the version is not found, we remove the group from the cache
 			// so it gets refreshed on the next call.
-			if m.isAPIGroupCached(groupVersion) {
+			if m.isAPIGroupCachedLocked(groupVersion) {
 				delete(m.apiGroups, groupName)
 			}
-			if m.isGroupVersionCached(groupVersion) {
+			if m.isGroupVersionCachedLocked(groupVersion) {
 				delete(m.knownGroups, groupName)
 			}
 			continue
@@ -308,8 +345,8 @@ func (m *mapper) fetchGroupVersionResourcesLocked(groupName string, versions ...
 	return groupVersionResources, nil
 }
 
-// isGroupVersionCached checks if a version for a group is cached in the known groups cache.
-func (m *mapper) isGroupVersionCached(gv schema.GroupVersion) bool {
+// isGroupVersionCachedLocked checks if a version for a group is cached in the known groups cache.
+func (m *mapper) isGroupVersionCachedLocked(gv schema.GroupVersion) bool {
 	if cachedGroup, ok := m.knownGroups[gv.Group]; ok {
 		_, cached := cachedGroup.VersionedResources[gv.Version]
 		return cached
@@ -318,8 +355,8 @@ func (m *mapper) isGroupVersionCached(gv schema.GroupVersion) bool {
 	return false
 }
 
-// isAPIGroupCached checks if a version for a group is cached in the api groups cache.
-func (m *mapper) isAPIGroupCached(gv schema.GroupVersion) bool {
+// isAPIGroupCachedLocked checks if a version for a group is cached in the api groups cache.
+func (m *mapper) isAPIGroupCachedLocked(gv schema.GroupVersion) bool {
 	cachedGroup, ok := m.apiGroups[gv.Group]
 	if !ok {
 		return false
diff --git a/pkg/client/apiutil/restmapper_test.go b/pkg/client/apiutil/restmapper_test.go
index 2e34a98735..51807f12de 100644
--- a/pkg/client/apiutil/restmapper_test.go
+++ b/pkg/client/apiutil/restmapper_test.go
@@ -20,6 +20,8 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"strconv"
+	"sync"
 	"testing"
 
 	_ "github.com/onsi/ginkgo/v2"
@@ -68,607 +70,705 @@ func (crt *countingRoundTripper) Reset() {
 	crt.requestCount = 0
 }
 
-func setupEnvtest(t *testing.T) (*rest.Config, func(t *testing.T)) {
+func setupEnvtest(t *testing.T, disableAggregatedDiscovery bool) *rest.Config {
 	t.Log("Setup envtest")
 
 	g := gmg.NewWithT(t)
 	testEnv := &envtest.Environment{
 		CRDDirectoryPaths: []string{"testdata"},
 	}
+	if disableAggregatedDiscovery {
+		testEnv.DownloadBinaryAssets = true
+		testEnv.DownloadBinaryAssetsVersion = "v1.28.0"
+		binaryAssetsDirectory, err := envtest.SetupEnvtestDefaultBinaryAssetsDirectory()
+		g.Expect(err).ToNot(gmg.HaveOccurred())
+		testEnv.BinaryAssetsDirectory = binaryAssetsDirectory
+		testEnv.ControlPlane.GetAPIServer().Configure().Append("feature-gates", "AggregatedDiscoveryEndpoint=false")
+	}
 
 	cfg, err := testEnv.Start()
 	g.Expect(err).NotTo(gmg.HaveOccurred())
 	g.Expect(cfg).NotTo(gmg.BeNil())
 
-	teardownFunc := func(t *testing.T) {
+	t.Cleanup(func() {
 		t.Log("Stop envtest")
 		g.Expect(testEnv.Stop()).To(gmg.Succeed())
-	}
+	})
 
-	return cfg, teardownFunc
+	return cfg
 }
 
 func TestLazyRestMapperProvider(t *testing.T) {
-	restCfg, tearDownFn := setupEnvtest(t)
-	defer tearDownFn(t)
-
-	t.Run("LazyRESTMapper should fetch data based on the request", func(t *testing.T) {
-		g := gmg.NewWithT(t)
-
-		// For each new group it performs just one request to the API server:
-		// GET https://host/apis/<group>/<version>
-
-		httpClient, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		crt := newCountingRoundTripper(httpClient.Transport)
-		httpClient.Transport = crt
-
-		lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		// There are no requests before any call
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
-
-		mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "apps", Kind: "deployment"}, "v1")
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("deployment"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(1))
-
-		mappings, err := lazyRestMapper.RESTMappings(schema.GroupKind{Group: "", Kind: "pod"}, "v1")
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mappings).To(gmg.HaveLen(1))
-		g.Expect(mappings[0].GroupVersionKind.Kind).To(gmg.Equal("pod"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
-
-		kind, err := lazyRestMapper.KindFor(schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "ingresses"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(kind.Kind).To(gmg.Equal("Ingress"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(3))
-
-		kinds, err := lazyRestMapper.KindsFor(schema.GroupVersionResource{Group: "authentication.k8s.io", Version: "v1", Resource: "tokenreviews"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(kinds).To(gmg.HaveLen(1))
-		g.Expect(kinds[0].Kind).To(gmg.Equal("TokenReview"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(4))
-
-		resource, err := lazyRestMapper.ResourceFor(schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1", Resource: "priorityclasses"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(resource.Resource).To(gmg.Equal("priorityclasses"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(5))
-
-		resources, err := lazyRestMapper.ResourcesFor(schema.GroupVersionResource{Group: "policy", Version: "v1", Resource: "poddisruptionbudgets"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(resources).To(gmg.HaveLen(1))
-		g.Expect(resources[0].Resource).To(gmg.Equal("poddisruptionbudgets"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(6))
-	})
-
-	t.Run("LazyRESTMapper should cache fetched data and doesn't perform any additional requests", func(t *testing.T) {
-		g := gmg.NewWithT(t)
-
-		httpClient, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		crt := newCountingRoundTripper(httpClient.Transport)
-		httpClient.Transport = crt
-
-		lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
-
-		mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "apps", Kind: "deployment"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("deployment"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(3))
-
-		// Data taken from cache - there are no more additional requests.
-
-		mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "apps", Kind: "deployment"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("deployment"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(3))
-
-		kind, err := lazyRestMapper.KindFor((schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployment"}))
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(kind.Kind).To(gmg.Equal("Deployment"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(3))
-
-		resource, err := lazyRestMapper.ResourceFor((schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployment"}))
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(resource.Resource).To(gmg.Equal("deployments"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(3))
-	})
-
-	t.Run("LazyRESTMapper should work correctly with empty versions list", func(t *testing.T) {
-		g := gmg.NewWithT(t)
-
-		httpClient, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		crt := newCountingRoundTripper(httpClient.Transport)
-		httpClient.Transport = crt
-
-		lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
-
-		// crew.example.com has 2 versions: v1 and v2
-
-		// If no versions were provided by user, we fetch all of them.
-		// Here we expect 4 calls.
-		// To initialize:
-		// 	#1: GET https://host/api
-		// 	#2: GET https://host/apis
-		// Then, for each version it performs one request to the API server:
-		// 	#3: GET https://host/apis/crew.example.com/v1
-		//	#4: GET https://host/apis/crew.example.com/v2
-		mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(4))
-
-		// All subsequent calls won't send requests to the server.
-		mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(4))
-	})
-
-	t.Run("LazyRESTMapper should work correctly with multiple API group versions", func(t *testing.T) {
-		g := gmg.NewWithT(t)
-
-		httpClient, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		crt := newCountingRoundTripper(httpClient.Transport)
-		httpClient.Transport = crt
-
-		lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
-
-		// We explicitly ask for 2 versions: v1 and v2.
-		// For each version it performs one request to the API server:
-		// 	#1: GET https://host/apis/crew.example.com/v1
-		//	#2: GET https://host/apis/crew.example.com/v2
-		mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"}, "v1", "v2")
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
-
-		// All subsequent calls won't send requests to the server as everything is stored in the cache.
-		mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"}, "v1")
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
-
-		mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
-	})
-
-	t.Run("LazyRESTMapper should work correctly with different API group versions", func(t *testing.T) {
-		g := gmg.NewWithT(t)
-
-		httpClient, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		crt := newCountingRoundTripper(httpClient.Transport)
-		httpClient.Transport = crt
-
-		lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
-
-		// Now we want resources for crew.example.com/v1 version only.
-		// Here we expect 1 call:
-		// #1: GET https://host/apis/crew.example.com/v1
-		mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"}, "v1")
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(1))
-
-		// Get additional resources from v2.
-		// It sends another request:
-		// #2: GET https://host/apis/crew.example.com/v2
-		mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"}, "v2")
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
-
-		// No subsequent calls require additional API requests.
-		mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"}, "v1")
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
-
-		mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"}, "v1", "v2")
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
-	})
-
-	t.Run("LazyRESTMapper should return an error if the group doesn't exist", func(t *testing.T) {
-		g := gmg.NewWithT(t)
-
-		// After initialization for each invalid group the mapper performs just 1 request to the API server.
-
-		httpClient, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		crt := newCountingRoundTripper(httpClient.Transport)
-		httpClient.Transport = crt
-
-		lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		// A version is specified but the group doesn't exist.
-		// For each group, we expect 1 call to the version-specific discovery endpoint:
-		// 	#1: GET https://host/apis/<group>/<version>
-
-		_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "INVALID1"}, "v1")
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(1))
-
-		_, err = lazyRestMapper.RESTMappings(schema.GroupKind{Group: "INVALID2"}, "v1")
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
-
-		_, err = lazyRestMapper.KindFor(schema.GroupVersionResource{Group: "INVALID3", Version: "v1"})
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(3))
-
-		_, err = lazyRestMapper.KindsFor(schema.GroupVersionResource{Group: "INVALID4", Version: "v1"})
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(4))
-
-		_, err = lazyRestMapper.ResourceFor(schema.GroupVersionResource{Group: "INVALID5", Version: "v1"})
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(5))
-
-		_, err = lazyRestMapper.ResourcesFor(schema.GroupVersionResource{Group: "INVALID6", Version: "v1"})
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(6))
-
-		// No version is specified but the group doesn't exist.
-		// For each group, we expect 2 calls to discover all group versions:
-		// 	#1: GET https://host/api
-		// 	#2: GET https://host/apis
-
-		_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "INVALID7"})
-		g.Expect(err).To(beNoMatchError())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(8))
-
-		_, err = lazyRestMapper.RESTMappings(schema.GroupKind{Group: "INVALID8"})
-		g.Expect(err).To(beNoMatchError())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(10))
-
-		_, err = lazyRestMapper.KindFor(schema.GroupVersionResource{Group: "INVALID9"})
-		g.Expect(err).To(beNoMatchError())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(12))
-
-		_, err = lazyRestMapper.KindsFor(schema.GroupVersionResource{Group: "INVALID10"})
-		g.Expect(err).To(beNoMatchError())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(14))
-
-		_, err = lazyRestMapper.ResourceFor(schema.GroupVersionResource{Group: "INVALID11"})
-		g.Expect(err).To(beNoMatchError())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(16))
-
-		_, err = lazyRestMapper.ResourcesFor(schema.GroupVersionResource{Group: "INVALID12"})
-		g.Expect(err).To(beNoMatchError())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(18))
-	})
-
-	t.Run("LazyRESTMapper should return an error if a resource doesn't exist", func(t *testing.T) {
-		g := gmg.NewWithT(t)
-
-		// For each invalid resource the mapper performs just 1 request to the API server.
-
-		httpClient, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		crt := newCountingRoundTripper(httpClient.Transport)
-		httpClient.Transport = crt
-
-		lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "apps", Kind: "INVALID"}, "v1")
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(1))
-
-		_, err = lazyRestMapper.RESTMappings(schema.GroupKind{Group: "", Kind: "INVALID"}, "v1")
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
-
-		_, err = lazyRestMapper.KindFor(schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "INVALID"})
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(3))
-
-		_, err = lazyRestMapper.KindsFor(schema.GroupVersionResource{Group: "authentication.k8s.io", Version: "v1", Resource: "INVALID"})
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(4))
-
-		_, err = lazyRestMapper.ResourceFor(schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1", Resource: "INVALID"})
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(5))
-
-		_, err = lazyRestMapper.ResourcesFor(schema.GroupVersionResource{Group: "policy", Version: "v1", Resource: "INVALID"})
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(6))
-	})
-
-	t.Run("LazyRESTMapper should return an error if the version doesn't exist", func(t *testing.T) {
-		g := gmg.NewWithT(t)
-
-		// After initialization, for each invalid resource mapper performs 1 requests to the API server.
-
-		httpClient, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		crt := newCountingRoundTripper(httpClient.Transport)
-		httpClient.Transport = crt
-
-		lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "apps", Kind: "deployment"}, "INVALID")
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(1))
-
-		_, err = lazyRestMapper.RESTMappings(schema.GroupKind{Group: "", Kind: "pod"}, "INVALID")
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
-
-		_, err = lazyRestMapper.KindFor(schema.GroupVersionResource{Group: "networking.k8s.io", Version: "INVALID", Resource: "ingresses"})
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(3))
-
-		_, err = lazyRestMapper.KindsFor(schema.GroupVersionResource{Group: "authentication.k8s.io", Version: "INVALID", Resource: "tokenreviews"})
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(4))
-
-		_, err = lazyRestMapper.ResourceFor(schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "INVALID", Resource: "priorityclasses"})
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(5))
-
-		_, err = lazyRestMapper.ResourcesFor(schema.GroupVersionResource{Group: "policy", Version: "INVALID", Resource: "poddisruptionbudgets"})
-		g.Expect(err).To(gmg.HaveOccurred())
-		g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(6))
-	})
-
-	t.Run("LazyRESTMapper should work correctly if the version isn't specified", func(t *testing.T) {
-		g := gmg.NewWithT(t)
-
-		httpClient, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		kind, err := lazyRestMapper.KindFor(schema.GroupVersionResource{Group: "networking.k8s.io", Resource: "ingress"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(kind.Version).ToNot(gmg.BeEmpty())
-
-		kinds, err := lazyRestMapper.KindsFor(schema.GroupVersionResource{Group: "authentication.k8s.io", Resource: "tokenreviews"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(kinds).ToNot(gmg.BeEmpty())
-		g.Expect(kinds[0].Version).ToNot(gmg.BeEmpty())
-
-		resorce, err := lazyRestMapper.ResourceFor(schema.GroupVersionResource{Group: "scheduling.k8s.io", Resource: "priorityclasses"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(resorce.Version).ToNot(gmg.BeEmpty())
-
-		resorces, err := lazyRestMapper.ResourcesFor(schema.GroupVersionResource{Group: "policy", Resource: "poddisruptionbudgets"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(kinds).ToNot(gmg.BeEmpty())
-		g.Expect(resorces[0].Version).ToNot(gmg.BeEmpty())
-	})
-
-	t.Run("LazyRESTMapper can fetch CRDs if they were created at runtime", func(t *testing.T) {
-		g := gmg.NewWithT(t)
-
-		// To fetch all versions mapper does 2 requests:
-		// GET https://host/api
-		// GET https://host/apis
-		// Then, for each version it performs just one request to the API server as usual:
-		// GET https://host/apis/<group>/<version>
-
-		httpClient, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		crt := newCountingRoundTripper(httpClient.Transport)
-		httpClient.Transport = crt
-
-		lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		// There are no requests before any call
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
-
-		// Since we don't specify what version we expect, restmapper will fetch them all and search there.
-		// To fetch a list of available versions
-		//  #1: GET https://host/api
-		//  #2: GET https://host/apis
-		// Then, for each currently registered version:
-		// 	#3: GET https://host/apis/crew.example.com/v1
-		//	#4: GET https://host/apis/crew.example.com/v2
-		mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(4))
-
-		s := scheme.Scheme
-		err = apiextensionsv1.AddToScheme(s)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		c, err := client.New(restCfg, client.Options{Scheme: s})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		// Register another CRD in runtime - "riders.crew.example.com".
-		createNewCRD(context.TODO(), g, c, "crew.example.com", "Rider", "riders")
-
-		// Wait a bit until the CRD is registered.
-		g.Eventually(func() error {
-			_, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "rider"})
-			return err
-		}).Should(gmg.Succeed())
-
-		// Since we don't specify what version we expect, restmapper will fetch them all and search there.
-		// To fetch a list of available versions
-		//  #1: GET https://host/api
-		//  #2: GET https://host/apis
-		// Then, for each currently registered version:
-		// 	#3: GET https://host/apis/crew.example.com/v1
-		//	#4: GET https://host/apis/crew.example.com/v2
-		mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "rider"})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("rider"))
-	})
-
-	t.Run("LazyRESTMapper should invalidate the group cache if a version is not found", func(t *testing.T) {
-		g := gmg.NewWithT(t)
-		ctx := context.Background()
-
-		httpClient, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		crt := newCountingRoundTripper(httpClient.Transport)
-		httpClient.Transport = crt
-
-		lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		s := scheme.Scheme
-		err = apiextensionsv1.AddToScheme(s)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		c, err := client.New(restCfg, client.Options{Scheme: s})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-
-		// Register a new CRD ina  new group to avoid collisions when deleting versions - "taxis.inventory.example.com".
-		group := "inventory.example.com"
-		kind := "Taxi"
-		plural := "taxis"
-		crdName := plural + "." + group
-		// Create a CRD with two versions: v1alpha1 and v1 where both are served and
-		// v1 is the storage version so we can easily remove v1alpha1 later.
-		crd := newCRD(ctx, g, c, group, kind, plural)
-		v1alpha1 := crd.Spec.Versions[0]
-		v1alpha1.Name = "v1alpha1"
-		v1alpha1.Storage = false
-		v1alpha1.Served = true
-		v1 := crd.Spec.Versions[0]
-		v1.Name = "v1"
-		v1.Storage = true
-		v1.Served = true
-		crd.Spec.Versions = []apiextensionsv1.CustomResourceDefinitionVersion{v1alpha1, v1}
-		g.Expect(c.Create(ctx, crd)).To(gmg.Succeed())
-		t.Cleanup(func() {
-			g.Expect(c.Delete(ctx, crd)).To(gmg.Succeed())
+	for _, aggregatedDiscovery := range []bool{true, false} {
+		t.Run("aggregatedDiscovery="+strconv.FormatBool(aggregatedDiscovery), func(t *testing.T) {
+			restCfg := setupEnvtest(t, !aggregatedDiscovery)
+
+			t.Run("LazyRESTMapper should fetch data based on the request", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				// For each new group it performs just one request to the API server:
+				// GET https://host/apis/<group>/<version>
+
+				httpClient, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				crt := newCountingRoundTripper(httpClient.Transport)
+				httpClient.Transport = crt
+
+				lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				// There are no requests before any call
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
+
+				mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "apps", Kind: "deployment"}, "v1")
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("deployment"))
+				expectedAPIRequestCount := 3
+				if aggregatedDiscovery {
+					expectedAPIRequestCount = 2
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				mappings, err := lazyRestMapper.RESTMappings(schema.GroupKind{Group: "", Kind: "pod"}, "v1")
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mappings).To(gmg.HaveLen(1))
+				g.Expect(mappings[0].GroupVersionKind.Kind).To(gmg.Equal("pod"))
+				if !aggregatedDiscovery {
+					expectedAPIRequestCount++
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				kind, err := lazyRestMapper.KindFor(schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "ingresses"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(kind.Kind).To(gmg.Equal("Ingress"))
+				if !aggregatedDiscovery {
+					expectedAPIRequestCount++
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				kinds, err := lazyRestMapper.KindsFor(schema.GroupVersionResource{Group: "authentication.k8s.io", Version: "v1", Resource: "tokenreviews"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(kinds).To(gmg.HaveLen(1))
+				g.Expect(kinds[0].Kind).To(gmg.Equal("TokenReview"))
+				if !aggregatedDiscovery {
+					expectedAPIRequestCount++
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				resource, err := lazyRestMapper.ResourceFor(schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1", Resource: "priorityclasses"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(resource.Resource).To(gmg.Equal("priorityclasses"))
+				if !aggregatedDiscovery {
+					expectedAPIRequestCount++
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				resources, err := lazyRestMapper.ResourcesFor(schema.GroupVersionResource{Group: "policy", Version: "v1", Resource: "poddisruptionbudgets"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(resources).To(gmg.HaveLen(1))
+				g.Expect(resources[0].Resource).To(gmg.Equal("poddisruptionbudgets"))
+				if !aggregatedDiscovery {
+					expectedAPIRequestCount++
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+			})
+
+			t.Run("LazyRESTMapper should cache fetched data and doesn't perform any additional requests", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				httpClient, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				crt := newCountingRoundTripper(httpClient.Transport)
+				httpClient.Transport = crt
+
+				lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
+
+				mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "apps", Kind: "deployment"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("deployment"))
+				expectedAPIRequestCount := 3
+				if aggregatedDiscovery {
+					expectedAPIRequestCount = 2
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				// Data taken from cache - there are no more additional requests.
+
+				mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "apps", Kind: "deployment"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("deployment"))
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				kind, err := lazyRestMapper.KindFor((schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployment"}))
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(kind.Kind).To(gmg.Equal("Deployment"))
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				resource, err := lazyRestMapper.ResourceFor((schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployment"}))
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(resource.Resource).To(gmg.Equal("deployments"))
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+			})
+
+			t.Run("LazyRESTMapper should work correctly with empty versions list", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				httpClient, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				crt := newCountingRoundTripper(httpClient.Transport)
+				httpClient.Transport = crt
+
+				lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
+
+				// crew.example.com has 2 versions: v1 and v2
+
+				// If no versions were provided by user, we fetch all of them.
+				// Here we expect 4 calls.
+				// To initialize:
+				// 	#1: GET https://host/api
+				// 	#2: GET https://host/apis
+				// Then, for each version it performs one request to the API server:
+				// 	#3: GET https://host/apis/crew.example.com/v1
+				//	#4: GET https://host/apis/crew.example.com/v2
+				mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
+				expectedAPIRequestCount := 4
+				if aggregatedDiscovery {
+					expectedAPIRequestCount = 2
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				// All subsequent calls won't send requests to the server.
+				mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+			})
+
+			t.Run("LazyRESTMapper should work correctly with multiple API group versions", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				httpClient, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				crt := newCountingRoundTripper(httpClient.Transport)
+				httpClient.Transport = crt
+
+				lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
+
+				// We explicitly ask for 2 versions: v1 and v2.
+				// For each version it performs one request to the API server:
+				// 	#1: GET https://host/apis/crew.example.com/v1
+				//	#2: GET https://host/apis/crew.example.com/v2
+				mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"}, "v1", "v2")
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
+				expectedAPIRequestCount := 4
+				if aggregatedDiscovery {
+					expectedAPIRequestCount = 2
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				// All subsequent calls won't send requests to the server as everything is stored in the cache.
+				mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"}, "v1")
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+			})
+
+			t.Run("LazyRESTMapper should work correctly with different API group versions", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				httpClient, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				crt := newCountingRoundTripper(httpClient.Transport)
+				httpClient.Transport = crt
+
+				lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
+
+				// Now we want resources for crew.example.com/v1 version only.
+				// Here we expect 1 call:
+				// #1: GET https://host/apis/crew.example.com/v1
+				mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"}, "v1")
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
+				expectedAPIRequestCount := 3
+				if aggregatedDiscovery {
+					expectedAPIRequestCount = 2
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				// Get additional resources from v2.
+				// It sends another request:
+				// #2: GET https://host/apis/crew.example.com/v2
+				mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"}, "v2")
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
+				if !aggregatedDiscovery {
+					expectedAPIRequestCount++
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				// No subsequent calls require additional API requests.
+				mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"}, "v1")
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"}, "v1", "v2")
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+			})
+
+			t.Run("LazyRESTMapper should return an error if the group doesn't exist", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				// After initialization for each invalid group the mapper performs just 1 request to the API server.
+
+				httpClient, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				crt := newCountingRoundTripper(httpClient.Transport)
+				httpClient.Transport = crt
+
+				lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				// A version is specified but the group doesn't exist.
+				// For each group, we expect 1 call to the version-specific discovery endpoint:
+				// 	#1: GET https://host/apis/<group>/<version>
+
+				_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "INVALID1"}, "v1")
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				expectedAPIRequestCount := 3
+				if aggregatedDiscovery {
+					expectedAPIRequestCount = 2
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+				crt.Reset()
+
+				_, err = lazyRestMapper.RESTMappings(schema.GroupKind{Group: "INVALID2"}, "v1")
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(1))
+
+				_, err = lazyRestMapper.KindFor(schema.GroupVersionResource{Group: "INVALID3", Version: "v1", Resource: "invalid"})
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
+
+				_, err = lazyRestMapper.KindsFor(schema.GroupVersionResource{Group: "INVALID4", Version: "v1", Resource: "invalid"})
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(3))
+
+				_, err = lazyRestMapper.ResourceFor(schema.GroupVersionResource{Group: "INVALID5", Version: "v1", Resource: "invalid"})
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(4))
+
+				_, err = lazyRestMapper.ResourcesFor(schema.GroupVersionResource{Group: "INVALID6", Version: "v1", Resource: "invalid"})
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(5))
+
+				// No version is specified but the group doesn't exist.
+				// For each group, we expect 2 calls to discover all group versions:
+				// 	#1: GET https://host/api
+				// 	#2: GET https://host/apis
+
+				_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "INVALID7"})
+				g.Expect(err).To(beNoMatchError())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(7))
+
+				_, err = lazyRestMapper.RESTMappings(schema.GroupKind{Group: "INVALID8"})
+				g.Expect(err).To(beNoMatchError())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(9))
+
+				_, err = lazyRestMapper.KindFor(schema.GroupVersionResource{Group: "INVALID9", Resource: "invalid"})
+				g.Expect(err).To(beNoMatchError())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(11))
+
+				_, err = lazyRestMapper.KindsFor(schema.GroupVersionResource{Group: "INVALID10", Resource: "invalid"})
+				g.Expect(err).To(beNoMatchError())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(13))
+
+				_, err = lazyRestMapper.ResourceFor(schema.GroupVersionResource{Group: "INVALID11", Resource: "invalid"})
+				g.Expect(err).To(beNoMatchError())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(15))
+
+				_, err = lazyRestMapper.ResourcesFor(schema.GroupVersionResource{Group: "INVALID12", Resource: "invalid"})
+				g.Expect(err).To(beNoMatchError())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(17))
+			})
+
+			t.Run("LazyRESTMapper should return an error if a resource doesn't exist", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				// For each invalid resource the mapper performs just 1 request to the API server.
+
+				httpClient, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				crt := newCountingRoundTripper(httpClient.Transport)
+				httpClient.Transport = crt
+
+				lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "apps", Kind: "INVALID"}, "v1")
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				expectedAPIRequestCount := 3
+				if aggregatedDiscovery {
+					expectedAPIRequestCount = 2
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+				crt.Reset()
+
+				_, err = lazyRestMapper.RESTMappings(schema.GroupKind{Group: "", Kind: "INVALID"}, "v1")
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(1))
+
+				_, err = lazyRestMapper.KindFor(schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "INVALID"})
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
+
+				_, err = lazyRestMapper.KindsFor(schema.GroupVersionResource{Group: "authentication.k8s.io", Version: "v1", Resource: "INVALID"})
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(3))
+
+				_, err = lazyRestMapper.ResourceFor(schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1", Resource: "INVALID"})
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(4))
+
+				_, err = lazyRestMapper.ResourcesFor(schema.GroupVersionResource{Group: "policy", Version: "v1", Resource: "INVALID"})
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(5))
+			})
+
+			t.Run("LazyRESTMapper should return an error if the version doesn't exist", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				// After initialization, for each invalid resource mapper performs 1 requests to the API server.
+
+				httpClient, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				crt := newCountingRoundTripper(httpClient.Transport)
+				httpClient.Transport = crt
+
+				lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "apps", Kind: "deployment"}, "INVALID")
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				expectedAPIRequestCount := 3
+				if aggregatedDiscovery {
+					expectedAPIRequestCount = 2
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+				crt.Reset()
+
+				_, err = lazyRestMapper.RESTMappings(schema.GroupKind{Group: "", Kind: "pod"}, "INVALID")
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(1))
+
+				_, err = lazyRestMapper.KindFor(schema.GroupVersionResource{Group: "networking.k8s.io", Version: "INVALID", Resource: "ingresses"})
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
+
+				_, err = lazyRestMapper.KindsFor(schema.GroupVersionResource{Group: "authentication.k8s.io", Version: "INVALID", Resource: "tokenreviews"})
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(3))
+
+				_, err = lazyRestMapper.ResourceFor(schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "INVALID", Resource: "priorityclasses"})
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(4))
+
+				_, err = lazyRestMapper.ResourcesFor(schema.GroupVersionResource{Group: "policy", Version: "INVALID", Resource: "poddisruptionbudgets"})
+				g.Expect(err).To(gmg.HaveOccurred())
+				g.Expect(meta.IsNoMatchError(err)).To(gmg.BeTrue())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(5))
+			})
+
+			t.Run("LazyRESTMapper should work correctly if the version isn't specified", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				httpClient, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				kind, err := lazyRestMapper.KindFor(schema.GroupVersionResource{Group: "networking.k8s.io", Resource: "ingress"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(kind.Version).ToNot(gmg.BeEmpty())
+
+				kinds, err := lazyRestMapper.KindsFor(schema.GroupVersionResource{Group: "authentication.k8s.io", Resource: "tokenreviews"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(kinds).ToNot(gmg.BeEmpty())
+				g.Expect(kinds[0].Version).ToNot(gmg.BeEmpty())
+
+				resorce, err := lazyRestMapper.ResourceFor(schema.GroupVersionResource{Group: "scheduling.k8s.io", Resource: "priorityclasses"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(resorce.Version).ToNot(gmg.BeEmpty())
+
+				resorces, err := lazyRestMapper.ResourcesFor(schema.GroupVersionResource{Group: "policy", Resource: "poddisruptionbudgets"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(kinds).ToNot(gmg.BeEmpty())
+				g.Expect(resorces[0].Version).ToNot(gmg.BeEmpty())
+			})
+
+			t.Run("LazyRESTMapper can fetch CRDs if they were created at runtime", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				// To fetch all versions mapper does 2 requests:
+				// GET https://host/api
+				// GET https://host/apis
+				// Then, for each version it performs just one request to the API server as usual:
+				// GET https://host/apis/<group>/<version>
+
+				httpClient, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				crt := newCountingRoundTripper(httpClient.Transport)
+				httpClient.Transport = crt
+
+				lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				// There are no requests before any call
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
+
+				// Since we don't specify what version we expect, restmapper will fetch them all and search there.
+				// To fetch a list of available versions
+				//  #1: GET https://host/api
+				//  #2: GET https://host/apis
+				// Then, for each currently registered version:
+				// 	#3: GET https://host/apis/crew.example.com/v1
+				//	#4: GET https://host/apis/crew.example.com/v2
+				mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "driver"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("driver"))
+				expectedAPIRequestCount := 4
+				if aggregatedDiscovery {
+					expectedAPIRequestCount = 2
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+
+				s := scheme.Scheme
+				err = apiextensionsv1.AddToScheme(s)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				c, err := client.New(restCfg, client.Options{Scheme: s})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				// Register another CRD in runtime - "riders.crew.example.com".
+				createNewCRD(t.Context(), g, c, "crew.example.com", "Rider", "riders")
+
+				// Wait a bit until the CRD is registered.
+				g.Eventually(func() error {
+					_, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "rider"})
+					return err
+				}).Should(gmg.Succeed())
+
+				// Since we don't specify what version we expect, restmapper will fetch them all and search there.
+				// To fetch a list of available versions
+				//  #1: GET https://host/api
+				//  #2: GET https://host/apis
+				// Then, for each currently registered version:
+				// 	#3: GET https://host/apis/crew.example.com/v1
+				//	#4: GET https://host/apis/crew.example.com/v2
+				mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: "crew.example.com", Kind: "rider"})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal("rider"))
+			})
+
+			t.Run("LazyRESTMapper should invalidate the group cache if a version is not found", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				httpClient, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				crt := newCountingRoundTripper(httpClient.Transport)
+				httpClient.Transport = crt
+
+				lazyRestMapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				s := scheme.Scheme
+				err = apiextensionsv1.AddToScheme(s)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				c, err := client.New(restCfg, client.Options{Scheme: s})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+
+				// Register a new CRD ina  new group to avoid collisions when deleting versions - "taxis.inventory.example.com".
+				group := "inventory.example.com"
+				kind := "Taxi"
+				plural := "taxis"
+				crdName := plural + "." + group
+				// Create a CRD with two versions: v1alpha1 and v1 where both are served and
+				// v1 is the storage version so we can easily remove v1alpha1 later.
+				crd := newCRD(t.Context(), g, c, group, kind, plural)
+				v1alpha1 := crd.Spec.Versions[0]
+				v1alpha1.Name = "v1alpha1"
+				v1alpha1.Storage = false
+				v1alpha1.Served = true
+				v1 := crd.Spec.Versions[0]
+				v1.Name = "v1"
+				v1.Storage = true
+				v1.Served = true
+				crd.Spec.Versions = []apiextensionsv1.CustomResourceDefinitionVersion{v1alpha1, v1}
+				g.Expect(c.Create(t.Context(), crd)).To(gmg.Succeed())
+				t.Cleanup(func() {
+					g.Expect(c.Delete(context.Background(), crd)).To(gmg.Succeed()) //nolint:forbidigo //t.Context is cancelled in t.Cleanup
+				})
+
+				// Wait until the CRD is registered.
+				discHTTP, err := rest.HTTPClientFor(restCfg)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				discClient, err := discovery.NewDiscoveryClientForConfigAndClient(restCfg, discHTTP)
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Eventually(func(g gmg.Gomega) {
+					_, err = discClient.ServerResourcesForGroupVersion(group + "/v1")
+					g.Expect(err).NotTo(gmg.HaveOccurred())
+				}).Should(gmg.Succeed(), "v1 should be available")
+
+				// There are no requests before any call
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
+
+				// Since we don't specify what version we expect, restmapper will fetch them all and search there.
+				// To fetch a list of available versions
+				//  #1: GET https://host/api
+				//  #2: GET https://host/apis
+				// Then, for all available versions:
+				// 	#3: GET https://host/apis/inventory.example.com/v1alpha1
+				//	#4: GET https://host/apis/inventory.example.com/v1
+				// This should fill the cache for apiGroups and versions.
+				mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: group, Kind: kind})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal(kind))
+				expectedAPIRequestCount := 4
+				if aggregatedDiscovery {
+					expectedAPIRequestCount = 2
+				}
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(expectedAPIRequestCount))
+				crt.Reset() // We reset the counter to check how many additional requests are made later.
+
+				// At this point v1alpha1 should be cached
+				_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: group, Kind: kind}, "v1alpha1")
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
+
+				// We update the CRD to only have v1 version.
+				g.Expect(c.Get(t.Context(), types.NamespacedName{Name: crdName}, crd)).To(gmg.Succeed())
+				for _, version := range crd.Spec.Versions {
+					if version.Name == "v1" {
+						v1 = version
+						break
+					}
+				}
+				crd.Spec.Versions = []apiextensionsv1.CustomResourceDefinitionVersion{v1}
+				g.Expect(c.Update(t.Context(), crd)).To(gmg.Succeed())
+
+				// We wait until v1alpha1 is not available anymore.
+				g.Eventually(func(g gmg.Gomega) {
+					_, err = discClient.ServerResourcesForGroupVersion(group + "/v1alpha1")
+					g.Expect(apierrors.IsNotFound(err)).To(gmg.BeTrue(), "v1alpha1 should not be available anymore")
+				}).Should(gmg.Succeed())
+
+				// Although v1alpha1 is not available anymore, the cache is not invalidated yet so it should return a mapping.
+				_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: group, Kind: kind}, "v1alpha1")
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
+
+				// We request Limo, which is not in the mapper because it doesn't exist.
+				// This will trigger a reload of the lazy mapper cache.
+				// Reloading the cache will read v2 again and since it's not available anymore, it should invalidate the cache.
+				// 	#1: GET https://host/apis/inventory.example.com/v1alpha1
+				// 	#2: GET https://host/apis/inventory.example.com/v1
+				_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: group, Kind: "Limo"})
+				g.Expect(err).To(beNoMatchError())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
+				crt.Reset()
+
+				// Now we request v1alpha1 again and it should return an error since the cache was invalidated.
+				// 	#1: GET https://host/apis/inventory.example.com/v1alpha1
+				_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: group, Kind: kind}, "v1alpha1")
+				g.Expect(err).To(beNoMatchError())
+				g.Expect(crt.GetRequestCount()).To(gmg.Equal(1))
+
+				// Verify that when requesting the mapping without a version, it doesn't error
+				// and it returns v1.
+				mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: group, Kind: kind})
+				g.Expect(err).NotTo(gmg.HaveOccurred())
+				g.Expect(mapping.Resource.Version).To(gmg.Equal("v1"))
+			})
+
+			t.Run("Restmapper should consistently return the preferred version", func(t *testing.T) {
+				g := gmg.NewWithT(t)
+
+				wg := sync.WaitGroup{}
+				wg.Add(50)
+				for i := 0; i < 50; i++ {
+					go func() {
+						defer wg.Done()
+						httpClient, err := rest.HTTPClientFor(restCfg)
+						g.Expect(err).NotTo(gmg.HaveOccurred())
+
+						mapper, err := apiutil.NewDynamicRESTMapper(restCfg, httpClient)
+						g.Expect(err).NotTo(gmg.HaveOccurred())
+
+						mapping, err := mapper.RESTMapping(schema.GroupKind{
+							Group: "crew.example.com",
+							Kind:  "Driver",
+						})
+						g.Expect(err).NotTo(gmg.HaveOccurred())
+						// APIServer seems to have a heuristic to prefer the higher
+						// version number.
+						g.Expect(mapping.GroupVersionKind.Version).To(gmg.Equal("v2"))
+					}()
+				}
+				wg.Wait()
+			})
 		})
-
-		// Wait until the CRD is registered.
-		discHTTP, err := rest.HTTPClientFor(restCfg)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		discClient, err := discovery.NewDiscoveryClientForConfigAndClient(restCfg, discHTTP)
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Eventually(func(g gmg.Gomega) {
-			_, err = discClient.ServerResourcesForGroupVersion(group + "/v1")
-			g.Expect(err).NotTo(gmg.HaveOccurred())
-		}).Should(gmg.Succeed(), "v1 should be available")
-
-		// There are no requests before any call
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
-
-		// Since we don't specify what version we expect, restmapper will fetch them all and search there.
-		// To fetch a list of available versions
-		//  #1: GET https://host/api
-		//  #2: GET https://host/apis
-		// Then, for all available versions:
-		// 	#3: GET https://host/apis/inventory.example.com/v1alpha1
-		//	#4: GET https://host/apis/inventory.example.com/v1
-		// This should fill the cache for apiGroups and versions.
-		mapping, err := lazyRestMapper.RESTMapping(schema.GroupKind{Group: group, Kind: kind})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.GroupVersionKind.Kind).To(gmg.Equal(kind))
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(4))
-		crt.Reset() // We reset the counter to check how many additional requests are made later.
-
-		// At this point v1alpha1 should be cached
-		_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: group, Kind: kind}, "v1alpha1")
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
-
-		// We update the CRD to only have v1 version.
-		g.Expect(c.Get(ctx, types.NamespacedName{Name: crdName}, crd)).To(gmg.Succeed())
-		for _, version := range crd.Spec.Versions {
-			if version.Name == "v1" {
-				v1 = version
-				break
-			}
-		}
-		crd.Spec.Versions = []apiextensionsv1.CustomResourceDefinitionVersion{v1}
-		g.Expect(c.Update(ctx, crd)).To(gmg.Succeed())
-
-		// We wait until v1alpha1 is not available anymore.
-		g.Eventually(func(g gmg.Gomega) {
-			_, err = discClient.ServerResourcesForGroupVersion(group + "/v1alpha1")
-			g.Expect(apierrors.IsNotFound(err)).To(gmg.BeTrue(), "v1alpha1 should not be available anymore")
-		}).Should(gmg.Succeed())
-
-		// Although v1alpha1 is not available anymore, the cache is not invalidated yet so it should return a mapping.
-		_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: group, Kind: kind}, "v1alpha1")
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(0))
-
-		// We request Limo, which is not in the mapper because it doesn't exist.
-		// This will trigger a reload of the lazy mapper cache.
-		// Reloading the cache will read v2 again and since it's not available anymore, it should invalidate the cache.
-		// 	#1: GET https://host/apis/inventory.example.com/v1alpha1
-		// 	#2: GET https://host/apis/inventory.example.com/v1
-		_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: group, Kind: "Limo"})
-		g.Expect(err).To(beNoMatchError())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(2))
-		crt.Reset()
-
-		// Now we request v1alpha1 again and it should return an error since the cache was invalidated.
-		// 	#1: GET https://host/apis/inventory.example.com/v1alpha1
-		_, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: group, Kind: kind}, "v1alpha1")
-		g.Expect(err).To(beNoMatchError())
-		g.Expect(crt.GetRequestCount()).To(gmg.Equal(1))
-
-		// Verify that when requesting the mapping without a version, it doesn't error
-		// and it returns v1.
-		mapping, err = lazyRestMapper.RESTMapping(schema.GroupKind{Group: group, Kind: kind})
-		g.Expect(err).NotTo(gmg.HaveOccurred())
-		g.Expect(mapping.Resource.Version).To(gmg.Equal("v1"))
-	})
+	}
 }
 
 // createNewCRD creates a new CRD with the given group, kind, and plural and returns it.
diff --git a/pkg/client/apiutil/restmapper_wb_test.go b/pkg/client/apiutil/restmapper_wb_test.go
index 96dbe79e77..73c4236724 100644
--- a/pkg/client/apiutil/restmapper_wb_test.go
+++ b/pkg/client/apiutil/restmapper_wb_test.go
@@ -21,6 +21,8 @@ import (
 
 	gmg "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/discovery"
 	"k8s.io/client-go/kubernetes/fake"
 	"k8s.io/client-go/restmapper"
 )
@@ -190,7 +192,7 @@ func TestLazyRestMapper_fetchGroupVersionResourcesLocked_CacheInvalidation(t *te
 			g := gmg.NewWithT(t)
 			m := &mapper{
 				mapper:      restmapper.NewDiscoveryRESTMapper([]*restmapper.APIGroupResources{}),
-				client:      fake.NewSimpleClientset().Discovery(),
+				client:      &fakeAggregatedDiscoveryClient{DiscoveryInterface: fake.NewSimpleClientset().Discovery()},
 				apiGroups:   tt.cachedAPIGroups,
 				knownGroups: tt.cachedKnownGroups,
 			}
@@ -201,3 +203,12 @@ func TestLazyRestMapper_fetchGroupVersionResourcesLocked_CacheInvalidation(t *te
 		})
 	}
 }
+
+type fakeAggregatedDiscoveryClient struct {
+	discovery.DiscoveryInterface
+}
+
+func (f *fakeAggregatedDiscoveryClient) GroupsAndMaybeResources() (*metav1.APIGroupList, map[schema.GroupVersion]*metav1.APIResourceList, map[schema.GroupVersion]error, error) {
+	groupList, err := f.DiscoveryInterface.ServerGroups()
+	return groupList, nil, nil, err
+}
diff --git a/pkg/client/applyconfigurations.go b/pkg/client/applyconfigurations.go
new file mode 100644
index 0000000000..97192050f9
--- /dev/null
+++ b/pkg/client/applyconfigurations.go
@@ -0,0 +1,75 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package client
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/utils/ptr"
+)
+
+type unstructuredApplyConfiguration struct {
+	*unstructured.Unstructured
+}
+
+func (u *unstructuredApplyConfiguration) IsApplyConfiguration() {}
+
+// ApplyConfigurationFromUnstructured creates a runtime.ApplyConfiguration from an *unstructured.Unstructured object.
+//
+// Do not use Unstructured objects here that were generated from API objects, as its impossible to tell
+// if a zero value was explicitly set.
+func ApplyConfigurationFromUnstructured(u *unstructured.Unstructured) runtime.ApplyConfiguration {
+	return &unstructuredApplyConfiguration{Unstructured: u}
+}
+
+type applyconfigurationRuntimeObject struct {
+	runtime.ApplyConfiguration
+}
+
+func (a *applyconfigurationRuntimeObject) GetObjectKind() schema.ObjectKind {
+	return a
+}
+
+func (a *applyconfigurationRuntimeObject) GroupVersionKind() schema.GroupVersionKind {
+	return schema.GroupVersionKind{}
+}
+
+func (a *applyconfigurationRuntimeObject) SetGroupVersionKind(gvk schema.GroupVersionKind) {}
+
+func (a *applyconfigurationRuntimeObject) DeepCopyObject() runtime.Object {
+	panic("applyconfigurationRuntimeObject does not support DeepCopyObject")
+}
+
+func runtimeObjectFromApplyConfiguration(ac runtime.ApplyConfiguration) runtime.Object {
+	return &applyconfigurationRuntimeObject{ApplyConfiguration: ac}
+}
+
+func gvkFromApplyConfiguration(ac applyConfiguration) (schema.GroupVersionKind, error) {
+	var gvk schema.GroupVersionKind
+	gv, err := schema.ParseGroupVersion(ptr.Deref(ac.GetAPIVersion(), ""))
+	if err != nil {
+		return gvk, fmt.Errorf("failed to parse %q as GroupVersion: %w", ptr.Deref(ac.GetAPIVersion(), ""), err)
+	}
+	gvk.Group = gv.Group
+	gvk.Version = gv.Version
+	gvk.Kind = ptr.Deref(ac.GetKind(), "")
+
+	return gvk, nil
+}
diff --git a/pkg/client/client.go b/pkg/client/client.go
index fe9862b814..e9f731453b 100644
--- a/pkg/client/client.go
+++ b/pkg/client/client.go
@@ -74,8 +74,8 @@ type NewClientFunc func(config *rest.Config, options Options) (Client, error)
 // New returns a new Client using the provided config and Options.
 //
 // By default, the client surfaces warnings returned by the server. To
-// suppress warnings, set config.WarningHandler = rest.NoWarnings{}. To
-// define custom behavior, implement the rest.WarningHandler interface.
+// suppress warnings, set config.WarningHandlerWithContext = rest.NoWarnings{}. To
+// define custom behavior, implement the rest.WarningHandlerWithContext interface.
 // See [sigs.k8s.io/controller-runtime/pkg/log.KubeAPIWarningLogger] for
 // an example.
 //
@@ -112,12 +112,11 @@ func newClient(config *rest.Config, options Options) (*client, error) {
 		config.UserAgent = rest.DefaultKubernetesUserAgent()
 	}
 
-	if config.WarningHandler == nil {
-		// By default, we de-duplicate and surface warnings.
-		config.WarningHandler = log.NewKubeAPIWarningLogger(
-			log.Log.WithName("KubeAPIWarningLogger"),
+	if config.WarningHandler == nil && config.WarningHandlerWithContext == nil {
+		// By default, we surface warnings.
+		config.WarningHandlerWithContext = log.NewKubeAPIWarningLogger(
 			log.KubeAPIWarningLoggerOptions{
-				Deduplicate: true,
+				Deduplicate: false,
 			},
 		)
 	}
@@ -152,8 +151,7 @@ func newClient(config *rest.Config, options Options) (*client, error) {
 		mapper:     options.Mapper,
 		codecs:     serializer.NewCodecFactory(options.Scheme),
 
-		structuredResourceByType:   make(map[schema.GroupVersionKind]*resourceMeta),
-		unstructuredResourceByType: make(map[schema.GroupVersionKind]*resourceMeta),
+		resourceByType: make(map[cacheKey]*resourceMeta),
 	}
 
 	rawMetaClient, err := metadata.NewForConfigAndClient(metadata.ConfigFor(config), options.HTTPClient)
@@ -330,6 +328,16 @@ func (c *client) Patch(ctx context.Context, obj Object, patch Patch, opts ...Pat
 	}
 }
 
+func (c *client) Apply(ctx context.Context, obj runtime.ApplyConfiguration, opts ...ApplyOption) error {
+	switch obj := obj.(type) {
+	case *unstructuredApplyConfiguration:
+		defer c.resetGroupVersionKind(obj, obj.GetObjectKind().GroupVersionKind())
+		return c.unstructuredClient.Apply(ctx, obj, opts...)
+	default:
+		return c.typedClient.Apply(ctx, obj, opts...)
+	}
+}
+
 // Get implements client.Client.
 func (c *client) Get(ctx context.Context, key ObjectKey, obj Object, opts ...GetOption) error {
 	if isUncached, err := c.shouldBypassCache(obj); err != nil {
diff --git a/pkg/client/client_rest_resources.go b/pkg/client/client_rest_resources.go
index 2d07879520..d75d685cbb 100644
--- a/pkg/client/client_rest_resources.go
+++ b/pkg/client/client_rest_resources.go
@@ -17,16 +17,17 @@ limitations under the License.
 package client
 
 import (
+	"fmt"
 	"net/http"
 	"strings"
 	"sync"
 
 	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/client-go/rest"
+	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
 )
 
@@ -47,22 +48,30 @@ type clientRestResources struct {
 	// codecs are used to create a REST client for a gvk
 	codecs serializer.CodecFactory
 
-	// structuredResourceByType stores structured type metadata
-	structuredResourceByType map[schema.GroupVersionKind]*resourceMeta
-	// unstructuredResourceByType stores unstructured type metadata
-	unstructuredResourceByType map[schema.GroupVersionKind]*resourceMeta
-	mu                         sync.RWMutex
+	// resourceByType stores type metadata
+	resourceByType map[cacheKey]*resourceMeta
+
+	mu sync.RWMutex
+}
+
+type cacheKey struct {
+	gvk                  schema.GroupVersionKind
+	forceDisableProtoBuf bool
 }
 
 // newResource maps obj to a Kubernetes Resource and constructs a client for that Resource.
 // If the object is a list, the resource represents the item's type instead.
-func (c *clientRestResources) newResource(gvk schema.GroupVersionKind, isList, isUnstructured bool) (*resourceMeta, error) {
+func (c *clientRestResources) newResource(gvk schema.GroupVersionKind,
+	isList bool,
+	forceDisableProtoBuf bool,
+	isUnstructured bool,
+) (*resourceMeta, error) {
 	if strings.HasSuffix(gvk.Kind, "List") && isList {
 		// if this was a list, treat it as a request for the item's resource
 		gvk.Kind = gvk.Kind[:len(gvk.Kind)-4]
 	}
 
-	client, err := apiutil.RESTClientForGVK(gvk, isUnstructured, c.config, c.codecs, c.httpClient)
+	client, err := apiutil.RESTClientForGVK(gvk, forceDisableProtoBuf, isUnstructured, c.config, c.codecs, c.httpClient)
 	if err != nil {
 		return nil, err
 	}
@@ -73,52 +82,96 @@ func (c *clientRestResources) newResource(gvk schema.GroupVersionKind, isList, i
 	return &resourceMeta{Interface: client, mapping: mapping, gvk: gvk}, nil
 }
 
+type applyConfiguration interface {
+	GetName() *string
+	GetNamespace() *string
+	GetKind() *string
+	GetAPIVersion() *string
+}
+
 // getResource returns the resource meta information for the given type of object.
 // If the object is a list, the resource represents the item's type instead.
-func (c *clientRestResources) getResource(obj runtime.Object) (*resourceMeta, error) {
-	gvk, err := apiutil.GVKForObject(obj, c.scheme)
-	if err != nil {
-		return nil, err
+func (c *clientRestResources) getResource(obj any) (*resourceMeta, error) {
+	var gvk schema.GroupVersionKind
+	var err error
+	var isApplyConfiguration bool
+	switch o := obj.(type) {
+	case runtime.Object:
+		gvk, err = apiutil.GVKForObject(o, c.scheme)
+		if err != nil {
+			return nil, err
+		}
+	case runtime.ApplyConfiguration:
+		ac, ok := o.(applyConfiguration)
+		if !ok {
+			return nil, fmt.Errorf("%T is a runtime.ApplyConfiguration but not an applyConfiguration", o)
+		}
+		gvk, err = gvkFromApplyConfiguration(ac)
+		if err != nil {
+			return nil, err
+		}
+		isApplyConfiguration = true
+	default:
+		return nil, fmt.Errorf("bug: %T is neither a runtime.Object nor a runtime.ApplyConfiguration", o)
 	}
 
 	_, isUnstructured := obj.(runtime.Unstructured)
+	forceDisableProtoBuf := isUnstructured || isApplyConfiguration
 
 	// It's better to do creation work twice than to not let multiple
 	// people make requests at once
 	c.mu.RLock()
-	resourceByType := c.structuredResourceByType
-	if isUnstructured {
-		resourceByType = c.unstructuredResourceByType
-	}
-	r, known := resourceByType[gvk]
+
+	cacheKey := cacheKey{gvk: gvk, forceDisableProtoBuf: forceDisableProtoBuf}
+
+	r, known := c.resourceByType[cacheKey]
+
 	c.mu.RUnlock()
 
 	if known {
 		return r, nil
 	}
 
+	var isList bool
+	if runtimeObject, ok := obj.(runtime.Object); ok && meta.IsListType(runtimeObject) {
+		isList = true
+	}
+
 	// Initialize a new Client
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	r, err = c.newResource(gvk, meta.IsListType(obj), isUnstructured)
+	r, err = c.newResource(gvk, isList, forceDisableProtoBuf, isUnstructured)
 	if err != nil {
 		return nil, err
 	}
-	resourceByType[gvk] = r
+	c.resourceByType[cacheKey] = r
 	return r, err
 }
 
 // getObjMeta returns objMeta containing both type and object metadata and state.
-func (c *clientRestResources) getObjMeta(obj runtime.Object) (*objMeta, error) {
+func (c *clientRestResources) getObjMeta(obj any) (*objMeta, error) {
 	r, err := c.getResource(obj)
 	if err != nil {
 		return nil, err
 	}
-	m, err := meta.Accessor(obj)
-	if err != nil {
-		return nil, err
+	objMeta := &objMeta{resourceMeta: r}
+
+	switch o := obj.(type) {
+	case runtime.Object:
+		m, err := meta.Accessor(obj)
+		if err != nil {
+			return nil, err
+		}
+		objMeta.namespace = m.GetNamespace()
+		objMeta.name = m.GetName()
+	case applyConfiguration:
+		objMeta.namespace = ptr.Deref(o.GetNamespace(), "")
+		objMeta.name = ptr.Deref(o.GetName(), "")
+	default:
+		return nil, fmt.Errorf("object %T is neither a runtime.Object nor a runtime.ApplyConfiguration", obj)
 	}
-	return &objMeta{resourceMeta: r, Object: m}, err
+
+	return objMeta, nil
 }
 
 // resourceMeta stores state for a Kubernetes type.
@@ -146,6 +199,6 @@ type objMeta struct {
 	// resourceMeta contains type information for the object
 	*resourceMeta
 
-	// Object contains meta data for the object instance
-	metav1.Object
+	namespace string
+	name      string
 }
diff --git a/pkg/client/client_test.go b/pkg/client/client_test.go
index 59ddf13664..63d64ce838 100644
--- a/pkg/client/client_test.go
+++ b/pkg/client/client_test.go
@@ -43,6 +43,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
+	corev1applyconfigurations "k8s.io/client-go/applyconfigurations/core/v1"
 	kscheme "k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/client-go/rest"
 	"k8s.io/utils/ptr"
@@ -150,7 +151,6 @@ var _ = Describe("Client", func() {
 	var replicaCount int32 = 2
 	var ns = "default"
 	var errNotCached *cache.ErrResourceNotCached
-	ctx := context.TODO()
 
 	BeforeEach(func() {
 		atomic.AddUint64(&count, 1)
@@ -209,7 +209,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 	})
 
 	var delOptions *metav1.DeleteOptions
-	AfterEach(func() {
+	AfterEach(func(ctx SpecContext) {
 		// Cleanup
 		var zero int64 = 0
 		policy := metav1.DeletePropagationForeground
@@ -231,7 +231,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 	})
 
 	Describe("WarningHandler", func() {
-		It("should log warnings with config.WarningHandler, if one is defined", func() {
+		It("should log warnings with config.WarningHandler, if one is defined", func(ctx SpecContext) {
 			cache := &fakeReader{}
 
 			testCfg := rest.CopyConfig(cfg)
@@ -334,7 +334,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 			Expect(cl.RESTMapper()).ToNot(BeNil())
 		})
 
-		It("should use the provided reader cache if provided, on get and list", func() {
+		It("should use the provided reader cache if provided, on get and list", func(ctx SpecContext) {
 			cache := &fakeReader{}
 			cl, err := client.New(cfg, client.Options{Cache: &client.CacheOptions{Reader: cache}})
 			Expect(err).NotTo(HaveOccurred())
@@ -344,7 +344,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 			Expect(cache.Called).To(Equal(2))
 		})
 
-		It("should propagate ErrResourceNotCached errors", func() {
+		It("should propagate ErrResourceNotCached errors", func(ctx SpecContext) {
 			c := &fakeUncachedReader{}
 			cl, err := client.New(cfg, client.Options{Cache: &client.CacheOptions{Reader: c}})
 			Expect(err).NotTo(HaveOccurred())
@@ -354,7 +354,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 			Expect(c.Called).To(Equal(2))
 		})
 
-		It("should not use the provided reader cache if provided, on get and list for uncached GVKs", func() {
+		It("should not use the provided reader cache if provided, on get and list for uncached GVKs", func(ctx SpecContext) {
 			cache := &fakeReader{}
 			cl, err := client.New(cfg, client.Options{Cache: &client.CacheOptions{Reader: cache, DisableFor: []client.Object{&corev1.Namespace{}}}})
 			Expect(err).NotTo(HaveOccurred())
@@ -367,13 +367,13 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 	Describe("Create", func() {
 		Context("with structured objects", func() {
-			It("should create a new object from a go struct", func() {
+			It("should create a new object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
 				By("creating the object")
-				err = cl.Create(context.TODO(), dep)
+				err = cl.Create(ctx, dep)
 				Expect(err).NotTo(HaveOccurred())
 
 				actual, err := clientset.AppsV1().Deployments(ns).Get(ctx, dep.Name, metav1.GetOptions{})
@@ -384,13 +384,13 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(dep).To(Equal(actual))
 			})
 
-			It("should create a new object non-namespace object from a go struct", func() {
+			It("should create a new object non-namespace object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
 				By("creating the object")
-				err = cl.Create(context.TODO(), node)
+				err = cl.Create(ctx, node)
 				Expect(err).NotTo(HaveOccurred())
 
 				actual, err := clientset.CoreV1().Nodes().Get(ctx, node.Name, metav1.GetOptions{})
@@ -401,7 +401,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(node).To(Equal(actual))
 			})
 
-			It("should fail if the object already exists", func() {
+			It("should fail if the object already exists", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -409,7 +409,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				old := dep.DeepCopy()
 
 				By("creating the object")
-				err = cl.Create(context.TODO(), dep)
+				err = cl.Create(ctx, dep)
 				Expect(err).NotTo(HaveOccurred())
 
 				actual, err := clientset.AppsV1().Deployments(ns).Get(ctx, dep.Name, metav1.GetOptions{})
@@ -417,24 +417,24 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(actual).NotTo(BeNil())
 
 				By("creating the object a second time")
-				err = cl.Create(context.TODO(), old)
+				err = cl.Create(ctx, old)
 				Expect(err).To(HaveOccurred())
 				Expect(apierrors.IsAlreadyExists(err)).To(BeTrue())
 			})
 
-			It("should fail if the object does not pass server-side validation", func() {
+			It("should fail if the object does not pass server-side validation", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
 				By("creating the pod, since required field Containers is empty")
-				err = cl.Create(context.TODO(), pod)
+				err = cl.Create(ctx, pod)
 				Expect(err).To(HaveOccurred())
 				// TODO(seans): Add test to validate the returned error. Problems currently with
 				// different returned error locally versus travis.
 			})
 
-			It("should fail if the object cannot be mapped to a GVK", func() {
+			It("should fail if the object cannot be mapped to a GVK", func(ctx SpecContext) {
 				By("creating client with empty Scheme")
 				emptyScheme := runtime.NewScheme()
 				cl, err := client.New(cfg, client.Options{Scheme: emptyScheme})
@@ -442,7 +442,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(cl).NotTo(BeNil())
 
 				By("creating the object fails")
-				err = cl.Create(context.TODO(), dep)
+				err = cl.Create(ctx, dep)
 				Expect(err).To(HaveOccurred())
 				Expect(err.Error()).To(ContainSubstring("no kind is registered for the type"))
 			})
@@ -453,13 +453,13 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 			})
 
 			Context("with the DryRun option", func() {
-				It("should not create a new object, global option", func() {
+				It("should not create a new object, global option", func(ctx SpecContext) {
 					cl, err := client.New(cfg, client.Options{DryRun: ptr.To(true)})
 					Expect(err).NotTo(HaveOccurred())
 					Expect(cl).NotTo(BeNil())
 
 					By("creating the object (with DryRun)")
-					err = cl.Create(context.TODO(), dep)
+					err = cl.Create(ctx, dep)
 					Expect(err).NotTo(HaveOccurred())
 
 					actual, err := clientset.AppsV1().Deployments(ns).Get(ctx, dep.Name, metav1.GetOptions{})
@@ -468,13 +468,13 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Expect(actual).To(Equal(&appsv1.Deployment{}))
 				})
 
-				It("should not create a new object, inline option", func() {
+				It("should not create a new object, inline option", func(ctx SpecContext) {
 					cl, err := client.New(cfg, client.Options{})
 					Expect(err).NotTo(HaveOccurred())
 					Expect(cl).NotTo(BeNil())
 
 					By("creating the object (with DryRun)")
-					err = cl.Create(context.TODO(), dep, client.DryRunAll)
+					err = cl.Create(ctx, dep, client.DryRunAll)
 					Expect(err).NotTo(HaveOccurred())
 
 					actual, err := clientset.AppsV1().Deployments(ns).Get(ctx, dep.Name, metav1.GetOptions{})
@@ -486,7 +486,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 		})
 
 		Context("with unstructured objects", func() {
-			It("should create a new object from a go struct", func() {
+			It("should create a new object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -501,7 +501,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				})
 
 				By("creating the object")
-				err = cl.Create(context.TODO(), u)
+				err = cl.Create(ctx, u)
 				Expect(err).NotTo(HaveOccurred())
 
 				actual, err := clientset.AppsV1().Deployments(ns).Get(ctx, dep.Name, metav1.GetOptions{})
@@ -509,7 +509,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(actual).NotTo(BeNil())
 			})
 
-			It("should create a new non-namespace object ", func() {
+			It("should create a new non-namespace object ", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -524,7 +524,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				})
 
 				By("creating the object")
-				err = cl.Create(context.TODO(), node)
+				err = cl.Create(ctx, node)
 				Expect(err).NotTo(HaveOccurred())
 
 				actual, err := clientset.CoreV1().Nodes().Get(ctx, node.Name, metav1.GetOptions{})
@@ -538,7 +538,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(u).To(Equal(au))
 			})
 
-			It("should fail if the object already exists", func() {
+			It("should fail if the object already exists", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -546,7 +546,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				old := dep.DeepCopy()
 
 				By("creating the object")
-				err = cl.Create(context.TODO(), dep)
+				err = cl.Create(ctx, dep)
 				Expect(err).NotTo(HaveOccurred())
 				actual, err := clientset.AppsV1().Deployments(ns).Get(ctx, dep.Name, metav1.GetOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -562,12 +562,12 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				})
 
 				By("creating the object a second time")
-				err = cl.Create(context.TODO(), u)
+				err = cl.Create(ctx, u)
 				Expect(err).To(HaveOccurred())
 				Expect(apierrors.IsAlreadyExists(err)).To(BeTrue())
 			})
 
-			It("should fail if the object does not pass server-side validation", func() {
+			It("should fail if the object does not pass server-side validation", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -580,7 +580,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 					Kind:    "Pod",
 				})
-				err = cl.Create(context.TODO(), u)
+				err = cl.Create(ctx, u)
 				Expect(err).To(HaveOccurred())
 				// TODO(seans): Add test to validate the returned error. Problems currently with
 				// different returned error locally versus travis.
@@ -589,17 +589,17 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 		})
 
 		Context("with metadata objects", func() {
-			It("should fail with an error", func() {
+			It("should fail with an error", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 
 				obj := metaOnlyFromObj(dep, scheme)
-				Expect(cl.Create(context.TODO(), obj)).NotTo(Succeed())
+				Expect(cl.Create(ctx, obj)).NotTo(Succeed())
 			})
 		})
 
 		Context("with the DryRun option", func() {
-			It("should not create a new object from a go struct", func() {
+			It("should not create a new object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -614,7 +614,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				})
 
 				By("creating the object")
-				err = cl.Create(context.TODO(), u, client.DryRunAll)
+				err = cl.Create(ctx, u, client.DryRunAll)
 				Expect(err).NotTo(HaveOccurred())
 
 				actual, err := clientset.AppsV1().Deployments(ns).Get(ctx, dep.Name, metav1.GetOptions{})
@@ -627,7 +627,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 	Describe("Update", func() {
 		Context("with structured objects", func() {
-			It("should update an existing object from a go struct", func() {
+			It("should update an existing object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -638,7 +638,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("updating the Deployment")
 				dep.Annotations = map[string]string{"foo": "bar"}
-				err = cl.Update(context.TODO(), dep)
+				err = cl.Update(ctx, dep)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has new annotation")
@@ -648,7 +648,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(actual.Annotations["foo"]).To(Equal("bar"))
 			})
 
-			It("should update and preserve type information", func() {
+			It("should update and preserve type information", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -659,14 +659,14 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("updating the Deployment")
 				dep.SetGroupVersionKind(depGvk)
-				err = cl.Update(context.TODO(), dep)
+				err = cl.Update(ctx, dep)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has type information")
 				Expect(dep.GroupVersionKind()).To(Equal(depGvk))
 			})
 
-			It("should update an existing object non-namespace object from a go struct", func() {
+			It("should update an existing object non-namespace object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -676,7 +676,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("updating the object")
 				node.Annotations = map[string]string{"foo": "bar"}
-				err = cl.Update(context.TODO(), node)
+				err = cl.Update(ctx, node)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validate updated Node had new annotation")
@@ -686,13 +686,13 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(actual.Annotations["foo"]).To(Equal("bar"))
 			})
 
-			It("should fail if the object does not exist", func() {
+			It("should fail if the object does not exist", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
 				By("updating non-existent object")
-				err = cl.Update(context.TODO(), dep)
+				err = cl.Update(ctx, dep)
 				Expect(err).To(HaveOccurred())
 			})
 
@@ -704,7 +704,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 			})
 
-			It("should fail if the object cannot be mapped to a GVK", func() {
+			It("should fail if the object cannot be mapped to a GVK", func(ctx SpecContext) {
 				By("creating client with empty Scheme")
 				emptyScheme := runtime.NewScheme()
 				cl, err := client.New(cfg, client.Options{Scheme: emptyScheme})
@@ -717,7 +717,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("updating the Deployment")
 				dep.Annotations = map[string]string{"foo": "bar"}
-				err = cl.Update(context.TODO(), dep)
+				err = cl.Update(ctx, dep)
 				Expect(err).To(HaveOccurred())
 				Expect(err.Error()).To(ContainSubstring("no kind is registered for the type"))
 			})
@@ -727,7 +727,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 			})
 		})
 		Context("with unstructured objects", func() {
-			It("should update an existing object from a go struct", func() {
+			It("should update an existing object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -745,7 +745,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 				})
 				u.SetAnnotations(map[string]string{"foo": "bar"})
-				err = cl.Update(context.TODO(), u)
+				err = cl.Update(ctx, u)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has new annotation")
@@ -755,7 +755,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(actual.Annotations["foo"]).To(Equal("bar"))
 			})
 
-			It("should update and preserve type information", func() {
+			It("should update and preserve type information", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -769,14 +769,14 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(scheme.Convert(dep, u, nil)).To(Succeed())
 				u.SetGroupVersionKind(depGvk)
 				u.SetAnnotations(map[string]string{"foo": "bar"})
-				err = cl.Update(context.TODO(), u)
+				err = cl.Update(ctx, u)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has type information")
 				Expect(u.GroupVersionKind()).To(Equal(depGvk))
 			})
 
-			It("should update an existing object non-namespace object from a go struct", func() {
+			It("should update an existing object non-namespace object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -793,7 +793,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 				})
 				u.SetAnnotations(map[string]string{"foo": "bar"})
-				err = cl.Update(context.TODO(), u)
+				err = cl.Update(ctx, u)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validate updated Node had new annotation")
@@ -802,7 +802,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(actual).NotTo(BeNil())
 				Expect(actual.Annotations["foo"]).To(Equal("bar"))
 			})
-			It("should fail if the object does not exist", func() {
+			It("should fail if the object does not exist", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -811,25 +811,25 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				u := &unstructured.Unstructured{}
 				Expect(scheme.Convert(dep, u, nil)).To(Succeed())
 				u.SetGroupVersionKind(depGvk)
-				err = cl.Update(context.TODO(), dep)
+				err = cl.Update(ctx, dep)
 				Expect(err).To(HaveOccurred())
 			})
 		})
 		Context("with metadata objects", func() {
-			It("should fail with an error", func() {
+			It("should fail with an error", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 
 				obj := metaOnlyFromObj(dep, scheme)
 
-				Expect(cl.Update(context.TODO(), obj)).NotTo(Succeed())
+				Expect(cl.Update(ctx, obj)).NotTo(Succeed())
 			})
 		})
 	})
 
 	Describe("Patch", func() {
 		Context("Metadata Client", func() {
-			It("should merge patch with options", func() {
+			It("should merge patch with options", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -845,7 +845,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				metadata.Labels["foo"] = "bar"
 
 				testOption := &mockPatchOption{}
-				Expect(cl.Patch(context.TODO(), metadata, client.Merge, testOption)).To(Succeed())
+				Expect(cl.Patch(ctx, metadata, client.Merge, testOption)).To(Succeed())
 
 				By("validating that patched metadata has new labels")
 				actual, err := clientset.AppsV1().Deployments(ns).Get(ctx, dep.Name, metav1.GetOptions{})
@@ -859,9 +859,150 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 		})
 	})
 
+	Describe("Apply", func() {
+		Context("Unstructured Client", func() {
+			It("should create and update a configMap using SSA", func(ctx SpecContext) {
+				cl, err := client.New(cfg, client.Options{})
+				Expect(err).NotTo(HaveOccurred())
+				Expect(cl).NotTo(BeNil())
+
+				data := map[string]any{
+					"some-key": "some-value",
+				}
+				obj := &unstructured.Unstructured{Object: map[string]any{
+					"apiVersion": "v1",
+					"kind":       "ConfigMap",
+					"metadata": map[string]any{
+						"name":      "test-configmap",
+						"namespace": "default",
+					},
+					"data": data,
+				}}
+
+				err = cl.Apply(ctx, client.ApplyConfigurationFromUnstructured(obj), &client.ApplyOptions{FieldManager: "test-manager"})
+				Expect(err).NotTo(HaveOccurred())
+
+				cm, err := clientset.CoreV1().ConfigMaps(obj.GetNamespace()).Get(ctx, obj.GetName(), metav1.GetOptions{})
+				Expect(err).NotTo(HaveOccurred())
+
+				actualData := map[string]any{}
+				for k, v := range cm.Data {
+					actualData[k] = v
+				}
+
+				Expect(actualData).To(BeComparableTo(data))
+				Expect(actualData).To(BeComparableTo(obj.Object["data"]))
+
+				data = map[string]any{
+					"a-new-key": "a-new-value",
+				}
+				obj.Object["data"] = data
+				unstructured.RemoveNestedField(obj.Object, "metadata", "managedFields")
+
+				err = cl.Apply(ctx, client.ApplyConfigurationFromUnstructured(obj), &client.ApplyOptions{FieldManager: "test-manager"})
+				Expect(err).NotTo(HaveOccurred())
+
+				cm, err = clientset.CoreV1().ConfigMaps(obj.GetNamespace()).Get(ctx, obj.GetName(), metav1.GetOptions{})
+				Expect(err).NotTo(HaveOccurred())
+
+				actualData = map[string]any{}
+				for k, v := range cm.Data {
+					actualData[k] = v
+				}
+
+				Expect(actualData).To(BeComparableTo(data))
+				Expect(actualData).To(BeComparableTo(obj.Object["data"]))
+			})
+		})
+
+		Context("Structured Client", func() {
+			It("should create and update a configMap using SSA", func(ctx SpecContext) {
+				cl, err := client.New(cfg, client.Options{})
+				Expect(err).NotTo(HaveOccurred())
+				Expect(cl).NotTo(BeNil())
+
+				data := map[string]string{
+					"some-key": "some-value",
+				}
+				obj := corev1applyconfigurations.
+					ConfigMap("test-configmap", "default").
+					WithData(data)
+
+				err = cl.Apply(ctx, obj, &client.ApplyOptions{FieldManager: "test-manager"})
+				Expect(err).NotTo(HaveOccurred())
+
+				cm, err := clientset.CoreV1().ConfigMaps(ptr.Deref(obj.GetNamespace(), "")).Get(ctx, ptr.Deref(obj.GetName(), ""), metav1.GetOptions{})
+				Expect(err).NotTo(HaveOccurred())
+
+				Expect(cm.Data).To(BeComparableTo(data))
+				Expect(cm.Data).To(BeComparableTo(obj.Data))
+
+				data = map[string]string{
+					"a-new-key": "a-new-value",
+				}
+				obj.Data = data
+
+				err = cl.Apply(ctx, obj, &client.ApplyOptions{FieldManager: "test-manager"})
+				Expect(err).NotTo(HaveOccurred())
+
+				cm, err = clientset.CoreV1().ConfigMaps(ptr.Deref(obj.GetNamespace(), "")).Get(ctx, ptr.Deref(obj.GetName(), ""), metav1.GetOptions{})
+				Expect(err).NotTo(HaveOccurred())
+
+				Expect(cm.Data).To(BeComparableTo(data))
+				Expect(cm.Data).To(BeComparableTo(obj.Data))
+			})
+
+			It("should create a secret without SSA and later create update a secret using SSA", func(ctx SpecContext) {
+				cl, err := client.New(cfg, client.Options{})
+				Expect(err).NotTo(HaveOccurred())
+				Expect(cl).NotTo(BeNil())
+				data := map[string][]byte{
+					"some-key": []byte("some-value"),
+				}
+				secretObject := &corev1.Secret{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "secret-one",
+						Namespace: "default",
+					},
+					Data: data,
+				}
+
+				secretApplyConfiguration := corev1applyconfigurations.
+					Secret("secret-two", "default").
+					WithData(data)
+
+				err = cl.Create(ctx, secretObject)
+				Expect(err).NotTo(HaveOccurred())
+
+				err = cl.Apply(ctx, secretApplyConfiguration, &client.ApplyOptions{FieldManager: "test-manager"})
+				Expect(err).NotTo(HaveOccurred())
+
+				secret, err := clientset.CoreV1().Secrets(ptr.Deref(secretApplyConfiguration.GetNamespace(), "")).Get(ctx, ptr.Deref(secretApplyConfiguration.GetName(), ""), metav1.GetOptions{})
+				Expect(err).NotTo(HaveOccurred())
+
+				Expect(secret.Data).To(BeComparableTo(data))
+				Expect(secret.Data).To(BeComparableTo(secretApplyConfiguration.Data))
+
+				data = map[string][]byte{
+					"some-key": []byte("some-new-value"),
+				}
+				secretApplyConfiguration.Data = data
+
+				err = cl.Apply(ctx, secretApplyConfiguration, &client.ApplyOptions{FieldManager: "test-manager"})
+				Expect(err).NotTo(HaveOccurred())
+
+				secret, err = clientset.CoreV1().Secrets(ptr.Deref(secretApplyConfiguration.GetNamespace(), "")).Get(ctx, ptr.Deref(secretApplyConfiguration.GetName(), ""), metav1.GetOptions{})
+				Expect(err).NotTo(HaveOccurred())
+
+				Expect(secret.Data).To(BeComparableTo(data))
+				Expect(secret.Data).To(BeComparableTo(secretApplyConfiguration.Data))
+			})
+		})
+	})
+
 	Describe("SubResourceClient", func() {
 		Context("with structured objects", func() {
-			It("should be able to read the Scale subresource", func() {
+			It("should be able to read the Scale subresource", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -876,7 +1017,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(err).NotTo(HaveOccurred())
 				Expect(scale.Spec.Replicas).To(Equal(*dep.Spec.Replicas))
 			})
-			It("should be able to create ServiceAccount tokens", func() {
+			It("should be able to create ServiceAccount tokens", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -892,7 +1033,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(token.Status.Token).NotTo(Equal(""))
 			})
 
-			It("should be able to create Pod evictions", func() {
+			It("should be able to create Pod evictions", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -916,7 +1057,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(apierrors.IsNotFound(err)).To(BeTrue())
 			})
 
-			It("should be able to create Pod bindings", func() {
+			It("should be able to create Pod bindings", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -941,7 +1082,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(pod.Spec.NodeName).To(Equal(node.Name))
 			})
 
-			It("should be able to approve CSRs", func() {
+			It("should be able to approve CSRs", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -965,7 +1106,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(csr.Status.Conditions[0].Status).To(Equal(corev1.ConditionTrue))
 			})
 
-			It("should be able to approve CSRs using Patch", func() {
+			It("should be able to approve CSRs using Patch", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -990,7 +1131,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(csr.Status.Conditions[0].Status).To(Equal(corev1.ConditionTrue))
 			})
 
-			It("should be able to update the scale subresource", func() {
+			It("should be able to update the scale subresource", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1011,7 +1152,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(*dep.Spec.Replicas).To(Equal(replicaCount))
 			})
 
-			It("should be able to patch the scale subresource", func() {
+			It("should be able to patch the scale subresource", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1035,8 +1176,8 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 		})
 
 		Context("with unstructured objects", func() {
-			It("should be able to read the Scale subresource", func() {
-				cl, err := client.New(cfg, client.Options{})
+			It("should be able to read the Scale subresource", func(ctx SpecContext) {
+				cl, err := client.New(cfg, client.Options{Scheme: runtime.NewScheme()})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
@@ -1060,8 +1201,8 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(found).To(BeTrue())
 				Expect(int32(val)).To(Equal(*dep.Spec.Replicas))
 			})
-			It("should be able to create ServiceAccount tokens", func() {
-				cl, err := client.New(cfg, client.Options{})
+			It("should be able to create ServiceAccount tokens", func(ctx SpecContext) {
+				cl, err := client.New(cfg, client.Options{Scheme: runtime.NewScheme()})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
@@ -1088,8 +1229,8 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(val).NotTo(Equal(""))
 			})
 
-			It("should be able to create Pod evictions", func() {
-				cl, err := client.New(cfg, client.Options{})
+			It("should be able to create Pod evictions", func(ctx SpecContext) {
+				cl, err := client.New(cfg, client.Options{Scheme: runtime.NewScheme()})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
@@ -1121,8 +1262,8 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(apierrors.IsNotFound(err)).To(BeTrue())
 			})
 
-			It("should be able to create Pod bindings", func() {
-				cl, err := client.New(cfg, client.Options{})
+			It("should be able to create Pod bindings", func(ctx SpecContext) {
+				cl, err := client.New(cfg, client.Options{Scheme: runtime.NewScheme()})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
@@ -1156,8 +1297,8 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(pod.Spec.NodeName).To(Equal(node.Name))
 			})
 
-			It("should be able to approve CSRs", func() {
-				cl, err := client.New(cfg, client.Options{})
+			It("should be able to approve CSRs", func(ctx SpecContext) {
+				cl, err := client.New(cfg, client.Options{Scheme: runtime.NewScheme()})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
@@ -1187,8 +1328,8 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(csr.Status.Conditions[0].Status).To(Equal(corev1.ConditionTrue))
 			})
 
-			It("should be able to approve CSRs using Patch", func() {
-				cl, err := client.New(cfg, client.Options{})
+			It("should be able to approve CSRs using Patch", func(ctx SpecContext) {
+				cl, err := client.New(cfg, client.Options{Scheme: runtime.NewScheme()})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
@@ -1219,8 +1360,8 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(csr.Status.Conditions[0].Status).To(Equal(corev1.ConditionTrue))
 			})
 
-			It("should be able to update the scale subresource", func() {
-				cl, err := client.New(cfg, client.Options{})
+			It("should be able to update the scale subresource", func(ctx SpecContext) {
+				cl, err := client.New(cfg, client.Options{Scheme: runtime.NewScheme()})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
@@ -1249,8 +1390,8 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(*dep.Spec.Replicas).To(Equal(replicaCount))
 			})
 
-			It("should be able to patch the scale subresource", func() {
-				cl, err := client.New(cfg, client.Options{})
+			It("should be able to patch the scale subresource", func(ctx SpecContext) {
+				cl, err := client.New(cfg, client.Options{Scheme: runtime.NewScheme()})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
@@ -1285,7 +1426,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 	Describe("StatusClient", func() {
 		Context("with structured objects", func() {
-			It("should update status of an existing object", func() {
+			It("should update status of an existing object", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1296,7 +1437,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("updating the status of Deployment")
 				dep.Status.Replicas = 1
-				err = cl.Status().Update(context.TODO(), dep)
+				err = cl.Status().Update(ctx, dep)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has new status")
@@ -1306,7 +1447,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(actual.Status.Replicas).To(BeEquivalentTo(1))
 			})
 
-			It("should update status and preserve type information", func() {
+			It("should update status and preserve type information", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1318,14 +1459,14 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				By("updating the status of Deployment")
 				dep.SetGroupVersionKind(depGvk)
 				dep.Status.Replicas = 1
-				err = cl.Status().Update(context.TODO(), dep)
+				err = cl.Status().Update(ctx, dep)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has type information")
 				Expect(dep.GroupVersionKind()).To(Equal(depGvk))
 			})
 
-			It("should patch status and preserve type information", func() {
+			It("should patch status and preserve type information", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1338,14 +1479,14 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				dep.SetGroupVersionKind(depGvk)
 				depPatch := client.MergeFrom(dep.DeepCopy())
 				dep.Status.Replicas = 1
-				err = cl.Status().Patch(context.TODO(), dep, depPatch)
+				err = cl.Status().Patch(ctx, dep, depPatch)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has type information")
 				Expect(dep.GroupVersionKind()).To(Equal(depGvk))
 			})
 
-			It("should not update spec of an existing object", func() {
+			It("should not update spec of an existing object", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1358,7 +1499,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				var rc int32 = 1
 				dep.Status.Replicas = 1
 				dep.Spec.Replicas = &rc
-				err = cl.Status().Update(context.TODO(), dep)
+				err = cl.Status().Update(ctx, dep)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has new status and unchanged spec")
@@ -1369,7 +1510,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(*actual.Spec.Replicas).To(BeEquivalentTo(replicaCount))
 			})
 
-			It("should update an existing object non-namespace object", func() {
+			It("should update an existing object non-namespace object", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1379,7 +1520,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("updating status of the object")
 				node.Status.Phase = corev1.NodeRunning
-				err = cl.Status().Update(context.TODO(), node)
+				err = cl.Status().Update(ctx, node)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validate updated Node had new annotation")
@@ -1389,17 +1530,17 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(actual.Status.Phase).To(Equal(corev1.NodeRunning))
 			})
 
-			It("should fail if the object does not exist", func() {
+			It("should fail if the object does not exist", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
 				By("updating status of a non-existent object")
-				err = cl.Status().Update(context.TODO(), dep)
+				err = cl.Status().Update(ctx, dep)
 				Expect(err).To(HaveOccurred())
 			})
 
-			It("should fail if the object cannot be mapped to a GVK", func() {
+			It("should fail if the object cannot be mapped to a GVK", func(ctx SpecContext) {
 				By("creating client with empty Scheme")
 				emptyScheme := runtime.NewScheme()
 				cl, err := client.New(cfg, client.Options{Scheme: emptyScheme})
@@ -1412,7 +1553,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("updating status of the Deployment")
 				dep.Status.Replicas = 1
-				err = cl.Status().Update(context.TODO(), dep)
+				err = cl.Status().Update(ctx, dep)
 				Expect(err).To(HaveOccurred())
 				Expect(err.Error()).To(ContainSubstring("no kind is registered for the type"))
 			})
@@ -1427,7 +1568,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 		})
 
 		Context("with unstructured objects", func() {
-			It("should update status of an existing object", func() {
+			It("should update status of an existing object", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1440,7 +1581,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				u := &unstructured.Unstructured{}
 				dep.Status.Replicas = 1
 				Expect(scheme.Convert(dep, u, nil)).To(Succeed())
-				err = cl.Status().Update(context.TODO(), u)
+				err = cl.Status().Update(ctx, u)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has new status")
@@ -1450,7 +1591,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(actual.Status.Replicas).To(BeEquivalentTo(1))
 			})
 
-			It("should update status and preserve type information", func() {
+			It("should update status and preserve type information", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1463,14 +1604,14 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				u := &unstructured.Unstructured{}
 				dep.Status.Replicas = 1
 				Expect(scheme.Convert(dep, u, nil)).To(Succeed())
-				err = cl.Status().Update(context.TODO(), u)
+				err = cl.Status().Update(ctx, u)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has type information")
 				Expect(u.GroupVersionKind()).To(Equal(depGvk))
 			})
 
-			It("should patch status and preserve type information", func() {
+			It("should patch status and preserve type information", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1484,7 +1625,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				depPatch := client.MergeFrom(dep.DeepCopy())
 				dep.Status.Replicas = 1
 				Expect(scheme.Convert(dep, u, nil)).To(Succeed())
-				err = cl.Status().Patch(context.TODO(), u, depPatch)
+				err = cl.Status().Patch(ctx, u, depPatch)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has type information")
@@ -1497,7 +1638,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(actual.Status.Replicas).To(BeEquivalentTo(1))
 			})
 
-			It("should not update spec of an existing object", func() {
+			It("should not update spec of an existing object", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1512,7 +1653,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				dep.Status.Replicas = 1
 				dep.Spec.Replicas = &rc
 				Expect(scheme.Convert(dep, u, nil)).To(Succeed())
-				err = cl.Status().Update(context.TODO(), u)
+				err = cl.Status().Update(ctx, u)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has new status and unchanged spec")
@@ -1523,7 +1664,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(*actual.Spec.Replicas).To(BeEquivalentTo(replicaCount))
 			})
 
-			It("should update an existing object non-namespace object", func() {
+			It("should update an existing object non-namespace object", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1535,7 +1676,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				u := &unstructured.Unstructured{}
 				node.Status.Phase = corev1.NodeRunning
 				Expect(scheme.Convert(node, u, nil)).To(Succeed())
-				err = cl.Status().Update(context.TODO(), u)
+				err = cl.Status().Update(ctx, u)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validate updated Node had new annotation")
@@ -1545,7 +1686,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(actual.Status.Phase).To(Equal(corev1.NodeRunning))
 			})
 
-			It("should fail if the object does not exist", func() {
+			It("should fail if the object does not exist", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1553,7 +1694,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				By("updating status of a non-existent object")
 				u := &unstructured.Unstructured{}
 				Expect(scheme.Convert(dep, u, nil)).To(Succeed())
-				err = cl.Status().Update(context.TODO(), u)
+				err = cl.Status().Update(ctx, u)
 				Expect(err).To(HaveOccurred())
 			})
 
@@ -1568,15 +1709,15 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 		})
 
 		Context("with metadata objects", func() {
-			It("should fail to update with an error", func() {
+			It("should fail to update with an error", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 
 				obj := metaOnlyFromObj(dep, scheme)
-				Expect(cl.Status().Update(context.TODO(), obj)).NotTo(Succeed())
+				Expect(cl.Status().Update(ctx, obj)).NotTo(Succeed())
 			})
 
-			It("should patch status and preserve type information", func() {
+			It("should patch status and preserve type information", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1589,7 +1730,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				objPatch := client.MergeFrom(metaOnlyFromObj(dep, scheme))
 				dep.Annotations = map[string]string{"some-new-annotation": "some-new-value"}
 				obj := metaOnlyFromObj(dep, scheme)
-				err = cl.Status().Patch(context.TODO(), obj, objPatch)
+				err = cl.Status().Patch(ctx, obj, objPatch)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating updated Deployment has type information")
@@ -1606,7 +1747,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 	Describe("Delete", func() {
 		Context("with structured objects", func() {
-			It("should delete an existing object from a go struct", func() {
+			It("should delete an existing object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1617,7 +1758,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("deleting the Deployment")
 				depName := dep.Name
-				err = cl.Delete(context.TODO(), dep)
+				err = cl.Delete(ctx, dep)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating the Deployment no longer exists")
@@ -1625,7 +1766,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(err).To(HaveOccurred())
 			})
 
-			It("should delete an existing object non-namespace object from a go struct", func() {
+			It("should delete an existing object non-namespace object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1636,7 +1777,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("deleting the Node")
 				nodeName := node.Name
-				err = cl.Delete(context.TODO(), node)
+				err = cl.Delete(ctx, node)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating the Node no longer exists")
@@ -1644,13 +1785,13 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(err).To(HaveOccurred())
 			})
 
-			It("should fail if the object does not exist", func() {
+			It("should fail if the object does not exist", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
 				By("Deleting node before it is ever created")
-				err = cl.Delete(context.TODO(), node)
+				err = cl.Delete(ctx, node)
 				Expect(err).To(HaveOccurred())
 			})
 
@@ -1658,7 +1799,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 			})
 
-			It("should fail if the object cannot be mapped to a GVK", func() {
+			It("should fail if the object cannot be mapped to a GVK", func(ctx SpecContext) {
 				By("creating client with empty Scheme")
 				emptyScheme := runtime.NewScheme()
 				cl, err := client.New(cfg, client.Options{Scheme: emptyScheme})
@@ -1670,7 +1811,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(err).NotTo(HaveOccurred())
 
 				By("deleting the Deployment fails")
-				err = cl.Delete(context.TODO(), dep)
+				err = cl.Delete(ctx, dep)
 				Expect(err).To(HaveOccurred())
 				Expect(err.Error()).To(ContainSubstring("no kind is registered for the type"))
 			})
@@ -1679,7 +1820,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 			})
 
-			It("should delete a collection of objects", func() {
+			It("should delete a collection of objects", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1698,7 +1839,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				dep2Name := dep2.Name
 
 				By("deleting Deployments")
-				err = cl.DeleteAllOf(context.TODO(), dep, client.InNamespace(ns), client.MatchingLabels(dep.ObjectMeta.Labels))
+				err = cl.DeleteAllOf(ctx, dep, client.InNamespace(ns), client.MatchingLabels(dep.ObjectMeta.Labels))
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating the Deployment no longer exists")
@@ -1709,7 +1850,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 			})
 		})
 		Context("with unstructured objects", func() {
-			It("should delete an existing object from a go struct", func() {
+			It("should delete an existing object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1727,7 +1868,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "Deployment",
 					Version: "v1",
 				})
-				err = cl.Delete(context.TODO(), u)
+				err = cl.Delete(ctx, u)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating the Deployment no longer exists")
@@ -1735,7 +1876,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(err).To(HaveOccurred())
 			})
 
-			It("should delete an existing object non-namespace object from a go struct", func() {
+			It("should delete an existing object non-namespace object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1753,7 +1894,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "Node",
 					Version: "v1",
 				})
-				err = cl.Delete(context.TODO(), u)
+				err = cl.Delete(ctx, u)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating the Node no longer exists")
@@ -1761,7 +1902,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(err).To(HaveOccurred())
 			})
 
-			It("should fail if the object does not exist", func() {
+			It("should fail if the object does not exist", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1774,11 +1915,11 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "Node",
 					Version: "v1",
 				})
-				err = cl.Delete(context.TODO(), node)
+				err = cl.Delete(ctx, node)
 				Expect(err).To(HaveOccurred())
 			})
 
-			It("should delete a collection of object", func() {
+			It("should delete a collection of object", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1804,7 +1945,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "Deployment",
 					Version: "v1",
 				})
-				err = cl.DeleteAllOf(context.TODO(), u, client.InNamespace(ns), client.MatchingLabels(dep.ObjectMeta.Labels))
+				err = cl.DeleteAllOf(ctx, u, client.InNamespace(ns), client.MatchingLabels(dep.ObjectMeta.Labels))
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating the Deployment no longer exists")
@@ -1815,7 +1956,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 			})
 		})
 		Context("with metadata objects", func() {
-			It("should delete an existing object from a go struct", func() {
+			It("should delete an existing object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1826,7 +1967,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("deleting the Deployment")
 				metaObj := metaOnlyFromObj(dep, scheme)
-				err = cl.Delete(context.TODO(), metaObj)
+				err = cl.Delete(ctx, metaObj)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating the Deployment no longer exists")
@@ -1834,7 +1975,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(err).To(HaveOccurred())
 			})
 
-			It("should delete an existing object non-namespace object from a go struct", func() {
+			It("should delete an existing object non-namespace object from a go struct", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1845,7 +1986,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("deleting the Node")
 				metaObj := metaOnlyFromObj(node, scheme)
-				err = cl.Delete(context.TODO(), metaObj)
+				err = cl.Delete(ctx, metaObj)
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating the Node no longer exists")
@@ -1853,18 +1994,18 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(err).To(HaveOccurred())
 			})
 
-			It("should fail if the object does not exist", func() {
+			It("should fail if the object does not exist", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
 
 				By("Deleting node before it is ever created")
 				metaObj := metaOnlyFromObj(node, scheme)
-				err = cl.Delete(context.TODO(), metaObj)
+				err = cl.Delete(ctx, metaObj)
 				Expect(err).To(HaveOccurred())
 			})
 
-			It("should delete a collection of object", func() {
+			It("should delete a collection of object", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1884,7 +2025,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("deleting Deployments")
 				metaObj := metaOnlyFromObj(dep, scheme)
-				err = cl.DeleteAllOf(context.TODO(), metaObj, client.InNamespace(ns), client.MatchingLabels(dep.ObjectMeta.Labels))
+				err = cl.DeleteAllOf(ctx, metaObj, client.InNamespace(ns), client.MatchingLabels(dep.ObjectMeta.Labels))
 				Expect(err).NotTo(HaveOccurred())
 
 				By("validating the Deployment no longer exists")
@@ -1898,7 +2039,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 	Describe("Get", func() {
 		Context("with structured objects", func() {
-			It("should fetch an existing object for a go struct", func() {
+			It("should fetch an existing object for a go struct", func(ctx SpecContext) {
 				By("first creating the Deployment")
 				dep, err := clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -1910,7 +2051,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				By("fetching the created Deployment")
 				var actual appsv1.Deployment
 				key := client.ObjectKey{Namespace: ns, Name: dep.Name}
-				err = cl.Get(context.TODO(), key, &actual)
+				err = cl.Get(ctx, key, &actual)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(actual).NotTo(BeNil())
 
@@ -1918,7 +2059,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(dep).To(Equal(&actual))
 			})
 
-			It("should fetch an existing non-namespace object for a go struct", func() {
+			It("should fetch an existing non-namespace object for a go struct", func(ctx SpecContext) {
 				By("first creating the object")
 				node, err := clientset.CoreV1().Nodes().Create(ctx, node, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -1930,14 +2071,14 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				By("retrieving node through client")
 				var actual corev1.Node
 				key := client.ObjectKey{Namespace: ns, Name: node.Name}
-				err = cl.Get(context.TODO(), key, &actual)
+				err = cl.Get(ctx, key, &actual)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(actual).NotTo(BeNil())
 
 				Expect(node).To(Equal(&actual))
 			})
 
-			It("should fail if the object does not exist", func() {
+			It("should fail if the object does not exist", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -1945,7 +2086,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				By("fetching object that has not been created yet")
 				key := client.ObjectKey{Namespace: ns, Name: dep.Name}
 				var actual appsv1.Deployment
-				err = cl.Get(context.TODO(), key, &actual)
+				err = cl.Get(ctx, key, &actual)
 				Expect(err).To(HaveOccurred())
 			})
 
@@ -1953,7 +2094,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 			})
 
-			It("should fail if the object cannot be mapped to a GVK", func() {
+			It("should fail if the object cannot be mapped to a GVK", func(ctx SpecContext) {
 				By("first creating the Deployment")
 				dep, err := clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -1967,7 +2108,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				By("fetching the created Deployment fails")
 				var actual appsv1.Deployment
 				key := client.ObjectKey{Namespace: ns, Name: dep.Name}
-				err = cl.Get(context.TODO(), key, &actual)
+				err = cl.Get(ctx, key, &actual)
 				Expect(err).To(HaveOccurred())
 				Expect(err.Error()).To(ContainSubstring("no kind is registered for the type"))
 			})
@@ -1979,8 +2120,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 			// Test this with an integrated type and a CRD to make sure it covers both proto
 			// and json deserialization.
 			for idx, object := range []client.Object{&corev1.ConfigMap{}, &pkg.ChaosPod{}} {
-				idx, object := idx, object
-				It(fmt.Sprintf("should not retain any data in the obj variable that is not on the server for %T", object), func() {
+				It(fmt.Sprintf("should not retain any data in the obj variable that is not on the server for %T", object), func(ctx SpecContext) {
 					cl, err := client.New(cfg, client.Options{})
 					Expect(err).NotTo(HaveOccurred())
 					Expect(cl).NotTo(BeNil())
@@ -2005,7 +2145,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 		})
 
 		Context("with unstructured objects", func() {
-			It("should fetch an existing object", func() {
+			It("should fetch an existing object", func(ctx SpecContext) {
 				By("first creating the Deployment")
 				dep, err := clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -2026,15 +2166,16 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 				})
 				key := client.ObjectKey{Namespace: ns, Name: dep.Name}
-				err = cl.Get(context.TODO(), key, &actual)
+				err = cl.Get(ctx, key, &actual)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(actual).NotTo(BeNil())
 
 				By("validating the fetched Deployment equals the created one")
-				Expect(u).To(Equal(&actual))
+				unstructured.RemoveNestedField(actual.Object, "spec", "template", "metadata", "creationTimestamp")
+				Expect(u).To(BeComparableTo(&actual))
 			})
 
-			It("should fetch an existing non-namespace object", func() {
+			It("should fetch an existing non-namespace object", func(ctx SpecContext) {
 				By("first creating the Node")
 				node, err := clientset.CoreV1().Nodes().Create(ctx, node, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -2055,7 +2196,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 				})
 				key := client.ObjectKey{Namespace: ns, Name: node.Name}
-				err = cl.Get(context.TODO(), key, &actual)
+				err = cl.Get(ctx, key, &actual)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(actual).NotTo(BeNil())
 
@@ -2063,7 +2204,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(u).To(Equal(&actual))
 			})
 
-			It("should fail if the object does not exist", func() {
+			It("should fail if the object does not exist", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -2071,11 +2212,11 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				By("fetching object that has not been created yet")
 				key := client.ObjectKey{Namespace: ns, Name: dep.Name}
 				u := &unstructured.Unstructured{}
-				err = cl.Get(context.TODO(), key, u)
+				err = cl.Get(ctx, key, u)
 				Expect(err).To(HaveOccurred())
 			})
 
-			It("should not retain any data in the obj variable that is not on the server", func() {
+			It("should not retain any data in the obj variable that is not on the server", func(ctx SpecContext) {
 				object := &unstructured.Unstructured{}
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
@@ -2100,7 +2241,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 			})
 		})
 		Context("with metadata objects", func() {
-			It("should fetch an existing object for a go struct", func() {
+			It("should fetch an existing object for a go struct", func(ctx SpecContext) {
 				By("first creating the Deployment")
 				dep, err := clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -2118,7 +2259,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				}
 				actual.SetGroupVersionKind(gvk)
 				key := client.ObjectKey{Namespace: ns, Name: dep.Name}
-				err = cl.Get(context.TODO(), key, &actual)
+				err = cl.Get(ctx, key, &actual)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(actual).NotTo(BeNil())
 
@@ -2129,7 +2270,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(metaOnlyFromObj(dep, scheme)).To(Equal(&actual))
 			})
 
-			It("should fetch an existing non-namespace object for a go struct", func() {
+			It("should fetch an existing non-namespace object for a go struct", func(ctx SpecContext) {
 				By("first creating the object")
 				node, err := clientset.CoreV1().Nodes().Create(ctx, node, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -2145,14 +2286,14 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "Node",
 				})
 				key := client.ObjectKey{Namespace: ns, Name: node.Name}
-				err = cl.Get(context.TODO(), key, &actual)
+				err = cl.Get(ctx, key, &actual)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(actual).NotTo(BeNil())
 
 				Expect(metaOnlyFromObj(node, scheme)).To(Equal(&actual))
 			})
 
-			It("should fail if the object does not exist", func() {
+			It("should fail if the object does not exist", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -2165,7 +2306,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 					Kind:    "Deployment",
 				})
-				err = cl.Get(context.TODO(), key, &actual)
+				err = cl.Get(ctx, key, &actual)
 				Expect(err).To(HaveOccurred())
 			})
 
@@ -2177,7 +2318,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 			})
 
-			It("should not retain any data in the obj variable that is not on the server", func() {
+			It("should not retain any data in the obj variable that is not on the server", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cl).NotTo(BeNil())
@@ -2202,7 +2343,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 	Describe("List", func() {
 		Context("with structured objects", func() {
-			It("should fetch collection of objects", func() {
+			It("should fetch collection of objects", func(ctx SpecContext) {
 				By("creating an initial object")
 				dep, err := clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -2212,7 +2353,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("listing all objects of that type in the cluster")
 				deps := &appsv1.DeploymentList{}
-				Expect(cl.List(context.Background(), deps)).NotTo(HaveOccurred())
+				Expect(cl.List(ctx, deps)).NotTo(HaveOccurred())
 
 				Expect(deps.Items).NotTo(BeEmpty())
 				hasDep := false
@@ -2225,7 +2366,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(hasDep).To(BeTrue())
 			})
 
-			It("should fetch unstructured collection of objects", func() {
+			It("should fetch unstructured collection of objects", func(ctx SpecContext) {
 				By("create an initial object")
 				_, err := clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -2240,7 +2381,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "DeploymentList",
 					Version: "v1",
 				})
-				err = cl.List(context.Background(), deps)
+				err = cl.List(ctx, deps)
 				Expect(err).NotTo(HaveOccurred())
 
 				Expect(deps.Items).NotTo(BeEmpty())
@@ -2259,7 +2400,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(hasDep).To(BeTrue())
 			})
 
-			It("should fetch unstructured collection of objects, even if scheme is empty", func() {
+			It("should fetch unstructured collection of objects, even if scheme is empty", func(ctx SpecContext) {
 				By("create an initial object")
 				_, err := clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -2274,7 +2415,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "DeploymentList",
 					Version: "v1",
 				})
-				err = cl.List(context.Background(), deps)
+				err = cl.List(ctx, deps)
 				Expect(err).NotTo(HaveOccurred())
 
 				Expect(deps.Items).NotTo(BeEmpty())
@@ -2288,20 +2429,20 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(hasDep).To(BeTrue())
 			})
 
-			It("should return an empty list if there are no matching objects", func() {
+			It("should return an empty list if there are no matching objects", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 
 				By("listing all Deployments in the cluster")
 				deps := &appsv1.DeploymentList{}
-				Expect(cl.List(context.Background(), deps)).NotTo(HaveOccurred())
+				Expect(cl.List(ctx, deps)).NotTo(HaveOccurred())
 
 				By("validating no Deployments are returned")
 				Expect(deps.Items).To(BeEmpty())
 			})
 
 			// TODO(seans): get label selector test working
-			It("should filter results by label selector", func() {
+			It("should filter results by label selector", func(ctx SpecContext) {
 				By("creating a Deployment with the app=frontend label")
 				depFrontend := &appsv1.Deployment{
 					ObjectMeta: metav1.ObjectMeta{
@@ -2348,7 +2489,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				By("listing all Deployments with label app=backend")
 				deps := &appsv1.DeploymentList{}
 				labels := map[string]string{"app": "backend"}
-				err = cl.List(context.Background(), deps, client.MatchingLabels(labels))
+				err = cl.List(ctx, deps, client.MatchingLabels(labels))
 				Expect(err).NotTo(HaveOccurred())
 
 				By("only the Deployment with the backend label is returned")
@@ -2361,7 +2502,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				deleteDeployment(ctx, depBackend, ns)
 			})
 
-			It("should filter results by namespace selector", func() {
+			It("should filter results by namespace selector", func(ctx SpecContext) {
 				By("creating a Deployment in test-namespace-1")
 				tns1 := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "test-namespace-1"}}
 				_, err := clientset.CoreV1().Namespaces().Create(ctx, tns1, metav1.CreateOptions{})
@@ -2405,7 +2546,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("listing all Deployments in test-namespace-1")
 				deps := &appsv1.DeploymentList{}
-				err = cl.List(context.Background(), deps, client.InNamespace("test-namespace-1"))
+				err = cl.List(ctx, deps, client.InNamespace("test-namespace-1"))
 				Expect(err).NotTo(HaveOccurred())
 
 				By("only the Deployment in test-namespace-1 is returned")
@@ -2420,7 +2561,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				deleteNamespace(ctx, tns2)
 			})
 
-			It("should filter results by field selector", func() {
+			It("should filter results by field selector", func(ctx SpecContext) {
 				By("creating a Deployment with name deployment-frontend")
 				depFrontend := &appsv1.Deployment{
 					ObjectMeta: metav1.ObjectMeta{Name: "deployment-frontend", Namespace: ns},
@@ -2458,7 +2599,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("listing all Deployments with field metadata.name=deployment-backend")
 				deps := &appsv1.DeploymentList{}
-				err = cl.List(context.Background(), deps,
+				err = cl.List(ctx, deps,
 					client.MatchingFields{"metadata.name": "deployment-backend"})
 				Expect(err).NotTo(HaveOccurred())
 
@@ -2472,7 +2613,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				deleteDeployment(ctx, depBackend, ns)
 			})
 
-			It("should filter results by namespace selector and label selector", func() {
+			It("should filter results by namespace selector and label selector", func(ctx SpecContext) {
 				By("creating a Deployment in test-namespace-3 with the app=frontend label")
 				tns3 := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "test-namespace-3"}}
 				_, err := clientset.CoreV1().Namespaces().Create(ctx, tns3, metav1.CreateOptions{})
@@ -2545,7 +2686,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				By("listing all Deployments in test-namespace-3 with label app=frontend")
 				deps := &appsv1.DeploymentList{}
 				labels := map[string]string{"app": "frontend"}
-				err = cl.List(context.Background(), deps,
+				err = cl.List(ctx, deps,
 					client.InNamespace("test-namespace-3"),
 					client.MatchingLabels(labels),
 				)
@@ -2565,7 +2706,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				deleteNamespace(ctx, tns4)
 			})
 
-			It("should filter results using limit and continue options", func() {
+			It("should filter results using limit and continue options", func(ctx SpecContext) {
 
 				makeDeployment := func(suffix string) *appsv1.Deployment {
 					return &appsv1.Deployment{
@@ -2610,7 +2751,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("listing 1 deployment when limit=1 is used")
 				deps := &appsv1.DeploymentList{}
-				err = cl.List(context.Background(), deps,
+				err = cl.List(ctx, deps,
 					client.Limit(1),
 				)
 				Expect(err).NotTo(HaveOccurred())
@@ -2623,7 +2764,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("listing the next deployment when previous continuation token is used and limit=1")
 				deps = &appsv1.DeploymentList{}
-				err = cl.List(context.Background(), deps,
+				err = cl.List(ctx, deps,
 					client.Limit(1),
 					client.Continue(continueToken),
 				)
@@ -2637,7 +2778,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 				By("listing the 2 remaining deployments when previous continuation token is used without a limit")
 				deps = &appsv1.DeploymentList{}
-				err = cl.List(context.Background(), deps,
+				err = cl.List(ctx, deps,
 					client.Continue(continueToken),
 				)
 				Expect(err).NotTo(HaveOccurred())
@@ -2662,7 +2803,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 		})
 
 		Context("with unstructured objects", func() {
-			It("should fetch collection of objects", func() {
+			It("should fetch collection of objects", func(ctx SpecContext) {
 				By("create an initial object")
 				_, err := clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -2677,7 +2818,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "DeploymentList",
 					Version: "v1",
 				})
-				err = cl.List(context.Background(), deps)
+				err = cl.List(ctx, deps)
 				Expect(err).NotTo(HaveOccurred())
 
 				Expect(deps.Items).NotTo(BeEmpty())
@@ -2691,7 +2832,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(hasDep).To(BeTrue())
 			})
 
-			It("should return an empty list if there are no matching objects", func() {
+			It("should return an empty list if there are no matching objects", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 
@@ -2702,13 +2843,13 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "DeploymentList",
 					Version: "v1",
 				})
-				Expect(cl.List(context.Background(), deps)).NotTo(HaveOccurred())
+				Expect(cl.List(ctx, deps)).NotTo(HaveOccurred())
 
 				By("validating no Deployments are returned")
 				Expect(deps.Items).To(BeEmpty())
 			})
 
-			It("should filter results by namespace selector", func() {
+			It("should filter results by namespace selector", func(ctx SpecContext) {
 				By("creating a Deployment in test-namespace-5")
 				tns1 := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "test-namespace-5"}}
 				_, err := clientset.CoreV1().Namespaces().Create(ctx, tns1, metav1.CreateOptions{})
@@ -2757,7 +2898,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "DeploymentList",
 					Version: "v1",
 				})
-				err = cl.List(context.Background(), deps, client.InNamespace("test-namespace-5"))
+				err = cl.List(ctx, deps, client.InNamespace("test-namespace-5"))
 				Expect(err).NotTo(HaveOccurred())
 
 				By("only the Deployment in test-namespace-5 is returned")
@@ -2772,7 +2913,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				deleteNamespace(ctx, tns2)
 			})
 
-			It("should filter results by field selector", func() {
+			It("should filter results by field selector", func(ctx SpecContext) {
 				By("creating a Deployment with name deployment-frontend")
 				depFrontend := &appsv1.Deployment{
 					ObjectMeta: metav1.ObjectMeta{Name: "deployment-frontend", Namespace: ns},
@@ -2815,7 +2956,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "DeploymentList",
 					Version: "v1",
 				})
-				err = cl.List(context.Background(), deps,
+				err = cl.List(ctx, deps,
 					client.MatchingFields{"metadata.name": "deployment-backend"})
 				Expect(err).NotTo(HaveOccurred())
 
@@ -2829,7 +2970,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				deleteDeployment(ctx, depBackend, ns)
 			})
 
-			It("should filter results by namespace selector and label selector", func() {
+			It("should filter results by namespace selector and label selector", func(ctx SpecContext) {
 				By("creating a Deployment in test-namespace-7 with the app=frontend label")
 				tns3 := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "test-namespace-7"}}
 				_, err := clientset.CoreV1().Namespaces().Create(ctx, tns3, metav1.CreateOptions{})
@@ -2907,7 +3048,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 				})
 				labels := map[string]string{"app": "frontend"}
-				err = cl.List(context.Background(), deps,
+				err = cl.List(ctx, deps,
 					client.InNamespace("test-namespace-7"), client.MatchingLabels(labels))
 				Expect(err).NotTo(HaveOccurred())
 
@@ -2934,7 +3075,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 			})
 		})
 		Context("with metadata objects", func() {
-			It("should fetch collection of objects", func() {
+			It("should fetch collection of objects", func(ctx SpecContext) {
 				By("creating an initial object")
 				dep, err := clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -2950,7 +3091,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				}
 				metaList := &metav1.PartialObjectMetadataList{}
 				metaList.SetGroupVersionKind(gvk)
-				Expect(cl.List(context.Background(), metaList)).NotTo(HaveOccurred())
+				Expect(cl.List(ctx, metaList)).NotTo(HaveOccurred())
 
 				By("validating that the list GVK has been preserved")
 				Expect(metaList.GroupVersionKind()).To(Equal(gvk))
@@ -2973,7 +3114,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				Expect(hasDep).To(BeTrue())
 			})
 
-			It("should return an empty list if there are no matching objects", func() {
+			It("should return an empty list if there are no matching objects", func(ctx SpecContext) {
 				cl, err := client.New(cfg, client.Options{})
 				Expect(err).NotTo(HaveOccurred())
 
@@ -2984,14 +3125,14 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 					Kind:    "DeploymentList",
 				})
-				Expect(cl.List(context.Background(), metaList)).NotTo(HaveOccurred())
+				Expect(cl.List(ctx, metaList)).NotTo(HaveOccurred())
 
 				By("validating no Deployments are returned")
 				Expect(metaList.Items).To(BeEmpty())
 			})
 
 			// TODO(seans): get label selector test working
-			It("should filter results by label selector", func() {
+			It("should filter results by label selector", func(ctx SpecContext) {
 				By("creating a Deployment with the app=frontend label")
 				depFrontend := &appsv1.Deployment{
 					ObjectMeta: metav1.ObjectMeta{
@@ -3043,7 +3184,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "DeploymentList",
 				})
 				labels := map[string]string{"app": "backend"}
-				err = cl.List(context.Background(), metaList, client.MatchingLabels(labels))
+				err = cl.List(ctx, metaList, client.MatchingLabels(labels))
 				Expect(err).NotTo(HaveOccurred())
 
 				By("only the Deployment with the backend label is returned")
@@ -3056,7 +3197,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				deleteDeployment(ctx, depBackend, ns)
 			})
 
-			It("should filter results by namespace selector", func() {
+			It("should filter results by namespace selector", func(ctx SpecContext) {
 				By("creating a Deployment in test-namespace-1")
 				tns1 := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "test-namespace-1"}}
 				_, err := clientset.CoreV1().Namespaces().Create(ctx, tns1, metav1.CreateOptions{})
@@ -3105,7 +3246,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 					Kind:    "DeploymentList",
 				})
-				err = cl.List(context.Background(), metaList, client.InNamespace("test-namespace-1"))
+				err = cl.List(ctx, metaList, client.InNamespace("test-namespace-1"))
 				Expect(err).NotTo(HaveOccurred())
 
 				By("only the Deployment in test-namespace-1 is returned")
@@ -3120,7 +3261,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				deleteNamespace(ctx, tns2)
 			})
 
-			It("should filter results by field selector", func() {
+			It("should filter results by field selector", func(ctx SpecContext) {
 				By("creating a Deployment with name deployment-frontend")
 				depFrontend := &appsv1.Deployment{
 					ObjectMeta: metav1.ObjectMeta{Name: "deployment-frontend", Namespace: ns},
@@ -3163,7 +3304,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 					Kind:    "DeploymentList",
 				})
-				err = cl.List(context.Background(), metaList,
+				err = cl.List(ctx, metaList,
 					client.MatchingFields{"metadata.name": "deployment-backend"})
 				Expect(err).NotTo(HaveOccurred())
 
@@ -3177,7 +3318,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				deleteDeployment(ctx, depBackend, ns)
 			})
 
-			It("should filter results by namespace selector and label selector", func() {
+			It("should filter results by namespace selector and label selector", func(ctx SpecContext) {
 				By("creating a Deployment in test-namespace-3 with the app=frontend label")
 				tns3 := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "test-namespace-3"}}
 				_, err := clientset.CoreV1().Namespaces().Create(ctx, tns3, metav1.CreateOptions{})
@@ -3255,7 +3396,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Kind:    "DeploymentList",
 				})
 				labels := map[string]string{"app": "frontend"}
-				err = cl.List(context.Background(), metaList,
+				err = cl.List(ctx, metaList,
 					client.InNamespace("test-namespace-3"),
 					client.MatchingLabels(labels),
 				)
@@ -3275,8 +3416,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 				deleteNamespace(ctx, tns4)
 			})
 
-			It("should filter results using limit and continue options", func() {
-
+			It("should filter results using limit and continue options", func(ctx SpecContext) {
 				makeDeployment := func(suffix string) *appsv1.Deployment {
 					return &appsv1.Deployment{
 						ObjectMeta: metav1.ObjectMeta{
@@ -3325,7 +3465,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 					Kind:    "DeploymentList",
 				})
-				err = cl.List(context.Background(), metaList,
+				err = cl.List(ctx, metaList,
 					client.Limit(1),
 				)
 				Expect(err).NotTo(HaveOccurred())
@@ -3343,7 +3483,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 					Kind:    "DeploymentList",
 				})
-				err = cl.List(context.Background(), metaList,
+				err = cl.List(ctx, metaList,
 					client.Limit(1),
 					client.Continue(continueToken),
 				)
@@ -3362,7 +3502,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 					Version: "v1",
 					Kind:    "DeploymentList",
 				})
-				err = cl.List(context.Background(), metaList,
+				err = cl.List(ctx, metaList,
 					client.Continue(continueToken),
 				)
 				Expect(err).NotTo(HaveOccurred())
@@ -3661,7 +3801,7 @@ U5wwSivyi7vmegHKmblOzNVKA5qPO8zWzqBC
 
 var _ = Describe("ClientWithCache", func() {
 	Describe("Get", func() {
-		It("should call cache reader when structured object", func() {
+		It("should call cache reader when structured object", func(ctx SpecContext) {
 			cachedReader := &fakeReader{}
 			cl, err := client.New(cfg, client.Options{
 				Cache: &client.CacheOptions{
@@ -3671,14 +3811,14 @@ var _ = Describe("ClientWithCache", func() {
 			Expect(err).NotTo(HaveOccurred())
 			var actual appsv1.Deployment
 			key := client.ObjectKey{Namespace: "ns", Name: "name"}
-			Expect(cl.Get(context.TODO(), key, &actual)).To(Succeed())
+			Expect(cl.Get(ctx, key, &actual)).To(Succeed())
 			Expect(1).To(Equal(cachedReader.Called))
 		})
 
 		When("getting unstructured objects", func() {
 			var dep *appsv1.Deployment
 
-			BeforeEach(func() {
+			BeforeEach(func(ctx SpecContext) {
 				dep = &appsv1.Deployment{
 					ObjectMeta: metav1.ObjectMeta{
 						Name:   "deployment1",
@@ -3695,17 +3835,17 @@ var _ = Describe("ClientWithCache", func() {
 					},
 				}
 				var err error
-				dep, err = clientset.AppsV1().Deployments("default").Create(context.Background(), dep, metav1.CreateOptions{})
+				dep, err = clientset.AppsV1().Deployments("default").Create(ctx, dep, metav1.CreateOptions{})
 				Expect(err).NotTo(HaveOccurred())
 			})
-			AfterEach(func() {
+			AfterEach(func(ctx SpecContext) {
 				Expect(clientset.AppsV1().Deployments("default").Delete(
-					context.Background(),
+					ctx,
 					dep.Name,
 					metav1.DeleteOptions{},
 				)).To(Succeed())
 			})
-			It("should call client reader when not cached", func() {
+			It("should call client reader when not cached", func(ctx SpecContext) {
 				cachedReader := &fakeReader{}
 				cl, err := client.New(cfg, client.Options{
 					Cache: &client.CacheOptions{
@@ -3722,10 +3862,10 @@ var _ = Describe("ClientWithCache", func() {
 				})
 				actual.SetName(dep.Name)
 				key := client.ObjectKey{Namespace: dep.Namespace, Name: dep.Name}
-				Expect(cl.Get(context.TODO(), key, actual)).To(Succeed())
+				Expect(cl.Get(ctx, key, actual)).To(Succeed())
 				Expect(0).To(Equal(cachedReader.Called))
 			})
-			It("should call cache reader when cached", func() {
+			It("should call cache reader when cached", func(ctx SpecContext) {
 				cachedReader := &fakeReader{}
 				cl, err := client.New(cfg, client.Options{
 					Cache: &client.CacheOptions{
@@ -3743,13 +3883,13 @@ var _ = Describe("ClientWithCache", func() {
 				})
 				actual.SetName(dep.Name)
 				key := client.ObjectKey{Namespace: dep.Namespace, Name: dep.Name}
-				Expect(cl.Get(context.TODO(), key, actual)).To(Succeed())
+				Expect(cl.Get(ctx, key, actual)).To(Succeed())
 				Expect(1).To(Equal(cachedReader.Called))
 			})
 		})
 	})
 	Describe("List", func() {
-		It("should call cache reader when structured object", func() {
+		It("should call cache reader when structured object", func(ctx SpecContext) {
 			cachedReader := &fakeReader{}
 			cl, err := client.New(cfg, client.Options{
 				Cache: &client.CacheOptions{
@@ -3758,12 +3898,12 @@ var _ = Describe("ClientWithCache", func() {
 			})
 			Expect(err).NotTo(HaveOccurred())
 			var actual appsv1.DeploymentList
-			Expect(cl.List(context.Background(), &actual)).To(Succeed())
+			Expect(cl.List(ctx, &actual)).To(Succeed())
 			Expect(1).To(Equal(cachedReader.Called))
 		})
 
 		When("listing unstructured objects", func() {
-			It("should call client reader when not cached", func() {
+			It("should call client reader when not cached", func(ctx SpecContext) {
 				cachedReader := &fakeReader{}
 				cl, err := client.New(cfg, client.Options{
 					Cache: &client.CacheOptions{
@@ -3778,10 +3918,10 @@ var _ = Describe("ClientWithCache", func() {
 					Kind:    "DeploymentList",
 					Version: "v1",
 				})
-				Expect(cl.List(context.Background(), actual)).To(Succeed())
+				Expect(cl.List(ctx, actual)).To(Succeed())
 				Expect(0).To(Equal(cachedReader.Called))
 			})
-			It("should call cache reader when cached", func() {
+			It("should call cache reader when cached", func(ctx SpecContext) {
 				cachedReader := &fakeReader{}
 				cl, err := client.New(cfg, client.Options{
 					Cache: &client.CacheOptions{
@@ -3797,7 +3937,7 @@ var _ = Describe("ClientWithCache", func() {
 					Kind:    "DeploymentList",
 					Version: "v1",
 				})
-				Expect(cl.List(context.Background(), actual)).To(Succeed())
+				Expect(cl.List(ctx, actual)).To(Succeed())
 				Expect(1).To(Equal(cachedReader.Called))
 			})
 		})
diff --git a/pkg/client/config/config.go b/pkg/client/config/config.go
index 5f0a6d4b1d..70389dfa90 100644
--- a/pkg/client/config/config.go
+++ b/pkg/client/config/config.go
@@ -61,6 +61,9 @@ func RegisterFlags(fs *flag.FlagSet) {
 // If --kubeconfig is set, will use the kubeconfig file at that location.  Otherwise will assume running
 // in cluster and use the cluster provided kubeconfig.
 //
+// The returned `*rest.Config` has client-side ratelimting disabled as we can rely on API priority and
+// fairness. Set its QPS to a value equal or bigger than 0 to re-enable it.
+//
 // It also applies saner defaults for QPS and burst based on the Kubernetes
 // controller manager defaults (20 QPS, 30 burst)
 //
@@ -81,6 +84,9 @@ func GetConfig() (*rest.Config, error) {
 // If --kubeconfig is set, will use the kubeconfig file at that location.  Otherwise will assume running
 // in cluster and use the cluster provided kubeconfig.
 //
+// The returned `*rest.Config` has client-side ratelimting disabled as we can rely on API priority and
+// fairness. Set its QPS to a value equal or bigger than 0 to re-enable it.
+//
 // It also applies saner defaults for QPS and burst based on the Kubernetes
 // controller manager defaults (20 QPS, 30 burst)
 //
@@ -99,10 +105,9 @@ func GetConfigWithContext(context string) (*rest.Config, error) {
 		return nil, err
 	}
 	if cfg.QPS == 0.0 {
-		cfg.QPS = 20.0
-	}
-	if cfg.Burst == 0 {
-		cfg.Burst = 30
+		// Disable client-side ratelimer by default, we can rely on
+		// API priority and fairness
+		cfg.QPS = -1
 	}
 	return cfg, nil
 }
@@ -170,6 +175,9 @@ func loadConfigWithContext(apiServerURL string, loader clientcmd.ClientConfigLoa
 // If --kubeconfig is set, will use the kubeconfig file at that location.  Otherwise will assume running
 // in cluster and use the cluster provided kubeconfig.
 //
+// The returned `*rest.Config` has client-side ratelimting disabled as we can rely on API priority and
+// fairness. Set its QPS to a value equal or bigger than 0 to re-enable it.
+//
 // Will log an error and exit if there is an error creating the rest.Config.
 func GetConfigOrDie() *rest.Config {
 	config, err := GetConfig()
diff --git a/pkg/client/config/config_test.go b/pkg/client/config/config_test.go
index 058ff33c1f..bbaeb2e2bd 100644
--- a/pkg/client/config/config_test.go
+++ b/pkg/client/config/config_test.go
@@ -52,7 +52,7 @@ var _ = Describe("Config", func() {
 	})
 
 	AfterEach(func() {
-		os.Unsetenv(clientcmd.RecommendedConfigPathEnvVar)
+		_ = os.Unsetenv(clientcmd.RecommendedConfigPathEnvVar)
 		kubeconfig = ""
 		clientcmd.RecommendedHomeFile = origRecommendedHomeFile
 
@@ -72,6 +72,7 @@ var _ = Describe("Config", func() {
 					cfg, err := GetConfigWithContext(tc.context)
 					Expect(err).NotTo(HaveOccurred())
 					Expect(cfg.Host).To(Equal(tc.wantHost))
+					Expect(cfg.QPS).To(Equal(float32(-1)))
 				})
 			}
 		}
@@ -82,8 +83,8 @@ var _ = Describe("Config", func() {
 				Expect(err).NotTo(HaveOccurred())
 
 				cfg, err := GetConfigWithContext("")
-				Expect(cfg).To(BeNil())
 				Expect(err).To(HaveOccurred())
+				Expect(cfg).To(BeNil())
 			})
 		})
 
@@ -191,7 +192,7 @@ func setConfigs(tc testCase, dir string) {
 
 func createFiles(files map[string]string, dir string) error {
 	for path, data := range files {
-		if err := os.WriteFile(filepath.Join(dir, path), []byte(data), 0644); err != nil { //nolint:gosec
+		if err := os.WriteFile(filepath.Join(dir, path), []byte(data), 0644); err != nil {
 			return err
 		}
 	}
diff --git a/pkg/client/dryrun.go b/pkg/client/dryrun.go
index bbcdd38321..a185860d33 100644
--- a/pkg/client/dryrun.go
+++ b/pkg/client/dryrun.go
@@ -82,6 +82,10 @@ func (c *dryRunClient) Patch(ctx context.Context, obj Object, patch Patch, opts
 	return c.client.Patch(ctx, obj, patch, append(opts, DryRunAll)...)
 }
 
+func (c *dryRunClient) Apply(ctx context.Context, obj runtime.ApplyConfiguration, opts ...ApplyOption) error {
+	return c.client.Apply(ctx, obj, append(opts, DryRunAll)...)
+}
+
 // Get implements client.Client.
 func (c *dryRunClient) Get(ctx context.Context, key ObjectKey, obj Object, opts ...GetOption) error {
 	return c.client.Get(ctx, key, obj, opts...)
diff --git a/pkg/client/dryrun_test.go b/pkg/client/dryrun_test.go
index 0d370e0576..912a4a10dc 100644
--- a/pkg/client/dryrun_test.go
+++ b/pkg/client/dryrun_test.go
@@ -17,7 +17,6 @@ limitations under the License.
 package client_test
 
 import (
-	"context"
 	"fmt"
 	"sync/atomic"
 
@@ -38,7 +37,6 @@ var _ = Describe("DryRunClient", func() {
 	var count uint64 = 0
 	var replicaCount int32 = 2
 	var ns = "default"
-	ctx := context.Background()
 
 	getClient := func() client.Client {
 		cl, err := client.New(cfg, client.Options{DryRun: ptr.To(true)})
@@ -47,7 +45,7 @@ var _ = Describe("DryRunClient", func() {
 		return cl
 	}
 
-	BeforeEach(func() {
+	BeforeEach(func(ctx SpecContext) {
 		atomic.AddUint64(&count, 1)
 		dep = &appsv1.Deployment{
 			ObjectMeta: metav1.ObjectMeta{
@@ -72,11 +70,11 @@ var _ = Describe("DryRunClient", func() {
 		Expect(err).NotTo(HaveOccurred())
 	})
 
-	AfterEach(func() {
+	AfterEach(func(ctx SpecContext) {
 		deleteDeployment(ctx, dep, ns)
 	})
 
-	It("should successfully Get an object", func() {
+	It("should successfully Get an object", func(ctx SpecContext) {
 		name := types.NamespacedName{Namespace: ns, Name: dep.Name}
 		result := &appsv1.Deployment{}
 
@@ -84,7 +82,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(result).To(BeEquivalentTo(dep))
 	})
 
-	It("should successfully List objects", func() {
+	It("should successfully List objects", func(ctx SpecContext) {
 		result := &appsv1.DeploymentList{}
 		opts := client.MatchingLabels(dep.Labels)
 
@@ -94,7 +92,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(result.Items[0]).To(BeEquivalentTo(*dep))
 	})
 
-	It("should not create an object", func() {
+	It("should not create an object", func(ctx SpecContext) {
 		newDep := dep.DeepCopy()
 		newDep.Name = "new-deployment"
 
@@ -104,7 +102,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(apierrors.IsNotFound(err)).To(BeTrue())
 	})
 
-	It("should not create an object with opts", func() {
+	It("should not create an object with opts", func(ctx SpecContext) {
 		newDep := dep.DeepCopy()
 		newDep.Name = "new-deployment"
 		opts := &client.CreateOptions{DryRun: []string{"Bye", "Pippa"}}
@@ -115,7 +113,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(apierrors.IsNotFound(err)).To(BeTrue())
 	})
 
-	It("should refuse a create request for an invalid object", func() {
+	It("should refuse a create request for an invalid object", func(ctx SpecContext) {
 		changedDep := dep.DeepCopy()
 		changedDep.Spec.Template.Spec.Containers = nil
 
@@ -123,7 +121,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(apierrors.IsInvalid(err)).To(BeTrue())
 	})
 
-	It("should not change objects via update", func() {
+	It("should not change objects via update", func(ctx SpecContext) {
 		changedDep := dep.DeepCopy()
 		*changedDep.Spec.Replicas = 2
 
@@ -135,7 +133,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(actual).To(BeEquivalentTo(dep))
 	})
 
-	It("should not change objects via update with opts", func() {
+	It("should not change objects via update with opts", func(ctx SpecContext) {
 		changedDep := dep.DeepCopy()
 		*changedDep.Spec.Replicas = 2
 		opts := &client.UpdateOptions{DryRun: []string{"Bye", "Pippa"}}
@@ -148,7 +146,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(actual).To(BeEquivalentTo(dep))
 	})
 
-	It("should refuse an update request for an invalid change", func() {
+	It("should refuse an update request for an invalid change", func(ctx SpecContext) {
 		changedDep := dep.DeepCopy()
 		changedDep.Spec.Template.Spec.Containers = nil
 
@@ -156,7 +154,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(apierrors.IsInvalid(err)).To(BeTrue())
 	})
 
-	It("should not change objects via patch", func() {
+	It("should not change objects via patch", func(ctx SpecContext) {
 		changedDep := dep.DeepCopy()
 		*changedDep.Spec.Replicas = 2
 
@@ -168,7 +166,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(actual).To(BeEquivalentTo(dep))
 	})
 
-	It("should not change objects via patch with opts", func() {
+	It("should not change objects via patch with opts", func(ctx SpecContext) {
 		changedDep := dep.DeepCopy()
 		*changedDep.Spec.Replicas = 2
 		opts := &client.PatchOptions{DryRun: []string{"Bye", "Pippa"}}
@@ -181,7 +179,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(actual).To(BeEquivalentTo(dep))
 	})
 
-	It("should not delete objects", func() {
+	It("should not delete objects", func(ctx SpecContext) {
 		Expect(getClient().Delete(ctx, dep)).NotTo(HaveOccurred())
 
 		actual, err := clientset.AppsV1().Deployments(ns).Get(ctx, dep.Name, metav1.GetOptions{})
@@ -190,7 +188,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(actual).To(BeEquivalentTo(dep))
 	})
 
-	It("should not delete objects with opts", func() {
+	It("should not delete objects with opts", func(ctx SpecContext) {
 		opts := &client.DeleteOptions{DryRun: []string{"Bye", "Pippa"}}
 
 		Expect(getClient().Delete(ctx, dep, opts)).NotTo(HaveOccurred())
@@ -201,7 +199,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(actual).To(BeEquivalentTo(dep))
 	})
 
-	It("should not delete objects via deleteAllOf", func() {
+	It("should not delete objects via deleteAllOf", func(ctx SpecContext) {
 		opts := []client.DeleteAllOfOption{client.InNamespace(ns), client.MatchingLabels(dep.Labels)}
 
 		Expect(getClient().DeleteAllOf(ctx, dep, opts...)).NotTo(HaveOccurred())
@@ -212,7 +210,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(actual).To(BeEquivalentTo(dep))
 	})
 
-	It("should not change objects via update status", func() {
+	It("should not change objects via update status", func(ctx SpecContext) {
 		changedDep := dep.DeepCopy()
 		changedDep.Status.Replicas = 99
 
@@ -224,7 +222,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(actual).To(BeEquivalentTo(dep))
 	})
 
-	It("should not change objects via update status with opts", func() {
+	It("should not change objects via update status with opts", func(ctx SpecContext) {
 		changedDep := dep.DeepCopy()
 		changedDep.Status.Replicas = 99
 		opts := &client.SubResourceUpdateOptions{UpdateOptions: client.UpdateOptions{DryRun: []string{"Bye", "Pippa"}}}
@@ -237,7 +235,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(actual).To(BeEquivalentTo(dep))
 	})
 
-	It("should not change objects via status patch", func() {
+	It("should not change objects via status patch", func(ctx SpecContext) {
 		changedDep := dep.DeepCopy()
 		changedDep.Status.Replicas = 99
 
@@ -249,7 +247,7 @@ var _ = Describe("DryRunClient", func() {
 		Expect(actual).To(BeEquivalentTo(dep))
 	})
 
-	It("should not change objects via status patch with opts", func() {
+	It("should not change objects via status patch with opts", func(ctx SpecContext) {
 		changedDep := dep.DeepCopy()
 		changedDep.Status.Replicas = 99
 
diff --git a/pkg/client/example_test.go b/pkg/client/example_test.go
index 2f8f975831..390dc10143 100644
--- a/pkg/client/example_test.go
+++ b/pkg/client/example_test.go
@@ -59,8 +59,8 @@ func ExampleNew() {
 
 func ExampleNew_suppress_warnings() {
 	cfg := config.GetConfigOrDie()
-	// Use a rest.WarningHandler that discards warning messages.
-	cfg.WarningHandler = rest.NoWarnings{}
+	// Use a rest.WarningHandlerWithContext that discards warning messages.
+	cfg.WarningHandlerWithContext = rest.NoWarnings{}
 
 	cl, err := client.New(cfg, client.Options{})
 	if err != nil {
diff --git a/pkg/client/fake/client.go b/pkg/client/fake/client.go
index 7366a18528..f88a44edd2 100644
--- a/pkg/client/fake/client.go
+++ b/pkg/client/fake/client.go
@@ -19,7 +19,6 @@ package fake
 import (
 	"bytes"
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"reflect"
@@ -29,9 +28,23 @@ import (
 	"sync"
 	"time"
 
-	// Using v4 to match upstream
+	/*
+	  Stick with gopkg.in/evanphx/json-patch.v4 here to match
+	  upstream Kubernetes code and avoid breaking changes introduced in v5.
+	  - Kubernetes itself remains on json-patch v4 to avoid compatibility issues
+	    tied to v5’s stricter RFC6902 compliance.
+	  - The fake client code is adapted from client-go’s testing fixture, which also
+	    relies on json-patch v4.
+	  See:
+	    https://github.com/kubernetes/kubernetes/pull/91622 (discussion of why K8s
+	    stays on v4)
+	    https://github.com/kubernetes/kubernetes/pull/120326 (v5.6.0+incompatible
+	    missing a critical fix)
+	*/
+
 	jsonpatch "gopkg.in/evanphx/json-patch.v4"
 	appsv1 "k8s.io/api/apps/v1"
+	authenticationv1 "k8s.io/api/authentication/v1"
 	autoscalingv1 "k8s.io/api/autoscaling/v1"
 	corev1 "k8s.io/api/core/v1"
 	policyv1 "k8s.io/api/policy/v1"
@@ -40,16 +53,21 @@ import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/validation"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/apimachinery/pkg/util/managedfields"
 	utilrand "k8s.io/apimachinery/pkg/util/rand"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apimachinery/pkg/util/strategicpatch"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	"k8s.io/apimachinery/pkg/watch"
+	clientgoapplyconfigurations "k8s.io/client-go/applyconfigurations"
 	"k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/client-go/testing"
 	"k8s.io/utils/ptr"
@@ -63,21 +81,31 @@ import (
 
 type versionedTracker struct {
 	testing.ObjectTracker
-	scheme                *runtime.Scheme
-	withStatusSubresource sets.Set[schema.GroupVersionKind]
+	scheme                        *runtime.Scheme
+	withStatusSubresource         sets.Set[schema.GroupVersionKind]
+	usesFieldManagedObjectTracker bool
 }
 
 type fakeClient struct {
-	tracker               versionedTracker
-	scheme                *runtime.Scheme
+	// trackerWriteLock must be acquired before writing to
+	// the tracker or performing reads that affect a following
+	// write.
+	trackerWriteLock sync.Mutex
+	tracker          versionedTracker
+
+	schemeLock sync.RWMutex
+	scheme     *runtime.Scheme
+
 	restMapper            meta.RESTMapper
 	withStatusSubresource sets.Set[schema.GroupVersionKind]
 
 	// indexes maps each GroupVersionKind (GVK) to the indexes registered for that GVK.
 	// The inner map maps from index name to IndexerFunc.
 	indexes map[schema.GroupVersionKind]map[string]client.IndexerFunc
+	// indexesLock must be held when accessing indexes.
+	indexesLock sync.RWMutex
 
-	schemeWriteLock sync.Mutex
+	returnManagedFields bool
 }
 
 var _ client.WithWatch = &fakeClient{}
@@ -111,6 +139,9 @@ type ClientBuilder struct {
 	withStatusSubresource []client.Object
 	objectTracker         testing.ObjectTracker
 	interceptorFuncs      *interceptor.Funcs
+	typeConverters        []managedfields.TypeConverter
+	returnManagedFields   bool
+	isBuilt               bool
 
 	// indexes maps each GroupVersionKind (GVK) to the indexes registered for that GVK.
 	// The inner map maps from index name to IndexerFunc.
@@ -152,6 +183,8 @@ func (f *ClientBuilder) WithRuntimeObjects(initRuntimeObjs ...runtime.Object) *C
 }
 
 // WithObjectTracker can be optionally used to initialize this fake client with testing.ObjectTracker.
+// Setting this is incompatible with setting WithTypeConverters, as they are a setting on the
+// tracker.
 func (f *ClientBuilder) WithObjectTracker(ot testing.ObjectTracker) *ClientBuilder {
 	f.objectTracker = ot
 	return f
@@ -208,8 +241,36 @@ func (f *ClientBuilder) WithInterceptorFuncs(interceptorFuncs interceptor.Funcs)
 	return f
 }
 
+// WithTypeConverters sets the type converters for the fake client. The list is ordered and the first
+// non-erroring converter is used. A type converter must be provided for all types the client is used
+// for, otherwise it will error.
+//
+// This setting is incompatible with WithObjectTracker, as the type converters are a setting on the tracker.
+//
+// If unset, this defaults to:
+// * clientgoapplyconfigurations.NewTypeConverter(scheme.Scheme),
+// * managedfields.NewDeducedTypeConverter(),
+//
+// Be aware that the behavior of the `NewDeducedTypeConverter` might not match the behavior of the
+// Kubernetes APIServer, it is recommended to provide a type converter for your types. TypeConverters
+// are generated along with ApplyConfigurations.
+func (f *ClientBuilder) WithTypeConverters(typeConverters ...managedfields.TypeConverter) *ClientBuilder {
+	f.typeConverters = append(f.typeConverters, typeConverters...)
+	return f
+}
+
+// WithReturnManagedFields configures the fake client to return managedFields
+// on objects.
+func (f *ClientBuilder) WithReturnManagedFields() *ClientBuilder {
+	f.returnManagedFields = true
+	return f
+}
+
 // Build builds and returns a new fake client.
 func (f *ClientBuilder) Build() client.WithWatch {
+	if f.isBuilt {
+		panic("Build() must not be called multiple times when creating a ClientBuilder")
+	}
 	if f.scheme == nil {
 		f.scheme = scheme.Scheme
 	}
@@ -217,8 +278,6 @@ func (f *ClientBuilder) Build() client.WithWatch {
 		f.restMapper = meta.NewDefaultRESTMapper([]schema.GroupVersion{})
 	}
 
-	var tracker versionedTracker
-
 	withStatusSubResource := sets.New(inTreeResourcesWithStatus()...)
 	for _, o := range f.withStatusSubresource {
 		gvk, err := apiutil.GVKForObject(o, f.scheme)
@@ -228,10 +287,36 @@ func (f *ClientBuilder) Build() client.WithWatch {
 		withStatusSubResource.Insert(gvk)
 	}
 
+	if f.objectTracker != nil && len(f.typeConverters) > 0 {
+		panic(errors.New("WithObjectTracker and WithTypeConverters are incompatible"))
+	}
+
+	var usesFieldManagedObjectTracker bool
 	if f.objectTracker == nil {
-		tracker = versionedTracker{ObjectTracker: testing.NewObjectTracker(f.scheme, scheme.Codecs.UniversalDecoder()), scheme: f.scheme, withStatusSubresource: withStatusSubResource}
-	} else {
-		tracker = versionedTracker{ObjectTracker: f.objectTracker, scheme: f.scheme, withStatusSubresource: withStatusSubResource}
+		if len(f.typeConverters) == 0 {
+			// Use corresponding scheme to ensure the converter error
+			// for types it can't handle.
+			clientGoScheme := runtime.NewScheme()
+			if err := scheme.AddToScheme(clientGoScheme); err != nil {
+				panic(fmt.Sprintf("failed to construct client-go scheme: %v", err))
+			}
+			f.typeConverters = []managedfields.TypeConverter{
+				clientgoapplyconfigurations.NewTypeConverter(clientGoScheme),
+				managedfields.NewDeducedTypeConverter(),
+			}
+		}
+		f.objectTracker = testing.NewFieldManagedObjectTracker(
+			f.scheme,
+			serializer.NewCodecFactory(f.scheme).UniversalDecoder(),
+			multiTypeConverter{upstream: f.typeConverters},
+		)
+		usesFieldManagedObjectTracker = true
+	}
+	tracker := versionedTracker{
+		ObjectTracker:                 f.objectTracker,
+		scheme:                        f.scheme,
+		withStatusSubresource:         withStatusSubResource,
+		usesFieldManagedObjectTracker: usesFieldManagedObjectTracker,
 	}
 
 	for _, obj := range f.initObject {
@@ -256,12 +341,14 @@ func (f *ClientBuilder) Build() client.WithWatch {
 		restMapper:            f.restMapper,
 		indexes:               f.indexes,
 		withStatusSubresource: withStatusSubResource,
+		returnManagedFields:   f.returnManagedFields,
 	}
 
 	if f.interceptorFuncs != nil {
 		result = interceptor.NewClient(result, *f.interceptorFuncs)
 	}
 
+	f.isBuilt = true
 	return result
 }
 
@@ -298,6 +385,16 @@ func (t versionedTracker) Add(obj runtime.Object) error {
 		if err != nil {
 			return err
 		}
+
+		// If the fieldManager can not decode fields, it will just silently clear them. This is pretty
+		// much guaranteed not to be what someone that initializes a fake client with objects that
+		// have them set wants, so validate them here.
+		// Ref https://github.com/kubernetes/kubernetes/blob/a956ef4862993b825bcd524a19260192ff1da72d/staging/src/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go#L105
+		if t.usesFieldManagedObjectTracker {
+			if err := managedfields.ValidateManagedFields(accessor.GetManagedFields()); err != nil {
+				return fmt.Errorf("invalid managedFields on %T: %w", obj, err)
+			}
+		}
 		if err := t.ObjectTracker.Add(obj); err != nil {
 			return err
 		}
@@ -312,8 +409,9 @@ func (t versionedTracker) Create(gvr schema.GroupVersionResource, obj runtime.Ob
 		return fmt.Errorf("failed to get accessor for object: %w", err)
 	}
 	if accessor.GetName() == "" {
+		gvk, _ := apiutil.GVKForObject(obj, t.scheme)
 		return apierrors.NewInvalid(
-			obj.GetObjectKind().GroupVersionKind().GroupKind(),
+			gvk.GroupKind(),
 			accessor.GetName(),
 			field.ErrorList{field.Required(field.NewPath("metadata.name"), "name is required")})
 	}
@@ -352,6 +450,9 @@ func convertFromUnstructuredIfNecessary(s *runtime.Scheme, o runtime.Object) (ru
 	if err != nil {
 		return nil, fmt.Errorf("scheme recognizes %s but failed to produce an object for it: %w", gvk, err)
 	}
+	if _, isTypedUnstructured := typed.(runtime.Unstructured); isTypedUnstructured {
+		return o, nil
+	}
 
 	unstructuredSerialized, err := json.Marshal(u)
 	if err != nil {
@@ -374,7 +475,11 @@ func (t versionedTracker) Update(gvr schema.GroupVersionResource, obj runtime.Ob
 }
 
 func (t versionedTracker) update(gvr schema.GroupVersionResource, obj runtime.Object, ns string, isStatus, deleting bool, opts metav1.UpdateOptions) error {
-	obj, err := t.updateObject(gvr, obj, ns, isStatus, deleting, opts.DryRun)
+	gvk, err := apiutil.GVKForObject(obj, t.scheme)
+	if err != nil {
+		return err
+	}
+	obj, err = t.updateObject(gvr, obj, ns, isStatus, deleting, opts.DryRun)
 	if err != nil {
 		return err
 	}
@@ -382,6 +487,10 @@ func (t versionedTracker) update(gvr schema.GroupVersionResource, obj runtime.Ob
 		return nil
 	}
 
+	if u, unstructured := obj.(*unstructured.Unstructured); unstructured {
+		u.SetGroupVersionKind(gvk)
+	}
+
 	return t.ObjectTracker.Update(gvr, obj, ns, opts)
 }
 
@@ -391,12 +500,9 @@ func (t versionedTracker) Patch(gvr schema.GroupVersionResource, obj runtime.Obj
 		return err
 	}
 
-	isStatus := false
 	// We apply patches using a client-go reaction that ends up calling the trackers Patch. As we can't change
 	// that reaction, we use the callstack to figure out if this originated from the status client.
-	if bytes.Contains(debug.Stack(), []byte("sigs.k8s.io/controller-runtime/pkg/client/fake.(*fakeSubResourceClient).statusPatch")) {
-		isStatus = true
-	}
+	isStatus := bytes.Contains(debug.Stack(), []byte("sigs.k8s.io/controller-runtime/pkg/client/fake.(*fakeSubResourceClient).statusPatch"))
 
 	obj, err = t.updateObject(gvr, obj, ns, isStatus, false, patchOptions.DryRun)
 	if err != nil {
@@ -416,8 +522,9 @@ func (t versionedTracker) updateObject(gvr schema.GroupVersionResource, obj runt
 	}
 
 	if accessor.GetName() == "" {
+		gvk, _ := apiutil.GVKForObject(obj, t.scheme)
 		return nil, apierrors.NewInvalid(
-			obj.GetObjectKind().GroupVersionKind().GroupKind(),
+			gvk.GroupKind(),
 			accessor.GetName(),
 			field.ErrorList{field.Required(field.NewPath("metadata.name"), "name is required")})
 	}
@@ -467,6 +574,11 @@ func (t versionedTracker) updateObject(gvr schema.GroupVersionResource, obj runt
 		switch {
 		case allowsUnconditionalUpdate(gvk):
 			accessor.SetResourceVersion(oldAccessor.GetResourceVersion())
+			// This is needed because if the patch explicitly sets the RV to null, the client-go reaction we use
+			// to apply it and whose output we process here will have it unset. It is not clear why the Kubernetes
+			// apiserver accepts such a patch, but it does so we just copy that behavior.
+			// Kubernetes apiserver behavior can be checked like this:
+			// `kubectl patch configmap foo --patch '{"metadata":{"annotations":{"foo":"bar"},"resourceVersion":null}}' -v=9`
 		case bytes.
 			Contains(debug.Stack(), []byte("sigs.k8s.io/controller-runtime/pkg/client/fake.(*fakeClient).Patch")):
 			// We apply patches using a client-go reaction that ends up calling the trackers Update. As we can't change
@@ -499,37 +611,60 @@ func (t versionedTracker) updateObject(gvr schema.GroupVersionResource, obj runt
 }
 
 func (c *fakeClient) Get(ctx context.Context, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
+	if err := c.addToSchemeIfUnknownAndUnstructuredOrPartial(obj); err != nil {
+		return err
+	}
+
+	c.schemeLock.RLock()
+	defer c.schemeLock.RUnlock()
 	gvr, err := getGVRFromObject(obj, c.scheme)
 	if err != nil {
 		return err
 	}
+	gvk, err := apiutil.GVKForObject(obj, c.scheme)
+	if err != nil {
+		return err
+	}
 	o, err := c.tracker.Get(gvr, key.Namespace, key.Name)
 	if err != nil {
 		return err
 	}
 
-	if _, isUnstructured := obj.(runtime.Unstructured); isUnstructured {
-		gvk, err := apiutil.GVKForObject(obj, c.scheme)
-		if err != nil {
-			return err
-		}
-		ta, err := meta.TypeAccessor(o)
-		if err != nil {
-			return err
-		}
-		ta.SetKind(gvk.Kind)
-		ta.SetAPIVersion(gvk.GroupVersion().String())
+	ta, err := meta.TypeAccessor(o)
+	if err != nil {
+		return err
 	}
 
+	// If the final object is unstructuctured, the json
+	// representation must contain GVK or the apimachinery
+	// json serializer will error out.
+	ta.SetAPIVersion(gvk.GroupVersion().String())
+	ta.SetKind(gvk.Kind)
+
 	j, err := json.Marshal(o)
 	if err != nil {
 		return err
 	}
 	zero(obj)
-	return json.Unmarshal(j, obj)
+	if err := json.Unmarshal(j, obj); err != nil {
+		return err
+	}
+
+	if !c.returnManagedFields {
+		obj.SetManagedFields(nil)
+	}
+
+	return ensureTypeMeta(obj, gvk)
 }
 
 func (c *fakeClient) Watch(ctx context.Context, list client.ObjectList, opts ...client.ListOption) (watch.Interface, error) {
+	if err := c.addToSchemeIfUnknownAndUnstructuredOrPartial(list); err != nil {
+		return nil, err
+	}
+
+	c.schemeLock.RLock()
+	defer c.schemeLock.RUnlock()
+
 	gvk, err := apiutil.GVKForObject(list, c.scheme)
 	if err != nil {
 		return nil, err
@@ -545,21 +680,30 @@ func (c *fakeClient) Watch(ctx context.Context, list client.ObjectList, opts ...
 }
 
 func (c *fakeClient) List(ctx context.Context, obj client.ObjectList, opts ...client.ListOption) error {
+	if err := c.addToSchemeIfUnknownAndUnstructuredOrPartial(obj); err != nil {
+		return err
+	}
+
+	c.schemeLock.RLock()
+	defer c.schemeLock.RUnlock()
 	gvk, err := apiutil.GVKForObject(obj, c.scheme)
 	if err != nil {
 		return err
 	}
 
-	originalKind := gvk.Kind
-
+	originalGVK := gvk
 	gvk.Kind = strings.TrimSuffix(gvk.Kind, "List")
+	listGVK := gvk
+	listGVK.Kind += "List"
 
-	if _, isUnstructuredList := obj.(runtime.Unstructured); isUnstructuredList && !c.scheme.Recognizes(gvk) {
+	if _, isUnstructuredList := obj.(runtime.Unstructured); isUnstructuredList && !c.scheme.Recognizes(listGVK) {
 		// We need to register the ListKind with UnstructuredList:
 		// https://github.com/kubernetes/kubernetes/blob/7b2776b89fb1be28d4e9203bdeec079be903c103/staging/src/k8s.io/client-go/dynamic/fake/simple.go#L44-L51
-		c.schemeWriteLock.Lock()
+		c.schemeLock.RUnlock()
+		c.schemeLock.Lock()
 		c.scheme.AddKnownTypeWithName(gvk.GroupVersion().WithKind(gvk.Kind+"List"), &unstructured.UnstructuredList{})
-		c.schemeWriteLock.Unlock()
+		c.schemeLock.Unlock()
+		c.schemeLock.RLock()
 	}
 
 	listOpts := client.ListOptions{}
@@ -571,35 +715,40 @@ func (c *fakeClient) List(ctx context.Context, obj client.ObjectList, opts ...cl
 		return err
 	}
 
-	if _, isUnstructured := obj.(runtime.Unstructured); isUnstructured {
-		ta, err := meta.TypeAccessor(o)
-		if err != nil {
-			return err
-		}
-		ta.SetKind(originalKind)
-		ta.SetAPIVersion(gvk.GroupVersion().String())
-	}
-
 	j, err := json.Marshal(o)
 	if err != nil {
 		return err
 	}
 	zero(obj)
-	if err := json.Unmarshal(j, obj); err != nil {
+	if err := ensureTypeMeta(obj, originalGVK); err != nil {
 		return err
 	}
-
-	if listOpts.LabelSelector == nil && listOpts.FieldSelector == nil {
-		return nil
+	objCopy := obj.DeepCopyObject().(client.ObjectList)
+	if err := json.Unmarshal(j, objCopy); err != nil {
+		return err
 	}
 
-	// If we're here, either a label or field selector are specified (or both), so before we return
-	// the list we must filter it. If both selectors are set, they are ANDed.
-	objs, err := meta.ExtractList(obj)
+	objs, err := meta.ExtractList(objCopy)
 	if err != nil {
 		return err
 	}
 
+	for _, o := range objs {
+		if err := ensureTypeMeta(o, gvk); err != nil {
+			return err
+		}
+
+		if !c.returnManagedFields {
+			o.(metav1.Object).SetManagedFields(nil)
+		}
+	}
+
+	if listOpts.LabelSelector == nil && listOpts.FieldSelector == nil {
+		return meta.SetList(obj, objs)
+	}
+
+	// If we're here, either a label or field selector are specified (or both), so before we return
+	// the list we must filter it. If both selectors are set, they are ANDed.
 	filteredList, err := c.filterList(objs, gvk, listOpts.LabelSelector, listOpts.FieldSelector)
 	if err != nil {
 		return err
@@ -634,10 +783,11 @@ func (c *fakeClient) filterList(list []runtime.Object, gvk schema.GroupVersionKi
 func (c *fakeClient) filterWithFields(list []runtime.Object, gvk schema.GroupVersionKind, fs fields.Selector) ([]runtime.Object, error) {
 	requiresExact := selector.RequiresExactMatch(fs)
 	if !requiresExact {
-		return nil, fmt.Errorf("field selector %s is not in one of the two supported forms \"key==val\" or \"key=val\"",
-			fs)
+		return nil, fmt.Errorf(`field selector %s is not in one of the two supported forms "key==val" or "key=val"`, fs)
 	}
 
+	c.indexesLock.RLock()
+	defer c.indexesLock.RUnlock()
 	// Field selection is mimicked via indexes, so there's no sane answer this function can give
 	// if there are no indexes registered for the GroupVersionKind of the objects in the list.
 	indexes := c.indexes[gvk]
@@ -699,6 +849,13 @@ func (c *fakeClient) IsObjectNamespaced(obj runtime.Object) (bool, error) {
 }
 
 func (c *fakeClient) Create(ctx context.Context, obj client.Object, opts ...client.CreateOption) error {
+	if err := c.addToSchemeIfUnknownAndUnstructuredOrPartial(obj); err != nil {
+		return err
+	}
+
+	c.schemeLock.RLock()
+	defer c.schemeLock.RUnlock()
+
 	createOptions := &client.CreateOptions{}
 	createOptions.ApplyOptions(opts)
 
@@ -729,10 +886,35 @@ func (c *fakeClient) Create(ctx context.Context, obj client.Object, opts ...clie
 		accessor.SetDeletionTimestamp(nil)
 	}
 
-	return c.tracker.Create(gvr, obj, accessor.GetNamespace())
+	gvk, err := apiutil.GVKForObject(obj, c.scheme)
+	if err != nil {
+		return err
+	}
+
+	c.trackerWriteLock.Lock()
+	defer c.trackerWriteLock.Unlock()
+
+	if err := c.tracker.Create(gvr, obj, accessor.GetNamespace(), *createOptions.AsCreateOptions()); err != nil {
+		// The managed fields tracker sets gvk even on errors
+		_ = ensureTypeMeta(obj, gvk)
+		return err
+	}
+
+	if !c.returnManagedFields {
+		obj.SetManagedFields(nil)
+	}
+
+	return ensureTypeMeta(obj, gvk)
 }
 
 func (c *fakeClient) Delete(ctx context.Context, obj client.Object, opts ...client.DeleteOption) error {
+	if err := c.addToSchemeIfUnknownAndUnstructuredOrPartial(obj); err != nil {
+		return err
+	}
+
+	c.schemeLock.RLock()
+	defer c.schemeLock.RUnlock()
+
 	gvr, err := getGVRFromObject(obj, c.scheme)
 	if err != nil {
 		return err
@@ -750,6 +932,8 @@ func (c *fakeClient) Delete(ctx context.Context, obj client.Object, opts ...clie
 		}
 	}
 
+	c.trackerWriteLock.Lock()
+	defer c.trackerWriteLock.Unlock()
 	// Check the ResourceVersion if that Precondition was specified.
 	if delOptions.Preconditions != nil && delOptions.Preconditions.ResourceVersion != nil {
 		name := accessor.GetName()
@@ -772,10 +956,17 @@ func (c *fakeClient) Delete(ctx context.Context, obj client.Object, opts ...clie
 		}
 	}
 
-	return c.deleteObject(gvr, accessor)
+	return c.deleteObjectLocked(gvr, accessor)
 }
 
 func (c *fakeClient) DeleteAllOf(ctx context.Context, obj client.Object, opts ...client.DeleteAllOfOption) error {
+	if err := c.addToSchemeIfUnknownAndUnstructuredOrPartial(obj); err != nil {
+		return err
+	}
+
+	c.schemeLock.RLock()
+	defer c.schemeLock.RUnlock()
+
 	gvk, err := apiutil.GVKForObject(obj, c.scheme)
 	if err != nil {
 		return err
@@ -790,6 +981,9 @@ func (c *fakeClient) DeleteAllOf(ctx context.Context, obj client.Object, opts ..
 		}
 	}
 
+	c.trackerWriteLock.Lock()
+	defer c.trackerWriteLock.Unlock()
+
 	gvr, _ := meta.UnsafeGuessKindToResource(gvk)
 	o, err := c.tracker.List(gvr, gvk, dcOptions.Namespace)
 	if err != nil {
@@ -809,7 +1003,7 @@ func (c *fakeClient) DeleteAllOf(ctx context.Context, obj client.Object, opts ..
 		if err != nil {
 			return err
 		}
-		err = c.deleteObject(gvr, accessor)
+		err = c.deleteObjectLocked(gvr, accessor)
 		if err != nil {
 			return err
 		}
@@ -822,6 +1016,13 @@ func (c *fakeClient) Update(ctx context.Context, obj client.Object, opts ...clie
 }
 
 func (c *fakeClient) update(obj client.Object, isStatus bool, opts ...client.UpdateOption) error {
+	if err := c.addToSchemeIfUnknownAndUnstructuredOrPartial(obj); err != nil {
+		return err
+	}
+
+	c.schemeLock.RLock()
+	defer c.schemeLock.RUnlock()
+
 	updateOptions := &client.UpdateOptions{}
 	updateOptions.ApplyOptions(opts)
 
@@ -835,21 +1036,111 @@ func (c *fakeClient) update(obj client.Object, isStatus bool, opts ...client.Upd
 	if err != nil {
 		return err
 	}
+	gvk, err := apiutil.GVKForObject(obj, c.scheme)
+	if err != nil {
+		return err
+	}
 	accessor, err := meta.Accessor(obj)
 	if err != nil {
 		return err
 	}
-	return c.tracker.update(gvr, obj, accessor.GetNamespace(), isStatus, false, *updateOptions.AsUpdateOptions())
+
+	c.trackerWriteLock.Lock()
+	defer c.trackerWriteLock.Unlock()
+
+	// Retain managed fields
+	// We can ignore all errors here since update will fail if we encounter an error.
+	obj.SetManagedFields(nil)
+	current, _ := c.tracker.Get(gvr, accessor.GetNamespace(), accessor.GetName())
+	if currentMetaObj, ok := current.(metav1.Object); ok {
+		obj.SetManagedFields(currentMetaObj.GetManagedFields())
+	}
+
+	if err := c.tracker.update(gvr, obj, accessor.GetNamespace(), isStatus, false, *updateOptions.AsUpdateOptions()); err != nil {
+		return err
+	}
+
+	if !c.returnManagedFields {
+		obj.SetManagedFields(nil)
+	}
+
+	return ensureTypeMeta(obj, gvk)
 }
 
 func (c *fakeClient) Patch(ctx context.Context, obj client.Object, patch client.Patch, opts ...client.PatchOption) error {
 	return c.patch(obj, patch, opts...)
 }
 
+func (c *fakeClient) Apply(ctx context.Context, obj runtime.ApplyConfiguration, opts ...client.ApplyOption) error {
+	applyOpts := &client.ApplyOptions{}
+	applyOpts.ApplyOptions(opts)
+
+	data, err := json.Marshal(obj)
+	if err != nil {
+		return fmt.Errorf("failed to marshal apply configuration: %w", err)
+	}
+
+	u := &unstructured.Unstructured{}
+	if err := json.Unmarshal(data, u); err != nil {
+		return fmt.Errorf("failed to unmarshal apply configuration: %w", err)
+	}
+
+	applyPatch := &fakeApplyPatch{}
+
+	patchOpts := &client.PatchOptions{}
+	patchOpts.Raw = applyOpts.AsPatchOptions()
+
+	if err := c.patch(u, applyPatch, patchOpts); err != nil {
+		return err
+	}
+
+	acJSON, err := json.Marshal(u)
+	if err != nil {
+		return fmt.Errorf("failed to marshal patched object: %w", err)
+	}
+
+	// We have to zero the object in case it contained a status and there is a
+	// status subresource. If its the private `unstructuredApplyConfiguration`
+	// we can not zero all of it, as that will cause the embedded Unstructured
+	// to be nil which then causes a NPD in the json.Unmarshal below.
+	switch reflect.TypeOf(obj).String() {
+	case "*client.unstructuredApplyConfiguration":
+		zero(reflect.ValueOf(obj).Elem().FieldByName("Unstructured").Interface())
+	default:
+		zero(obj)
+	}
+	if err := json.Unmarshal(acJSON, obj); err != nil {
+		return fmt.Errorf("failed to unmarshal patched object: %w", err)
+	}
+
+	return nil
+}
+
+type fakeApplyPatch struct{}
+
+func (p *fakeApplyPatch) Type() types.PatchType {
+	return types.ApplyPatchType
+}
+
+func (p *fakeApplyPatch) Data(obj client.Object) ([]byte, error) {
+	return json.Marshal(obj)
+}
+
 func (c *fakeClient) patch(obj client.Object, patch client.Patch, opts ...client.PatchOption) error {
+	if err := c.addToSchemeIfUnknownAndUnstructuredOrPartial(obj); err != nil {
+		return err
+	}
+
 	patchOptions := &client.PatchOptions{}
 	patchOptions.ApplyOptions(opts)
 
+	if errs := validation.ValidatePatchOptions(patchOptions.AsPatchOptions(), patch.Type()); len(errs) > 0 {
+		return apierrors.NewInvalid(schema.GroupKind{Group: "meta.k8s.io", Kind: "PatchOptions"}, "", errs)
+	}
+
+	c.schemeLock.RLock()
+	defer c.schemeLock.RUnlock()
+
 	for _, dryRunOpt := range patchOptions.DryRun {
 		if dryRunOpt == metav1.DryRunAll {
 			return nil
@@ -860,49 +1151,77 @@ func (c *fakeClient) patch(obj client.Object, patch client.Patch, opts ...client
 	if err != nil {
 		return err
 	}
-	accessor, err := meta.Accessor(obj)
-	if err != nil {
-		return err
-	}
-	data, err := patch.Data(obj)
+	gvk, err := apiutil.GVKForObject(obj, c.scheme)
 	if err != nil {
 		return err
 	}
-
-	gvk, err := apiutil.GVKForObject(obj, c.scheme)
+	accessor, err := meta.Accessor(obj)
 	if err != nil {
 		return err
 	}
 
+	var isApplyCreate bool
+	c.trackerWriteLock.Lock()
+	defer c.trackerWriteLock.Unlock()
 	oldObj, err := c.tracker.Get(gvr, accessor.GetNamespace(), accessor.GetName())
 	if err != nil {
-		return err
+		if !apierrors.IsNotFound(err) || patch.Type() != types.ApplyPatchType {
+			return err
+		}
+		oldObj = &unstructured.Unstructured{}
+		isApplyCreate = true
 	}
 	oldAccessor, err := meta.Accessor(oldObj)
 	if err != nil {
 		return err
 	}
 
-	// Apply patch without updating object.
-	// To remain in accordance with the behavior of k8s api behavior,
-	// a patch must not allow for changes to the deletionTimestamp of an object.
-	// The reaction() function applies the patch to the object and calls Update(),
-	// whereas dryPatch() replicates this behavior but skips the call to Update().
-	// This ensures that the patch may be rejected if a deletionTimestamp is modified, prior
-	// to updating the object.
-	action := testing.NewPatchAction(gvr, accessor.GetNamespace(), accessor.GetName(), patch.Type(), data)
-	o, err := dryPatch(action, c.tracker)
-	if err != nil {
-		return err
+	// SSA deletionTimestamp updates are silently ignored
+	if patch.Type() == types.ApplyPatchType && !isApplyCreate {
+		obj.SetDeletionTimestamp(oldAccessor.GetDeletionTimestamp())
 	}
-	newObj, err := meta.Accessor(o)
+
+	data, err := patch.Data(obj)
 	if err != nil {
 		return err
 	}
 
-	// Validate that deletionTimestamp has not been changed
-	if !deletionTimestampEqual(newObj, oldAccessor) {
-		return fmt.Errorf("rejected patch, metadata.deletionTimestamp immutable")
+	action := testing.NewPatchActionWithOptions(
+		gvr,
+		accessor.GetNamespace(),
+		accessor.GetName(),
+		patch.Type(),
+		data,
+		*patchOptions.AsPatchOptions(),
+	)
+
+	// Apply is implemented in the tracker and calling it has side-effects
+	// such as bumping RV and updating managedFields timestamps, hence we
+	// can not dry-run it. Luckily, the only validation we use it for
+	// doesn't apply to SSA - Creating objects with non-nil deletionTimestamp
+	// through SSA is possible and updating the deletionTimestamp is valid,
+	// but has no effect.
+	if patch.Type() != types.ApplyPatchType {
+		// Apply patch without updating object.
+		// To remain in accordance with the behavior of k8s api behavior,
+		// a patch must not allow for changes to the deletionTimestamp of an object.
+		// The reaction() function applies the patch to the object and calls Update(),
+		// whereas dryPatch() replicates this behavior but skips the call to Update().
+		// This ensures that the patch may be rejected if a deletionTimestamp is modified, prior
+		// to updating the object.
+		o, err := dryPatch(action, c.tracker)
+		if err != nil {
+			return err
+		}
+		newObj, err := meta.Accessor(o)
+		if err != nil {
+			return err
+		}
+
+		// Validate that deletionTimestamp has not been changed
+		if !deletionTimestampEqual(newObj, oldAccessor) {
+			return fmt.Errorf("rejected patch, metadata.deletionTimestamp immutable")
+		}
 	}
 
 	reaction := testing.ObjectReaction(c.tracker)
@@ -914,21 +1233,28 @@ func (c *fakeClient) patch(obj client.Object, patch client.Patch, opts ...client
 		panic("tracker could not handle patch method")
 	}
 
-	if _, isUnstructured := obj.(runtime.Unstructured); isUnstructured {
-		ta, err := meta.TypeAccessor(o)
-		if err != nil {
-			return err
-		}
-		ta.SetKind(gvk.Kind)
-		ta.SetAPIVersion(gvk.GroupVersion().String())
+	ta, err := meta.TypeAccessor(o)
+	if err != nil {
+		return err
 	}
 
+	ta.SetAPIVersion(gvk.GroupVersion().String())
+	ta.SetKind(gvk.Kind)
+
 	j, err := json.Marshal(o)
 	if err != nil {
 		return err
 	}
 	zero(obj)
-	return json.Unmarshal(j, obj)
+	if err := json.Unmarshal(j, obj); err != nil {
+		return err
+	}
+
+	if !c.returnManagedFields {
+		obj.SetManagedFields(nil)
+	}
+
+	return ensureTypeMeta(obj, gvk)
 }
 
 // Applying a patch results in a deletionTimestamp that is truncated to the nearest second.
@@ -956,6 +1282,9 @@ func dryPatch(action testing.PatchActionImpl, tracker testing.ObjectTracker) (ru
 
 	obj, err := tracker.Get(gvr, ns, action.GetName())
 	if err != nil {
+		if apierrors.IsNotFound(err) && action.GetPatchType() == types.ApplyPatchType {
+			return &unstructured.Unstructured{}, nil
+		}
 		return nil, err
 	}
 
@@ -1000,8 +1329,10 @@ func dryPatch(action testing.PatchActionImpl, tracker testing.ObjectTracker) (ru
 		if err = json.Unmarshal(mergedByte, obj); err != nil {
 			return nil, err
 		}
+	case types.ApplyCBORPatchType:
+		return nil, errors.New("apply CBOR patches are not supported in the fake client")
 	case types.ApplyPatchType:
-		return nil, errors.New("apply patches are not supported in the fake client. Follow https://github.com/kubernetes/kubernetes/issues/115598 for the current status")
+		return nil, errors.New("bug in controller-runtime: should not end up in dryPatch for SSA")
 	default:
 		return nil, fmt.Errorf("%s PatchType is not supported", action.GetPatchType())
 	}
@@ -1009,19 +1340,19 @@ func dryPatch(action testing.PatchActionImpl, tracker testing.ObjectTracker) (ru
 }
 
 // copyStatusFrom copies the status from old into new
-func copyStatusFrom(old, new runtime.Object) error {
+func copyStatusFrom(old, n runtime.Object) error {
 	oldMapStringAny, err := toMapStringAny(old)
 	if err != nil {
 		return fmt.Errorf("failed to convert old to *unstructured.Unstructured: %w", err)
 	}
-	newMapStringAny, err := toMapStringAny(new)
+	newMapStringAny, err := toMapStringAny(n)
 	if err != nil {
 		return fmt.Errorf("failed to convert new to *unststructured.Unstructured: %w", err)
 	}
 
 	newMapStringAny["status"] = oldMapStringAny["status"]
 
-	if err := fromMapStringAny(newMapStringAny, new); err != nil {
+	if err := fromMapStringAny(newMapStringAny, n); err != nil {
 		return fmt.Errorf("failed to convert back from map[string]any: %w", err)
 	}
 
@@ -1029,12 +1360,12 @@ func copyStatusFrom(old, new runtime.Object) error {
 }
 
 // copyFrom copies from old into new
-func copyFrom(old, new runtime.Object) error {
+func copyFrom(old, n runtime.Object) error {
 	oldMapStringAny, err := toMapStringAny(old)
 	if err != nil {
 		return fmt.Errorf("failed to convert old to *unstructured.Unstructured: %w", err)
 	}
-	if err := fromMapStringAny(oldMapStringAny, new); err != nil {
+	if err := fromMapStringAny(oldMapStringAny, n); err != nil {
 		return fmt.Errorf("failed to convert back from map[string]any: %w", err)
 	}
 
@@ -1082,7 +1413,7 @@ func (c *fakeClient) SubResource(subResource string) client.SubResourceClient {
 	return &fakeSubResourceClient{client: c, subResource: subResource}
 }
 
-func (c *fakeClient) deleteObject(gvr schema.GroupVersionResource, accessor metav1.Object) error {
+func (c *fakeClient) deleteObjectLocked(gvr schema.GroupVersionResource, accessor metav1.Object) error {
 	old, err := c.tracker.Get(gvr, accessor.GetNamespace(), accessor.GetName())
 	if err == nil {
 		oldAccessor, err := meta.Accessor(old)
@@ -1097,7 +1428,7 @@ func (c *fakeClient) deleteObject(gvr schema.GroupVersionResource, accessor meta
 		}
 	}
 
-	//TODO: implement propagation
+	// TODO: implement propagation
 	return c.tracker.Delete(gvr, accessor.GetNamespace(), accessor.GetName())
 }
 
@@ -1125,7 +1456,7 @@ func (sw *fakeSubResourceClient) Get(ctx context.Context, obj, subResource clien
 		}
 		scale, isScale := subResource.(*autoscalingv1.Scale)
 		if !isScale {
-			return apierrors.NewBadRequest(fmt.Sprintf("expected Scale, got %t", subResource))
+			return apierrors.NewBadRequest(fmt.Sprintf("expected Scale, got %T", subResource))
 		}
 		scaleOut, err := extractScale(obj)
 		if err != nil {
@@ -1146,13 +1477,26 @@ func (sw *fakeSubResourceClient) Create(ctx context.Context, obj client.Object,
 			_, isEviction = subResource.(*policyv1.Eviction)
 		}
 		if !isEviction {
-			return apierrors.NewBadRequest(fmt.Sprintf("got invalid type %t, expected Eviction", subResource))
+			return apierrors.NewBadRequest(fmt.Sprintf("got invalid type %T, expected Eviction", subResource))
 		}
 		if _, isPod := obj.(*corev1.Pod); !isPod {
 			return apierrors.NewNotFound(schema.GroupResource{}, "")
 		}
 
 		return sw.client.Delete(ctx, obj)
+	case "token":
+		tokenRequest, isTokenRequest := subResource.(*authenticationv1.TokenRequest)
+		if !isTokenRequest {
+			return apierrors.NewBadRequest(fmt.Sprintf("got invalid type %T, expected TokenRequest", subResource))
+		}
+		if _, isServiceAccount := obj.(*corev1.ServiceAccount); !isServiceAccount {
+			return apierrors.NewNotFound(schema.GroupResource{}, "")
+		}
+
+		tokenRequest.Status.Token = "fake-token"
+		tokenRequest.Status.ExpirationTimestamp = metav1.Date(6041, 1, 1, 0, 0, 0, 0, time.UTC)
+
+		return sw.client.Get(ctx, client.ObjectKeyFromObject(obj), obj)
 	default:
 		return fmt.Errorf("fakeSubResourceWriter does not support create for %s", sw.subResource)
 	}
@@ -1164,7 +1508,7 @@ func (sw *fakeSubResourceClient) Update(ctx context.Context, obj client.Object,
 
 	switch sw.subResource {
 	case subResourceScale:
-		if err := sw.client.Get(ctx, client.ObjectKeyFromObject(obj), obj); err != nil {
+		if err := sw.client.Get(ctx, client.ObjectKeyFromObject(obj), obj.DeepCopyObject().(client.Object)); err != nil {
 			return err
 		}
 		if updateOptions.SubResourceBody == nil {
@@ -1173,7 +1517,7 @@ func (sw *fakeSubResourceClient) Update(ctx context.Context, obj client.Object,
 
 		scale, isScale := updateOptions.SubResourceBody.(*autoscalingv1.Scale)
 		if !isScale {
-			return apierrors.NewBadRequest(fmt.Sprintf("expected Scale, got %t", updateOptions.SubResourceBody))
+			return apierrors.NewBadRequest(fmt.Sprintf("expected Scale, got %T", updateOptions.SubResourceBody))
 		}
 		if err := applyScale(obj, scale); err != nil {
 			return err
@@ -1487,3 +1831,81 @@ func applyScale(obj client.Object, scale *autoscalingv1.Scale) error {
 	}
 	return nil
 }
+
+// AddIndex adds an index to a fake client. It will panic if used with a client that is not a fake client.
+// It will error if there is already an index for given object with the same name as field.
+//
+// It can be used to test code that adds indexes to the cache at runtime.
+func AddIndex(c client.Client, obj runtime.Object, field string, extractValue client.IndexerFunc) error {
+	fakeClient, isFakeClient := c.(*fakeClient)
+	if !isFakeClient {
+		panic("AddIndex can only be used with a fake client")
+	}
+	fakeClient.indexesLock.Lock()
+	defer fakeClient.indexesLock.Unlock()
+
+	if fakeClient.indexes == nil {
+		fakeClient.indexes = make(map[schema.GroupVersionKind]map[string]client.IndexerFunc, 1)
+	}
+
+	gvk, err := apiutil.GVKForObject(obj, fakeClient.scheme)
+	if err != nil {
+		return fmt.Errorf("failed to get gvk for %T: %w", obj, err)
+	}
+
+	if fakeClient.indexes[gvk] == nil {
+		fakeClient.indexes[gvk] = make(map[string]client.IndexerFunc, 1)
+	}
+
+	if fakeClient.indexes[gvk][field] != nil {
+		return fmt.Errorf("index %s already exists", field)
+	}
+
+	fakeClient.indexes[gvk][field] = extractValue
+
+	return nil
+}
+
+func (c *fakeClient) addToSchemeIfUnknownAndUnstructuredOrPartial(obj runtime.Object) error {
+	c.schemeLock.Lock()
+	defer c.schemeLock.Unlock()
+
+	_, isUnstructured := obj.(*unstructured.Unstructured)
+	_, isUnstructuredList := obj.(*unstructured.UnstructuredList)
+	_, isPartial := obj.(*metav1.PartialObjectMetadata)
+	_, isPartialList := obj.(*metav1.PartialObjectMetadataList)
+	if !isUnstructured && !isUnstructuredList && !isPartial && !isPartialList {
+		return nil
+	}
+
+	gvk, err := apiutil.GVKForObject(obj, c.scheme)
+	if err != nil {
+		return err
+	}
+
+	if !c.scheme.Recognizes(gvk) {
+		c.scheme.AddKnownTypeWithName(gvk, obj)
+	}
+
+	return nil
+}
+
+func ensureTypeMeta(obj runtime.Object, gvk schema.GroupVersionKind) error {
+	ta, err := meta.TypeAccessor(obj)
+	if err != nil {
+		return err
+	}
+	_, isUnstructured := obj.(runtime.Unstructured)
+	_, isPartialObject := obj.(*metav1.PartialObjectMetadata)
+	_, isPartialObjectList := obj.(*metav1.PartialObjectMetadataList)
+	if !isUnstructured && !isPartialObject && !isPartialObjectList {
+		ta.SetKind("")
+		ta.SetAPIVersion("")
+		return nil
+	}
+
+	ta.SetKind(gvk.Kind)
+	ta.SetAPIVersion(gvk.GroupVersion().String())
+
+	return nil
+}
diff --git a/pkg/client/fake/client_test.go b/pkg/client/fake/client_test.go
index e86a64eefc..21c5f21dd7 100644
--- a/pkg/client/fake/client_test.go
+++ b/pkg/client/fake/client_test.go
@@ -21,12 +21,14 @@ import (
 	"encoding/json"
 	"fmt"
 	"strconv"
+	"sync"
 	"time"
 
 	"github.com/google/go-cmp/cmp"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	appsv1 "k8s.io/api/apps/v1"
+	authenticationv1 "k8s.io/api/authentication/v1"
 	autoscalingv1 "k8s.io/api/autoscaling/v1"
 	coordinationv1 "k8s.io/api/coordination/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -40,9 +42,14 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/watch"
+	clientgoapplyconfigurations "k8s.io/client-go/applyconfigurations"
+	corev1applyconfigurations "k8s.io/client-go/applyconfigurations/core/v1"
 	"k8s.io/client-go/kubernetes/fake"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/testing"
 	"k8s.io/utils/ptr"
 
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -64,10 +71,6 @@ var _ = Describe("Fake client", func() {
 	BeforeEach(func() {
 		replicas := int32(1)
 		dep = &appsv1.Deployment{
-			TypeMeta: metav1.TypeMeta{
-				APIVersion: "apps/v1",
-				Kind:       "Deployment",
-			},
 			ObjectMeta: metav1.ObjectMeta{
 				Name:            "test-deployment",
 				Namespace:       "ns1",
@@ -81,10 +84,6 @@ var _ = Describe("Fake client", func() {
 			},
 		}
 		dep2 = &appsv1.Deployment{
-			TypeMeta: metav1.TypeMeta{
-				APIVersion: "apps/v1",
-				Kind:       "Deployment",
-			},
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "test-deployment-2",
 				Namespace: "ns1",
@@ -98,10 +97,6 @@ var _ = Describe("Fake client", func() {
 			},
 		}
 		cm = &corev1.ConfigMap{
-			TypeMeta: metav1.TypeMeta{
-				APIVersion: "v1",
-				Kind:       "ConfigMap",
-			},
 			ObjectMeta: metav1.ObjectMeta{
 				Name:            "test-cm",
 				Namespace:       "ns2",
@@ -114,19 +109,19 @@ var _ = Describe("Fake client", func() {
 	})
 
 	AssertClientWithoutIndexBehavior := func() {
-		It("should be able to Get", func() {
+		It("should be able to Get", func(ctx SpecContext) {
 			By("Getting a deployment")
 			namespacedName := types.NamespacedName{
 				Name:      "test-deployment",
 				Namespace: "ns1",
 			}
 			obj := &appsv1.Deployment{}
-			err := cl.Get(context.Background(), namespacedName, obj)
+			err := cl.Get(ctx, namespacedName, obj)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(obj).To(Equal(dep))
 		})
 
-		It("should be able to Get using unstructured", func() {
+		It("should be able to Get using unstructured", func(ctx SpecContext) {
 			By("Getting a deployment")
 			namespacedName := types.NamespacedName{
 				Name:      "test-deployment",
@@ -135,47 +130,53 @@ var _ = Describe("Fake client", func() {
 			obj := &unstructured.Unstructured{}
 			obj.SetAPIVersion("apps/v1")
 			obj.SetKind("Deployment")
-			err := cl.Get(context.Background(), namespacedName, obj)
+			err := cl.Get(ctx, namespacedName, obj)
 			Expect(err).ToNot(HaveOccurred())
 		})
 
-		It("should be able to List", func() {
+		It("should be able to List", func(ctx SpecContext) {
 			By("Listing all deployments in a namespace")
 			list := &appsv1.DeploymentList{}
-			err := cl.List(context.Background(), list, client.InNamespace("ns1"))
+			err := cl.List(ctx, list, client.InNamespace("ns1"))
 			Expect(err).ToNot(HaveOccurred())
 			Expect(list.Items).To(HaveLen(2))
 			Expect(list.Items).To(ConsistOf(*dep, *dep2))
 		})
 
-		It("should be able to List using unstructured list", func() {
+		It("should be able to List using unstructured list", func(ctx SpecContext) {
 			By("Listing all deployments in a namespace")
 			list := &unstructured.UnstructuredList{}
 			list.SetAPIVersion("apps/v1")
 			list.SetKind("DeploymentList")
-			err := cl.List(context.Background(), list, client.InNamespace("ns1"))
+			err := cl.List(ctx, list, client.InNamespace("ns1"))
 			Expect(err).ToNot(HaveOccurred())
+			Expect(list.GroupVersionKind().GroupVersion().String()).To(Equal("apps/v1"))
+			Expect(list.GetKind()).To(Equal("DeploymentList"))
 			Expect(list.Items).To(HaveLen(2))
 		})
 
-		It("should be able to List using unstructured list when setting a non-list kind", func() {
+		It("should be able to List using unstructured list when setting a non-list kind", func(ctx SpecContext) {
 			By("Listing all deployments in a namespace")
 			list := &unstructured.UnstructuredList{}
 			list.SetAPIVersion("apps/v1")
 			list.SetKind("Deployment")
-			err := cl.List(context.Background(), list, client.InNamespace("ns1"))
+			err := cl.List(ctx, list, client.InNamespace("ns1"))
 			Expect(err).ToNot(HaveOccurred())
+			Expect(list.GroupVersionKind().GroupVersion().String()).To(Equal("apps/v1"))
+			Expect(list.GetKind()).To(Equal("Deployment"))
 			Expect(list.Items).To(HaveLen(2))
 		})
 
-		It("should be able to retrieve registered objects that got manipulated as unstructured", func() {
+		It("should be able to retrieve registered objects that got manipulated as unstructured", func(ctx SpecContext) {
 			list := func() {
 				By("Listing all endpoints in a namespace")
 				list := &unstructured.UnstructuredList{}
 				list.SetAPIVersion("v1")
 				list.SetKind("EndpointsList")
-				err := cl.List(context.Background(), list, client.InNamespace("ns1"))
+				err := cl.List(ctx, list, client.InNamespace("ns1"))
 				Expect(err).ToNot(HaveOccurred())
+				Expect(list.GroupVersionKind().GroupVersion().String()).To(Equal("v1"))
+				Expect(list.GetKind()).To(Equal("EndpointsList"))
 				Expect(list.Items).To(HaveLen(1))
 			}
 
@@ -191,44 +192,44 @@ var _ = Describe("Fake client", func() {
 			By("Adding the object during client initialization")
 			cl = NewClientBuilder().WithRuntimeObjects(unstructuredEndpoint()).Build()
 			list()
-			Expect(cl.Delete(context.Background(), unstructuredEndpoint())).To(Succeed())
+			Expect(cl.Delete(ctx, unstructuredEndpoint())).To(Succeed())
 
 			By("Creating an object")
 			item := unstructuredEndpoint()
-			err := cl.Create(context.Background(), item)
+			err := cl.Create(ctx, item)
 			Expect(err).ToNot(HaveOccurred())
 			list()
 
 			By("Updating the object")
 			item.SetAnnotations(map[string]string{"foo": "bar"})
-			err = cl.Update(context.Background(), item)
+			err = cl.Update(ctx, item)
 			Expect(err).ToNot(HaveOccurred())
 			list()
 
 			By("Patching the object")
 			old := item.DeepCopy()
 			item.SetAnnotations(map[string]string{"bar": "baz"})
-			err = cl.Patch(context.Background(), item, client.MergeFrom(old))
+			err = cl.Patch(ctx, item, client.MergeFrom(old))
 			Expect(err).ToNot(HaveOccurred())
 			list()
 		})
 
-		It("should be able to Create an unregistered type using unstructured", func() {
+		It("should be able to Create an unregistered type using unstructured", func(ctx SpecContext) {
 			item := &unstructured.Unstructured{}
 			item.SetAPIVersion("custom/v1")
 			item.SetKind("Image")
 			item.SetName("my-item")
-			err := cl.Create(context.Background(), item)
+			err := cl.Create(ctx, item)
 			Expect(err).ToNot(HaveOccurred())
 		})
 
-		It("should be able to Get an unregisted type using unstructured", func() {
+		It("should be able to Get an unregisted type using unstructured", func(ctx SpecContext) {
 			By("Creating an object of an unregistered type")
 			item := &unstructured.Unstructured{}
 			item.SetAPIVersion("custom/v2")
 			item.SetKind("Image")
 			item.SetName("my-item")
-			err := cl.Create(context.Background(), item)
+			err := cl.Create(ctx, item)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting and the object")
@@ -236,39 +237,43 @@ var _ = Describe("Fake client", func() {
 			item.SetAPIVersion("custom/v2")
 			item.SetKind("Image")
 			item.SetName("my-item")
-			err = cl.Get(context.Background(), client.ObjectKeyFromObject(item), item)
+			err = cl.Get(ctx, client.ObjectKeyFromObject(item), item)
 			Expect(err).ToNot(HaveOccurred())
 		})
 
-		It("should be able to List an unregistered type using unstructured", func() {
+		It("should be able to List an unregistered type using unstructured with ListKind", func(ctx SpecContext) {
 			list := &unstructured.UnstructuredList{}
 			list.SetAPIVersion("custom/v3")
 			list.SetKind("ImageList")
-			err := cl.List(context.Background(), list)
+			err := cl.List(ctx, list)
+			Expect(list.GroupVersionKind().GroupVersion().String()).To(Equal("custom/v3"))
+			Expect(list.GetKind()).To(Equal("ImageList"))
 			Expect(err).ToNot(HaveOccurred())
 		})
 
-		It("should be able to List an unregistered type using unstructured", func() {
+		It("should be able to List an unregistered type using unstructured with Kind", func(ctx SpecContext) {
 			list := &unstructured.UnstructuredList{}
 			list.SetAPIVersion("custom/v4")
 			list.SetKind("Image")
-			err := cl.List(context.Background(), list)
+			err := cl.List(ctx, list)
 			Expect(err).ToNot(HaveOccurred())
+			Expect(list.GroupVersionKind().GroupVersion().String()).To(Equal("custom/v4"))
+			Expect(list.GetKind()).To(Equal("Image"))
 		})
 
-		It("should be able to Update an unregistered type using unstructured", func() {
+		It("should be able to Update an unregistered type using unstructured", func(ctx SpecContext) {
 			By("Creating an object of an unregistered type")
 			item := &unstructured.Unstructured{}
 			item.SetAPIVersion("custom/v5")
 			item.SetKind("Image")
 			item.SetName("my-item")
-			err := cl.Create(context.Background(), item)
+			err := cl.Create(ctx, item)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Updating the object")
 			err = unstructured.SetNestedField(item.Object, int64(2), "spec", "replicas")
 			Expect(err).ToNot(HaveOccurred())
-			err = cl.Update(context.Background(), item)
+			err = cl.Update(ctx, item)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting the object")
@@ -276,7 +281,7 @@ var _ = Describe("Fake client", func() {
 			item.SetAPIVersion("custom/v5")
 			item.SetKind("Image")
 			item.SetName("my-item")
-			err = cl.Get(context.Background(), client.ObjectKeyFromObject(item), item)
+			err = cl.Get(ctx, client.ObjectKeyFromObject(item), item)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Inspecting the object")
@@ -286,20 +291,20 @@ var _ = Describe("Fake client", func() {
 			Expect(value).To(Equal(int64(2)))
 		})
 
-		It("should be able to Patch an unregistered type using unstructured", func() {
+		It("should be able to Patch an unregistered type using unstructured", func(ctx SpecContext) {
 			By("Creating an object of an unregistered type")
 			item := &unstructured.Unstructured{}
 			item.SetAPIVersion("custom/v6")
 			item.SetKind("Image")
 			item.SetName("my-item")
-			err := cl.Create(context.Background(), item)
+			err := cl.Create(ctx, item)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Updating the object")
 			original := item.DeepCopy()
 			err = unstructured.SetNestedField(item.Object, int64(2), "spec", "replicas")
 			Expect(err).ToNot(HaveOccurred())
-			err = cl.Patch(context.Background(), item, client.MergeFrom(original))
+			err = cl.Patch(ctx, item, client.MergeFrom(original))
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting the object")
@@ -307,7 +312,7 @@ var _ = Describe("Fake client", func() {
 			item.SetAPIVersion("custom/v6")
 			item.SetKind("Image")
 			item.SetName("my-item")
-			err = cl.Get(context.Background(), client.ObjectKeyFromObject(item), item)
+			err = cl.Get(ctx, client.ObjectKeyFromObject(item), item)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Inspecting the object")
@@ -317,17 +322,17 @@ var _ = Describe("Fake client", func() {
 			Expect(value).To(Equal(int64(2)))
 		})
 
-		It("should be able to Delete an unregistered type using unstructured", func() {
+		It("should be able to Delete an unregistered type using unstructured", func(ctx SpecContext) {
 			By("Creating an object of an unregistered type")
 			item := &unstructured.Unstructured{}
 			item.SetAPIVersion("custom/v7")
 			item.SetKind("Image")
 			item.SetName("my-item")
-			err := cl.Create(context.Background(), item)
+			err := cl.Create(ctx, item)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Deleting the object")
-			err = cl.Delete(context.Background(), item)
+			err = cl.Delete(ctx, item)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting the object")
@@ -335,14 +340,41 @@ var _ = Describe("Fake client", func() {
 			item.SetAPIVersion("custom/v7")
 			item.SetKind("Image")
 			item.SetName("my-item")
-			err = cl.Get(context.Background(), client.ObjectKeyFromObject(item), item)
+			err = cl.Get(ctx, client.ObjectKeyFromObject(item), item)
 			Expect(apierrors.IsNotFound(err)).To(BeTrue())
 		})
 
-		It("should support filtering by labels and their values", func() {
+		It("should be able to retrieve objects by PartialObjectMetadata", func(ctx SpecContext) {
+			By("Creating a Resource")
+			secret := &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "foo",
+					Namespace: "bar",
+				},
+			}
+			err := cl.Create(ctx, secret)
+			Expect(err).ToNot(HaveOccurred())
+
+			By("Fetching the resource using a PartialObjectMeta")
+			partialObjMeta := &metav1.PartialObjectMetadata{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "foo",
+					Namespace: "bar",
+				},
+			}
+			partialObjMeta.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Secret"))
+
+			err = cl.Get(ctx, client.ObjectKeyFromObject(partialObjMeta), partialObjMeta)
+			Expect(err).ToNot(HaveOccurred())
+
+			Expect(partialObjMeta.Kind).To(Equal("Secret"))
+			Expect(partialObjMeta.APIVersion).To(Equal("v1"))
+		})
+
+		It("should support filtering by labels and their values", func(ctx SpecContext) {
 			By("Listing deployments with a particular label and value")
 			list := &appsv1.DeploymentList{}
-			err := cl.List(context.Background(), list, client.InNamespace("ns1"),
+			err := cl.List(ctx, list, client.InNamespace("ns1"),
 				client.MatchingLabels(map[string]string{
 					"test-label": "label-value",
 				}))
@@ -351,49 +383,25 @@ var _ = Describe("Fake client", func() {
 			Expect(list.Items).To(ConsistOf(*dep2))
 		})
 
-		It("should support filtering by label existence", func() {
+		It("should support filtering by label existence", func(ctx SpecContext) {
 			By("Listing deployments with a particular label")
 			list := &appsv1.DeploymentList{}
-			err := cl.List(context.Background(), list, client.InNamespace("ns1"),
+			err := cl.List(ctx, list, client.InNamespace("ns1"),
 				client.HasLabels{"test-label"})
 			Expect(err).ToNot(HaveOccurred())
 			Expect(list.Items).To(HaveLen(1))
 			Expect(list.Items).To(ConsistOf(*dep2))
 		})
 
-		It("should reject apply patches, they are not supported in the fake client", func() {
-			By("Creating a new configmap")
-			cm := &corev1.ConfigMap{
-				TypeMeta: metav1.TypeMeta{
-					APIVersion: "v1",
-					Kind:       "ConfigMap",
-				},
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "new-test-cm",
-					Namespace: "ns2",
-				},
-			}
-			err := cl.Create(context.Background(), cm)
-			Expect(err).ToNot(HaveOccurred())
-
-			cm.Data = map[string]string{"foo": "bar"}
-			err = cl.Patch(context.Background(), cm, client.Apply, client.ForceOwnership)
-			Expect(err).To(MatchError(ContainSubstring("apply patches are not supported in the fake client")))
-		})
-
-		It("should be able to Create", func() {
+		It("should be able to Create", func(ctx SpecContext) {
 			By("Creating a new configmap")
 			newcm := &corev1.ConfigMap{
-				TypeMeta: metav1.TypeMeta{
-					APIVersion: "v1",
-					Kind:       "ConfigMap",
-				},
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "new-test-cm",
 					Namespace: "ns2",
 				},
 			}
-			err := cl.Create(context.Background(), newcm)
+			err := cl.Create(ctx, newcm)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting the new configmap")
@@ -402,13 +410,13 @@ var _ = Describe("Fake client", func() {
 				Namespace: "ns2",
 			}
 			obj := &corev1.ConfigMap{}
-			err = cl.Get(context.Background(), namespacedName, obj)
+			err = cl.Get(ctx, namespacedName, obj)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(obj).To(Equal(newcm))
 			Expect(obj.ObjectMeta.ResourceVersion).To(Equal("1"))
 		})
 
-		It("should error on create with set resourceVersion", func() {
+		It("should error on create with set resourceVersion", func(ctx SpecContext) {
 			By("Creating a new configmap")
 			newcm := &corev1.ConfigMap{
 				ObjectMeta: metav1.ObjectMeta{
@@ -417,58 +425,46 @@ var _ = Describe("Fake client", func() {
 					ResourceVersion: "1",
 				},
 			}
-			err := cl.Create(context.Background(), newcm)
+			err := cl.Create(ctx, newcm)
 			Expect(apierrors.IsBadRequest(err)).To(BeTrue())
 		})
 
-		It("should not change the submitted object if Create failed", func() {
+		It("should not change the submitted object if Create failed", func(ctx SpecContext) {
 			By("Trying to create an existing configmap")
 			submitted := cm.DeepCopy()
 			submitted.ResourceVersion = ""
 			submittedReference := submitted.DeepCopy()
-			err := cl.Create(context.Background(), submitted)
+			err := cl.Create(ctx, submitted)
 			Expect(err).To(HaveOccurred())
 			Expect(apierrors.IsAlreadyExists(err)).To(BeTrue())
-			Expect(submitted).To(Equal(submittedReference))
+			Expect(submitted).To(BeComparableTo(submittedReference))
 		})
 
-		It("should error on Create with empty Name", func() {
+		It("should error on Create with empty Name", func(ctx SpecContext) {
 			By("Creating a new configmap")
 			newcm := &corev1.ConfigMap{
-				TypeMeta: metav1.TypeMeta{
-					APIVersion: "v1",
-					Kind:       "ConfigMap",
-				},
 				ObjectMeta: metav1.ObjectMeta{
 					Namespace: "ns2",
 				},
 			}
-			err := cl.Create(context.Background(), newcm)
+			err := cl.Create(ctx, newcm)
 			Expect(err.Error()).To(Equal("ConfigMap \"\" is invalid: metadata.name: Required value: name is required"))
 		})
 
-		It("should error on Update with empty Name", func() {
+		It("should error on Update with empty Name", func(ctx SpecContext) {
 			By("Creating a new configmap")
 			newcm := &corev1.ConfigMap{
-				TypeMeta: metav1.TypeMeta{
-					APIVersion: "v1",
-					Kind:       "ConfigMap",
-				},
 				ObjectMeta: metav1.ObjectMeta{
 					Namespace: "ns2",
 				},
 			}
-			err := cl.Update(context.Background(), newcm)
+			err := cl.Update(ctx, newcm)
 			Expect(err.Error()).To(Equal("ConfigMap \"\" is invalid: metadata.name: Required value: name is required"))
 		})
 
-		It("should be able to Create with GenerateName", func() {
+		It("should be able to Create with GenerateName", func(ctx SpecContext) {
 			By("Creating a new configmap")
 			newcm := &corev1.ConfigMap{
-				TypeMeta: metav1.TypeMeta{
-					APIVersion: "v1",
-					Kind:       "ConfigMap",
-				},
 				ObjectMeta: metav1.ObjectMeta{
 					GenerateName: "new-test-cm",
 					Namespace:    "ns2",
@@ -477,12 +473,12 @@ var _ = Describe("Fake client", func() {
 					},
 				},
 			}
-			err := cl.Create(context.Background(), newcm)
+			err := cl.Create(ctx, newcm)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Listing configmaps with a particular label")
 			list := &corev1.ConfigMapList{}
-			err = cl.List(context.Background(), list, client.InNamespace("ns2"),
+			err = cl.List(ctx, list, client.InNamespace("ns2"),
 				client.MatchingLabels(map[string]string{
 					"test-label": "label-value",
 				}))
@@ -491,13 +487,9 @@ var _ = Describe("Fake client", func() {
 			Expect(list.Items[0].Name).NotTo(BeEmpty())
 		})
 
-		It("should be able to Update", func() {
+		It("should be able to Update", func(ctx SpecContext) {
 			By("Updating a new configmap")
 			newcm := &corev1.ConfigMap{
-				TypeMeta: metav1.TypeMeta{
-					APIVersion: "v1",
-					Kind:       "ConfigMap",
-				},
 				ObjectMeta: metav1.ObjectMeta{
 					Name:            "test-cm",
 					Namespace:       "ns2",
@@ -507,7 +499,7 @@ var _ = Describe("Fake client", func() {
 					"test-key": "new-value",
 				},
 			}
-			err := cl.Update(context.Background(), newcm)
+			err := cl.Update(ctx, newcm)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting the new configmap")
@@ -516,19 +508,15 @@ var _ = Describe("Fake client", func() {
 				Namespace: "ns2",
 			}
 			obj := &corev1.ConfigMap{}
-			err = cl.Get(context.Background(), namespacedName, obj)
+			err = cl.Get(ctx, namespacedName, obj)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(obj).To(Equal(newcm))
 			Expect(obj.ObjectMeta.ResourceVersion).To(Equal("1000"))
 		})
 
-		It("should allow updates with non-set ResourceVersion for a resource that allows unconditional updates", func() {
+		It("should allow updates with non-set ResourceVersion for a resource that allows unconditional updates", func(ctx SpecContext) {
 			By("Updating a new configmap")
 			newcm := &corev1.ConfigMap{
-				TypeMeta: metav1.TypeMeta{
-					APIVersion: "v1",
-					Kind:       "ConfigMap",
-				},
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-cm",
 					Namespace: "ns2",
@@ -537,7 +525,7 @@ var _ = Describe("Fake client", func() {
 					"test-key": "new-value",
 				},
 			}
-			err := cl.Update(context.Background(), newcm)
+			err := cl.Update(ctx, newcm)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting the configmap")
@@ -546,51 +534,42 @@ var _ = Describe("Fake client", func() {
 				Namespace: "ns2",
 			}
 			obj := &corev1.ConfigMap{}
-			err = cl.Get(context.Background(), namespacedName, obj)
+			err = cl.Get(ctx, namespacedName, obj)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(obj).To(Equal(newcm))
 			Expect(obj.ObjectMeta.ResourceVersion).To(Equal("1000"))
 		})
 
-		It("should allow patch with non-set ResourceVersion for a resource that doesn't allow unconditional updates", func() {
-			schemeBuilder := &scheme.Builder{GroupVersion: schema.GroupVersion{Group: "test", Version: "v1"}}
-			schemeBuilder.Register(&WithPointerMeta{}, &WithPointerMetaList{})
-
-			scheme := runtime.NewScheme()
-			Expect(schemeBuilder.AddToScheme(scheme)).NotTo(HaveOccurred())
-
-			cl := NewClientBuilder().WithScheme(scheme).Build()
-			original := &WithPointerMeta{
-				ObjectMeta: &metav1.ObjectMeta{
+		It("should allow patch when the patch sets RV to 'null'", func(ctx SpecContext) {
+			cl := NewClientBuilder().Build()
+			original := &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
 					Name:      "obj",
 					Namespace: "ns2",
 				}}
 
-			err := cl.Create(context.Background(), original)
+			err := cl.Create(ctx, original)
 			Expect(err).ToNot(HaveOccurred())
 
-			newObj := &WithPointerMeta{
-				ObjectMeta: &metav1.ObjectMeta{
+			newObj := &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
 					Name:      original.Name,
 					Namespace: original.Namespace,
 					Annotations: map[string]string{
 						"foo": "bar",
 					},
 				}}
-			Expect(cl.Patch(context.Background(), newObj, client.MergeFrom(original))).To(Succeed())
 
-			patched := &WithPointerMeta{}
-			Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(original), patched)).To(Succeed())
+			Expect(cl.Patch(ctx, newObj, client.MergeFrom(original))).To(Succeed())
+
+			patched := &corev1.ConfigMap{}
+			Expect(cl.Get(ctx, client.ObjectKeyFromObject(original), patched)).To(Succeed())
 			Expect(patched.Annotations).To(Equal(map[string]string{"foo": "bar"}))
 		})
 
-		It("should reject updates with non-set ResourceVersion for a resource that doesn't allow unconditional updates", func() {
+		It("should reject updates with non-set ResourceVersion for a resource that doesn't allow unconditional updates", func(ctx SpecContext) {
 			By("Creating a new binding")
 			binding := &corev1.Binding{
-				TypeMeta: metav1.TypeMeta{
-					APIVersion: "v1",
-					Kind:       "Binding",
-				},
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-binding",
 					Namespace: "ns2",
@@ -602,14 +581,10 @@ var _ = Describe("Fake client", func() {
 					Name:       cm.Name,
 				},
 			}
-			Expect(cl.Create(context.Background(), binding)).To(Succeed())
+			Expect(cl.Create(ctx, binding)).To(Succeed())
 
 			By("Updating the binding with a new resource lacking resource version")
 			newBinding := &corev1.Binding{
-				TypeMeta: metav1.TypeMeta{
-					APIVersion: "v1",
-					Kind:       "Binding",
-				},
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      binding.Name,
 					Namespace: binding.Namespace,
@@ -619,23 +594,19 @@ var _ = Describe("Fake client", func() {
 					Name:      "blue",
 				},
 			}
-			Expect(cl.Update(context.Background(), newBinding)).NotTo(Succeed())
+			Expect(cl.Update(ctx, newBinding)).NotTo(Succeed())
 		})
 
-		It("should allow create on update for a resource that allows create on update", func() {
+		It("should allow create on update for a resource that allows create on update", func(ctx SpecContext) {
 			By("Creating a new lease with update")
 			lease := &coordinationv1.Lease{
-				TypeMeta: metav1.TypeMeta{
-					APIVersion: "coordination.k8s.io/v1",
-					Kind:       "Lease",
-				},
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-lease",
 					Namespace: "ns2",
 				},
 				Spec: coordinationv1.LeaseSpec{},
 			}
-			Expect(cl.Create(context.Background(), lease)).To(Succeed())
+			Expect(cl.Create(ctx, lease)).To(Succeed())
 
 			By("Getting the lease")
 			namespacedName := types.NamespacedName{
@@ -643,18 +614,14 @@ var _ = Describe("Fake client", func() {
 				Namespace: lease.Namespace,
 			}
 			obj := &coordinationv1.Lease{}
-			Expect(cl.Get(context.Background(), namespacedName, obj)).To(Succeed())
+			Expect(cl.Get(ctx, namespacedName, obj)).To(Succeed())
 			Expect(obj).To(Equal(lease))
 			Expect(obj.ObjectMeta.ResourceVersion).To(Equal("1"))
 		})
 
-		It("should reject create on update for a resource that does not allow create on update", func() {
+		It("should reject create on update for a resource that does not allow create on update", func(ctx SpecContext) {
 			By("Attemping to create a new configmap with update")
 			newcm := &corev1.ConfigMap{
-				TypeMeta: metav1.TypeMeta{
-					APIVersion: "v1",
-					Kind:       "ConfigMap",
-				},
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "different-test-cm",
 					Namespace: "ns2",
@@ -663,10 +630,10 @@ var _ = Describe("Fake client", func() {
 					"test-key": "new-value",
 				},
 			}
-			Expect(cl.Update(context.Background(), newcm)).NotTo(Succeed())
+			Expect(cl.Update(ctx, newcm)).NotTo(Succeed())
 		})
 
-		It("should reject updates with non-matching ResourceVersion", func() {
+		It("should reject updates with non-matching ResourceVersion", func(ctx SpecContext) {
 			By("Updating a new configmap")
 			newcm := &corev1.ConfigMap{
 				ObjectMeta: metav1.ObjectMeta{
@@ -678,7 +645,7 @@ var _ = Describe("Fake client", func() {
 					"test-key": "new-value",
 				},
 			}
-			err := cl.Update(context.Background(), newcm)
+			err := cl.Update(ctx, newcm)
 			Expect(apierrors.IsConflict(err)).To(BeTrue())
 
 			By("Getting the configmap")
@@ -687,67 +654,67 @@ var _ = Describe("Fake client", func() {
 				Namespace: "ns2",
 			}
 			obj := &corev1.ConfigMap{}
-			err = cl.Get(context.Background(), namespacedName, obj)
+			err = cl.Get(ctx, namespacedName, obj)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(obj).To(Equal(cm))
 			Expect(obj.ObjectMeta.ResourceVersion).To(Equal(trackerAddResourceVersion))
 		})
 
-		It("should reject Delete with a mismatched ResourceVersion", func() {
+		It("should reject Delete with a mismatched ResourceVersion", func(ctx SpecContext) {
 			bogusRV := "bogus"
 			By("Deleting with a mismatched ResourceVersion Precondition")
-			err := cl.Delete(context.Background(), dep, client.Preconditions{ResourceVersion: &bogusRV})
+			err := cl.Delete(ctx, dep, client.Preconditions{ResourceVersion: &bogusRV})
 			Expect(apierrors.IsConflict(err)).To(BeTrue())
 
 			list := &appsv1.DeploymentList{}
-			err = cl.List(context.Background(), list, client.InNamespace("ns1"))
+			err = cl.List(ctx, list, client.InNamespace("ns1"))
 			Expect(err).ToNot(HaveOccurred())
 			Expect(list.Items).To(HaveLen(2))
 			Expect(list.Items).To(ConsistOf(*dep, *dep2))
 		})
 
-		It("should successfully Delete with a matching ResourceVersion", func() {
+		It("should successfully Delete with a matching ResourceVersion", func(ctx SpecContext) {
 			goodRV := trackerAddResourceVersion
 			By("Deleting with a matching ResourceVersion Precondition")
-			err := cl.Delete(context.Background(), dep, client.Preconditions{ResourceVersion: &goodRV})
+			err := cl.Delete(ctx, dep, client.Preconditions{ResourceVersion: &goodRV})
 			Expect(err).ToNot(HaveOccurred())
 
 			list := &appsv1.DeploymentList{}
-			err = cl.List(context.Background(), list, client.InNamespace("ns1"))
+			err = cl.List(ctx, list, client.InNamespace("ns1"))
 			Expect(err).ToNot(HaveOccurred())
 			Expect(list.Items).To(HaveLen(1))
 			Expect(list.Items).To(ConsistOf(*dep2))
 		})
 
-		It("should be able to Delete with no ResourceVersion Precondition", func() {
+		It("should be able to Delete with no ResourceVersion Precondition", func(ctx SpecContext) {
 			By("Deleting a deployment")
-			err := cl.Delete(context.Background(), dep)
+			err := cl.Delete(ctx, dep)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Listing all deployments in the namespace")
 			list := &appsv1.DeploymentList{}
-			err = cl.List(context.Background(), list, client.InNamespace("ns1"))
+			err = cl.List(ctx, list, client.InNamespace("ns1"))
 			Expect(err).ToNot(HaveOccurred())
 			Expect(list.Items).To(HaveLen(1))
 			Expect(list.Items).To(ConsistOf(*dep2))
 		})
 
-		It("should be able to Delete with no opts even if object's ResourceVersion doesn't match server", func() {
+		It("should be able to Delete with no opts even if object's ResourceVersion doesn't match server", func(ctx SpecContext) {
 			By("Deleting a deployment")
 			depCopy := dep.DeepCopy()
 			depCopy.ResourceVersion = "bogus"
-			err := cl.Delete(context.Background(), depCopy)
+			err := cl.Delete(ctx, depCopy)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Listing all deployments in the namespace")
 			list := &appsv1.DeploymentList{}
-			err = cl.List(context.Background(), list, client.InNamespace("ns1"))
+			err = cl.List(ctx, list, client.InNamespace("ns1"))
 			Expect(err).ToNot(HaveOccurred())
 			Expect(list.Items).To(HaveLen(1))
 			Expect(list.Items).To(ConsistOf(*dep2))
 		})
 
-		It("should handle finalizers on Update", func() {
+		It("should handle finalizers on Update", func(ctx SpecContext) {
 			namespacedName := types.NamespacedName{
 				Name:      "test-cm",
 				Namespace: "delete-with-finalizers",
@@ -763,31 +730,31 @@ var _ = Describe("Fake client", func() {
 					"test-key": "new-value",
 				},
 			}
-			err := cl.Create(context.Background(), newObj)
+			err := cl.Create(ctx, newObj)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Deleting the object")
-			err = cl.Delete(context.Background(), newObj)
+			err = cl.Delete(ctx, newObj)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting the object")
 			obj := &corev1.ConfigMap{}
-			err = cl.Get(context.Background(), namespacedName, obj)
+			err = cl.Get(ctx, namespacedName, obj)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(obj.DeletionTimestamp).NotTo(BeNil())
 
 			By("Removing the finalizer")
 			obj.Finalizers = []string{}
-			err = cl.Update(context.Background(), obj)
+			err = cl.Update(ctx, obj)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting the object")
 			obj = &corev1.ConfigMap{}
-			err = cl.Get(context.Background(), namespacedName, obj)
+			err = cl.Get(ctx, namespacedName, obj)
 			Expect(apierrors.IsNotFound(err)).To(BeTrue())
 		})
 
-		It("should reject changes to deletionTimestamp on Update", func() {
+		It("should reject changes to deletionTimestamp on Update", func(ctx SpecContext) {
 			namespacedName := types.NamespacedName{
 				Name:      "test-cm",
 				Namespace: "reject-with-deletiontimestamp",
@@ -802,52 +769,52 @@ var _ = Describe("Fake client", func() {
 					"test-key": "new-value",
 				},
 			}
-			err := cl.Create(context.Background(), newObj)
+			err := cl.Create(ctx, newObj)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting the object")
 			obj := &corev1.ConfigMap{}
-			err = cl.Get(context.Background(), namespacedName, obj)
+			err = cl.Get(ctx, namespacedName, obj)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(obj.DeletionTimestamp).To(BeNil())
 
 			By("Adding deletionTimestamp")
 			now := metav1.Now()
 			obj.DeletionTimestamp = &now
-			err = cl.Update(context.Background(), obj)
+			err = cl.Update(ctx, obj)
 			Expect(err).To(HaveOccurred())
 
 			By("Deleting the object")
-			err = cl.Delete(context.Background(), newObj)
+			err = cl.Delete(ctx, newObj)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Changing the deletionTimestamp to new value")
 			obj = &corev1.ConfigMap{}
 			t := metav1.NewTime(time.Now().Add(time.Second))
 			obj.DeletionTimestamp = &t
-			err = cl.Update(context.Background(), obj)
+			err = cl.Update(ctx, obj)
 			Expect(err).To(HaveOccurred())
 
 			By("Removing deletionTimestamp")
 			obj.DeletionTimestamp = nil
-			err = cl.Update(context.Background(), obj)
+			err = cl.Update(ctx, obj)
 			Expect(err).To(HaveOccurred())
 
 		})
 
-		It("should be able to Delete a Collection", func() {
+		It("should be able to Delete a Collection", func(ctx SpecContext) {
 			By("Deleting a deploymentList")
-			err := cl.DeleteAllOf(context.Background(), &appsv1.Deployment{}, client.InNamespace("ns1"))
+			err := cl.DeleteAllOf(ctx, &appsv1.Deployment{}, client.InNamespace("ns1"))
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Listing all deployments in the namespace")
 			list := &appsv1.DeploymentList{}
-			err = cl.List(context.Background(), list, client.InNamespace("ns1"))
+			err = cl.List(ctx, list, client.InNamespace("ns1"))
 			Expect(err).ToNot(HaveOccurred())
 			Expect(list.Items).To(BeEmpty())
 		})
 
-		It("should handle finalizers deleting a collection", func() {
+		It("should handle finalizers deleting a collection", func(ctx SpecContext) {
 			for i := 0; i < 5; i++ {
 				namespacedName := types.NamespacedName{
 					Name:      fmt.Sprintf("test-cm-%d", i),
@@ -864,16 +831,16 @@ var _ = Describe("Fake client", func() {
 						"test-key": "new-value",
 					},
 				}
-				err := cl.Create(context.Background(), newObj)
+				err := cl.Create(ctx, newObj)
 				Expect(err).ToNot(HaveOccurred())
 			}
 
 			By("Deleting the object")
-			err := cl.DeleteAllOf(context.Background(), &corev1.ConfigMap{}, client.InNamespace("delete-collection-with-finalizers"))
+			err := cl.DeleteAllOf(ctx, &corev1.ConfigMap{}, client.InNamespace("delete-collection-with-finalizers"))
 			Expect(err).ToNot(HaveOccurred())
 
 			configmaps := corev1.ConfigMapList{}
-			err = cl.List(context.Background(), &configmaps, client.InNamespace("delete-collection-with-finalizers"))
+			err = cl.List(ctx, &configmaps, client.InNamespace("delete-collection-with-finalizers"))
 			Expect(err).ToNot(HaveOccurred())
 
 			Expect(configmaps.Items).To(HaveLen(5))
@@ -882,9 +849,9 @@ var _ = Describe("Fake client", func() {
 			}
 		})
 
-		It("should be able to watch", func() {
+		It("should be able to watch", func(ctx SpecContext) {
 			By("Creating a watch")
-			objWatch, err := cl.Watch(context.Background(), &corev1.ServiceList{})
+			objWatch, err := cl.Watch(ctx, &corev1.ServiceList{})
 			Expect(err).NotTo(HaveOccurred())
 
 			defer objWatch.Stop()
@@ -895,7 +862,7 @@ var _ = Describe("Fake client", func() {
 				// in the outer routine, sleep to make sure this is always true
 				time.Sleep(100 * time.Millisecond)
 
-				err := cl.Create(context.Background(), &corev1.Service{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "for-watch"}})
+				err := cl.Create(ctx, &corev1.Service{ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "for-watch"}})
 				Expect(err).ToNot(HaveOccurred())
 			}()
 
@@ -909,7 +876,7 @@ var _ = Describe("Fake client", func() {
 		})
 
 		Context("with the DryRun option", func() {
-			It("should not create a new object", func() {
+			It("should not create a new object", func(ctx SpecContext) {
 				By("Creating a new configmap with DryRun")
 				newcm := &corev1.ConfigMap{
 					ObjectMeta: metav1.ObjectMeta{
@@ -917,7 +884,7 @@ var _ = Describe("Fake client", func() {
 						Namespace: "ns2",
 					},
 				}
-				err := cl.Create(context.Background(), newcm, client.DryRunAll)
+				err := cl.Create(ctx, newcm, client.DryRunAll)
 				Expect(err).ToNot(HaveOccurred())
 
 				By("Getting the new configmap")
@@ -926,13 +893,13 @@ var _ = Describe("Fake client", func() {
 					Namespace: "ns2",
 				}
 				obj := &corev1.ConfigMap{}
-				err = cl.Get(context.Background(), namespacedName, obj)
+				err = cl.Get(ctx, namespacedName, obj)
 				Expect(err).To(HaveOccurred())
 				Expect(apierrors.IsNotFound(err)).To(BeTrue())
 				Expect(obj).NotTo(Equal(newcm))
 			})
 
-			It("should not Update the object", func() {
+			It("should not Update the object", func(ctx SpecContext) {
 				By("Updating a new configmap with DryRun")
 				newcm := &corev1.ConfigMap{
 					ObjectMeta: metav1.ObjectMeta{
@@ -944,7 +911,7 @@ var _ = Describe("Fake client", func() {
 						"test-key": "new-value",
 					},
 				}
-				err := cl.Update(context.Background(), newcm, client.DryRunAll)
+				err := cl.Update(ctx, newcm, client.DryRunAll)
 				Expect(err).ToNot(HaveOccurred())
 
 				By("Getting the new configmap")
@@ -953,19 +920,19 @@ var _ = Describe("Fake client", func() {
 					Namespace: "ns2",
 				}
 				obj := &corev1.ConfigMap{}
-				err = cl.Get(context.Background(), namespacedName, obj)
+				err = cl.Get(ctx, namespacedName, obj)
 				Expect(err).ToNot(HaveOccurred())
 				Expect(obj).To(Equal(cm))
 				Expect(obj.ObjectMeta.ResourceVersion).To(Equal(trackerAddResourceVersion))
 			})
 
-			It("Should not Delete the object", func() {
+			It("Should not Delete the object", func(ctx SpecContext) {
 				By("Deleting a configmap with DryRun with Delete()")
-				err := cl.Delete(context.Background(), cm, client.DryRunAll)
+				err := cl.Delete(ctx, cm, client.DryRunAll)
 				Expect(err).ToNot(HaveOccurred())
 
 				By("Deleting a configmap with DryRun with DeleteAllOf()")
-				err = cl.DeleteAllOf(context.Background(), cm, client.DryRunAll)
+				err = cl.DeleteAllOf(ctx, cm, client.DryRunAll)
 				Expect(err).ToNot(HaveOccurred())
 
 				By("Getting the configmap")
@@ -974,14 +941,14 @@ var _ = Describe("Fake client", func() {
 					Namespace: "ns2",
 				}
 				obj := &corev1.ConfigMap{}
-				err = cl.Get(context.Background(), namespacedName, obj)
+				err = cl.Get(ctx, namespacedName, obj)
 				Expect(err).ToNot(HaveOccurred())
 				Expect(obj).To(Equal(cm))
 				Expect(obj.ObjectMeta.ResourceVersion).To(Equal(trackerAddResourceVersion))
 			})
 		})
 
-		It("should be able to Patch", func() {
+		It("should be able to Patch", func(ctx SpecContext) {
 			By("Patching a deployment")
 			mergePatch, err := json.Marshal(map[string]interface{}{
 				"metadata": map[string]interface{}{
@@ -991,7 +958,7 @@ var _ = Describe("Fake client", func() {
 				},
 			})
 			Expect(err).NotTo(HaveOccurred())
-			err = cl.Patch(context.Background(), dep, client.RawPatch(types.StrategicMergePatchType, mergePatch))
+			err = cl.Patch(ctx, dep, client.RawPatch(types.StrategicMergePatchType, mergePatch))
 			Expect(err).NotTo(HaveOccurred())
 
 			By("Getting the patched deployment")
@@ -1000,13 +967,13 @@ var _ = Describe("Fake client", func() {
 				Namespace: "ns1",
 			}
 			obj := &appsv1.Deployment{}
-			err = cl.Get(context.Background(), namespacedName, obj)
+			err = cl.Get(ctx, namespacedName, obj)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(obj.Annotations["foo"]).To(Equal("bar"))
 			Expect(obj.ObjectMeta.ResourceVersion).To(Equal("1000"))
 		})
 
-		It("should ignore deletionTimestamp without finalizer on Create", func() {
+		It("should ignore deletionTimestamp without finalizer on Create", func(ctx SpecContext) {
 			namespacedName := types.NamespacedName{
 				Name:      "test-cm",
 				Namespace: "ignore-deletiontimestamp",
@@ -1025,18 +992,18 @@ var _ = Describe("Fake client", func() {
 				},
 			}
 
-			err := cl.Create(context.Background(), newObj)
+			err := cl.Create(ctx, newObj)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting the object")
 			obj := &corev1.ConfigMap{}
-			err = cl.Get(context.Background(), namespacedName, obj)
+			err = cl.Get(ctx, namespacedName, obj)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(obj.DeletionTimestamp).To(BeNil())
 
 		})
 
-		It("should reject deletionTimestamp without finalizers on Build", func() {
+		It("should reject deletionTimestamp without finalizers on Build", func(ctx SpecContext) {
 			namespacedName := types.NamespacedName{
 				Name:      "test-cm",
 				Namespace: "reject-deletiontimestamp-no-finalizers",
@@ -1073,12 +1040,12 @@ var _ = Describe("Fake client", func() {
 
 			By("Getting the object")
 			obj = &corev1.ConfigMap{}
-			err := cl.Get(context.Background(), namespacedName, obj)
+			err := cl.Get(ctx, namespacedName, obj)
 			Expect(err).ToNot(HaveOccurred())
 
 		})
 
-		It("should reject changes to deletionTimestamp on Patch", func() {
+		It("should reject changes to deletionTimestamp on Patch", func(ctx SpecContext) {
 			namespacedName := types.NamespacedName{
 				Name:      "test-cm",
 				Namespace: "reject-deletiontimestamp",
@@ -1095,7 +1062,7 @@ var _ = Describe("Fake client", func() {
 					"test-key": "new-value",
 				},
 			}
-			err := cl.Create(context.Background(), newObj)
+			err := cl.Create(ctx, newObj)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Add a deletionTimestamp")
@@ -1107,16 +1074,16 @@ var _ = Describe("Fake client", func() {
 					DeletionTimestamp: &now,
 				},
 			}
-			err = cl.Patch(context.Background(), obj, client.MergeFrom(newObj))
+			err = cl.Patch(ctx, obj, client.MergeFrom(newObj))
 			Expect(err).To(HaveOccurred())
 
 			By("Deleting the object")
-			err = cl.Delete(context.Background(), newObj)
+			err = cl.Delete(ctx, newObj)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting the object")
 			obj = &corev1.ConfigMap{}
-			err = cl.Get(context.Background(), namespacedName, obj)
+			err = cl.Get(ctx, namespacedName, obj)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(obj.DeletionTimestamp).NotTo(BeNil())
 
@@ -1124,7 +1091,7 @@ var _ = Describe("Fake client", func() {
 			newObj = &corev1.ConfigMap{}
 			t := metav1.NewTime(time.Now().Add(time.Second))
 			newObj.DeletionTimestamp = &t
-			err = cl.Patch(context.Background(), newObj, client.MergeFrom(obj))
+			err = cl.Patch(ctx, newObj, client.MergeFrom(obj))
 			Expect(err).To(HaveOccurred())
 
 			By("Removing deletionTimestamp")
@@ -1135,12 +1102,12 @@ var _ = Describe("Fake client", func() {
 					DeletionTimestamp: nil,
 				},
 			}
-			err = cl.Patch(context.Background(), newObj, client.MergeFrom(obj))
+			err = cl.Patch(ctx, newObj, client.MergeFrom(obj))
 			Expect(err).To(HaveOccurred())
 
 		})
 
-		It("should handle finalizers on Patch", func() {
+		It("should handle finalizers on Patch", func(ctx SpecContext) {
 			namespacedName := types.NamespacedName{
 				Name:      "test-cm",
 				Namespace: "delete-with-finalizers",
@@ -1156,11 +1123,11 @@ var _ = Describe("Fake client", func() {
 					"test-key": "new-value",
 				},
 			}
-			err := cl.Create(context.Background(), newObj)
+			err := cl.Create(ctx, newObj)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Deleting the object")
-			err = cl.Delete(context.Background(), newObj)
+			err = cl.Delete(ctx, newObj)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Removing the finalizer")
@@ -1171,16 +1138,16 @@ var _ = Describe("Fake client", func() {
 					Finalizers: []string{},
 				},
 			}
-			err = cl.Patch(context.Background(), obj, client.MergeFrom(newObj))
+			err = cl.Patch(ctx, obj, client.MergeFrom(newObj))
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Getting the object")
 			obj = &corev1.ConfigMap{}
-			err = cl.Get(context.Background(), namespacedName, obj)
+			err = cl.Get(ctx, namespacedName, obj)
 			Expect(apierrors.IsNotFound(err)).To(BeTrue())
 		})
 
-		It("should remove finalizers of the object on Patch", func() {
+		It("should remove finalizers of the object on Patch", func(ctx SpecContext) {
 			namespacedName := types.NamespacedName{
 				Name:      "test-cm",
 				Namespace: "patch-finalizers-in-obj",
@@ -1196,7 +1163,7 @@ var _ = Describe("Fake client", func() {
 					"test-key": "new-value",
 				},
 			}
-			err := cl.Create(context.Background(), obj)
+			err := cl.Create(ctx, obj)
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Removing the finalizer")
@@ -1208,7 +1175,7 @@ var _ = Describe("Fake client", func() {
 				},
 			})
 			Expect(err).ToNot(HaveOccurred())
-			err = cl.Patch(context.Background(), obj, client.RawPatch(types.StrategicMergePatchType, mergePatch))
+			err = cl.Patch(ctx, obj, client.RawPatch(types.StrategicMergePatchType, mergePatch))
 			Expect(err).ToNot(HaveOccurred())
 
 			By("Check the finalizer has been removed in the object")
@@ -1216,7 +1183,7 @@ var _ = Describe("Fake client", func() {
 
 			By("Check the finalizer has been removed in client")
 			newObj := &corev1.ConfigMap{}
-			err = cl.Get(context.Background(), namespacedName, newObj)
+			err = cl.Get(ctx, namespacedName, newObj)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(newObj.Finalizers).To(BeEmpty())
 		})
@@ -1285,79 +1252,140 @@ var _ = Describe("Fake client", func() {
 			})
 
 			Context("filtered List using field selector", func() {
-				It("errors when there's no Index for the GroupVersionResource", func() {
+				It("errors when there's no Index for the GroupVersionResource", func(ctx SpecContext) {
+					listOpts := &client.ListOptions{
+						FieldSelector: fields.OneTermEqualSelector("key", "val"),
+					}
+					list := &corev1.ConfigMapList{}
+					err := cl.List(ctx, list, listOpts)
+					Expect(err).To(HaveOccurred())
+					Expect(list.Items).To(BeEmpty())
+				})
+
+				It("errors when there's no Index for the GroupVersionResource with UnstructuredList", func(ctx SpecContext) {
 					listOpts := &client.ListOptions{
 						FieldSelector: fields.OneTermEqualSelector("key", "val"),
 					}
-					err := cl.List(context.Background(), &corev1.ConfigMapList{}, listOpts)
+					list := &unstructured.UnstructuredList{}
+					list.SetAPIVersion("v1")
+					list.SetKind("ConfigMapList")
+					err := cl.List(ctx, list, listOpts)
 					Expect(err).To(HaveOccurred())
+					Expect(list.GroupVersionKind().GroupVersion().String()).To(Equal("v1"))
+					Expect(list.GetKind()).To(Equal("ConfigMapList"))
+					Expect(list.Items).To(BeEmpty())
 				})
 
-				It("errors when there's no Index matching the field name", func() {
+				It("errors when there's no Index matching the field name", func(ctx SpecContext) {
 					listOpts := &client.ListOptions{
 						FieldSelector: fields.OneTermEqualSelector("spec.paused", "false"),
 					}
-					err := cl.List(context.Background(), &appsv1.DeploymentList{}, listOpts)
+					list := &appsv1.DeploymentList{}
+					err := cl.List(ctx, list, listOpts)
 					Expect(err).To(HaveOccurred())
+					Expect(list.Items).To(BeEmpty())
 				})
 
-				It("errors when field selector uses two requirements", func() {
+				It("errors when field selector uses two requirements", func(ctx SpecContext) {
 					listOpts := &client.ListOptions{
 						FieldSelector: fields.AndSelectors(
 							fields.OneTermEqualSelector("spec.replicas", "1"),
 							fields.OneTermEqualSelector("spec.strategy.type", string(appsv1.RecreateDeploymentStrategyType)),
 						)}
-					err := cl.List(context.Background(), &appsv1.DeploymentList{}, listOpts)
+					list := &appsv1.DeploymentList{}
+					err := cl.List(ctx, list, listOpts)
 					Expect(err).To(HaveOccurred())
+					Expect(list.Items).To(BeEmpty())
 				})
 
-				It("returns two deployments that match the only field selector requirement", func() {
+				It("returns two deployments that match the only field selector requirement", func(ctx SpecContext) {
 					listOpts := &client.ListOptions{
 						FieldSelector: fields.OneTermEqualSelector("spec.replicas", "1"),
 					}
 					list := &appsv1.DeploymentList{}
-					Expect(cl.List(context.Background(), list, listOpts)).To(Succeed())
+					Expect(cl.List(ctx, list, listOpts)).To(Succeed())
 					Expect(list.Items).To(ConsistOf(*dep, *dep2))
 				})
 
-				It("returns no object because no object matches the only field selector requirement", func() {
+				It("returns no object because no object matches the only field selector requirement", func(ctx SpecContext) {
 					listOpts := &client.ListOptions{
 						FieldSelector: fields.OneTermEqualSelector("spec.replicas", "2"),
 					}
 					list := &appsv1.DeploymentList{}
-					Expect(cl.List(context.Background(), list, listOpts)).To(Succeed())
+					Expect(cl.List(ctx, list, listOpts)).To(Succeed())
 					Expect(list.Items).To(BeEmpty())
 				})
 
-				It("returns deployment that matches both the field and label selectors", func() {
+				It("returns deployment that matches both the field and label selectors", func(ctx SpecContext) {
 					listOpts := &client.ListOptions{
 						FieldSelector: fields.OneTermEqualSelector("spec.replicas", "1"),
 						LabelSelector: labels.SelectorFromSet(dep2.Labels),
 					}
 					list := &appsv1.DeploymentList{}
-					Expect(cl.List(context.Background(), list, listOpts)).To(Succeed())
+					Expect(cl.List(ctx, list, listOpts)).To(Succeed())
 					Expect(list.Items).To(ConsistOf(*dep2))
 				})
 
-				It("returns no object even if field selector matches because label selector doesn't", func() {
+				It("returns no object even if field selector matches because label selector doesn't", func(ctx SpecContext) {
 					listOpts := &client.ListOptions{
 						FieldSelector: fields.OneTermEqualSelector("spec.replicas", "1"),
 						LabelSelector: labels.Nothing(),
 					}
 					list := &appsv1.DeploymentList{}
-					Expect(cl.List(context.Background(), list, listOpts)).To(Succeed())
+					Expect(cl.List(ctx, list, listOpts)).To(Succeed())
 					Expect(list.Items).To(BeEmpty())
 				})
 
-				It("returns no object even if label selector matches because field selector doesn't", func() {
+				It("returns no object even if label selector matches because field selector doesn't", func(ctx SpecContext) {
 					listOpts := &client.ListOptions{
 						FieldSelector: fields.OneTermEqualSelector("spec.replicas", "2"),
 						LabelSelector: labels.Everything(),
 					}
 					list := &appsv1.DeploymentList{}
-					Expect(cl.List(context.Background(), list, listOpts)).To(Succeed())
+					Expect(cl.List(ctx, list, listOpts)).To(Succeed())
 					Expect(list.Items).To(BeEmpty())
 				})
+
+				It("supports adding an index at runtime", func(ctx SpecContext) {
+					listOpts := &client.ListOptions{
+						FieldSelector: fields.OneTermEqualSelector("metadata.name", "test-deployment-2"),
+					}
+					list := &appsv1.DeploymentList{}
+					err := cl.List(ctx, list, listOpts)
+					Expect(err).To(HaveOccurred())
+					Expect(err.Error()).To(ContainSubstring("no index with name metadata.name has been registered"))
+
+					err = AddIndex(cl, &appsv1.Deployment{}, "metadata.name", func(obj client.Object) []string {
+						return []string{obj.GetName()}
+					})
+					Expect(err).To(Succeed())
+
+					Expect(cl.List(ctx, list, listOpts)).To(Succeed())
+					Expect(list.Items).To(ConsistOf(*dep2))
+				})
+
+				It("Is not a datarace to add and use indexes in parallel", func(ctx SpecContext) {
+					wg := sync.WaitGroup{}
+					wg.Add(2)
+
+					listOpts := &client.ListOptions{
+						FieldSelector: fields.OneTermEqualSelector("spec.replicas", "2"),
+					}
+					go func() {
+						defer wg.Done()
+						defer GinkgoRecover()
+						Expect(cl.List(ctx, &appsv1.DeploymentList{}, listOpts)).To(Succeed())
+					}()
+					go func() {
+						defer wg.Done()
+						defer GinkgoRecover()
+						err := AddIndex(cl, &appsv1.Deployment{}, "metadata.name", func(obj client.Object) []string {
+							return []string{obj.GetName()}
+						})
+						Expect(err).To(Succeed())
+					}()
+					wg.Wait()
+				})
 			})
 		})
 
@@ -1371,43 +1399,43 @@ var _ = Describe("Fake client", func() {
 			})
 
 			Context("filtered List using field selector", func() {
-				It("uses the second index to retrieve the indexed objects when there are matches", func() {
+				It("uses the second index to retrieve the indexed objects when there are matches", func(ctx SpecContext) {
 					listOpts := &client.ListOptions{
 						FieldSelector: fields.OneTermEqualSelector("spec.strategy.type", string(appsv1.RecreateDeploymentStrategyType)),
 					}
 					list := &appsv1.DeploymentList{}
-					Expect(cl.List(context.Background(), list, listOpts)).To(Succeed())
+					Expect(cl.List(ctx, list, listOpts)).To(Succeed())
 					Expect(list.Items).To(ConsistOf(*dep))
 				})
 
-				It("uses the second index to retrieve the indexed objects when there are no matches", func() {
+				It("uses the second index to retrieve the indexed objects when there are no matches", func(ctx SpecContext) {
 					listOpts := &client.ListOptions{
 						FieldSelector: fields.OneTermEqualSelector("spec.strategy.type", string(appsv1.RollingUpdateDeploymentStrategyType)),
 					}
 					list := &appsv1.DeploymentList{}
-					Expect(cl.List(context.Background(), list, listOpts)).To(Succeed())
+					Expect(cl.List(ctx, list, listOpts)).To(Succeed())
 					Expect(list.Items).To(BeEmpty())
 				})
 
-				It("no error when field selector uses two requirements", func() {
+				It("no error when field selector uses two requirements", func(ctx SpecContext) {
 					listOpts := &client.ListOptions{
 						FieldSelector: fields.AndSelectors(
 							fields.OneTermEqualSelector("spec.replicas", "1"),
 							fields.OneTermEqualSelector("spec.strategy.type", string(appsv1.RecreateDeploymentStrategyType)),
 						)}
 					list := &appsv1.DeploymentList{}
-					Expect(cl.List(context.Background(), list, listOpts)).To(Succeed())
+					Expect(cl.List(ctx, list, listOpts)).To(Succeed())
 					Expect(list.Items).To(ConsistOf(*dep))
 				})
 			})
 		})
 	})
 
-	It("should set the ResourceVersion to 999 when adding an object to the tracker", func() {
+	It("should set the ResourceVersion to 999 when adding an object to the tracker", func(ctx SpecContext) {
 		cl := NewClientBuilder().WithObjects(&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "cm"}}).Build()
 
 		retrieved := &corev1.Secret{}
-		Expect(cl.Get(context.Background(), types.NamespacedName{Name: "cm"}, retrieved)).To(Succeed())
+		Expect(cl.Get(ctx, types.NamespacedName{Name: "cm"}, retrieved)).To(Succeed())
 
 		reference := &corev1.Secret{
 			ObjectMeta: metav1.ObjectMeta{
@@ -1418,7 +1446,7 @@ var _ = Describe("Fake client", func() {
 		Expect(retrieved).To(Equal(reference))
 	})
 
-	It("should be able to build with given tracker and get resource", func() {
+	It("should be able to build with given tracker and get resource", func(ctx SpecContext) {
 		clientSet := fake.NewSimpleClientset(dep)
 		cl := NewClientBuilder().WithRuntimeObjects(dep2).WithObjectTracker(clientSet.Tracker()).Build()
 
@@ -1428,12 +1456,12 @@ var _ = Describe("Fake client", func() {
 			Namespace: "ns1",
 		}
 		obj := &appsv1.Deployment{}
-		err := cl.Get(context.Background(), namespacedName, obj)
+		err := cl.Get(ctx, namespacedName, obj)
 		Expect(err).ToNot(HaveOccurred())
-		Expect(obj).To(Equal(dep))
+		Expect(obj).To(BeComparableTo(dep))
 
 		By("Getting a deployment from clientSet")
-		csDep2, err := clientSet.AppsV1().Deployments("ns1").Get(context.Background(), "test-deployment-2", metav1.GetOptions{})
+		csDep2, err := clientSet.AppsV1().Deployments("ns1").Get(ctx, "test-deployment-2", metav1.GetOptions{})
 		Expect(err).ToNot(HaveOccurred())
 		Expect(csDep2).To(Equal(dep2))
 
@@ -1444,10 +1472,6 @@ var _ = Describe("Fake client", func() {
 		}
 
 		dep3 := &appsv1.Deployment{
-			TypeMeta: metav1.TypeMeta{
-				APIVersion: "apps/v1",
-				Kind:       "Deployment",
-			},
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "test-deployment-3",
 				Namespace: "ns1",
@@ -1458,16 +1482,16 @@ var _ = Describe("Fake client", func() {
 			},
 		}
 
-		_, err = clientSet.AppsV1().Deployments("ns1").Create(context.Background(), dep3, metav1.CreateOptions{})
+		_, err = clientSet.AppsV1().Deployments("ns1").Create(ctx, dep3, metav1.CreateOptions{})
 		Expect(err).ToNot(HaveOccurred())
 
 		obj = &appsv1.Deployment{}
-		err = cl.Get(context.Background(), namespacedName3, obj)
+		err = cl.Get(ctx, namespacedName3, obj)
 		Expect(err).ToNot(HaveOccurred())
-		Expect(obj).To(Equal(dep3))
+		Expect(obj).To(BeComparableTo(dep3))
 	})
 
-	It("should not change the status of typed objects that have a status subresource on update", func() {
+	It("should not change the status of typed objects that have a status subresource on update", func(ctx SpecContext) {
 		obj := &corev1.Pod{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "pod",
@@ -1476,14 +1500,14 @@ var _ = Describe("Fake client", func() {
 		cl := NewClientBuilder().WithStatusSubresource(obj).WithObjects(obj).Build()
 
 		obj.Status.Phase = "Running"
-		Expect(cl.Update(context.Background(), obj)).To(Succeed())
+		Expect(cl.Update(ctx, obj)).To(Succeed())
 
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(obj), obj)).To(Succeed())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(obj), obj)).To(Succeed())
 
 		Expect(obj.Status).To(BeEquivalentTo(corev1.PodStatus{}))
 	})
 
-	It("should return a conflict error when an incorrect RV is used on status update", func() {
+	It("should return a conflict error when an incorrect RV is used on status update", func(ctx SpecContext) {
 		obj := &corev1.Node{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:            "node",
@@ -1494,11 +1518,11 @@ var _ = Describe("Fake client", func() {
 
 		obj.Status.Phase = corev1.NodeRunning
 		obj.ResourceVersion = "invalid"
-		err := cl.Status().Update(context.Background(), obj)
+		err := cl.Status().Update(ctx, obj)
 		Expect(apierrors.IsConflict(err)).To(BeTrue())
 	})
 
-	It("should not change non-status field of typed objects that have a status subresource on status update", func() {
+	It("should not change non-status field of typed objects that have a status subresource on status update", func(ctx SpecContext) {
 		obj := &corev1.Node{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "node",
@@ -1524,10 +1548,10 @@ var _ = Describe("Fake client", func() {
 		}
 
 		obj.Status.NodeInfo.MachineID = machineIDFromStatusUpdate
-		Expect(cl.Status().Update(context.Background(), obj)).NotTo(HaveOccurred())
+		Expect(cl.Status().Update(ctx, obj)).NotTo(HaveOccurred())
 
 		actual := &corev1.Node{ObjectMeta: metav1.ObjectMeta{Name: obj.Name}}
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(actual), actual)).NotTo(HaveOccurred())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(actual), actual)).NotTo(HaveOccurred())
 
 		objOriginal.APIVersion = actual.APIVersion
 		objOriginal.Kind = actual.Kind
@@ -1536,7 +1560,7 @@ var _ = Describe("Fake client", func() {
 		Expect(cmp.Diff(objOriginal, actual)).To(BeEmpty())
 	})
 
-	It("should be able to update an object after updating an object's status", func() {
+	It("should be able to update an object after updating an object's status", func(ctx SpecContext) {
 		obj := &corev1.Node{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "node",
@@ -1554,7 +1578,7 @@ var _ = Describe("Fake client", func() {
 		expectedObj := obj.DeepCopy()
 
 		obj.Status.NodeInfo.MachineID = machineIDFromStatusUpdate
-		Expect(cl.Status().Update(context.Background(), obj)).NotTo(HaveOccurred())
+		Expect(cl.Status().Update(ctx, obj)).NotTo(HaveOccurred())
 
 		obj.Annotations = map[string]string{
 			"some-annotation-key": "some",
@@ -1562,10 +1586,10 @@ var _ = Describe("Fake client", func() {
 		expectedObj.Annotations = map[string]string{
 			"some-annotation-key": "some",
 		}
-		Expect(cl.Update(context.Background(), obj)).NotTo(HaveOccurred())
+		Expect(cl.Update(ctx, obj)).NotTo(HaveOccurred())
 
 		actual := &corev1.Node{ObjectMeta: metav1.ObjectMeta{Name: obj.Name}}
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(actual), actual)).NotTo(HaveOccurred())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(actual), actual)).NotTo(HaveOccurred())
 
 		expectedObj.APIVersion = actual.APIVersion
 		expectedObj.Kind = actual.Kind
@@ -1574,7 +1598,7 @@ var _ = Describe("Fake client", func() {
 		Expect(cmp.Diff(expectedObj, actual)).To(BeEmpty())
 	})
 
-	It("should be able to update an object's status after updating an object", func() {
+	It("should be able to update an object's status after updating an object", func(ctx SpecContext) {
 		obj := &corev1.Node{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "node",
@@ -1597,14 +1621,14 @@ var _ = Describe("Fake client", func() {
 		expectedObj.Annotations = map[string]string{
 			"some-annotation-key": "some",
 		}
-		Expect(cl.Update(context.Background(), obj)).NotTo(HaveOccurred())
+		Expect(cl.Update(ctx, obj)).NotTo(HaveOccurred())
 
 		obj.Spec.PodCIDR = cidrFromStatusUpdate
 		obj.Status.NodeInfo.MachineID = machineIDFromStatusUpdate
-		Expect(cl.Status().Update(context.Background(), obj)).NotTo(HaveOccurred())
+		Expect(cl.Status().Update(ctx, obj)).NotTo(HaveOccurred())
 
 		actual := &corev1.Node{ObjectMeta: metav1.ObjectMeta{Name: obj.Name}}
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(actual), actual)).NotTo(HaveOccurred())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(actual), actual)).NotTo(HaveOccurred())
 
 		expectedObj.APIVersion = actual.APIVersion
 		expectedObj.Kind = actual.Kind
@@ -1613,7 +1637,7 @@ var _ = Describe("Fake client", func() {
 		Expect(cmp.Diff(expectedObj, actual)).To(BeEmpty())
 	})
 
-	It("Should only override status fields of typed objects that have a status subresource on status update", func() {
+	It("Should only override status fields of typed objects that have a status subresource on status update", func(ctx SpecContext) {
 		obj := &corev1.Node{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "node",
@@ -1631,10 +1655,10 @@ var _ = Describe("Fake client", func() {
 		objOriginal := obj.DeepCopy()
 
 		obj.Status.Phase = corev1.NodeRunning
-		Expect(cl.Status().Update(context.Background(), obj)).NotTo(HaveOccurred())
+		Expect(cl.Status().Update(ctx, obj)).NotTo(HaveOccurred())
 
 		actual := &corev1.Node{ObjectMeta: metav1.ObjectMeta{Name: obj.Name}}
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(actual), actual)).NotTo(HaveOccurred())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(actual), actual)).NotTo(HaveOccurred())
 
 		objOriginal.APIVersion = actual.APIVersion
 		objOriginal.Kind = actual.Kind
@@ -1644,7 +1668,7 @@ var _ = Describe("Fake client", func() {
 		Expect(objOriginal.Status.Phase).ToNot(Equal(actual.Status.Phase))
 	})
 
-	It("should be able to change typed objects that have a scale subresource on patch", func() {
+	It("should be able to change typed objects that have a scale subresource on patch", func(ctx SpecContext) {
 		obj := &appsv1.Deployment{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "deploy",
@@ -1654,10 +1678,10 @@ var _ = Describe("Fake client", func() {
 		objOriginal := obj.DeepCopy()
 
 		patch := []byte(fmt.Sprintf(`{"spec":{"replicas":%d}}`, 2))
-		Expect(cl.SubResource("scale").Patch(context.Background(), obj, client.RawPatch(types.MergePatchType, patch))).NotTo(HaveOccurred())
+		Expect(cl.SubResource("scale").Patch(ctx, obj, client.RawPatch(types.MergePatchType, patch))).NotTo(HaveOccurred())
 
 		actual := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: obj.Name}}
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(actual), actual)).To(Succeed())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(actual), actual)).To(Succeed())
 
 		objOriginal.APIVersion = actual.APIVersion
 		objOriginal.Kind = actual.Kind
@@ -1666,24 +1690,24 @@ var _ = Describe("Fake client", func() {
 		Expect(cmp.Diff(objOriginal, actual)).To(BeEmpty())
 	})
 
-	It("should not change the status of typed objects that have a status subresource on patch", func() {
+	It("should not change the status of typed objects that have a status subresource on patch", func(ctx SpecContext) {
 		obj := &corev1.Pod{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "node",
 			},
 		}
-		Expect(cl.Create(context.Background(), obj)).To(Succeed())
+		Expect(cl.Create(ctx, obj)).To(Succeed())
 		original := obj.DeepCopy()
 
 		obj.Status.Phase = "Running"
-		Expect(cl.Patch(context.Background(), obj, client.MergeFrom(original))).To(Succeed())
+		Expect(cl.Patch(ctx, obj, client.MergeFrom(original))).To(Succeed())
 
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(obj), obj)).To(Succeed())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(obj), obj)).To(Succeed())
 
 		Expect(obj.Status).To(BeEquivalentTo(corev1.PodStatus{}))
 	})
 
-	It("should not change non-status field of typed objects that have a status subresource on status patch", func() {
+	It("should not change non-status field of typed objects that have a status subresource on status patch", func(ctx SpecContext) {
 		obj := &corev1.Node{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "node",
@@ -1697,10 +1721,10 @@ var _ = Describe("Fake client", func() {
 
 		obj.Spec.PodCIDR = cidrFromStatusUpdate
 		obj.Status.NodeInfo.MachineID = "machine-id"
-		Expect(cl.Status().Patch(context.Background(), obj, client.MergeFrom(objOriginal))).NotTo(HaveOccurred())
+		Expect(cl.Status().Patch(ctx, obj, client.MergeFrom(objOriginal))).NotTo(HaveOccurred())
 
 		actual := &corev1.Node{ObjectMeta: metav1.ObjectMeta{Name: obj.Name}}
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(actual), actual)).NotTo(HaveOccurred())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(actual), actual)).NotTo(HaveOccurred())
 
 		objOriginal.APIVersion = actual.APIVersion
 		objOriginal.Kind = actual.Kind
@@ -1709,7 +1733,57 @@ var _ = Describe("Fake client", func() {
 		Expect(cmp.Diff(objOriginal, actual)).To(BeEmpty())
 	})
 
-	It("should not change the status of unstructured objects that are configured to have a status subresource on update", func() {
+	It("should Unmarshal the schemaless object with int64 to preserve ints", func(ctx SpecContext) {
+		schemeBuilder := &scheme.Builder{GroupVersion: schema.GroupVersion{Group: "test", Version: "v1"}}
+		schemeBuilder.Register(&WithSchemalessSpec{})
+
+		scheme := runtime.NewScheme()
+		Expect(schemeBuilder.AddToScheme(scheme)).NotTo(HaveOccurred())
+
+		spec := Schemaless{
+			"key": int64(1),
+		}
+
+		obj := &WithSchemalessSpec{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "a-foo",
+			},
+			Spec: spec,
+		}
+		cl := NewClientBuilder().WithScheme(scheme).WithStatusSubresource(obj).WithObjects(obj).Build()
+
+		Expect(cl.Update(ctx, obj)).To(Succeed())
+		Expect(obj.Spec).To(BeEquivalentTo(spec))
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(obj), obj)).To(Succeed())
+		Expect(obj.Spec).To(BeEquivalentTo(spec))
+	})
+
+	It("should Unmarshal the schemaless object with float64 to preserve ints", func(ctx SpecContext) {
+		schemeBuilder := &scheme.Builder{GroupVersion: schema.GroupVersion{Group: "test", Version: "v1"}}
+		schemeBuilder.Register(&WithSchemalessSpec{})
+
+		scheme := runtime.NewScheme()
+		Expect(schemeBuilder.AddToScheme(scheme)).NotTo(HaveOccurred())
+
+		spec := Schemaless{
+			"key": 1.1,
+		}
+
+		obj := &WithSchemalessSpec{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "a-foo",
+			},
+			Spec: spec,
+		}
+		cl := NewClientBuilder().WithScheme(scheme).WithStatusSubresource(obj).WithObjects(obj).Build()
+
+		Expect(cl.Update(ctx, obj)).To(Succeed())
+		Expect(obj.Spec).To(BeEquivalentTo(spec))
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(obj), obj)).To(Succeed())
+		Expect(obj.Spec).To(BeEquivalentTo(spec))
+	})
+
+	It("should not change the status of unstructured objects that are configured to have a status subresource on update", func(ctx SpecContext) {
 		obj := &unstructured.Unstructured{}
 		obj.SetAPIVersion("foo/v1")
 		obj.SetKind("Foo")
@@ -1723,14 +1797,14 @@ var _ = Describe("Fake client", func() {
 		err = unstructured.SetNestedField(obj.Object, map[string]any{"state": "new"}, "status")
 		Expect(err).ToNot(HaveOccurred())
 
-		Expect(cl.Update(context.Background(), obj)).To(Succeed())
+		Expect(cl.Update(ctx, obj)).To(Succeed())
 
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(obj), obj)).To(Succeed())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(obj), obj)).To(Succeed())
 
 		Expect(obj.Object["status"]).To(BeEquivalentTo(map[string]any{"state": "old"}))
 	})
 
-	It("should not change non-status fields of unstructured objects that are configured to have a status subresource on status update", func() {
+	It("should not change non-status fields of unstructured objects that are configured to have a status subresource on status update", func(ctx SpecContext) {
 		obj := &unstructured.Unstructured{}
 		obj.SetAPIVersion("foo/v1")
 		obj.SetKind("Foo")
@@ -1746,14 +1820,14 @@ var _ = Describe("Fake client", func() {
 		err = unstructured.SetNestedField(obj.Object, map[string]any{"state": "new"}, "status")
 		Expect(err).ToNot(HaveOccurred())
 
-		Expect(cl.Status().Update(context.Background(), obj)).To(Succeed())
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(obj), obj)).To(Succeed())
+		Expect(cl.Status().Update(ctx, obj)).To(Succeed())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(obj), obj)).To(Succeed())
 
 		Expect(obj.Object["status"]).To(BeEquivalentTo(map[string]any{"state": "new"}))
 		Expect(obj.Object["spec"]).To(BeEquivalentTo("original"))
 	})
 
-	It("should not change the status of known unstructured objects that have a status subresource on update", func() {
+	It("should not change the status of known unstructured objects that have a status subresource on update", func(ctx SpecContext) {
 		obj := &corev1.Pod{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "pod",
@@ -1772,7 +1846,7 @@ var _ = Describe("Fake client", func() {
 		u.SetAPIVersion("v1")
 		u.SetKind("Pod")
 		u.SetName(obj.Name)
-		err := cl.Get(context.Background(), client.ObjectKeyFromObject(u), u)
+		err := cl.Get(ctx, client.ObjectKeyFromObject(u), u)
 		Expect(err).NotTo(HaveOccurred())
 
 		err = unstructured.SetNestedField(u.Object, string(corev1.RestartPolicyNever), "spec", "restartPolicy")
@@ -1780,19 +1854,17 @@ var _ = Describe("Fake client", func() {
 		err = unstructured.SetNestedField(u.Object, string(corev1.PodRunning), "status", "phase")
 		Expect(err).NotTo(HaveOccurred())
 
-		Expect(cl.Update(context.Background(), u)).To(Succeed())
+		Expect(cl.Update(ctx, u)).To(Succeed())
 
 		actual := &corev1.Pod{}
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(obj), actual)).To(Succeed())
-		obj.APIVersion = u.GetAPIVersion()
-		obj.Kind = u.GetKind()
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(obj), actual)).To(Succeed())
 		obj.ResourceVersion = actual.ResourceVersion
 		// only the spec mutation should persist
 		obj.Spec.RestartPolicy = corev1.RestartPolicyNever
 		Expect(cmp.Diff(obj, actual)).To(BeEmpty())
 	})
 
-	It("should not change non-status field of known unstructured objects that have a status subresource on status update", func() {
+	It("should not change non-status field of known unstructured objects that have a status subresource on status update", func(ctx SpecContext) {
 		obj := &corev1.Pod{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "pod",
@@ -1811,7 +1883,7 @@ var _ = Describe("Fake client", func() {
 		u.SetAPIVersion("v1")
 		u.SetKind("Pod")
 		u.SetName(obj.Name)
-		err := cl.Get(context.Background(), client.ObjectKeyFromObject(u), u)
+		err := cl.Get(ctx, client.ObjectKeyFromObject(u), u)
 		Expect(err).NotTo(HaveOccurred())
 
 		err = unstructured.SetNestedField(u.Object, string(corev1.RestartPolicyNever), "spec", "restartPolicy")
@@ -1819,37 +1891,37 @@ var _ = Describe("Fake client", func() {
 		err = unstructured.SetNestedField(u.Object, string(corev1.PodRunning), "status", "phase")
 		Expect(err).NotTo(HaveOccurred())
 
-		Expect(cl.Status().Update(context.Background(), u)).To(Succeed())
+		Expect(cl.Status().Update(ctx, u)).To(Succeed())
 
 		actual := &corev1.Pod{}
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(obj), actual)).To(Succeed())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(obj), actual)).To(Succeed())
 		obj.ResourceVersion = actual.ResourceVersion
 		// only the status mutation should persist
 		obj.Status.Phase = corev1.PodRunning
 		Expect(cmp.Diff(obj, actual)).To(BeEmpty())
 	})
 
-	It("should not change the status of unstructured objects that are configured to have a status subresource on patch", func() {
+	It("should not change the status of unstructured objects that are configured to have a status subresource on patch", func(ctx SpecContext) {
 		obj := &unstructured.Unstructured{}
 		obj.SetAPIVersion("foo/v1")
 		obj.SetKind("Foo")
 		obj.SetName("a-foo")
 		cl := NewClientBuilder().WithStatusSubresource(obj).Build()
 
-		Expect(cl.Create(context.Background(), obj)).To(Succeed())
+		Expect(cl.Create(ctx, obj)).To(Succeed())
 		original := obj.DeepCopy()
 
 		err := unstructured.SetNestedField(obj.Object, map[string]interface{}{"count": int64(2)}, "status")
 		Expect(err).ToNot(HaveOccurred())
-		Expect(cl.Patch(context.Background(), obj, client.MergeFrom(original))).To(Succeed())
+		Expect(cl.Patch(ctx, obj, client.MergeFrom(original))).To(Succeed())
 
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(obj), obj)).To(Succeed())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(obj), obj)).To(Succeed())
 
 		Expect(obj.Object["status"]).To(BeNil())
 
 	})
 
-	It("should not change non-status fields of unstructured objects that are configured to have a status subresource on status patch", func() {
+	It("should not change non-status fields of unstructured objects that are configured to have a status subresource on status patch", func(ctx SpecContext) {
 		obj := &unstructured.Unstructured{}
 		obj.SetAPIVersion("foo/v1")
 		obj.SetKind("Foo")
@@ -1866,14 +1938,14 @@ var _ = Describe("Fake client", func() {
 		err = unstructured.SetNestedField(obj.Object, map[string]any{"state": "new"}, "status")
 		Expect(err).ToNot(HaveOccurred())
 
-		Expect(cl.Status().Patch(context.Background(), obj, client.MergeFrom(original))).To(Succeed())
-		Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(obj), obj)).To(Succeed())
+		Expect(cl.Status().Patch(ctx, obj, client.MergeFrom(original))).To(Succeed())
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(obj), obj)).To(Succeed())
 
 		Expect(obj.Object["status"]).To(BeEquivalentTo(map[string]any{"state": "new"}))
 		Expect(obj.Object["spec"]).To(BeEquivalentTo("original"))
 	})
 
-	It("should return not found on status update of resources that don't have a status subresource", func() {
+	It("should return not found on status update of resources that don't have a status subresource", func(ctx SpecContext) {
 		obj := &unstructured.Unstructured{}
 		obj.SetAPIVersion("foo/v1")
 		obj.SetKind("Foo")
@@ -1881,7 +1953,7 @@ var _ = Describe("Fake client", func() {
 
 		cl := NewClientBuilder().WithObjects(obj).Build()
 
-		err := cl.Status().Update(context.Background(), obj)
+		err := cl.Status().Update(ctx, obj)
 		Expect(apierrors.IsNotFound(err)).To(BeTrue())
 	})
 
@@ -1890,206 +1962,400 @@ var _ = Describe("Fake client", func() {
 		&policyv1.Eviction{},
 	}
 	for _, tp := range evictionTypes {
-		It("should delete a pod through the eviction subresource", func() {
+		It("should delete a pod through the eviction subresource", func(ctx SpecContext) {
 			pod := &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "foo"}}
 
 			cl := NewClientBuilder().WithObjects(pod).Build()
 
-			err := cl.SubResource("eviction").Create(context.Background(), pod, tp)
+			err := cl.SubResource("eviction").Create(ctx, pod, tp)
 			Expect(err).NotTo(HaveOccurred())
 
-			err = cl.Get(context.Background(), client.ObjectKeyFromObject(pod), pod)
+			err = cl.Get(ctx, client.ObjectKeyFromObject(pod), pod)
 			Expect(apierrors.IsNotFound(err)).To(BeTrue())
 		})
 
-		It("should return not found when attempting to evict a pod that doesn't exist", func() {
+		It("should return not found when attempting to evict a pod that doesn't exist", func(ctx SpecContext) {
 			cl := NewClientBuilder().Build()
 
 			pod := &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "foo"}}
-			err := cl.SubResource("eviction").Create(context.Background(), pod, tp)
+			err := cl.SubResource("eviction").Create(ctx, pod, tp)
 			Expect(apierrors.IsNotFound(err)).To(BeTrue())
 		})
 
-		It("should return not found when attempting to evict something other than a pod", func() {
+		It("should return not found when attempting to evict something other than a pod", func(ctx SpecContext) {
 			ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "foo"}}
 			cl := NewClientBuilder().WithObjects(ns).Build()
 
-			err := cl.SubResource("eviction").Create(context.Background(), ns, tp)
+			err := cl.SubResource("eviction").Create(ctx, ns, tp)
 			Expect(apierrors.IsNotFound(err)).To(BeTrue())
 		})
 
-		It("should return an error when using the wrong subresource", func() {
+		It("should return an error when using the wrong subresource", func(ctx SpecContext) {
 			cl := NewClientBuilder().Build()
 
-			err := cl.SubResource("eviction-subresource").Create(context.Background(), &corev1.Namespace{}, tp)
+			err := cl.SubResource("eviction-subresource").Create(ctx, &corev1.Namespace{}, tp)
 			Expect(err).To(HaveOccurred())
 		})
 	}
 
-	It("should error when creating an eviction with the wrong type", func() {
+	It("should error when creating an eviction with the wrong type", func(ctx SpecContext) {
+		cl := NewClientBuilder().Build()
+		err := cl.SubResource("eviction").Create(ctx, &corev1.Pod{}, &corev1.Namespace{})
+		Expect(apierrors.IsBadRequest(err)).To(BeTrue())
+	})
+
+	It("should create a ServiceAccount token through the token subresource", func(ctx SpecContext) {
+		sa := &corev1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Name: "foo"}}
+		cl := NewClientBuilder().WithObjects(sa).Build()
+
+		tokenRequest := &authenticationv1.TokenRequest{}
+		err := cl.SubResource("token").Create(ctx, sa, tokenRequest)
+		Expect(err).NotTo(HaveOccurred())
+
+		Expect(tokenRequest.Status.Token).NotTo(Equal(""))
+		Expect(tokenRequest.Status.ExpirationTimestamp).NotTo(Equal(metav1.Time{}))
+	})
+
+	It("should return not found when creating a token for a ServiceAccount that doesn't exist", func(ctx SpecContext) {
+		sa := &corev1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Name: "foo"}}
+		cl := NewClientBuilder().Build()
+
+		err := cl.SubResource("token").Create(ctx, sa, &authenticationv1.TokenRequest{})
+		Expect(err).To(HaveOccurred())
+		Expect(apierrors.IsNotFound(err)).To(BeTrue())
+	})
+
+	It("should error when creating a token with the wrong subresource type", func(ctx SpecContext) {
 		cl := NewClientBuilder().Build()
-		err := cl.SubResource("eviction").Create(context.Background(), &corev1.Pod{}, &corev1.Namespace{})
+		err := cl.SubResource("token").Create(ctx, &corev1.ServiceAccount{}, &corev1.Namespace{})
+		Expect(err).To(HaveOccurred())
 		Expect(apierrors.IsBadRequest(err)).To(BeTrue())
 	})
 
-	It("should leave typemeta empty on typed get", func() {
+	It("should error when creating a token with the wrong type", func(ctx SpecContext) {
+		cl := NewClientBuilder().Build()
+		err := cl.SubResource("token").Create(ctx, &corev1.Secret{}, &authenticationv1.TokenRequest{})
+		Expect(err).To(HaveOccurred())
+		Expect(apierrors.IsNotFound(err)).To(BeTrue())
+	})
+
+	It("should leave typemeta empty on typed get", func(ctx SpecContext) {
 		cl := NewClientBuilder().WithObjects(&corev1.Pod{ObjectMeta: metav1.ObjectMeta{
 			Namespace: "default",
 			Name:      "foo",
 		}}).Build()
 
 		var pod corev1.Pod
-		Expect(cl.Get(context.Background(), client.ObjectKey{Namespace: "default", Name: "foo"}, &pod)).NotTo(HaveOccurred())
+		Expect(cl.Get(ctx, client.ObjectKey{Namespace: "default", Name: "foo"}, &pod)).NotTo(HaveOccurred())
 
 		Expect(pod.TypeMeta).To(Equal(metav1.TypeMeta{}))
 	})
 
-	It("should leave typemeta empty on typed list", func() {
+	It("should leave typemeta empty on typed list", func(ctx SpecContext) {
 		cl := NewClientBuilder().WithObjects(&corev1.Pod{ObjectMeta: metav1.ObjectMeta{
 			Namespace: "default",
 			Name:      "foo",
 		}}).Build()
 
 		var podList corev1.PodList
-		Expect(cl.List(context.Background(), &podList)).NotTo(HaveOccurred())
+		Expect(cl.List(ctx, &podList)).NotTo(HaveOccurred())
 		Expect(podList.ListMeta).To(Equal(metav1.ListMeta{}))
 		Expect(podList.Items[0].TypeMeta).To(Equal(metav1.TypeMeta{}))
 	})
 
-	It("should be able to Get an object that has pointer fields for metadata", func() {
-		schemeBuilder := &scheme.Builder{GroupVersion: schema.GroupVersion{Group: "test", Version: "v1"}}
-		schemeBuilder.Register(&WithPointerMeta{}, &WithPointerMetaList{})
+	It("should allow concurrent patches to a configMap", func(ctx SpecContext) {
 		scheme := runtime.NewScheme()
-		Expect(schemeBuilder.AddToScheme(scheme)).NotTo(HaveOccurred())
+		Expect(corev1.AddToScheme(scheme)).To(Succeed())
 
-		cl := NewClientBuilder().
-			WithScheme(scheme).
-			WithObjects(&WithPointerMeta{ObjectMeta: &metav1.ObjectMeta{
-				Name: "foo",
-			}}).
-			Build()
+		obj := &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:            "foo",
+				ResourceVersion: "0",
+			},
+		}
+		cl := NewClientBuilder().WithScheme(scheme).WithObjects(obj).Build()
 
-		var object WithPointerMeta
-		Expect(cl.Get(context.Background(), client.ObjectKey{Name: "foo"}, &object)).NotTo(HaveOccurred())
-	})
+		const tries = 50
+		wg := sync.WaitGroup{}
+		wg.Add(tries)
 
-	It("should be able to List an object type that has pointer fields for metadata", func() {
-		schemeBuilder := &scheme.Builder{GroupVersion: schema.GroupVersion{Group: "test", Version: "v1"}}
-		schemeBuilder.Register(&WithPointerMeta{}, &WithPointerMetaList{})
-		scheme := runtime.NewScheme()
-		Expect(schemeBuilder.AddToScheme(scheme)).NotTo(HaveOccurred())
+		for i := range tries {
+			go func() {
+				defer wg.Done()
+				defer GinkgoRecover()
 
-		cl := NewClientBuilder().
-			WithScheme(scheme).
-			WithObjects(&WithPointerMeta{ObjectMeta: &metav1.ObjectMeta{
-				Name: "foo",
-			}}).
-			Build()
+				newObj := obj.DeepCopy()
+				newObj.Data = map[string]string{"foo": strconv.Itoa(i)}
+				Expect(cl.Patch(ctx, newObj, client.MergeFrom(obj))).To(Succeed())
+			}()
+		}
+		wg.Wait()
 
-		var objectList WithPointerMetaList
-		Expect(cl.List(context.Background(), &objectList)).NotTo(HaveOccurred())
-		Expect(objectList.Items).To(HaveLen(1))
+		// While the order is not deterministic, there must be $tries distinct updates
+		// that each increment the resource version by one
+		Expect(cl.Get(ctx, client.ObjectKey{Name: "foo"}, obj)).To(Succeed())
+		Expect(obj.ResourceVersion).To(Equal(strconv.Itoa(tries)))
 	})
 
-	It("should be able to List an object type that has pointer fields for metadata with no results", func() {
-		schemeBuilder := &scheme.Builder{GroupVersion: schema.GroupVersion{Group: "test", Version: "v1"}}
-		schemeBuilder.Register(&WithPointerMeta{}, &WithPointerMetaList{})
+	It("should not allow concurrent patches to a configMap if the patch contains a ResourceVersion", func(ctx SpecContext) {
 		scheme := runtime.NewScheme()
-		Expect(schemeBuilder.AddToScheme(scheme)).NotTo(HaveOccurred())
+		Expect(corev1.AddToScheme(scheme)).To(Succeed())
 
-		cl := NewClientBuilder().
-			WithScheme(scheme).
-			Build()
+		obj := &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:            "foo",
+				ResourceVersion: "0",
+			},
+		}
+		cl := NewClientBuilder().WithScheme(scheme).WithObjects(obj).Build()
+		wg := sync.WaitGroup{}
+		wg.Add(5)
+
+		for i := range 5 {
+			go func() {
+				defer wg.Done()
+				defer GinkgoRecover()
 
-		var objectList WithPointerMetaList
-		Expect(cl.List(context.Background(), &objectList)).NotTo(HaveOccurred())
-		Expect(objectList.Items).To(BeEmpty())
+				newObj := obj.DeepCopy()
+				newObj.ResourceVersion = "1" // include an invalid RV to cause a conflict
+				newObj.Data = map[string]string{"foo": strconv.Itoa(i)}
+				Expect(apierrors.IsConflict(cl.Patch(ctx, newObj, client.MergeFrom(obj)))).To(BeTrue())
+			}()
+		}
+		wg.Wait()
 	})
 
-	It("should be able to Patch an object type that has pointer fields for metadata", func() {
-		schemeBuilder := &scheme.Builder{GroupVersion: schema.GroupVersion{Group: "test", Version: "v1"}}
-		schemeBuilder.Register(&WithPointerMeta{}, &WithPointerMetaList{})
+	It("should allow concurrent updates to an object that allows unconditionalUpdate if the incoming request has no RV", func(ctx SpecContext) {
 		scheme := runtime.NewScheme()
-		Expect(schemeBuilder.AddToScheme(scheme)).NotTo(HaveOccurred())
+		Expect(corev1.AddToScheme(scheme)).To(Succeed())
 
-		obj := &WithPointerMeta{ObjectMeta: &metav1.ObjectMeta{
-			Name: "foo",
-		}}
-		cl := NewClientBuilder().
-			WithScheme(scheme).
-			WithObjects(obj).
-			Build()
+		obj := &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:            "foo",
+				ResourceVersion: "0",
+			},
+		}
+		cl := NewClientBuilder().WithScheme(scheme).WithObjects(obj).Build()
 
-		original := obj.DeepCopy()
-		obj.Labels = map[string]string{"foo": "bar"}
-		Expect(cl.Patch(context.Background(), obj, client.MergeFrom(original))).NotTo(HaveOccurred())
+		const tries = 50
+		wg := sync.WaitGroup{}
+		wg.Add(tries)
+
+		for i := range tries {
+			go func() {
+				defer wg.Done()
+				defer GinkgoRecover()
+
+				newObj := obj.DeepCopy()
+				newObj.Data = map[string]string{"foo": strconv.Itoa(i)}
+				newObj.ResourceVersion = ""
+				Expect(cl.Update(ctx, newObj)).To(Succeed())
+			}()
+		}
+		wg.Wait()
 
-		Expect(cl.Get(context.Background(), client.ObjectKey{Name: "foo"}, obj)).NotTo(HaveOccurred())
-		Expect(obj.Labels).To(Equal(map[string]string{"foo": "bar"}))
+		// While the order is not deterministic, there must be $tries distinct updates
+		// that each increment the resource version by one
+		Expect(cl.Get(ctx, client.ObjectKey{Name: "foo"}, obj)).To(Succeed())
+		Expect(obj.ResourceVersion).To(Equal(strconv.Itoa(tries)))
 	})
 
-	It("should be able to Update an object type that has pointer fields for metadata", func() {
-		schemeBuilder := &scheme.Builder{GroupVersion: schema.GroupVersion{Group: "test", Version: "v1"}}
-		schemeBuilder.Register(&WithPointerMeta{}, &WithPointerMetaList{})
+	It("If a create races with an update for an object that allows createOnUpdate, the update should always succeed", func(ctx SpecContext) {
 		scheme := runtime.NewScheme()
-		Expect(schemeBuilder.AddToScheme(scheme)).NotTo(HaveOccurred())
-
-		obj := &WithPointerMeta{ObjectMeta: &metav1.ObjectMeta{
-			Name: "foo",
-		}}
-		cl := NewClientBuilder().
-			WithScheme(scheme).
-			WithObjects(obj).
-			Build()
+		Expect(corev1.AddToScheme(scheme)).To(Succeed())
 
-		Expect(cl.Get(context.Background(), client.ObjectKey{Name: "foo"}, obj)).NotTo(HaveOccurred())
+		cl := NewClientBuilder().WithScheme(scheme).Build()
 
-		obj.Labels = map[string]string{"foo": "bar"}
-		Expect(cl.Update(context.Background(), obj)).NotTo(HaveOccurred())
+		const tries = 50
+		wg := sync.WaitGroup{}
+		wg.Add(tries * 2)
 
-		Expect(cl.Get(context.Background(), client.ObjectKey{Name: "foo"}, obj)).NotTo(HaveOccurred())
-		Expect(obj.Labels).To(Equal(map[string]string{"foo": "bar"}))
-	})
+		for i := range tries {
+			obj := &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: strconv.Itoa(i),
+				},
+			}
+			go func() {
+				defer wg.Done()
+				defer GinkgoRecover()
 
-	It("should be able to Delete an object type that has pointer fields for metadata", func() {
-		schemeBuilder := &scheme.Builder{GroupVersion: schema.GroupVersion{Group: "test", Version: "v1"}}
-		schemeBuilder.Register(&WithPointerMeta{}, &WithPointerMetaList{})
-		scheme := runtime.NewScheme()
-		Expect(schemeBuilder.AddToScheme(scheme)).NotTo(HaveOccurred())
+				// this may or may not succeed depending on if we win the race. Either is acceptable,
+				// but if it fails, it must fail due to an AlreadyExists.
+				err := cl.Create(ctx, obj.DeepCopy())
+				if err != nil {
+					Expect(apierrors.IsAlreadyExists(err)).To(BeTrue())
+				}
+			}()
 
-		obj := &WithPointerMeta{ObjectMeta: &metav1.ObjectMeta{
-			Name: "foo",
-		}}
-		cl := NewClientBuilder().
-			WithScheme(scheme).
-			WithObjects(obj).
-			Build()
+			go func() {
+				defer wg.Done()
+				defer GinkgoRecover()
 
-		Expect(cl.Delete(context.Background(), obj)).NotTo(HaveOccurred())
+				// This must always succeed, regardless of the outcome of the create.
+				Expect(cl.Update(ctx, obj.DeepCopy())).To(Succeed())
+			}()
+		}
 
-		err := cl.Get(context.Background(), client.ObjectKey{Name: "foo"}, obj)
-		Expect(apierrors.IsNotFound(err)).To(BeTrue())
+		wg.Wait()
 	})
 
-	It("disallows scale subresources on unsupported built-in types", func() {
+	It("If a delete races with an update for an object that allows createOnUpdate, the update should always succeed", func(ctx SpecContext) {
 		scheme := runtime.NewScheme()
 		Expect(corev1.AddToScheme(scheme)).To(Succeed())
-		Expect(apiextensions.AddToScheme(scheme)).To(Succeed())
 
-		obj := &corev1.Pod{
-			ObjectMeta: metav1.ObjectMeta{
-				Name: "foo",
-			},
+		cl := NewClientBuilder().WithScheme(scheme).Build()
+
+		const tries = 50
+		wg := sync.WaitGroup{}
+		wg.Add(tries * 2)
+
+		for i := range tries {
+			obj := &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: strconv.Itoa(i),
+				},
+			}
+			Expect(cl.Create(ctx, obj.DeepCopy())).To(Succeed())
+
+			go func() {
+				defer wg.Done()
+				defer GinkgoRecover()
+
+				Expect(cl.Delete(ctx, obj.DeepCopy())).To(Succeed())
+			}()
+
+			go func() {
+				defer wg.Done()
+				defer GinkgoRecover()
+
+				// This must always succeed, regardless of if the delete came before or
+				// after us.
+				Expect(cl.Update(ctx, obj.DeepCopy())).To(Succeed())
+			}()
 		}
-		cl := NewClientBuilder().WithScheme(scheme).WithObjects(obj).Build()
 
-		scale := &autoscalingv1.Scale{Spec: autoscalingv1.ScaleSpec{Replicas: 2}}
-		expectedErr := "unimplemented scale subresource for resource *v1.Pod"
-		Expect(cl.SubResource(subResourceScale).Get(context.Background(), obj, scale).Error()).To(Equal(expectedErr))
-		Expect(cl.SubResource(subResourceScale).Update(context.Background(), obj, client.WithSubResourceBody(scale)).Error()).To(Equal(expectedErr))
+		wg.Wait()
 	})
 
-	It("disallows scale subresources on non-existing objects", func() {
+	It("If a DeleteAllOf races with a delete, the DeleteAllOf should always succeed", func(ctx SpecContext) {
+		scheme := runtime.NewScheme()
+		Expect(corev1.AddToScheme(scheme)).To(Succeed())
+
+		cl := NewClientBuilder().WithScheme(scheme).Build()
+
+		const objects = 50
+		wg := sync.WaitGroup{}
+		wg.Add(objects)
+
+		for i := range objects {
+			obj := &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: strconv.Itoa(i),
+				},
+			}
+			Expect(cl.Create(ctx, obj.DeepCopy())).To(Succeed())
+		}
+
+		for i := range objects {
+			obj := &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: strconv.Itoa(i),
+				},
+			}
+
+			go func() {
+				defer wg.Done()
+				defer GinkgoRecover()
+
+				// This may or may not succeed depending on if the DeleteAllOf is faster,
+				// but if it fails, it should be a not found.
+				err := cl.Delete(ctx, obj)
+				if err != nil {
+					Expect(apierrors.IsNotFound(err)).To(BeTrue())
+				}
+			}()
+		}
+		Expect(cl.DeleteAllOf(ctx, &corev1.Service{})).To(Succeed())
+
+		wg.Wait()
+	})
+
+	It("If an update races with a scale update, only one of them succeeds", func(ctx SpecContext) {
+		scheme := runtime.NewScheme()
+		Expect(appsv1.AddToScheme(scheme)).To(Succeed())
+
+		cl := NewClientBuilder().WithScheme(scheme).Build()
+
+		const tries = 5000
+		for i := range tries {
+			dep := &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: strconv.Itoa(i),
+				},
+			}
+			Expect(cl.Create(ctx, dep)).To(Succeed())
+
+			wg := sync.WaitGroup{}
+			wg.Add(2)
+			var updateSucceeded bool
+			var scaleSucceeded bool
+
+			go func() {
+				defer wg.Done()
+				defer GinkgoRecover()
+
+				dep := dep.DeepCopy()
+				dep.Annotations = map[string]string{"foo": "bar"}
+
+				// This may or may not fail. If it does fail, it must be a conflict.
+				err := cl.Update(ctx, dep)
+				if err != nil {
+					Expect(apierrors.IsConflict(err)).To(BeTrue())
+				} else {
+					updateSucceeded = true
+				}
+			}()
+
+			go func() {
+				defer wg.Done()
+				defer GinkgoRecover()
+
+				// This may or may not fail. If it does fail, it must be a conflict.
+				scale := &autoscalingv1.Scale{Spec: autoscalingv1.ScaleSpec{Replicas: 10}}
+				err := cl.SubResource("scale").Update(ctx, dep.DeepCopy(), client.WithSubResourceBody(scale))
+				if err != nil {
+					Expect(apierrors.IsConflict(err)).To(BeTrue())
+				} else {
+					scaleSucceeded = true
+				}
+			}()
+
+			wg.Wait()
+			Expect(updateSucceeded).ToNot(Equal(scaleSucceeded))
+		}
+
+	})
+
+	It("disallows scale subresources on unsupported built-in types", func(ctx SpecContext) {
+		scheme := runtime.NewScheme()
+		Expect(corev1.AddToScheme(scheme)).To(Succeed())
+		Expect(apiextensions.AddToScheme(scheme)).To(Succeed())
+
+		obj := &corev1.Pod{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "foo",
+			},
+		}
+		cl := NewClientBuilder().WithScheme(scheme).WithObjects(obj).Build()
+
+		scale := &autoscalingv1.Scale{Spec: autoscalingv1.ScaleSpec{Replicas: 2}}
+		expectedErr := "unimplemented scale subresource for resource *v1.Pod"
+		Expect(cl.SubResource(subResourceScale).Get(ctx, obj, scale).Error()).To(Equal(expectedErr))
+		Expect(cl.SubResource(subResourceScale).Update(ctx, obj, client.WithSubResourceBody(scale)).Error()).To(Equal(expectedErr))
+	})
+
+	It("disallows scale subresources on non-existing objects", func(ctx SpecContext) {
 		obj := &appsv1.Deployment{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "foo",
@@ -2102,8 +2368,631 @@ var _ = Describe("Fake client", func() {
 
 		scale := &autoscalingv1.Scale{Spec: autoscalingv1.ScaleSpec{Replicas: 2}}
 		expectedErr := "deployments.apps \"foo\" not found"
-		Expect(cl.SubResource(subResourceScale).Get(context.Background(), obj, scale).Error()).To(Equal(expectedErr))
-		Expect(cl.SubResource(subResourceScale).Update(context.Background(), obj, client.WithSubResourceBody(scale)).Error()).To(Equal(expectedErr))
+		Expect(cl.SubResource(subResourceScale).Get(ctx, obj, scale).Error()).To(Equal(expectedErr))
+		Expect(cl.SubResource(subResourceScale).Update(ctx, obj, client.WithSubResourceBody(scale)).Error()).To(Equal(expectedErr))
+	})
+
+	It("clears typemeta from structured objects on create", func(ctx SpecContext) {
+		obj := &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "foo",
+			},
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "v1",
+				Kind:       "ConfigMap",
+			},
+		}
+		cl := NewClientBuilder().Build()
+		Expect(cl.Create(ctx, obj)).To(Succeed())
+		Expect(obj.TypeMeta).To(Equal(metav1.TypeMeta{}))
+	})
+
+	It("clears typemeta from structured objects on update", func(ctx SpecContext) {
+		obj := &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "foo",
+			},
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "v1",
+				Kind:       "ConfigMap",
+			},
+		}
+		cl := NewClientBuilder().WithObjects(obj).Build()
+		Expect(cl.Update(ctx, obj)).To(Succeed())
+		Expect(obj.TypeMeta).To(Equal(metav1.TypeMeta{}))
+	})
+
+	It("clears typemeta from structured objects on patch", func(ctx SpecContext) {
+		obj := &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "foo",
+			},
+		}
+		cl := NewClientBuilder().WithObjects(obj).Build()
+		original := obj.DeepCopy()
+		obj.TypeMeta = metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "ConfigMap",
+		}
+		Expect(cl.Patch(ctx, obj, client.MergeFrom(original))).To(Succeed())
+		Expect(obj.TypeMeta).To(Equal(metav1.TypeMeta{}))
+	})
+
+	It("clears typemeta from structured objects on get", func(ctx SpecContext) {
+		obj := &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "foo",
+			},
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "v1",
+				Kind:       "ConfigMap",
+			},
+		}
+		cl := NewClientBuilder().WithObjects(obj).Build()
+		target := &corev1.ConfigMap{}
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(obj), target)).To(Succeed())
+		Expect(target.TypeMeta).To(Equal(metav1.TypeMeta{}))
+	})
+
+	It("clears typemeta from structured objects on list", func(ctx SpecContext) {
+		obj := &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: "foo",
+			},
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "v1",
+				Kind:       "ConfigMap",
+			},
+		}
+		cl := NewClientBuilder().WithObjects(obj).Build()
+		target := &corev1.ConfigMapList{
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: "v1",
+				Kind:       "ConfigMap",
+			},
+		}
+		Expect(cl.List(ctx, target)).To(Succeed())
+		Expect(target.TypeMeta).To(Equal(metav1.TypeMeta{}))
+		Expect(target.Items[0].TypeMeta).To(Equal(metav1.TypeMeta{}))
+	})
+
+	It("is threadsafe", func(ctx SpecContext) {
+		cl := NewClientBuilder().Build()
+
+		u := func() *unstructured.Unstructured {
+			u := &unstructured.Unstructured{}
+			u.SetAPIVersion("custom/v1")
+			u.SetKind("Version")
+			u.SetName("foo")
+			return u
+		}
+
+		uList := func() *unstructured.UnstructuredList {
+			u := &unstructured.UnstructuredList{}
+			u.SetAPIVersion("custom/v1")
+			u.SetKind("Version")
+
+			return u
+		}
+
+		meta := func() *metav1.PartialObjectMetadata {
+			return &metav1.PartialObjectMetadata{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "foo",
+					Namespace: "default",
+				},
+				TypeMeta: metav1.TypeMeta{
+					APIVersion: "custom/v1",
+					Kind:       "Version",
+				},
+			}
+		}
+		metaList := func() *metav1.PartialObjectMetadataList {
+			return &metav1.PartialObjectMetadataList{
+				TypeMeta: metav1.TypeMeta{
+
+					APIVersion: "custom/v1",
+					Kind:       "Version",
+				},
+			}
+		}
+
+		pod := func() *corev1.Pod {
+			return &corev1.Pod{ObjectMeta: metav1.ObjectMeta{
+				Name:      "foo",
+				Namespace: "default",
+			}}
+		}
+
+		ops := []func(){
+			func() { _ = cl.Create(ctx, u()) },
+			func() { _ = cl.Get(ctx, client.ObjectKeyFromObject(u()), u()) },
+			func() { _ = cl.Update(ctx, u()) },
+			func() { _ = cl.Patch(ctx, u(), client.RawPatch(types.StrategicMergePatchType, []byte("foo"))) },
+			func() { _ = cl.Delete(ctx, u()) },
+			func() { _ = cl.DeleteAllOf(ctx, u(), client.HasLabels{"foo"}) },
+			func() { _ = cl.List(ctx, uList()) },
+
+			func() { _ = cl.Create(ctx, meta()) },
+			func() { _ = cl.Get(ctx, client.ObjectKeyFromObject(meta()), meta()) },
+			func() { _ = cl.Update(ctx, meta()) },
+			func() { _ = cl.Patch(ctx, meta(), client.RawPatch(types.StrategicMergePatchType, []byte("foo"))) },
+			func() { _ = cl.Delete(ctx, meta()) },
+			func() { _ = cl.DeleteAllOf(ctx, meta(), client.HasLabels{"foo"}) },
+			func() { _ = cl.List(ctx, metaList()) },
+
+			func() { _ = cl.Create(ctx, pod()) },
+			func() { _ = cl.Get(ctx, client.ObjectKeyFromObject(pod()), pod()) },
+			func() { _ = cl.Update(ctx, pod()) },
+			func() { _ = cl.Patch(ctx, pod(), client.RawPatch(types.StrategicMergePatchType, []byte("foo"))) },
+			func() { _ = cl.Delete(ctx, pod()) },
+			func() { _ = cl.DeleteAllOf(ctx, pod(), client.HasLabels{"foo"}) },
+			func() { _ = cl.List(ctx, &corev1.PodList{}) },
+		}
+
+		wg := sync.WaitGroup{}
+		wg.Add(len(ops))
+		for _, op := range ops {
+			go func() {
+				defer wg.Done()
+				op()
+			}()
+		}
+
+		wg.Wait()
+	})
+
+	DescribeTable("mutating operations return the updated object",
+		func(ctx SpecContext, mutate func(ctx SpecContext) (*corev1.ConfigMap, error)) {
+			mutated, err := mutate(ctx)
+			Expect(err).NotTo(HaveOccurred())
+
+			var retrieved corev1.ConfigMap
+			Expect(cl.Get(ctx, client.ObjectKeyFromObject(mutated), &retrieved)).To(Succeed())
+
+			Expect(&retrieved).To(BeComparableTo(mutated))
+		},
+
+		Entry("create", func(ctx SpecContext) (*corev1.ConfigMap, error) {
+			cl = NewClientBuilder().Build()
+			cm.ResourceVersion = ""
+			return cm, cl.Create(ctx, cm)
+		}),
+		Entry("update", func(ctx SpecContext) (*corev1.ConfigMap, error) {
+			cl = NewClientBuilder().WithObjects(cm).Build()
+			cm.Labels = map[string]string{"updated-label": "update-test"}
+			cm.Data["new-key"] = "new-value"
+			return cm, cl.Update(ctx, cm)
+		}),
+		Entry("patch", func(ctx SpecContext) (*corev1.ConfigMap, error) {
+			cl = NewClientBuilder().WithObjects(cm).Build()
+			original := cm.DeepCopy()
+
+			cm.Labels = map[string]string{"updated-label": "update-test"}
+			cm.Data["new-key"] = "new-value"
+			return cm, cl.Patch(ctx, cm, client.MergeFrom(original))
+		}),
+		Entry("Create through Apply", func(ctx SpecContext) (*corev1.ConfigMap, error) {
+			ac := corev1applyconfigurations.ConfigMap(cm.Name, cm.Namespace).WithData(cm.Data)
+
+			cl = NewClientBuilder().Build()
+			Expect(cl.Apply(ctx, ac, client.FieldOwner("foo"))).To(Succeed())
+
+			serialized, err := json.Marshal(ac)
+			Expect(err).NotTo(HaveOccurred())
+
+			var cm corev1.ConfigMap
+			Expect(json.Unmarshal(serialized, &cm)).To(Succeed())
+
+			// ApplyConfigurations always have TypeMeta set as they do not support using the scheme
+			// to retrieve gvk.
+			cm.TypeMeta = metav1.TypeMeta{}
+			return &cm, nil
+		}),
+		Entry("Update through Apply", func(ctx SpecContext) (*corev1.ConfigMap, error) {
+			ac := corev1applyconfigurations.ConfigMap(cm.Name, cm.Namespace).
+				WithLabels(map[string]string{"updated-label": "update-test"}).
+				WithData(map[string]string{"new-key": "new-value"})
+
+			cl = NewClientBuilder().WithObjects(cm).Build()
+			Expect(cl.Apply(ctx, ac, client.FieldOwner("foo"))).To(Succeed())
+
+			serialized, err := json.Marshal(ac)
+			Expect(err).NotTo(HaveOccurred())
+
+			var cm corev1.ConfigMap
+			Expect(json.Unmarshal(serialized, &cm)).To(Succeed())
+
+			// ApplyConfigurations always have TypeMeta set as they do not support using the scheme
+			// to retrieve gvk.
+			cm.TypeMeta = metav1.TypeMeta{}
+			return &cm, nil
+		}),
+	)
+
+	It("supports server-side apply of a client-go resource", func(ctx SpecContext) {
+		cl := NewClientBuilder().Build()
+		obj := &unstructured.Unstructured{}
+		obj.SetAPIVersion("v1")
+		obj.SetKind("ConfigMap")
+		obj.SetName("foo")
+		Expect(unstructured.SetNestedField(obj.Object, map[string]any{"some": "data"}, "data")).To(Succeed())
+
+		Expect(cl.Patch(ctx, obj, client.Apply, client.FieldOwner("foo"))).To(Succeed())
+
+		cm := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "foo"}}
+
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(cm), cm)).To(Succeed())
+		Expect(cm.Data).To(Equal(map[string]string{"some": "data"}))
+
+		Expect(unstructured.SetNestedField(obj.Object, map[string]any{"other": "data"}, "data")).To(Succeed())
+		Expect(cl.Patch(ctx, obj, client.Apply, client.FieldOwner("foo"))).To(Succeed())
+
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(cm), cm)).To(Succeed())
+		Expect(cm.Data).To(Equal(map[string]string{"other": "data"}))
+	})
+
+	It("supports server-side apply of a custom resource", func(ctx SpecContext) {
+		cl := NewClientBuilder().Build()
+		obj := &unstructured.Unstructured{}
+		obj.SetAPIVersion("custom/v1")
+		obj.SetKind("FakeResource")
+		obj.SetName("foo")
+		result := obj.DeepCopy()
+
+		Expect(unstructured.SetNestedField(obj.Object, map[string]any{"some": "data"}, "spec")).To(Succeed())
+
+		Expect(cl.Patch(ctx, obj, client.Apply, client.FieldOwner("foo"))).To(Succeed())
+
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(result), result)).To(Succeed())
+		Expect(result.Object["spec"]).To(Equal(map[string]any{"some": "data"}))
+
+		Expect(unstructured.SetNestedField(obj.Object, map[string]any{"other": "data"}, "spec")).To(Succeed())
+		Expect(cl.Patch(ctx, obj, client.Apply, client.FieldOwner("foo"))).To(Succeed())
+
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(result), result)).To(Succeed())
+		Expect(result.Object["spec"]).To(Equal(map[string]any{"other": "data"}))
+	})
+
+	It("errors out when doing SSA with managedFields set", func(ctx SpecContext) {
+		cl := NewClientBuilder().WithReturnManagedFields().Build()
+		obj := &unstructured.Unstructured{}
+		obj.SetAPIVersion("v1")
+		obj.SetKind("ConfigMap")
+		obj.SetName("foo")
+		Expect(unstructured.SetNestedField(obj.Object, map[string]any{"some": "data"}, "data")).To(Succeed())
+
+		Expect(cl.Patch(ctx, obj, client.Apply, client.FieldOwner("foo"))).To(Succeed())
+
+		err := cl.Patch(ctx, obj, client.Apply, client.FieldOwner("foo"))
+		Expect(err).To(HaveOccurred())
+		Expect(err.Error()).To(ContainSubstring("metadata.managedFields must be nil"))
+	})
+
+	It("supports server-side apply using a custom type converter", func(ctx SpecContext) {
+		cl := NewClientBuilder().
+			WithTypeConverters(clientgoapplyconfigurations.NewTypeConverter(clientgoscheme.Scheme)).
+			Build()
+		obj := &unstructured.Unstructured{}
+		obj.SetAPIVersion("v1")
+		obj.SetKind("ConfigMap")
+		obj.SetName("foo")
+
+		Expect(unstructured.SetNestedField(obj.Object, map[string]any{"some": "data"}, "data")).To(Succeed())
+
+		Expect(cl.Patch(ctx, obj, client.Apply, client.FieldOwner("foo"))).To(Succeed())
+
+		cm := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "foo"}}
+
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(cm), cm)).To(Succeed())
+		Expect(cm.Data).To(Equal(map[string]string{"some": "data"}))
+
+		Expect(unstructured.SetNestedField(obj.Object, map[string]any{"other": "data"}, "data")).To(Succeed())
+		Expect(cl.Patch(ctx, obj, client.Apply, client.FieldOwner("foo"))).To(Succeed())
+
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(cm), cm)).To(Succeed())
+		Expect(cm.Data).To(Equal(map[string]string{"other": "data"}))
+	})
+
+	It("returns managedFields if configured to do so", func(ctx SpecContext) {
+		cl := NewClientBuilder().WithReturnManagedFields().Build()
+		cm := &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "some-cm",
+				Namespace: "default",
+			},
+			Data: map[string]string{
+				"initial": "data",
+			},
+		}
+		Expect(cl.Create(ctx, cm)).NotTo(HaveOccurred())
+		Expect(cm.ManagedFields).NotTo(BeNil())
+
+		retrieved := &corev1.ConfigMap{}
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(cm), retrieved)).NotTo(HaveOccurred())
+		Expect(retrieved.ManagedFields).NotTo(BeNil())
+
+		cm.Data["another"] = "value"
+		cm.SetManagedFields(nil)
+		Expect(cl.Update(ctx, cm)).NotTo(HaveOccurred())
+		Expect(cm.ManagedFields).NotTo(BeNil())
+
+		cm.SetManagedFields(nil)
+		beforePatch := cm.DeepCopy()
+		cm.Data["a-third"] = "value"
+		Expect(cl.Patch(ctx, cm, client.MergeFrom(beforePatch))).NotTo(HaveOccurred())
+		Expect(cm.ManagedFields).NotTo(BeNil())
+
+		u := &unstructured.Unstructured{Object: map[string]any{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]any{
+				"name":      cm.Name,
+				"namespace": cm.Namespace,
+			},
+			"data": map[string]any{
+				"ssa": "value",
+			},
+		}}
+		Expect(cl.Patch(ctx, u, client.Apply, client.FieldOwner("foo"))).NotTo(HaveOccurred())
+		_, exists, err := unstructured.NestedFieldNoCopy(u.Object, "metadata", "managedFields")
+		Expect(err).NotTo(HaveOccurred())
+		Expect(exists).To(BeTrue())
+
+		var list corev1.ConfigMapList
+		Expect(cl.List(ctx, &list)).NotTo(HaveOccurred())
+		for _, item := range list.Items {
+			Expect(item.ManagedFields).NotTo(BeNil())
+		}
+	})
+
+	It("clears managedFields from objects in a list", func(ctx SpecContext) {
+		cl := NewClientBuilder().Build()
+		obj := corev1applyconfigurations.
+			ConfigMap("foo", "default").
+			WithData(map[string]string{"some": "data"})
+
+		Expect(cl.Apply(ctx, obj, &client.ApplyOptions{FieldManager: "test-manager"})).To(Succeed())
+
+		var list corev1.ConfigMapList
+		Expect(cl.List(ctx, &list)).NotTo(HaveOccurred())
+		for _, item := range list.Items {
+			Expect(item.ManagedFields).To(BeNil())
+		}
+	})
+
+	It("supports server-side apply of a client-go resource via Apply method", func(ctx SpecContext) {
+		cl := NewClientBuilder().Build()
+		obj := corev1applyconfigurations.
+			ConfigMap("foo", "default").
+			WithData(map[string]string{"some": "data"})
+
+		Expect(cl.Apply(ctx, obj, &client.ApplyOptions{FieldManager: "test-manager"})).To(Succeed())
+
+		cm := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "foo", Namespace: "default"}}
+
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(cm), cm)).To(Succeed())
+		Expect(cm.Data).To(BeComparableTo(map[string]string{"some": "data"}))
+
+		obj.Data = map[string]string{"other": "data"}
+		Expect(cl.Apply(ctx, obj, &client.ApplyOptions{FieldManager: "test-manager"})).To(Succeed())
+
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(cm), cm)).To(Succeed())
+		Expect(cm.Data).To(BeComparableTo(map[string]string{"other": "data"}))
+	})
+
+	It("errors when trying to server-side apply an object without configuring a FieldManager", func(ctx SpecContext) {
+		cl := NewClientBuilder().Build()
+		obj := corev1applyconfigurations.
+			ConfigMap("foo", "default").
+			WithData(map[string]string{"some": "data"})
+
+		err := cl.Apply(ctx, obj)
+		Expect(err).To(HaveOccurred())
+		Expect(apierrors.IsInvalid(err)).To(BeTrue(), "Expected error to be an invalid error")
+	})
+
+	It("errors when trying to server-side apply an object with an invalid FieldManager", func(ctx SpecContext) {
+		cl := NewClientBuilder().Build()
+		obj := corev1applyconfigurations.
+			ConfigMap("foo", "default").
+			WithData(map[string]string{"some": "data"})
+
+		err := cl.Apply(ctx, obj, client.FieldOwner("\x00"))
+		Expect(err).To(HaveOccurred())
+		Expect(apierrors.IsInvalid(err)).To(BeTrue(), "Expected error to be an invalid error")
+	})
+
+	It("supports server-side apply of a custom resource via Apply method", func(ctx SpecContext) {
+		cl := NewClientBuilder().Build()
+		obj := &unstructured.Unstructured{}
+		obj.SetAPIVersion("custom/v1")
+		obj.SetKind("FakeResource")
+		obj.SetName("foo")
+		result := obj.DeepCopy()
+
+		Expect(unstructured.SetNestedField(obj.Object, map[string]any{"some": "data"}, "spec")).To(Succeed())
+
+		applyConfig := client.ApplyConfigurationFromUnstructured(obj)
+		Expect(cl.Apply(ctx, applyConfig, &client.ApplyOptions{FieldManager: "test-manager"})).To(Succeed())
+
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(result), result)).To(Succeed())
+		Expect(result.Object["spec"]).To(Equal(map[string]any{"some": "data"}))
+
+		Expect(unstructured.SetNestedField(obj.Object, map[string]any{"other": "data"}, "spec")).To(Succeed())
+		applyConfig2 := client.ApplyConfigurationFromUnstructured(obj)
+		Expect(cl.Apply(ctx, applyConfig2, &client.ApplyOptions{FieldManager: "test-manager"})).To(Succeed())
+
+		Expect(cl.Get(ctx, client.ObjectKeyFromObject(result), result)).To(Succeed())
+		Expect(result.Object["spec"]).To(Equal(map[string]any{"other": "data"}))
+	})
+
+	It("sets managed fields through all methods", func(ctx SpecContext) {
+		owner := "test-owner"
+		cl := client.WithFieldOwner(
+			NewClientBuilder().WithReturnManagedFields().Build(),
+			owner,
+		)
+
+		obj := &corev1.ConfigMap{
+			ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "foo"},
+			Data:       map[string]string{"method": "create"},
+		}
+		Expect(cl.Create(ctx, obj)).NotTo(HaveOccurred())
+
+		Expect(obj.ManagedFields).NotTo(BeEmpty())
+		for _, f := range obj.ManagedFields {
+			Expect(f.Manager).To(BeEquivalentTo(owner))
+		}
+
+		originalObj := obj.DeepCopy()
+		obj.Data["method"] = "patch"
+		Expect(cl.Patch(ctx, obj, client.MergeFrom(originalObj))).NotTo(HaveOccurred())
+		Expect(obj.ManagedFields).NotTo(BeEmpty())
+		for _, f := range obj.ManagedFields {
+			Expect(f.Manager).To(BeEquivalentTo(owner))
+		}
+
+		obj.Data["method"] = "update"
+		Expect(cl.Update(ctx, obj)).NotTo(HaveOccurred())
+		Expect(obj.ManagedFields).NotTo(BeEmpty())
+		for _, f := range obj.ManagedFields {
+			Expect(f.Manager).To(BeEquivalentTo(owner))
+		}
+	})
+
+	// GH-3267
+	It("Doesn't leave stale data when updating an object through SSA", func(ctx SpecContext) {
+		obj := corev1applyconfigurations.
+			ConfigMap("foo", "default").
+			WithData(map[string]string{"some": "data"})
+
+		cl := NewClientBuilder().Build()
+		Expect(cl.Apply(ctx, obj, client.FieldOwner("foo"))).NotTo(HaveOccurred())
+
+		obj.WithData(map[string]string{"bar": "baz"})
+		Expect(cl.Apply(ctx, obj, client.FieldOwner("foo"))).NotTo(HaveOccurred())
+		var cms corev1.ConfigMapList
+		Expect(cl.List(ctx, &cms)).NotTo(HaveOccurred())
+		Expect(len(cms.Items)).To(BeEquivalentTo(1))
+	})
+
+	It("allows to set deletionTimestamp on an object during SSA create", func(ctx SpecContext) {
+		now := metav1.Time{Time: time.Now().Round(time.Second)}
+		obj := corev1applyconfigurations.
+			ConfigMap("foo", "default").
+			WithDeletionTimestamp(now).
+			WithData(map[string]string{"some": "data"})
+
+		cl := NewClientBuilder().Build()
+		Expect(cl.Apply(ctx, obj, client.FieldOwner("foo"))).NotTo(HaveOccurred())
+
+		Expect(obj.DeletionTimestamp).To(BeEquivalentTo(&now))
+	})
+
+	It("will silently ignore a deletionTimestamp update through SSA", func(ctx SpecContext) {
+		now := metav1.Time{Time: time.Now().Round(time.Second)}
+		obj := corev1applyconfigurations.
+			ConfigMap("foo", "default").
+			WithDeletionTimestamp(now).
+			WithFinalizers("foo.bar").
+			WithData(map[string]string{"some": "data"})
+
+		cl := NewClientBuilder().Build()
+		Expect(cl.Apply(ctx, obj, client.FieldOwner("foo"))).NotTo(HaveOccurred())
+		Expect(obj.DeletionTimestamp).To(BeEquivalentTo(&now))
+
+		later := metav1.Time{Time: now.Add(time.Second)}
+		obj.DeletionTimestamp = &later
+		Expect(cl.Apply(ctx, obj, client.FieldOwner("foo"))).NotTo(HaveOccurred())
+		Expect(*obj.DeletionTimestamp).To(BeEquivalentTo(now))
+	})
+
+	It("will error out if an object with invalid managedFields is added", func(ctx SpecContext) {
+		fieldV1Map := map[string]interface{}{
+			"f:metadata": map[string]interface{}{
+				"f:name":        map[string]interface{}{},
+				"f:labels":      map[string]interface{}{},
+				"f:annotations": map[string]interface{}{},
+				"f:finalizers":  map[string]interface{}{},
+			},
+		}
+		fieldV1, err := json.Marshal(fieldV1Map)
+		Expect(err).NotTo(HaveOccurred())
+
+		obj := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{
+			Name:      "cm-1",
+			Namespace: "default",
+			ManagedFields: []metav1.ManagedFieldsEntry{{
+				Manager:    "my-manager",
+				Operation:  metav1.ManagedFieldsOperationUpdate,
+				FieldsType: "FieldsV1",
+				FieldsV1:   &metav1.FieldsV1{Raw: fieldV1},
+			}},
+		}}
+
+		Expect(func() {
+			NewClientBuilder().WithObjects(obj).Build()
+		}).To(PanicWith(MatchError(ContainSubstring("invalid managedFields"))))
+	})
+
+	It("allows adding an object with managedFields", func(ctx SpecContext) {
+		fieldV1Map := map[string]interface{}{
+			"f:metadata": map[string]interface{}{
+				"f:name":        map[string]interface{}{},
+				"f:labels":      map[string]interface{}{},
+				"f:annotations": map[string]interface{}{},
+				"f:finalizers":  map[string]interface{}{},
+			},
+		}
+		fieldV1, err := json.Marshal(fieldV1Map)
+		Expect(err).NotTo(HaveOccurred())
+
+		obj := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{
+			Name:      "cm-1",
+			Namespace: "default",
+			ManagedFields: []metav1.ManagedFieldsEntry{{
+				Manager:    "my-manager",
+				Operation:  metav1.ManagedFieldsOperationUpdate,
+				FieldsType: "FieldsV1",
+				FieldsV1:   &metav1.FieldsV1{Raw: fieldV1},
+				APIVersion: "v1",
+			}},
+		}}
+
+		NewClientBuilder().WithObjects(obj).Build()
+	})
+
+	It("allows adding an object with invalid managedFields when not using the FieldManagedObjectTracker", func(ctx SpecContext) {
+		fieldV1Map := map[string]interface{}{
+			"f:metadata": map[string]interface{}{
+				"f:name":        map[string]interface{}{},
+				"f:labels":      map[string]interface{}{},
+				"f:annotations": map[string]interface{}{},
+				"f:finalizers":  map[string]interface{}{},
+			},
+		}
+		fieldV1, err := json.Marshal(fieldV1Map)
+		Expect(err).NotTo(HaveOccurred())
+
+		obj := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{
+			Name:      "cm-1",
+			Namespace: "default",
+			ManagedFields: []metav1.ManagedFieldsEntry{{
+				Manager:    "my-manager",
+				Operation:  metav1.ManagedFieldsOperationUpdate,
+				FieldsType: "FieldsV1",
+				FieldsV1:   &metav1.FieldsV1{Raw: fieldV1},
+			}},
+		}}
+
+		NewClientBuilder().
+			WithObjectTracker(testing.NewObjectTracker(
+				clientgoscheme.Scheme,
+				serializer.NewCodecFactory(clientgoscheme.Scheme).UniversalDecoder(),
+			)).
+			WithObjects(obj).
+			Build()
 	})
 
 	scalableObjs := []client.Object{
@@ -2141,11 +3030,11 @@ var _ = Describe("Fake client", func() {
 		},
 	}
 	for _, obj := range scalableObjs {
-		It(fmt.Sprintf("should be able to Get scale subresources for resource %T", obj), func() {
+		It(fmt.Sprintf("should be able to Get scale subresources for resource %T", obj), func(ctx SpecContext) {
 			cl := NewClientBuilder().WithObjects(obj).Build()
 
 			scaleActual := &autoscalingv1.Scale{}
-			Expect(cl.SubResource(subResourceScale).Get(context.Background(), obj, scaleActual)).NotTo(HaveOccurred())
+			Expect(cl.SubResource(subResourceScale).Get(ctx, obj, scaleActual)).NotTo(HaveOccurred())
 
 			scaleExpected := &autoscalingv1.Scale{
 				ObjectMeta: metav1.ObjectMeta{
@@ -2160,14 +3049,14 @@ var _ = Describe("Fake client", func() {
 			Expect(cmp.Diff(scaleExpected, scaleActual)).To(BeEmpty())
 		})
 
-		It(fmt.Sprintf("should be able to Update scale subresources for resource %T", obj), func() {
+		It(fmt.Sprintf("should be able to Update scale subresources for resource %T", obj), func(ctx SpecContext) {
 			cl := NewClientBuilder().WithObjects(obj).Build()
 
 			scaleExpected := &autoscalingv1.Scale{Spec: autoscalingv1.ScaleSpec{Replicas: 3}}
-			Expect(cl.SubResource(subResourceScale).Update(context.Background(), obj, client.WithSubResourceBody(scaleExpected))).NotTo(HaveOccurred())
+			Expect(cl.SubResource(subResourceScale).Update(ctx, obj, client.WithSubResourceBody(scaleExpected))).NotTo(HaveOccurred())
 
 			objActual := obj.DeepCopyObject().(client.Object)
-			Expect(cl.Get(context.Background(), client.ObjectKeyFromObject(objActual), objActual)).To(Succeed())
+			Expect(cl.Get(ctx, client.ObjectKeyFromObject(objActual), objActual)).To(Succeed())
 
 			objExpected := obj.DeepCopyObject().(client.Object)
 			switch expected := objExpected.(type) {
@@ -2187,68 +3076,65 @@ var _ = Describe("Fake client", func() {
 			Expect(cmp.Diff(objExpected, objActual)).To(BeEmpty())
 
 			scaleActual := &autoscalingv1.Scale{}
-			Expect(cl.SubResource(subResourceScale).Get(context.Background(), obj, scaleActual)).NotTo(HaveOccurred())
+			Expect(cl.SubResource(subResourceScale).Get(ctx, obj, scaleActual)).NotTo(HaveOccurred())
 
 			// When we called Update, these were derived but we need them now to compare.
 			scaleExpected.Name = scaleActual.Name
 			scaleExpected.ResourceVersion = scaleActual.ResourceVersion
 			Expect(cmp.Diff(scaleExpected, scaleActual)).To(BeEmpty())
 		})
+
 	}
 })
 
-type WithPointerMetaList struct {
-	*metav1.ListMeta
-	*metav1.TypeMeta
-	Items []*WithPointerMeta
+type Schemaless map[string]interface{}
+
+type WithSchemalessSpec struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec Schemaless `json:"spec,omitempty"`
 }
 
-func (t *WithPointerMetaList) DeepCopy() *WithPointerMetaList {
-	l := &WithPointerMetaList{
-		ListMeta: t.ListMeta.DeepCopy(),
+func (t *WithSchemalessSpec) DeepCopy() *WithSchemalessSpec {
+	w := &WithSchemalessSpec{
+		ObjectMeta: *t.ObjectMeta.DeepCopy(),
 	}
-	if t.TypeMeta != nil {
-		l.TypeMeta = &metav1.TypeMeta{
-			APIVersion: t.APIVersion,
-			Kind:       t.Kind,
-		}
-	}
-	for _, item := range t.Items {
-		l.Items = append(l.Items, item.DeepCopy())
+	w.TypeMeta = metav1.TypeMeta{
+		APIVersion: t.APIVersion,
+		Kind:       t.Kind,
 	}
+	t.Spec.DeepCopyInto(&w.Spec)
 
-	return l
+	return w
 }
 
-func (t *WithPointerMetaList) DeepCopyObject() runtime.Object {
+func (t *WithSchemalessSpec) DeepCopyObject() runtime.Object {
 	return t.DeepCopy()
 }
 
-type WithPointerMeta struct {
-	*metav1.TypeMeta
-	*metav1.ObjectMeta
-}
-
-func (t *WithPointerMeta) DeepCopy() *WithPointerMeta {
-	w := &WithPointerMeta{
-		ObjectMeta: t.ObjectMeta.DeepCopy(),
-	}
-	if t.TypeMeta != nil {
-		w.TypeMeta = &metav1.TypeMeta{
-			APIVersion: t.APIVersion,
-			Kind:       t.Kind,
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Schemaless) DeepCopyInto(out *Schemaless) {
+	if *in != nil {
+		*out = make(Schemaless, len(*in))
+		for key := range *in {
+			(*out)[key] = (*in)[key]
 		}
 	}
-
-	return w
 }
 
-func (t *WithPointerMeta) DeepCopyObject() runtime.Object {
-	return t.DeepCopy()
+// DeepCopy copies the receiver, creating a new Schemaless.
+func (in *Schemaless) DeepCopy() *Schemaless {
+	if in == nil {
+		return nil
+	}
+	out := new(Schemaless)
+	in.DeepCopyInto(out)
+	return out
 }
 
 var _ = Describe("Fake client builder", func() {
-	It("panics when an index with the same name and GroupVersionKind is registered twice", func() {
+	It("panics when an index with the same name and GroupVersionKind is registered twice", func(ctx SpecContext) {
 		// We need any realistic GroupVersionKind, the choice of apps/v1 Deployment is arbitrary.
 		cb := NewClientBuilder().WithIndex(&appsv1.Deployment{},
 			"test-name",
@@ -2261,7 +3147,7 @@ var _ = Describe("Fake client builder", func() {
 		}).To(Panic())
 	})
 
-	It("should wrap the fake client with an interceptor when WithInterceptorFuncs is called", func() {
+	It("should wrap the fake client with an interceptor when WithInterceptorFuncs is called", func(ctx SpecContext) {
 		var called bool
 		cli := NewClientBuilder().WithInterceptorFuncs(interceptor.Funcs{
 			Get: func(ctx context.Context, client client.WithWatch, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
@@ -2269,8 +3155,17 @@ var _ = Describe("Fake client builder", func() {
 				return nil
 			},
 		}).Build()
-		err := cli.Get(context.Background(), client.ObjectKey{}, &corev1.Pod{})
+		err := cli.Get(ctx, client.ObjectKey{}, &corev1.Pod{})
 		Expect(err).NotTo(HaveOccurred())
 		Expect(called).To(BeTrue())
 	})
+
+	It("should panic when calling build more than once", func() {
+		cb := NewClientBuilder()
+		anotherCb := cb
+		cb.Build()
+		Expect(func() {
+			anotherCb.Build()
+		}).To(Panic())
+	})
 })
diff --git a/pkg/client/fake/doc.go b/pkg/client/fake/doc.go
index d42347a2e2..47cad3980d 100644
--- a/pkg/client/fake/doc.go
+++ b/pkg/client/fake/doc.go
@@ -20,7 +20,7 @@ Package fake provides a fake client for testing.
 A fake client is backed by its simple object store indexed by GroupVersionResource.
 You can create a fake client with optional objects.
 
-	client := NewClientBuilder().WithScheme(scheme).WithObj(initObjs...).Build()
+	client := NewClientBuilder().WithScheme(scheme).WithObjects(initObjs...).Build()
 
 You can invoke the methods defined in the Client interface.
 
diff --git a/pkg/client/fake/typeconverter.go b/pkg/client/fake/typeconverter.go
new file mode 100644
index 0000000000..3cb3a0dc77
--- /dev/null
+++ b/pkg/client/fake/typeconverter.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	kerrors "k8s.io/apimachinery/pkg/util/errors"
+	"k8s.io/apimachinery/pkg/util/managedfields"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+type multiTypeConverter struct {
+	upstream []managedfields.TypeConverter
+}
+
+func (m multiTypeConverter) ObjectToTyped(r runtime.Object, o ...typed.ValidationOptions) (*typed.TypedValue, error) {
+	var errs []error
+	for _, u := range m.upstream {
+		res, err := u.ObjectToTyped(r, o...)
+		if err != nil {
+			errs = append(errs, err)
+			continue
+		}
+
+		return res, nil
+	}
+
+	return nil, fmt.Errorf("failed to convert Object to TypedValue: %w", kerrors.NewAggregate(errs))
+}
+
+func (m multiTypeConverter) TypedToObject(v *typed.TypedValue) (runtime.Object, error) {
+	var errs []error
+	for _, u := range m.upstream {
+		res, err := u.TypedToObject(v)
+		if err != nil {
+			errs = append(errs, err)
+			continue
+		}
+
+		return res, nil
+	}
+
+	return nil, fmt.Errorf("failed to convert TypedValue to Object: %w", kerrors.NewAggregate(errs))
+}
diff --git a/pkg/client/fake/typeconverter_test.go b/pkg/client/fake/typeconverter_test.go
new file mode 100644
index 0000000000..8acba79f88
--- /dev/null
+++ b/pkg/client/fake/typeconverter_test.go
@@ -0,0 +1,200 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	"errors"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/managedfields"
+	"sigs.k8s.io/structured-merge-diff/v6/typed"
+)
+
+var _ = Describe("multiTypeConverter", func() {
+	Describe("ObjectToTyped", func() {
+		It("should use first converter when it succeeds", func() {
+			testObj := &corev1.ConfigMap{Data: map[string]string{"key": "value"}}
+			testTyped := &typed.TypedValue{}
+
+			firstConverter := &mockTypeConverter{
+				objectToTypedResult: testTyped,
+			}
+			secondConverter := &mockTypeConverter{
+				objectToTypedError: errors.New("second converter should not be called"),
+			}
+
+			converter := multiTypeConverter{
+				upstream: []managedfields.TypeConverter{firstConverter, secondConverter},
+			}
+
+			result, err := converter.ObjectToTyped(testObj)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(result).To(Equal(testTyped))
+		})
+
+		It("should use second converter when first fails", func() {
+			testObj := &corev1.ConfigMap{Data: map[string]string{"key": "value"}}
+			testTyped := &typed.TypedValue{}
+
+			firstConverter := &mockTypeConverter{
+				objectToTypedError: errors.New("first converter error"),
+			}
+			secondConverter := &mockTypeConverter{
+				objectToTypedResult: testTyped,
+			}
+
+			converter := multiTypeConverter{
+				upstream: []managedfields.TypeConverter{firstConverter, secondConverter},
+			}
+
+			result, err := converter.ObjectToTyped(testObj)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(result).To(Equal(testTyped))
+		})
+
+		It("should return aggregate error when all converters fail", func() {
+			testObj := &corev1.ConfigMap{Data: map[string]string{"key": "value"}}
+
+			firstConverter := &mockTypeConverter{
+				objectToTypedError: errors.New("first converter error"),
+			}
+			secondConverter := &mockTypeConverter{
+				objectToTypedError: errors.New("second converter error"),
+			}
+
+			converter := multiTypeConverter{
+				upstream: []managedfields.TypeConverter{firstConverter, secondConverter},
+			}
+
+			result, err := converter.ObjectToTyped(testObj)
+			Expect(err).To(HaveOccurred())
+			Expect(result).To(BeNil())
+			Expect(err.Error()).To(ContainSubstring("failed to convert Object to Typed"))
+			Expect(err.Error()).To(ContainSubstring("first converter error"))
+			Expect(err.Error()).To(ContainSubstring("second converter error"))
+		})
+
+		It("should return error when no converters provided", func() {
+			testObj := &corev1.ConfigMap{Data: map[string]string{"key": "value"}}
+
+			converter := multiTypeConverter{
+				upstream: []managedfields.TypeConverter{},
+			}
+
+			result, err := converter.ObjectToTyped(testObj)
+			Expect(err).To(HaveOccurred())
+			Expect(result).To(BeNil())
+			Expect(err.Error()).To(ContainSubstring("failed to convert Object to Typed"))
+		})
+	})
+
+	Describe("TypedToObject", func() {
+		It("should use first converter when it succeeds", func() {
+			testTyped := &typed.TypedValue{}
+			testObj := &corev1.ConfigMap{Data: map[string]string{"key": "value"}}
+
+			firstConverter := &mockTypeConverter{
+				typedToObjectResult: testObj,
+			}
+			secondConverter := &mockTypeConverter{
+				typedToObjectError: errors.New("second converter should not be called"),
+			}
+
+			converter := multiTypeConverter{
+				upstream: []managedfields.TypeConverter{firstConverter, secondConverter},
+			}
+
+			result, err := converter.TypedToObject(testTyped)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(result).To(Equal(testObj))
+		})
+
+		It("should use second converter when first fails", func() {
+			testTyped := &typed.TypedValue{}
+			testObj := &corev1.ConfigMap{Data: map[string]string{"key": "value"}}
+
+			firstConverter := &mockTypeConverter{
+				typedToObjectError: errors.New("first converter error"),
+			}
+			secondConverter := &mockTypeConverter{
+				typedToObjectResult: testObj,
+			}
+
+			converter := multiTypeConverter{
+				upstream: []managedfields.TypeConverter{firstConverter, secondConverter},
+			}
+
+			result, err := converter.TypedToObject(testTyped)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(result).To(Equal(testObj))
+		})
+
+		It("should return aggregate error when all converters fail", func() {
+			testTyped := &typed.TypedValue{}
+
+			firstConverter := &mockTypeConverter{
+				typedToObjectError: errors.New("first converter error"),
+			}
+			secondConverter := &mockTypeConverter{
+				typedToObjectError: errors.New("second converter error"),
+			}
+
+			converter := multiTypeConverter{
+				upstream: []managedfields.TypeConverter{firstConverter, secondConverter},
+			}
+
+			result, err := converter.TypedToObject(testTyped)
+			Expect(err).To(HaveOccurred())
+			Expect(result).To(BeNil())
+			Expect(err.Error()).To(ContainSubstring("failed to convert TypedValue to Object"))
+			Expect(err.Error()).To(ContainSubstring("first converter error"))
+			Expect(err.Error()).To(ContainSubstring("second converter error"))
+		})
+
+		It("should return error when no converters provided", func() {
+			testTyped := &typed.TypedValue{}
+
+			converter := multiTypeConverter{
+				upstream: []managedfields.TypeConverter{},
+			}
+
+			result, err := converter.TypedToObject(testTyped)
+			Expect(err).To(HaveOccurred())
+			Expect(result).To(BeNil())
+			Expect(err.Error()).To(ContainSubstring("failed to convert TypedValue to Object"))
+		})
+	})
+})
+
+type mockTypeConverter struct {
+	objectToTypedResult *typed.TypedValue
+	objectToTypedError  error
+
+	typedToObjectResult runtime.Object
+	typedToObjectError  error
+}
+
+func (m *mockTypeConverter) ObjectToTyped(r runtime.Object, o ...typed.ValidationOptions) (*typed.TypedValue, error) {
+	return m.objectToTypedResult, m.objectToTypedError
+}
+
+func (m *mockTypeConverter) TypedToObject(v *typed.TypedValue) (runtime.Object, error) {
+	return m.typedToObjectResult, m.typedToObjectError
+}
diff --git a/pkg/client/fieldowner.go b/pkg/client/fieldowner.go
index 07183cd192..93274f9500 100644
--- a/pkg/client/fieldowner.go
+++ b/pkg/client/fieldowner.go
@@ -54,6 +54,10 @@ func (f *clientWithFieldManager) Patch(ctx context.Context, obj Object, patch Pa
 	return f.c.Patch(ctx, obj, patch, append([]PatchOption{FieldOwner(f.owner)}, opts...)...)
 }
 
+func (f *clientWithFieldManager) Apply(ctx context.Context, obj runtime.ApplyConfiguration, opts ...ApplyOption) error {
+	return f.c.Apply(ctx, obj, append([]ApplyOption{FieldOwner(f.owner)}, opts...)...)
+}
+
 func (f *clientWithFieldManager) Delete(ctx context.Context, obj Object, opts ...DeleteOption) error {
 	return f.c.Delete(ctx, obj, opts...)
 }
diff --git a/pkg/client/fieldowner_test.go b/pkg/client/fieldowner_test.go
index 7c3d752316..95cb4e0f91 100644
--- a/pkg/client/fieldowner_test.go
+++ b/pkg/client/fieldowner_test.go
@@ -31,7 +31,7 @@ func TestWithFieldOwner(t *testing.T) {
 	fakeClient := testClient(t, "custom-field-mgr", func() { calls++ })
 	wrappedClient := client.WithFieldOwner(fakeClient, "custom-field-mgr")
 
-	ctx := context.Background()
+	ctx := t.Context()
 	dummyObj := &corev1.Namespace{}
 
 	_ = wrappedClient.Create(ctx, dummyObj)
@@ -55,7 +55,7 @@ func TestWithFieldOwnerOverridden(t *testing.T) {
 	fakeClient := testClient(t, "new-field-manager", func() { calls++ })
 	wrappedClient := client.WithFieldOwner(fakeClient, "old-field-manager")
 
-	ctx := context.Background()
+	ctx := t.Context()
 	dummyObj := &corev1.Namespace{}
 
 	_ = wrappedClient.Create(ctx, dummyObj, client.FieldOwner("new-field-manager"))
diff --git a/pkg/client/fieldvalidation.go b/pkg/client/fieldvalidation.go
index 659b3d44c9..ce8d0576c7 100644
--- a/pkg/client/fieldvalidation.go
+++ b/pkg/client/fieldvalidation.go
@@ -53,6 +53,10 @@ func (c *clientWithFieldValidation) Patch(ctx context.Context, obj Object, patch
 	return c.client.Patch(ctx, obj, patch, append([]PatchOption{c.validation}, opts...)...)
 }
 
+func (c *clientWithFieldValidation) Apply(ctx context.Context, obj runtime.ApplyConfiguration, opts ...ApplyOption) error {
+	return c.client.Apply(ctx, obj, opts...)
+}
+
 func (c *clientWithFieldValidation) Delete(ctx context.Context, obj Object, opts ...DeleteOption) error {
 	return c.client.Delete(ctx, obj, opts...)
 }
diff --git a/pkg/client/fieldvalidation_test.go b/pkg/client/fieldvalidation_test.go
index 4d06e5d96f..d32ee5717d 100644
--- a/pkg/client/fieldvalidation_test.go
+++ b/pkg/client/fieldvalidation_test.go
@@ -25,20 +25,21 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	corev1applyconfigurations "k8s.io/client-go/applyconfigurations/core/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
 )
 
 var _ = Describe("ClientWithFieldValidation", func() {
-	It("should return errors for invalid fields when using strict validation", func() {
+	It("should return errors for invalid fields when using strict validation", func(ctx SpecContext) {
 		cl, err := client.New(cfg, client.Options{})
 		Expect(err).NotTo(HaveOccurred())
 		Expect(cl).NotTo(BeNil())
 
 		wrappedClient := client.WithFieldValidation(cl, metav1.FieldValidationStrict)
-		ctx := context.Background()
 
 		baseNode := &unstructured.Unstructured{}
 		baseNode.SetGroupVersionKind(schema.GroupVersionKind{
@@ -99,11 +100,12 @@ func TestWithStrictFieldValidation(t *testing.T) {
 	fakeClient := testFieldValidationClient(t, metav1.FieldValidationStrict, func() { calls++ })
 	wrappedClient := client.WithFieldValidation(fakeClient, metav1.FieldValidationStrict)
 
-	ctx := context.Background()
+	ctx := t.Context()
 	dummyObj := &corev1.Namespace{}
 
 	_ = wrappedClient.Create(ctx, dummyObj)
 	_ = wrappedClient.Update(ctx, dummyObj)
+	_ = wrappedClient.Apply(ctx, corev1applyconfigurations.ConfigMap("foo", "bar"))
 	_ = wrappedClient.Patch(ctx, dummyObj, nil)
 	_ = wrappedClient.Status().Create(ctx, dummyObj, dummyObj)
 	_ = wrappedClient.Status().Update(ctx, dummyObj)
@@ -112,7 +114,7 @@ func TestWithStrictFieldValidation(t *testing.T) {
 	_ = wrappedClient.SubResource("some-subresource").Update(ctx, dummyObj)
 	_ = wrappedClient.SubResource("some-subresource").Patch(ctx, dummyObj, nil)
 
-	if expectedCalls := 9; calls != expectedCalls {
+	if expectedCalls := 10; calls != expectedCalls {
 		t.Fatalf("wrong number of calls to assertions: expected=%d; got=%d", expectedCalls, calls)
 	}
 }
@@ -123,7 +125,7 @@ func TestWithStrictFieldValidationOverridden(t *testing.T) {
 	fakeClient := testFieldValidationClient(t, metav1.FieldValidationWarn, func() { calls++ })
 	wrappedClient := client.WithFieldValidation(fakeClient, metav1.FieldValidationStrict)
 
-	ctx := context.Background()
+	ctx := t.Context()
 	dummyObj := &corev1.Namespace{}
 
 	_ = wrappedClient.Create(ctx, dummyObj, client.FieldValidation(metav1.FieldValidationWarn))
@@ -188,6 +190,10 @@ func testFieldValidationClient(t *testing.T, expectedFieldValidation string, cal
 			}
 			return nil
 		},
+		Apply: func(ctx context.Context, client client.WithWatch, obj runtime.ApplyConfiguration, opts ...client.ApplyOption) error {
+			callback()
+			return nil
+		},
 		Patch: func(ctx context.Context, c client.WithWatch, obj client.Object, patch client.Patch, opts ...client.PatchOption) error {
 			callback()
 			out := &client.PatchOptions{}
diff --git a/pkg/client/interceptor/intercept.go b/pkg/client/interceptor/intercept.go
index 3d3f3cb011..7ff73bd8da 100644
--- a/pkg/client/interceptor/intercept.go
+++ b/pkg/client/interceptor/intercept.go
@@ -19,6 +19,7 @@ type Funcs struct {
 	DeleteAllOf       func(ctx context.Context, client client.WithWatch, obj client.Object, opts ...client.DeleteAllOfOption) error
 	Update            func(ctx context.Context, client client.WithWatch, obj client.Object, opts ...client.UpdateOption) error
 	Patch             func(ctx context.Context, client client.WithWatch, obj client.Object, patch client.Patch, opts ...client.PatchOption) error
+	Apply             func(ctx context.Context, client client.WithWatch, obj runtime.ApplyConfiguration, opts ...client.ApplyOption) error
 	Watch             func(ctx context.Context, client client.WithWatch, obj client.ObjectList, opts ...client.ListOption) (watch.Interface, error)
 	SubResource       func(client client.WithWatch, subResource string) client.SubResourceClient
 	SubResourceGet    func(ctx context.Context, client client.Client, subResourceName string, obj client.Object, subResource client.Object, opts ...client.SubResourceGetOption) error
@@ -92,6 +93,14 @@ func (c interceptor) Patch(ctx context.Context, obj client.Object, patch client.
 	return c.client.Patch(ctx, obj, patch, opts...)
 }
 
+func (c interceptor) Apply(ctx context.Context, obj runtime.ApplyConfiguration, opts ...client.ApplyOption) error {
+	if c.funcs.Apply != nil {
+		return c.funcs.Apply(ctx, c.client, obj, opts...)
+	}
+
+	return c.client.Apply(ctx, obj, opts...)
+}
+
 func (c interceptor) DeleteAllOf(ctx context.Context, obj client.Object, opts ...client.DeleteAllOfOption) error {
 	if c.funcs.DeleteAllOf != nil {
 		return c.funcs.DeleteAllOf(ctx, c.client, obj, opts...)
diff --git a/pkg/client/interceptor/intercept_test.go b/pkg/client/interceptor/intercept_test.go
index a0536789b1..26ea5b057e 100644
--- a/pkg/client/interceptor/intercept_test.go
+++ b/pkg/client/interceptor/intercept_test.go
@@ -16,8 +16,7 @@ import (
 
 var _ = Describe("NewClient", func() {
 	wrappedClient := dummyClient{}
-	ctx := context.Background()
-	It("should call the provided Get function", func() {
+	It("should call the provided Get function", func(ctx SpecContext) {
 		var called bool
 		client := NewClient(wrappedClient, Funcs{
 			Get: func(ctx context.Context, client client.WithWatch, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
@@ -28,7 +27,7 @@ var _ = Describe("NewClient", func() {
 		_ = client.Get(ctx, types.NamespacedName{}, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the underlying client if the provided Get function is nil", func() {
+	It("should call the underlying client if the provided Get function is nil", func(ctx SpecContext) {
 		var called bool
 		client1 := NewClient(wrappedClient, Funcs{
 			Get: func(ctx context.Context, client client.WithWatch, key client.ObjectKey, obj client.Object, opts ...client.GetOption) error {
@@ -40,7 +39,7 @@ var _ = Describe("NewClient", func() {
 		_ = client2.Get(ctx, types.NamespacedName{}, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the provided List function", func() {
+	It("should call the provided List function", func(ctx SpecContext) {
 		var called bool
 		client := NewClient(wrappedClient, Funcs{
 			List: func(ctx context.Context, client client.WithWatch, list client.ObjectList, opts ...client.ListOption) error {
@@ -51,7 +50,7 @@ var _ = Describe("NewClient", func() {
 		_ = client.List(ctx, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the underlying client if the provided List function is nil", func() {
+	It("should call the underlying client if the provided List function is nil", func(ctx SpecContext) {
 		var called bool
 		client1 := NewClient(wrappedClient, Funcs{
 			List: func(ctx context.Context, client client.WithWatch, list client.ObjectList, opts ...client.ListOption) error {
@@ -63,7 +62,30 @@ var _ = Describe("NewClient", func() {
 		_ = client2.List(ctx, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the provided Create function", func() {
+	It("should call the provided Apply function", func(ctx SpecContext) {
+		var called bool
+		client := NewClient(wrappedClient, Funcs{
+			Apply: func(ctx context.Context, client client.WithWatch, obj runtime.ApplyConfiguration, opts ...client.ApplyOption) error {
+				called = true
+				return nil
+			},
+		})
+		_ = client.Apply(ctx, nil)
+		Expect(called).To(BeTrue())
+	})
+	It("should call the underlying client if the provided Apply function is nil", func(ctx SpecContext) {
+		var called bool
+		client1 := NewClient(wrappedClient, Funcs{
+			Apply: func(ctx context.Context, client client.WithWatch, obj runtime.ApplyConfiguration, opts ...client.ApplyOption) error {
+				called = true
+				return nil
+			},
+		})
+		client2 := NewClient(client1, Funcs{})
+		_ = client2.Apply(ctx, nil)
+		Expect(called).To(BeTrue())
+	})
+	It("should call the provided Create function", func(ctx SpecContext) {
 		var called bool
 		client := NewClient(wrappedClient, Funcs{
 			Create: func(ctx context.Context, client client.WithWatch, obj client.Object, opts ...client.CreateOption) error {
@@ -74,7 +96,7 @@ var _ = Describe("NewClient", func() {
 		_ = client.Create(ctx, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the underlying client if the provided Create function is nil", func() {
+	It("should call the underlying client if the provided Create function is nil", func(ctx SpecContext) {
 		var called bool
 		client1 := NewClient(wrappedClient, Funcs{
 			Create: func(ctx context.Context, client client.WithWatch, obj client.Object, opts ...client.CreateOption) error {
@@ -86,7 +108,7 @@ var _ = Describe("NewClient", func() {
 		_ = client2.Create(ctx, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the provided Delete function", func() {
+	It("should call the provided Delete function", func(ctx SpecContext) {
 		var called bool
 		client := NewClient(wrappedClient, Funcs{
 			Delete: func(ctx context.Context, client client.WithWatch, obj client.Object, opts ...client.DeleteOption) error {
@@ -97,7 +119,7 @@ var _ = Describe("NewClient", func() {
 		_ = client.Delete(ctx, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the underlying client if the provided Delete function is nil", func() {
+	It("should call the underlying client if the provided Delete function is nil", func(ctx SpecContext) {
 		var called bool
 		client1 := NewClient(wrappedClient, Funcs{
 			Delete: func(ctx context.Context, client client.WithWatch, obj client.Object, opts ...client.DeleteOption) error {
@@ -109,7 +131,7 @@ var _ = Describe("NewClient", func() {
 		_ = client2.Delete(ctx, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the provided DeleteAllOf function", func() {
+	It("should call the provided DeleteAllOf function", func(ctx SpecContext) {
 		var called bool
 		client := NewClient(wrappedClient, Funcs{
 			DeleteAllOf: func(ctx context.Context, client client.WithWatch, obj client.Object, opts ...client.DeleteAllOfOption) error {
@@ -120,7 +142,7 @@ var _ = Describe("NewClient", func() {
 		_ = client.DeleteAllOf(ctx, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the underlying client if the provided DeleteAllOf function is nil", func() {
+	It("should call the underlying client if the provided DeleteAllOf function is nil", func(ctx SpecContext) {
 		var called bool
 		client1 := NewClient(wrappedClient, Funcs{
 			DeleteAllOf: func(ctx context.Context, client client.WithWatch, obj client.Object, opts ...client.DeleteAllOfOption) error {
@@ -132,7 +154,7 @@ var _ = Describe("NewClient", func() {
 		_ = client2.DeleteAllOf(ctx, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the provided Update function", func() {
+	It("should call the provided Update function", func(ctx SpecContext) {
 		var called bool
 		client := NewClient(wrappedClient, Funcs{
 			Update: func(ctx context.Context, client client.WithWatch, obj client.Object, opts ...client.UpdateOption) error {
@@ -143,7 +165,7 @@ var _ = Describe("NewClient", func() {
 		_ = client.Update(ctx, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the underlying client if the provided Update function is nil", func() {
+	It("should call the underlying client if the provided Update function is nil", func(ctx SpecContext) {
 		var called bool
 		client1 := NewClient(wrappedClient, Funcs{
 			Update: func(ctx context.Context, client client.WithWatch, obj client.Object, opts ...client.UpdateOption) error {
@@ -155,7 +177,7 @@ var _ = Describe("NewClient", func() {
 		_ = client2.Update(ctx, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the provided Patch function", func() {
+	It("should call the provided Patch function", func(ctx SpecContext) {
 		var called bool
 		client := NewClient(wrappedClient, Funcs{
 			Patch: func(ctx context.Context, client client.WithWatch, obj client.Object, patch client.Patch, opts ...client.PatchOption) error {
@@ -166,7 +188,7 @@ var _ = Describe("NewClient", func() {
 		_ = client.Patch(ctx, nil, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the underlying client if the provided Patch function is nil", func() {
+	It("should call the underlying client if the provided Patch function is nil", func(ctx SpecContext) {
 		var called bool
 		client1 := NewClient(wrappedClient, Funcs{
 			Patch: func(ctx context.Context, client client.WithWatch, obj client.Object, patch client.Patch, opts ...client.PatchOption) error {
@@ -178,7 +200,7 @@ var _ = Describe("NewClient", func() {
 		_ = client2.Patch(ctx, nil, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the provided Watch function", func() {
+	It("should call the provided Watch function", func(ctx SpecContext) {
 		var called bool
 		client := NewClient(wrappedClient, Funcs{
 			Watch: func(ctx context.Context, client client.WithWatch, obj client.ObjectList, opts ...client.ListOption) (watch.Interface, error) {
@@ -189,7 +211,7 @@ var _ = Describe("NewClient", func() {
 		_, _ = client.Watch(ctx, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the underlying client if the provided Watch function is nil", func() {
+	It("should call the underlying client if the provided Watch function is nil", func(ctx SpecContext) {
 		var called bool
 		client1 := NewClient(wrappedClient, Funcs{
 			Watch: func(ctx context.Context, client client.WithWatch, obj client.ObjectList, opts ...client.ListOption) (watch.Interface, error) {
@@ -229,8 +251,7 @@ var _ = Describe("NewClient", func() {
 
 var _ = Describe("NewSubResourceClient", func() {
 	c := dummyClient{}
-	ctx := context.Background()
-	It("should call the provided Get function", func() {
+	It("should call the provided Get function", func(ctx SpecContext) {
 		var called bool
 		c := NewClient(c, Funcs{
 			SubResourceGet: func(_ context.Context, client client.Client, subResourceName string, obj, subResource client.Object, opts ...client.SubResourceGetOption) error {
@@ -242,7 +263,7 @@ var _ = Describe("NewSubResourceClient", func() {
 		_ = c.SubResource("foo").Get(ctx, nil, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the underlying client if the provided Get function is nil", func() {
+	It("should call the underlying client if the provided Get function is nil", func(ctx SpecContext) {
 		var called bool
 		client1 := NewClient(c, Funcs{
 			SubResourceGet: func(_ context.Context, client client.Client, subResourceName string, obj, subResource client.Object, opts ...client.SubResourceGetOption) error {
@@ -255,7 +276,7 @@ var _ = Describe("NewSubResourceClient", func() {
 		_ = client2.SubResource("foo").Get(ctx, nil, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the provided Update function", func() {
+	It("should call the provided Update function", func(ctx SpecContext) {
 		var called bool
 		client := NewClient(c, Funcs{
 			SubResourceUpdate: func(_ context.Context, client client.Client, subResourceName string, obj client.Object, opts ...client.SubResourceUpdateOption) error {
@@ -267,7 +288,7 @@ var _ = Describe("NewSubResourceClient", func() {
 		_ = client.SubResource("foo").Update(ctx, nil, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the underlying client if the provided Update function is nil", func() {
+	It("should call the underlying client if the provided Update function is nil", func(ctx SpecContext) {
 		var called bool
 		client1 := NewClient(c, Funcs{
 			SubResourceUpdate: func(_ context.Context, client client.Client, subResourceName string, obj client.Object, opts ...client.SubResourceUpdateOption) error {
@@ -280,7 +301,7 @@ var _ = Describe("NewSubResourceClient", func() {
 		_ = client2.SubResource("foo").Update(ctx, nil, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the provided Patch function", func() {
+	It("should call the provided Patch function", func(ctx SpecContext) {
 		var called bool
 		client := NewClient(c, Funcs{
 			SubResourcePatch: func(_ context.Context, client client.Client, subResourceName string, obj client.Object, patch client.Patch, opts ...client.SubResourcePatchOption) error {
@@ -292,7 +313,7 @@ var _ = Describe("NewSubResourceClient", func() {
 		_ = client.SubResource("foo").Patch(ctx, nil, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the underlying client if the provided Patch function is nil", func() {
+	It("should call the underlying client if the provided Patch function is nil", func(ctx SpecContext) {
 		var called bool
 		client1 := NewClient(c, Funcs{
 			SubResourcePatch: func(ctx context.Context, client client.Client, subResourceName string, obj client.Object, patch client.Patch, opts ...client.SubResourcePatchOption) error {
@@ -305,7 +326,7 @@ var _ = Describe("NewSubResourceClient", func() {
 		_ = client2.SubResource("foo").Patch(ctx, nil, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the provided Create function", func() {
+	It("should call the provided Create function", func(ctx SpecContext) {
 		var called bool
 		client := NewClient(c, Funcs{
 			SubResourceCreate: func(_ context.Context, client client.Client, subResourceName string, obj, subResource client.Object, opts ...client.SubResourceCreateOption) error {
@@ -317,7 +338,7 @@ var _ = Describe("NewSubResourceClient", func() {
 		_ = client.SubResource("foo").Create(ctx, nil, nil)
 		Expect(called).To(BeTrue())
 	})
-	It("should call the underlying client if the provided Create function is nil", func() {
+	It("should call the underlying client if the provided Create function is nil", func(ctx SpecContext) {
 		var called bool
 		client1 := NewClient(c, Funcs{
 			SubResourceCreate: func(_ context.Context, client client.Client, subResourceName string, obj, subResource client.Object, opts ...client.SubResourceCreateOption) error {
@@ -360,6 +381,10 @@ func (d dummyClient) Patch(ctx context.Context, obj client.Object, patch client.
 	return nil
 }
 
+func (d dummyClient) Apply(ctx context.Context, obj runtime.ApplyConfiguration, opts ...client.ApplyOption) error {
+	return nil
+}
+
 func (d dummyClient) DeleteAllOf(ctx context.Context, obj client.Object, opts ...client.DeleteAllOfOption) error {
 	return nil
 }
diff --git a/pkg/client/interfaces.go b/pkg/client/interfaces.go
index 3cd745e4c0..61559ecbe1 100644
--- a/pkg/client/interfaces.go
+++ b/pkg/client/interfaces.go
@@ -61,6 +61,9 @@ type Reader interface {
 
 // Writer knows how to create, delete, and update Kubernetes objects.
 type Writer interface {
+	// Apply applies the given apply configuration to the Kubernetes cluster.
+	Apply(ctx context.Context, obj runtime.ApplyConfiguration, opts ...ApplyOption) error
+
 	// Create saves the object obj in the Kubernetes cluster. obj must be a
 	// struct pointer so that obj can be updated with the content returned by the Server.
 	Create(ctx context.Context, obj Object, opts ...CreateOption) error
@@ -94,16 +97,16 @@ type SubResourceClientConstructor interface {
 	// - ServiceAccount token creation:
 	//     sa := &corev1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Namespace: "foo", Name: "bar"}}
 	//     token := &authenticationv1.TokenRequest{}
-	//     c.SubResourceClient("token").Create(ctx, sa, token)
+	//     c.SubResource("token").Create(ctx, sa, token)
 	//
 	// - Pod eviction creation:
 	//     pod := &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Namespace: "foo", Name: "bar"}}
-	//     c.SubResourceClient("eviction").Create(ctx, pod, &policyv1.Eviction{})
+	//     c.SubResource("eviction").Create(ctx, pod, &policyv1.Eviction{})
 	//
 	// - Pod binding creation:
 	//     pod := &corev1.Pod{ObjectMeta: metav1.ObjectMeta{Namespace: "foo", Name: "bar"}}
 	//     binding := &corev1.Binding{Target: corev1.ObjectReference{Name: "my-node"}}
-	//     c.SubResourceClient("binding").Create(ctx, pod, binding)
+	//     c.SubResource("binding").Create(ctx, pod, binding)
 	//
 	// - CertificateSigningRequest approval:
 	//     csr := &certificatesv1.CertificateSigningRequest{
@@ -115,17 +118,17 @@ type SubResourceClientConstructor interface {
 	//         }},
 	//       },
 	//     }
-	//     c.SubResourceClient("approval").Update(ctx, csr)
+	//     c.SubResource("approval").Update(ctx, csr)
 	//
 	// - Scale retrieval:
 	//     dep := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Namespace: "foo", Name: "bar"}}
 	//     scale := &autoscalingv1.Scale{}
-	//     c.SubResourceClient("scale").Get(ctx, dep, scale)
+	//     c.SubResource("scale").Get(ctx, dep, scale)
 	//
 	// - Scale update:
 	//     dep := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Namespace: "foo", Name: "bar"}}
 	//     scale := &autoscalingv1.Scale{Spec: autoscalingv1.ScaleSpec{Replicas: 2}}
-	//     c.SubResourceClient("scale").Update(ctx, dep, client.WithSubResourceBody(scale))
+	//     c.SubResource("scale").Update(ctx, dep, client.WithSubResourceBody(scale))
 	SubResource(subResource string) SubResourceClient
 }
 
@@ -193,7 +196,7 @@ type IndexerFunc func(Object) []string
 // FieldIndexer knows how to index over a particular "field" such that it
 // can later be used by a field selector.
 type FieldIndexer interface {
-	// IndexFields adds an index with the given field name on the given object type
+	// IndexField adds an index with the given field name on the given object type
 	// by using the given function to extract the value for that field.  If you want
 	// compatibility with the Kubernetes API server, only return one key, and only use
 	// fields that the API server supports.  Otherwise, you can return multiple keys,
diff --git a/pkg/client/namespaced_client.go b/pkg/client/namespaced_client.go
index 222dc79579..cacba4a9c6 100644
--- a/pkg/client/namespaced_client.go
+++ b/pkg/client/namespaced_client.go
@@ -19,10 +19,13 @@ package client
 import (
 	"context"
 	"fmt"
+	"reflect"
 
 	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
 )
 
 // NewNamespacedClient wraps an existing client enforcing the namespace value.
@@ -147,6 +150,52 @@ func (n *namespacedClient) Patch(ctx context.Context, obj Object, patch Patch, o
 	return n.client.Patch(ctx, obj, patch, opts...)
 }
 
+func (n *namespacedClient) Apply(ctx context.Context, obj runtime.ApplyConfiguration, opts ...ApplyOption) error {
+	var gvk schema.GroupVersionKind
+	switch o := obj.(type) {
+	case applyConfiguration:
+		var err error
+		gvk, err = gvkFromApplyConfiguration(o)
+		if err != nil {
+			return err
+		}
+	case *unstructuredApplyConfiguration:
+		gvk = o.GroupVersionKind()
+	default:
+		return fmt.Errorf("object %T is not a valid apply configuration", obj)
+	}
+	isNamespaceScoped, err := apiutil.IsGVKNamespaced(gvk, n.RESTMapper())
+	if err != nil {
+		return fmt.Errorf("error finding the scope of the object: %w", err)
+	}
+	if isNamespaceScoped {
+		switch o := obj.(type) {
+		case applyConfiguration:
+			if o.GetNamespace() != nil && *o.GetNamespace() != "" && *o.GetNamespace() != n.namespace {
+				return fmt.Errorf("namespace %s provided for the object %s does not match the namespace %s on the client",
+					*o.GetNamespace(), ptr.Deref(o.GetName(), ""), n.namespace)
+			}
+			v := reflect.ValueOf(o)
+			withNamespace := v.MethodByName("WithNamespace")
+			if !withNamespace.IsValid() {
+				return fmt.Errorf("ApplyConfiguration %T does not have a WithNamespace method", o)
+			}
+			if tp := withNamespace.Type(); tp.NumIn() != 1 || tp.In(0).Kind() != reflect.String {
+				return fmt.Errorf("WithNamespace method of ApplyConfiguration %T must take a single string argument", o)
+			}
+			withNamespace.Call([]reflect.Value{reflect.ValueOf(n.namespace)})
+		case *unstructuredApplyConfiguration:
+			if o.GetNamespace() != "" && o.GetNamespace() != n.namespace {
+				return fmt.Errorf("namespace %s provided for the object %s does not match the namespace %s on the client",
+					o.GetNamespace(), o.GetName(), n.namespace)
+			}
+			o.SetNamespace(n.namespace)
+		}
+	}
+
+	return n.client.Apply(ctx, obj, opts...)
+}
+
 // Get implements client.Client.
 func (n *namespacedClient) Get(ctx context.Context, key ObjectKey, obj Object, opts ...GetOption) error {
 	isNamespaceScoped, err := n.IsObjectNamespaced(obj)
diff --git a/pkg/client/namespaced_client_test.go b/pkg/client/namespaced_client_test.go
index 6e1c2641a3..cf28289e72 100644
--- a/pkg/client/namespaced_client_test.go
+++ b/pkg/client/namespaced_client_test.go
@@ -25,21 +25,26 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
-	rbacv1 "k8s.io/api/rbac/v1"
-
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
+	appsv1applyconfigurations "k8s.io/client-go/applyconfigurations/apps/v1"
+	corev1applyconfigurations "k8s.io/client-go/applyconfigurations/core/v1"
+	metav1applyconfigurations "k8s.io/client-go/applyconfigurations/meta/v1"
+	rbacv1applyconfigurations "k8s.io/client-go/applyconfigurations/rbac/v1"
+
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 var _ = Describe("NamespacedClient", func() {
 	var dep *appsv1.Deployment
+	var acDep *appsv1applyconfigurations.DeploymentApplyConfiguration
 	var ns = "default"
-	ctx := context.Background()
 	var count uint64 = 0
 	var replicaCount int32 = 2
 
@@ -75,20 +80,36 @@ var _ = Describe("NamespacedClient", func() {
 				},
 			},
 		}
+		acDep = appsv1applyconfigurations.Deployment(dep.Name, "").
+			WithLabels(dep.Labels).
+			WithSpec(appsv1applyconfigurations.DeploymentSpec().
+				WithReplicas(*dep.Spec.Replicas).
+				WithSelector(metav1applyconfigurations.LabelSelector().WithMatchLabels(dep.Spec.Selector.MatchLabels)).
+				WithTemplate(corev1applyconfigurations.PodTemplateSpec().
+					WithLabels(dep.Spec.Template.Labels).
+					WithSpec(corev1applyconfigurations.PodSpec().
+						WithContainers(corev1applyconfigurations.Container().
+							WithName(dep.Spec.Template.Spec.Containers[0].Name).
+							WithImage(dep.Spec.Template.Spec.Containers[0].Image),
+						),
+					),
+				),
+			)
+
 	})
 
 	Describe("Get", func() {
-
-		BeforeEach(func() {
+		BeforeEach(func(ctx SpecContext) {
 			var err error
 			dep, err = clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 			Expect(err).NotTo(HaveOccurred())
 		})
 
-		AfterEach(func() {
+		AfterEach(func(ctx SpecContext) {
 			deleteDeployment(ctx, dep, ns)
 		})
-		It("should successfully Get a namespace-scoped object", func() {
+
+		It("should successfully Get a namespace-scoped object", func(ctx SpecContext) {
 			name := types.NamespacedName{Name: dep.Name}
 			result := &appsv1.Deployment{}
 
@@ -97,7 +118,7 @@ var _ = Describe("NamespacedClient", func() {
 		})
 
 		It("should error when namespace provided in the object is different than the one "+
-			"specified in client", func() {
+			"specified in client", func(ctx SpecContext) {
 			name := types.NamespacedName{Name: dep.Name, Namespace: "non-default"}
 			result := &appsv1.Deployment{}
 
@@ -106,17 +127,17 @@ var _ = Describe("NamespacedClient", func() {
 	})
 
 	Describe("List", func() {
-		BeforeEach(func() {
+		BeforeEach(func(ctx SpecContext) {
 			var err error
 			dep, err = clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 			Expect(err).NotTo(HaveOccurred())
 		})
 
-		AfterEach(func() {
+		AfterEach(func(ctx SpecContext) {
 			deleteDeployment(ctx, dep, ns)
 		})
 
-		It("should successfully List objects when namespace is not specified with the object", func() {
+		It("should successfully List objects when namespace is not specified with the object", func(ctx SpecContext) {
 			result := &appsv1.DeploymentList{}
 			opts := client.MatchingLabels(dep.Labels)
 
@@ -125,7 +146,7 @@ var _ = Describe("NamespacedClient", func() {
 			Expect(result.Items[0]).To(BeEquivalentTo(*dep))
 		})
 
-		It("should List objects from the namespace specified in the client", func() {
+		It("should List objects from the namespace specified in the client", func(ctx SpecContext) {
 			result := &appsv1.DeploymentList{}
 			opts := client.InNamespace("non-default")
 
@@ -135,12 +156,72 @@ var _ = Describe("NamespacedClient", func() {
 		})
 	})
 
+	Describe("Apply", func() {
+		AfterEach(func(ctx SpecContext) {
+			deleteDeployment(ctx, dep, ns)
+		})
+
+		It("should successfully apply an object in the right namespace", func(ctx SpecContext) {
+			err := getClient().Apply(ctx, acDep, client.FieldOwner("test"))
+			Expect(err).NotTo(HaveOccurred())
+
+			res, err := clientset.AppsV1().Deployments(ns).Get(ctx, dep.Name, metav1.GetOptions{})
+			Expect(err).NotTo(HaveOccurred())
+			Expect(res.GetNamespace()).To(BeEquivalentTo(ns))
+		})
+
+		It("should successfully apply an object in the right namespace through unstructured", func(ctx SpecContext) {
+			serialized, err := json.Marshal(acDep)
+			Expect(err).NotTo(HaveOccurred())
+			u := &unstructured.Unstructured{}
+			Expect(json.Unmarshal(serialized, &u.Object)).To(Succeed())
+			err = getClient().Apply(ctx, client.ApplyConfigurationFromUnstructured(u), client.FieldOwner("test"))
+			Expect(err).NotTo(HaveOccurred())
+
+			res, err := clientset.AppsV1().Deployments(ns).Get(ctx, dep.Name, metav1.GetOptions{})
+			Expect(err).NotTo(HaveOccurred())
+			Expect(res.GetNamespace()).To(BeEquivalentTo(ns))
+		})
+
+		It("should not create an object if the namespace of the object is different", func(ctx SpecContext) {
+			acDep.WithNamespace("non-default")
+			err := getClient().Apply(ctx, acDep, client.FieldOwner("test"))
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("does not match the namespace"))
+		})
+
+		It("should not create an object through unstructured if the namespace of the object is different", func(ctx SpecContext) {
+			acDep.WithNamespace("non-default")
+			serialized, err := json.Marshal(acDep)
+			Expect(err).NotTo(HaveOccurred())
+			u := &unstructured.Unstructured{}
+			Expect(json.Unmarshal(serialized, &u.Object)).To(Succeed())
+			err = getClient().Apply(ctx, client.ApplyConfigurationFromUnstructured(u), client.FieldOwner("test"))
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("does not match the namespace"))
+		})
+
+		It("should create a cluster scoped object", func(ctx SpecContext) {
+			cr := rbacv1applyconfigurations.ClusterRole(fmt.Sprintf("clusterRole-%v", count))
+
+			err := getClient().Apply(ctx, cr, client.FieldOwner("test"))
+			Expect(err).NotTo(HaveOccurred())
+
+			By("checking if the object was created")
+			res, err := clientset.RbacV1().ClusterRoles().Get(ctx, *cr.Name, metav1.GetOptions{})
+			Expect(err).NotTo(HaveOccurred())
+			Expect(res).NotTo(BeNil())
+
+			deleteClusterRole(ctx, &rbacv1.ClusterRole{ObjectMeta: metav1.ObjectMeta{Name: *cr.Name}})
+		})
+	})
+
 	Describe("Create", func() {
-		AfterEach(func() {
+		AfterEach(func(ctx SpecContext) {
 			deleteDeployment(ctx, dep, ns)
 		})
 
-		It("should successfully create object in the right namespace", func() {
+		It("should successfully create object in the right namespace", func(ctx SpecContext) {
 			By("creating the object initially")
 			err := getClient().Create(ctx, dep)
 			Expect(err).NotTo(HaveOccurred())
@@ -151,13 +232,13 @@ var _ = Describe("NamespacedClient", func() {
 			Expect(res.GetNamespace()).To(BeEquivalentTo(ns))
 		})
 
-		It("should not create object if the namespace of the object is different", func() {
+		It("should not create object if the namespace of the object is different", func(ctx SpecContext) {
 			By("creating the object initially")
 			dep.SetNamespace("non-default")
 			err := getClient().Create(ctx, dep)
 			Expect(err).To(HaveOccurred())
 		})
-		It("should create a cluster scoped object", func() {
+		It("should create a cluster scoped object", func(ctx SpecContext) {
 			cr := &rbacv1.ClusterRole{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:   fmt.Sprintf("clusterRole-%v", count),
@@ -186,16 +267,16 @@ var _ = Describe("NamespacedClient", func() {
 
 	Describe("Update", func() {
 		var err error
-		BeforeEach(func() {
+		BeforeEach(func(ctx SpecContext) {
 			dep, err = clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 			dep.Annotations = map[string]string{"foo": "bar"}
 			Expect(err).NotTo(HaveOccurred())
 		})
-		AfterEach(func() {
+		AfterEach(func(ctx SpecContext) {
 			deleteDeployment(ctx, dep, ns)
 		})
 
-		It("should successfully update the provided object", func() {
+		It("should successfully update the provided object", func(ctx SpecContext) {
 			By("updating the Deployment")
 			err = getClient().Update(ctx, dep)
 			Expect(err).NotTo(HaveOccurred())
@@ -208,7 +289,7 @@ var _ = Describe("NamespacedClient", func() {
 			Expect(actual.Annotations["foo"]).To(Equal("bar"))
 		})
 
-		It("should successfully update the provided object when namespace is not provided", func() {
+		It("should successfully update the provided object when namespace is not provided", func(ctx SpecContext) {
 			By("updating the Deployment")
 			dep.SetNamespace("")
 			err = getClient().Update(ctx, dep)
@@ -222,14 +303,14 @@ var _ = Describe("NamespacedClient", func() {
 			Expect(actual.Annotations["foo"]).To(Equal("bar"))
 		})
 
-		It("should not update when object namespace is different", func() {
+		It("should not update when object namespace is different", func(ctx SpecContext) {
 			By("updating the Deployment")
 			dep.SetNamespace("non-default")
 			err = getClient().Update(ctx, dep)
 			Expect(err).To(HaveOccurred())
 		})
 
-		It("should not update any object from other namespace", func() {
+		It("should not update any object from other namespace", func(ctx SpecContext) {
 			By("creating a new namespace")
 			tns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "non-default-1"}}
 			_, err := clientset.CoreV1().Namespaces().Create(ctx, tns, metav1.CreateOptions{})
@@ -266,7 +347,7 @@ var _ = Describe("NamespacedClient", func() {
 			deleteNamespace(ctx, tns)
 		})
 
-		It("should update a cluster scoped resource", func() {
+		It("should update a cluster scoped resource", func(ctx SpecContext) {
 			changedCR := &rbacv1.ClusterRole{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:   fmt.Sprintf("clusterRole-%v", count),
@@ -302,16 +383,16 @@ var _ = Describe("NamespacedClient", func() {
 
 	Describe("Patch", func() {
 		var err error
-		BeforeEach(func() {
+		BeforeEach(func(ctx SpecContext) {
 			dep, err = clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 			Expect(err).NotTo(HaveOccurred())
 		})
 
-		AfterEach(func() {
+		AfterEach(func(ctx SpecContext) {
 			deleteDeployment(ctx, dep, ns)
 		})
 
-		It("should successfully modify the object using Patch", func() {
+		It("should successfully modify the object using Patch", func(ctx SpecContext) {
 			By("Applying Patch")
 			err = getClient().Patch(ctx, dep, client.RawPatch(types.MergePatchType, generatePatch()))
 			Expect(err).NotTo(HaveOccurred())
@@ -323,7 +404,7 @@ var _ = Describe("NamespacedClient", func() {
 			Expect(actual.GetNamespace()).To(Equal(ns))
 		})
 
-		It("should successfully modify the object using Patch when namespace is not provided", func() {
+		It("should successfully modify the object using Patch when namespace is not provided", func(ctx SpecContext) {
 			By("Applying Patch")
 			dep.SetNamespace("")
 			err = getClient().Patch(ctx, dep, client.RawPatch(types.MergePatchType, generatePatch()))
@@ -336,13 +417,13 @@ var _ = Describe("NamespacedClient", func() {
 			Expect(actual.GetNamespace()).To(Equal(ns))
 		})
 
-		It("should not modify the object when namespace of the object is different", func() {
+		It("should not modify the object when namespace of the object is different", func(ctx SpecContext) {
 			dep.SetNamespace("non-default")
 			err = getClient().Patch(ctx, dep, client.RawPatch(types.MergePatchType, generatePatch()))
 			Expect(err).To(HaveOccurred())
 		})
 
-		It("should not modify an object from a different namespace", func() {
+		It("should not modify an object from a different namespace", func(ctx SpecContext) {
 			By("creating a new namespace")
 			tns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "non-default-2"}}
 			_, err := clientset.CoreV1().Namespaces().Create(ctx, tns, metav1.CreateOptions{})
@@ -377,7 +458,7 @@ var _ = Describe("NamespacedClient", func() {
 			deleteNamespace(ctx, tns)
 		})
 
-		It("should successfully modify cluster scoped resource", func() {
+		It("should successfully modify cluster scoped resource", func(ctx SpecContext) {
 			cr := &rbacv1.ClusterRole{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:   fmt.Sprintf("clusterRole-%v", count),
@@ -411,15 +492,15 @@ var _ = Describe("NamespacedClient", func() {
 
 	Describe("Delete and DeleteAllOf", func() {
 		var err error
-		BeforeEach(func() {
+		BeforeEach(func(ctx SpecContext) {
 			dep, err = clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 			Expect(err).NotTo(HaveOccurred())
 		})
 
-		AfterEach(func() {
+		AfterEach(func(ctx SpecContext) {
 			deleteDeployment(ctx, dep, ns)
 		})
-		It("should successfully delete an object when namespace is not specified", func() {
+		It("should successfully delete an object when namespace is not specified", func(ctx SpecContext) {
 			By("deleting the object")
 			dep.SetNamespace("")
 			err = getClient().Delete(ctx, dep)
@@ -430,7 +511,7 @@ var _ = Describe("NamespacedClient", func() {
 			Expect(err).To(HaveOccurred())
 		})
 
-		It("should successfully delete all of the deployments in the given namespace", func() {
+		It("should successfully delete all of the deployments in the given namespace", func(ctx SpecContext) {
 			By("Deleting all objects in the namespace")
 			err = getClient().DeleteAllOf(ctx, dep)
 			Expect(err).NotTo(HaveOccurred())
@@ -440,7 +521,7 @@ var _ = Describe("NamespacedClient", func() {
 			Expect(err).To(HaveOccurred())
 		})
 
-		It("should not delete deployments in other namespaces", func() {
+		It("should not delete deployments in other namespaces", func(ctx SpecContext) {
 			tns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "non-default-3"}}
 			_, err = clientset.CoreV1().Namespaces().Create(ctx, tns, metav1.CreateOptions{})
 			Expect(err).NotTo(HaveOccurred())
@@ -482,16 +563,16 @@ var _ = Describe("NamespacedClient", func() {
 
 	Describe("SubResourceWriter", func() {
 		var err error
-		BeforeEach(func() {
+		BeforeEach(func(ctx SpecContext) {
 			dep, err = clientset.AppsV1().Deployments(ns).Create(ctx, dep, metav1.CreateOptions{})
 			Expect(err).NotTo(HaveOccurred())
 		})
 
-		AfterEach(func() {
+		AfterEach(func(ctx SpecContext) {
 			deleteDeployment(ctx, dep, ns)
 		})
 
-		It("should change objects via update status", func() {
+		It("should change objects via update status", func(ctx SpecContext) {
 			changedDep := dep.DeepCopy()
 			changedDep.Status.Replicas = 99
 
@@ -504,7 +585,7 @@ var _ = Describe("NamespacedClient", func() {
 			Expect(actual.Status.Replicas).To(BeEquivalentTo(99))
 		})
 
-		It("should not change objects via update status when object namespace is different", func() {
+		It("should not change objects via update status when object namespace is different", func(ctx SpecContext) {
 			changedDep := dep.DeepCopy()
 			changedDep.SetNamespace("test")
 			changedDep.Status.Replicas = 99
@@ -512,7 +593,7 @@ var _ = Describe("NamespacedClient", func() {
 			Expect(getClient().SubResource("status").Update(ctx, changedDep)).To(HaveOccurred())
 		})
 
-		It("should change objects via status patch", func() {
+		It("should change objects via status patch", func(ctx SpecContext) {
 			changedDep := dep.DeepCopy()
 			changedDep.Status.Replicas = 99
 
@@ -525,7 +606,7 @@ var _ = Describe("NamespacedClient", func() {
 			Expect(actual.Status.Replicas).To(BeEquivalentTo(99))
 		})
 
-		It("should not change objects via status patch when object namespace is different", func() {
+		It("should not change objects via status patch when object namespace is different", func(ctx SpecContext) {
 			changedDep := dep.DeepCopy()
 			changedDep.Status.Replicas = 99
 			changedDep.SetNamespace("test")
@@ -535,7 +616,7 @@ var _ = Describe("NamespacedClient", func() {
 	})
 
 	Describe("Test on invalid objects", func() {
-		It("should refuse to perform operations on invalid object", func() {
+		It("should refuse to perform operations on invalid object", func(ctx SpecContext) {
 			err := getClient().Create(ctx, nil)
 			Expect(err).To(HaveOccurred())
 
diff --git a/pkg/client/options.go b/pkg/client/options.go
index db50ed8feb..33c460738c 100644
--- a/pkg/client/options.go
+++ b/pkg/client/options.go
@@ -21,6 +21,7 @@ import (
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/selection"
+	"k8s.io/utils/ptr"
 )
 
 // {{{ "Functional" Option Interfaces
@@ -61,6 +62,12 @@ type PatchOption interface {
 	ApplyToPatch(*PatchOptions)
 }
 
+// ApplyOption is some configuration that modifies options for an apply request.
+type ApplyOption interface {
+	// ApplyToApply applies this configuration to the given apply options.
+	ApplyToApply(*ApplyOptions)
+}
+
 // DeleteAllOfOption is some configuration that modifies options for a delete request.
 type DeleteAllOfOption interface {
 	// ApplyToDeleteAllOf applies this configuration to the given deletecollection options.
@@ -115,7 +122,12 @@ func (dryRunAll) ApplyToPatch(opts *PatchOptions) {
 	opts.DryRun = []string{metav1.DryRunAll}
 }
 
-// ApplyToPatch applies this configuration to the given delete options.
+// ApplyToApply applies this configuration to the given apply options.
+func (dryRunAll) ApplyToApply(opts *ApplyOptions) {
+	opts.DryRun = []string{metav1.DryRunAll}
+}
+
+// ApplyToDelete applies this configuration to the given delete options.
 func (dryRunAll) ApplyToDelete(opts *DeleteOptions) {
 	opts.DryRun = []string{metav1.DryRunAll}
 }
@@ -154,6 +166,11 @@ func (f FieldOwner) ApplyToUpdate(opts *UpdateOptions) {
 	opts.FieldManager = string(f)
 }
 
+// ApplyToApply applies this configuration to the given apply options.
+func (f FieldOwner) ApplyToApply(opts *ApplyOptions) {
+	opts.FieldManager = string(f)
+}
+
 // ApplyToSubResourcePatch applies this configuration to the given patch options.
 func (f FieldOwner) ApplyToSubResourcePatch(opts *SubResourcePatchOptions) {
 	opts.FieldManager = string(f)
@@ -431,6 +448,12 @@ type GetOptions struct {
 	// Raw represents raw GetOptions, as passed to the API server.  Note
 	// that these may not be respected by all implementations of interface.
 	Raw *metav1.GetOptions
+
+	// UnsafeDisableDeepCopy indicates not to deep copy objects during get object.
+	// Be very careful with this, when enabled you must DeepCopy any object before mutating it,
+	// otherwise you will mutate the object in the cache.
+	// +optional
+	UnsafeDisableDeepCopy *bool
 }
 
 var _ GetOption = &GetOptions{}
@@ -440,6 +463,9 @@ func (o *GetOptions) ApplyToGet(lo *GetOptions) {
 	if o.Raw != nil {
 		lo.Raw = o.Raw
 	}
+	if o.UnsafeDisableDeepCopy != nil {
+		lo.UnsafeDisableDeepCopy = o.UnsafeDisableDeepCopy
+	}
 }
 
 // AsGetOptions returns these options as a flattened metav1.GetOptions.
@@ -618,6 +644,9 @@ type MatchingLabelsSelector struct {
 
 // ApplyToList applies this configuration to the given list options.
 func (m MatchingLabelsSelector) ApplyToList(opts *ListOptions) {
+	if m.Selector == nil {
+		m.Selector = labels.Nothing()
+	}
 	opts.LabelSelector = m
 }
 
@@ -651,6 +680,9 @@ type MatchingFieldsSelector struct {
 
 // ApplyToList applies this configuration to the given list options.
 func (m MatchingFieldsSelector) ApplyToList(opts *ListOptions) {
+	if m.Selector == nil {
+		m.Selector = fields.Nothing()
+	}
 	opts.FieldSelector = m
 }
 
@@ -692,15 +724,14 @@ func (l Limit) ApplyToList(opts *ListOptions) {
 // otherwise you will mutate the object in the cache.
 type UnsafeDisableDeepCopyOption bool
 
+// ApplyToGet applies this configuration to the given an Get options.
+func (d UnsafeDisableDeepCopyOption) ApplyToGet(opts *GetOptions) {
+	opts.UnsafeDisableDeepCopy = ptr.To(bool(d))
+}
+
 // ApplyToList applies this configuration to the given an List options.
 func (d UnsafeDisableDeepCopyOption) ApplyToList(opts *ListOptions) {
-	definitelyTrue := true
-	definitelyFalse := false
-	if d {
-		opts.UnsafeDisableDeepCopy = &definitelyTrue
-	} else {
-		opts.UnsafeDisableDeepCopy = &definitelyFalse
-	}
+	opts.UnsafeDisableDeepCopy = ptr.To(bool(d))
 }
 
 // UnsafeDisableDeepCopy indicates not to deep copy objects during list objects.
@@ -863,10 +894,18 @@ func (o *PatchOptions) AsPatchOptions() *metav1.PatchOptions {
 		o.Raw = &metav1.PatchOptions{}
 	}
 
-	o.Raw.DryRun = o.DryRun
-	o.Raw.Force = o.Force
-	o.Raw.FieldManager = o.FieldManager
-	o.Raw.FieldValidation = o.FieldValidation
+	if o.DryRun != nil {
+		o.Raw.DryRun = o.DryRun
+	}
+	if o.Force != nil {
+		o.Raw.Force = o.Force
+	}
+	if o.FieldManager != "" {
+		o.Raw.FieldManager = o.FieldManager
+	}
+	if o.FieldValidation != "" {
+		o.Raw.FieldValidation = o.FieldValidation
+	}
 	return o.Raw
 }
 
@@ -899,13 +938,15 @@ var ForceOwnership = forceOwnership{}
 type forceOwnership struct{}
 
 func (forceOwnership) ApplyToPatch(opts *PatchOptions) {
-	definitelyTrue := true
-	opts.Force = &definitelyTrue
+	opts.Force = ptr.To(true)
 }
 
 func (forceOwnership) ApplyToSubResourcePatch(opts *SubResourcePatchOptions) {
-	definitelyTrue := true
-	opts.Force = &definitelyTrue
+	opts.Force = ptr.To(true)
+}
+
+func (forceOwnership) ApplyToApply(opts *ApplyOptions) {
+	opts.Force = ptr.To(true)
 }
 
 // }}}
@@ -939,3 +980,57 @@ func (o *DeleteAllOfOptions) ApplyToDeleteAllOf(do *DeleteAllOfOptions) {
 }
 
 // }}}
+
+// ApplyOptions are the options for an apply request.
+type ApplyOptions struct {
+	// When present, indicates that modifications should not be
+	// persisted. An invalid or unrecognized dryRun directive will
+	// result in an error response and no further processing of the
+	// request. Valid values are:
+	// - All: all dry run stages will be processed
+	DryRun []string
+
+	// Force is going to "force" Apply requests. It means user will
+	// re-acquire conflicting fields owned by other people.
+	Force *bool
+
+	// fieldManager is a name associated with the actor or entity
+	// that is making these changes. The value must be less than or
+	// 128 characters long, and only contain printable characters,
+	// as defined by https://golang.org/pkg/unicode/#IsPrint. This
+	// field is required.
+	//
+	// +required
+	FieldManager string
+}
+
+// ApplyOptions applies the given opts onto the ApplyOptions
+func (o *ApplyOptions) ApplyOptions(opts []ApplyOption) *ApplyOptions {
+	for _, opt := range opts {
+		opt.ApplyToApply(o)
+	}
+	return o
+}
+
+// ApplyToApply applies the given opts onto the ApplyOptions
+func (o *ApplyOptions) ApplyToApply(opts *ApplyOptions) {
+	if o.DryRun != nil {
+		opts.DryRun = o.DryRun
+	}
+	if o.Force != nil {
+		opts.Force = o.Force
+	}
+
+	if o.FieldManager != "" {
+		opts.FieldManager = o.FieldManager
+	}
+}
+
+// AsPatchOptions constructs patch options from the given ApplyOptions
+func (o *ApplyOptions) AsPatchOptions() *metav1.PatchOptions {
+	return &metav1.PatchOptions{
+		DryRun:       o.DryRun,
+		Force:        o.Force,
+		FieldManager: o.FieldManager,
+	}
+}
diff --git a/pkg/client/options_test.go b/pkg/client/options_test.go
index c6dc09b676..0aa6a74007 100644
--- a/pkg/client/options_test.go
+++ b/pkg/client/options_test.go
@@ -36,12 +36,38 @@ var _ = Describe("ListOptions", func() {
 		o.ApplyToList(newListOpts)
 		Expect(newListOpts).To(Equal(o))
 	})
+	It("Should set LabelSelector with MatchingLabelsSelector", func() {
+		labelSelector, err := labels.Parse("a=b")
+		Expect(err).NotTo(HaveOccurred())
+		newListOpts := &client.ListOptions{}
+		newListOpts.ApplyOptions([]client.ListOption{client.MatchingLabelsSelector{Selector: labelSelector}})
+		expectedListOpts := &client.ListOptions{LabelSelector: client.MatchingLabelsSelector{Selector: labelSelector}}
+		Expect(newListOpts).To(Equal(expectedListOpts))
+	})
+	It("Should set LabelSelector to nothing with empty MatchingLabelsSelector", func() {
+		newListOpts := &client.ListOptions{}
+		newListOpts.ApplyOptions([]client.ListOption{client.MatchingLabelsSelector{}})
+		expectedListOpts := &client.ListOptions{LabelSelector: client.MatchingLabelsSelector{Selector: labels.Nothing()}}
+		Expect(newListOpts).To(Equal(expectedListOpts))
+	})
 	It("Should set FieldSelector", func() {
 		o := &client.ListOptions{FieldSelector: fields.Nothing()}
 		newListOpts := &client.ListOptions{}
 		o.ApplyToList(newListOpts)
 		Expect(newListOpts).To(Equal(o))
 	})
+	It("Should set FieldSelector with MatchingFieldsSelector", func() {
+		newListOpts := &client.ListOptions{}
+		newListOpts.ApplyOptions([]client.ListOption{client.MatchingFieldsSelector{Selector: fields.Nothing()}})
+		expectedListOpts := &client.ListOptions{FieldSelector: client.MatchingFieldsSelector{Selector: fields.Nothing()}}
+		Expect(newListOpts).To(Equal(expectedListOpts))
+	})
+	It("Should set FieldSelector to nothing with empty MatchingFieldsSelector", func() {
+		newListOpts := &client.ListOptions{}
+		newListOpts.ApplyOptions([]client.ListOption{client.MatchingFieldsSelector{}})
+		expectedListOpts := &client.ListOptions{FieldSelector: client.MatchingFieldsSelector{Selector: fields.Nothing()}}
+		Expect(newListOpts).To(Equal(expectedListOpts))
+	})
 	It("Should set Namespace", func() {
 		o := &client.ListOptions{Namespace: "my-ns"}
 		newListOpts := &client.ListOptions{}
@@ -66,6 +92,19 @@ var _ = Describe("ListOptions", func() {
 		o.ApplyToList(newListOpts)
 		Expect(newListOpts).To(Equal(o))
 	})
+	It("Should set UnsafeDisableDeepCopy", func() {
+		definitelyTrue := true
+		o := &client.ListOptions{UnsafeDisableDeepCopy: &definitelyTrue}
+		newListOpts := &client.ListOptions{}
+		o.ApplyToList(newListOpts)
+		Expect(newListOpts).To(Equal(o))
+	})
+	It("Should set UnsafeDisableDeepCopy through option", func() {
+		listOpts := &client.ListOptions{}
+		client.UnsafeDisableDeepCopy.ApplyToList(listOpts)
+		Expect(listOpts.UnsafeDisableDeepCopy).ToNot(BeNil())
+		Expect(*listOpts.UnsafeDisableDeepCopy).To(BeTrue())
+	})
 	It("Should not set anything", func() {
 		o := &client.ListOptions{}
 		newListOpts := &client.ListOptions{}
@@ -81,6 +120,40 @@ var _ = Describe("GetOptions", func() {
 		o.ApplyToGet(newGetOpts)
 		Expect(newGetOpts).To(Equal(o))
 	})
+	It("Should set UnsafeDisableDeepCopy", func() {
+		definitelyTrue := true
+		o := &client.GetOptions{UnsafeDisableDeepCopy: &definitelyTrue}
+		newGetOpts := &client.GetOptions{}
+		o.ApplyToGet(newGetOpts)
+		Expect(newGetOpts).To(Equal(o))
+	})
+	It("Should set UnsafeDisableDeepCopy through option", func() {
+		getOpts := &client.GetOptions{}
+		client.UnsafeDisableDeepCopy.ApplyToGet(getOpts)
+		Expect(getOpts.UnsafeDisableDeepCopy).ToNot(BeNil())
+		Expect(*getOpts.UnsafeDisableDeepCopy).To(BeTrue())
+	})
+})
+
+var _ = Describe("ApplyOptions", func() {
+	It("Should set DryRun", func() {
+		o := &client.ApplyOptions{DryRun: []string{"Hello", "Theodore"}}
+		newApplyOpts := &client.ApplyOptions{}
+		o.ApplyToApply(newApplyOpts)
+		Expect(newApplyOpts).To(Equal(o))
+	})
+	It("Should set Force", func() {
+		o := &client.ApplyOptions{Force: ptr.To(true)}
+		newApplyOpts := &client.ApplyOptions{}
+		o.ApplyToApply(newApplyOpts)
+		Expect(newApplyOpts).To(Equal(o))
+	})
+	It("Should set FieldManager", func() {
+		o := &client.ApplyOptions{FieldManager: "field-manager"}
+		newApplyOpts := &client.ApplyOptions{}
+		o.ApplyToApply(newApplyOpts)
+		Expect(newApplyOpts).To(Equal(o))
+	})
 })
 
 var _ = Describe("CreateOptions", func() {
@@ -252,6 +325,57 @@ var _ = Describe("MatchingLabels", func() {
 	})
 })
 
+var _ = Describe("DryRunAll", func() {
+	It("Should apply to ApplyOptions", func() {
+		o := &client.ApplyOptions{DryRun: []string{"server"}}
+		t := client.DryRunAll
+		t.ApplyToApply(o)
+		Expect(o.DryRun).To(Equal([]string{metav1.DryRunAll}))
+	})
+	It("Should apply to CreateOptions", func() {
+		o := &client.CreateOptions{DryRun: []string{"server"}}
+		t := client.DryRunAll
+		t.ApplyToCreate(o)
+		Expect(o.DryRun).To(Equal([]string{metav1.DryRunAll}))
+	})
+	It("Should apply to UpdateOptions", func() {
+		o := &client.UpdateOptions{DryRun: []string{"server"}}
+		t := client.DryRunAll
+		t.ApplyToUpdate(o)
+		Expect(o.DryRun).To(Equal([]string{metav1.DryRunAll}))
+	})
+	It("Should apply to PatchOptions", func() {
+		o := &client.PatchOptions{DryRun: []string{"server"}}
+		t := client.DryRunAll
+		t.ApplyToPatch(o)
+		Expect(o.DryRun).To(Equal([]string{metav1.DryRunAll}))
+	})
+	It("Should apply to DeleteOptions", func() {
+		o := &client.DeleteOptions{DryRun: []string{"server"}}
+		t := client.DryRunAll
+		t.ApplyToDelete(o)
+		Expect(o.DryRun).To(Equal([]string{metav1.DryRunAll}))
+	})
+	It("Should apply to SubResourcePatchOptions", func() {
+		o := &client.SubResourcePatchOptions{PatchOptions: client.PatchOptions{DryRun: []string{"server"}}}
+		t := client.DryRunAll
+		t.ApplyToSubResourcePatch(o)
+		Expect(o.DryRun).To(Equal([]string{metav1.DryRunAll}))
+	})
+	It("Should apply to SubResourceCreateOptions", func() {
+		o := &client.SubResourceCreateOptions{CreateOptions: client.CreateOptions{DryRun: []string{"server"}}}
+		t := client.DryRunAll
+		t.ApplyToSubResourceCreate(o)
+		Expect(o.DryRun).To(Equal([]string{metav1.DryRunAll}))
+	})
+	It("Should apply to SubResourceUpdateOptions", func() {
+		o := &client.SubResourceUpdateOptions{UpdateOptions: client.UpdateOptions{DryRun: []string{"server"}}}
+		t := client.DryRunAll
+		t.ApplyToSubResourceUpdate(o)
+		Expect(o.DryRun).To(Equal([]string{metav1.DryRunAll}))
+	})
+})
+
 var _ = Describe("FieldOwner", func() {
 	It("Should apply to PatchOptions", func() {
 		o := &client.PatchOptions{FieldManager: "bar"}
@@ -259,6 +383,12 @@ var _ = Describe("FieldOwner", func() {
 		t.ApplyToPatch(o)
 		Expect(o.FieldManager).To(Equal("foo"))
 	})
+	It("Should apply to ApplyOptions", func() {
+		o := &client.ApplyOptions{FieldManager: "bar"}
+		t := client.FieldOwner("foo")
+		t.ApplyToApply(o)
+		Expect(o.FieldManager).To(Equal("foo"))
+	})
 	It("Should apply to CreateOptions", func() {
 		o := &client.CreateOptions{FieldManager: "bar"}
 		t := client.FieldOwner("foo")
@@ -304,6 +434,12 @@ var _ = Describe("ForceOwnership", func() {
 		t.ApplyToSubResourcePatch(o)
 		Expect(*o.Force).To(BeTrue())
 	})
+	It("Should apply to ApplyOptions", func() {
+		o := &client.ApplyOptions{}
+		t := client.ForceOwnership
+		t.ApplyToApply(o)
+		Expect(*o.Force).To(BeTrue())
+	})
 })
 
 var _ = Describe("HasLabels", func() {
diff --git a/pkg/client/patch.go b/pkg/client/patch.go
index 11d6083885..b99d7663bd 100644
--- a/pkg/client/patch.go
+++ b/pkg/client/patch.go
@@ -27,6 +27,11 @@ import (
 
 var (
 	// Apply uses server-side apply to patch the given object.
+	//
+	// This should now only be used to patch sub resources, e.g. with client.Client.Status().Patch().
+	// Use client.Client.Apply() instead of client.Client.Patch(..., client.Apply, ...)
+	// This will be deprecated once the Apply method has been added for sub resources.
+	// See the following issue for more details: https://github.com/kubernetes-sigs/controller-runtime/issues/3183
 	Apply Patch = applyPatch{}
 
 	// Merge uses the raw object as a merge patch, without modifications.
diff --git a/pkg/client/typed_client.go b/pkg/client/typed_client.go
index 92afd9a9c2..3bd762a638 100644
--- a/pkg/client/typed_client.go
+++ b/pkg/client/typed_client.go
@@ -18,8 +18,10 @@ package client
 
 import (
 	"context"
+	"fmt"
 
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/util/apply"
 )
 
 var _ Reader = &typedClient{}
@@ -41,7 +43,7 @@ func (c *typedClient) Create(ctx context.Context, obj Object, opts ...CreateOpti
 	createOpts.ApplyOptions(opts)
 
 	return o.Post().
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
 		Body(obj).
 		VersionedParams(createOpts.AsCreateOptions(), c.paramCodec).
@@ -60,9 +62,9 @@ func (c *typedClient) Update(ctx context.Context, obj Object, opts ...UpdateOpti
 	updateOpts.ApplyOptions(opts)
 
 	return o.Put().
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		Body(obj).
 		VersionedParams(updateOpts.AsUpdateOptions(), c.paramCodec).
 		Do(ctx).
@@ -80,9 +82,9 @@ func (c *typedClient) Delete(ctx context.Context, obj Object, opts ...DeleteOpti
 	deleteOpts.ApplyOptions(opts)
 
 	return o.Delete().
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		Body(deleteOpts.AsDeleteOptions()).
 		Do(ctx).
 		Error()
@@ -123,15 +125,40 @@ func (c *typedClient) Patch(ctx context.Context, obj Object, patch Patch, opts .
 	patchOpts.ApplyOptions(opts)
 
 	return o.Patch(patch.Type()).
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		VersionedParams(patchOpts.AsPatchOptions(), c.paramCodec).
 		Body(data).
 		Do(ctx).
 		Into(obj)
 }
 
+func (c *typedClient) Apply(ctx context.Context, obj runtime.ApplyConfiguration, opts ...ApplyOption) error {
+	o, err := c.resources.getObjMeta(obj)
+	if err != nil {
+		return err
+	}
+	req, err := apply.NewRequest(o, obj)
+	if err != nil {
+		return fmt.Errorf("failed to create apply request: %w", err)
+	}
+	applyOpts := &ApplyOptions{}
+	applyOpts.ApplyOptions(opts)
+
+	return req.
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
+		Resource(o.resource()).
+		Name(o.name).
+		VersionedParams(applyOpts.AsPatchOptions(), c.paramCodec).
+		Do(ctx).
+		// This is hacky, it is required because `Into` takes a `runtime.Object` and
+		// that is not implemented by the ApplyConfigurations. The generated clients
+		// don't have this problem because they deserialize into the api type, not the
+		// apply configuration: https://github.com/kubernetes/kubernetes/blob/22f5e01a37c0bc6a5f494dec14dd4e3688ee1d55/staging/src/k8s.io/client-go/gentype/type.go#L296-L317
+		Into(runtimeObjectFromApplyConfiguration(obj))
+}
+
 // Get implements client.Client.
 func (c *typedClient) Get(ctx context.Context, key ObjectKey, obj Object, opts ...GetOption) error {
 	r, err := c.resources.getResource(obj)
@@ -179,9 +206,9 @@ func (c *typedClient) GetSubResource(ctx context.Context, obj, subResourceObj Ob
 	getOpts.ApplyOptions(opts)
 
 	return o.Get().
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		SubResource(subResource).
 		VersionedParams(getOpts.AsGetOptions(), c.paramCodec).
 		Do(ctx).
@@ -202,9 +229,9 @@ func (c *typedClient) CreateSubResource(ctx context.Context, obj Object, subReso
 	createOpts.ApplyOptions(opts)
 
 	return o.Post().
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		SubResource(subResource).
 		Body(subResourceObj).
 		VersionedParams(createOpts.AsCreateOptions(), c.paramCodec).
@@ -237,9 +264,9 @@ func (c *typedClient) UpdateSubResource(ctx context.Context, obj Object, subReso
 	}
 
 	return o.Put().
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		SubResource(subResource).
 		Body(body).
 		VersionedParams(updateOpts.AsUpdateOptions(), c.paramCodec).
@@ -268,9 +295,9 @@ func (c *typedClient) PatchSubResource(ctx context.Context, obj Object, subResou
 	}
 
 	return o.Patch(patch.Type()).
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		SubResource(subResource).
 		Body(data).
 		VersionedParams(patchOpts.AsPatchOptions(), c.paramCodec).
diff --git a/pkg/client/unstructured_client.go b/pkg/client/unstructured_client.go
index 0d96951780..e636c3beef 100644
--- a/pkg/client/unstructured_client.go
+++ b/pkg/client/unstructured_client.go
@@ -22,6 +22,7 @@ import (
 	"strings"
 
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/util/apply"
 )
 
 var _ Reader = &unstructuredClient{}
@@ -50,7 +51,7 @@ func (uc *unstructuredClient) Create(ctx context.Context, obj Object, opts ...Cr
 	createOpts.ApplyOptions(opts)
 
 	result := o.Post().
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
 		Body(obj).
 		VersionedParams(createOpts.AsCreateOptions(), uc.paramCodec).
@@ -79,9 +80,9 @@ func (uc *unstructuredClient) Update(ctx context.Context, obj Object, opts ...Up
 	updateOpts.ApplyOptions(opts)
 
 	result := o.Put().
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		Body(obj).
 		VersionedParams(updateOpts.AsUpdateOptions(), uc.paramCodec).
 		Do(ctx).
@@ -106,9 +107,9 @@ func (uc *unstructuredClient) Delete(ctx context.Context, obj Object, opts ...De
 	deleteOpts.ApplyOptions(opts)
 
 	return o.Delete().
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		Body(deleteOpts.AsDeleteOptions()).
 		Do(ctx).
 		Error()
@@ -157,15 +158,41 @@ func (uc *unstructuredClient) Patch(ctx context.Context, obj Object, patch Patch
 	patchOpts.ApplyOptions(opts)
 
 	return o.Patch(patch.Type()).
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		VersionedParams(patchOpts.AsPatchOptions(), uc.paramCodec).
 		Body(data).
 		Do(ctx).
 		Into(obj)
 }
 
+func (uc *unstructuredClient) Apply(ctx context.Context, obj runtime.ApplyConfiguration, opts ...ApplyOption) error {
+	unstructuredApplyConfig, ok := obj.(*unstructuredApplyConfiguration)
+	if !ok {
+		return fmt.Errorf("bug: unstructured client got an applyconfiguration that was not %T but %T", &unstructuredApplyConfiguration{}, obj)
+	}
+	o, err := uc.resources.getObjMeta(unstructuredApplyConfig.Unstructured)
+	if err != nil {
+		return err
+	}
+
+	req, err := apply.NewRequest(o, obj)
+	if err != nil {
+		return fmt.Errorf("failed to create apply request: %w", err)
+	}
+	applyOpts := &ApplyOptions{}
+	applyOpts.ApplyOptions(opts)
+
+	return req.
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
+		Resource(o.resource()).
+		Name(o.name).
+		VersionedParams(applyOpts.AsPatchOptions(), uc.paramCodec).
+		Do(ctx).
+		Into(unstructuredApplyConfig.Unstructured)
+}
+
 // Get implements client.Client.
 func (uc *unstructuredClient) Get(ctx context.Context, key ObjectKey, obj Object, opts ...GetOption) error {
 	u, ok := obj.(runtime.Unstructured)
@@ -244,9 +271,9 @@ func (uc *unstructuredClient) GetSubResource(ctx context.Context, obj, subResour
 	getOpts.ApplyOptions(opts)
 
 	return o.Get().
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		SubResource(subResource).
 		VersionedParams(getOpts.AsGetOptions(), uc.paramCodec).
 		Do(ctx).
@@ -275,9 +302,9 @@ func (uc *unstructuredClient) CreateSubResource(ctx context.Context, obj, subRes
 	createOpts.ApplyOptions(opts)
 
 	return o.Post().
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		SubResource(subResource).
 		Body(subResourceObj).
 		VersionedParams(createOpts.AsCreateOptions(), uc.paramCodec).
@@ -310,9 +337,9 @@ func (uc *unstructuredClient) UpdateSubResource(ctx context.Context, obj Object,
 	}
 
 	return o.Put().
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		SubResource(subResource).
 		Body(body).
 		VersionedParams(updateOpts.AsUpdateOptions(), uc.paramCodec).
@@ -347,9 +374,9 @@ func (uc *unstructuredClient) PatchSubResource(ctx context.Context, obj Object,
 	}
 
 	result := o.Patch(patch.Type()).
-		NamespaceIfScoped(o.GetNamespace(), o.isNamespaced()).
+		NamespaceIfScoped(o.namespace, o.isNamespaced()).
 		Resource(o.resource()).
-		Name(o.GetName()).
+		Name(o.name).
 		SubResource(subResource).
 		Body(data).
 		VersionedParams(patchOpts.AsPatchOptions(), uc.paramCodec).
diff --git a/pkg/client/watch_test.go b/pkg/client/watch_test.go
index 26d90f6550..8d5b3344d3 100644
--- a/pkg/client/watch_test.go
+++ b/pkg/client/watch_test.go
@@ -38,9 +38,8 @@ var _ = Describe("ClientWithWatch", func() {
 	var count uint64 = 0
 	var replicaCount int32 = 2
 	var ns = "kube-public"
-	ctx := context.TODO()
 
-	BeforeEach(func() {
+	BeforeEach(func(ctx SpecContext) {
 		atomic.AddUint64(&count, 1)
 		dep = &appsv1.Deployment{
 			ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("watch-deployment-name-%v", count), Namespace: ns, Labels: map[string]string{"app": fmt.Sprintf("bar-%v", count)}},
@@ -61,18 +60,18 @@ var _ = Describe("ClientWithWatch", func() {
 		Expect(err).NotTo(HaveOccurred())
 	})
 
-	AfterEach(func() {
+	AfterEach(func(ctx SpecContext) {
 		deleteDeployment(ctx, dep, ns)
 	})
 
 	Describe("NewWithWatch", func() {
-		It("should return a new Client", func() {
+		It("should return a new Client", func(ctx SpecContext) {
 			cl, err := client.NewWithWatch(cfg, client.Options{})
 			Expect(err).NotTo(HaveOccurred())
 			Expect(cl).NotTo(BeNil())
 		})
 
-		watchSuite := func(through client.ObjectList, expectedType client.Object, checkGvk bool) {
+		watchSuite := func(ctx context.Context, through client.ObjectList, expectedType client.Object, checkGvk bool) {
 			cl, err := client.NewWithWatch(cfg, client.Options{})
 			Expect(err).NotTo(HaveOccurred())
 			Expect(cl).NotTo(BeNil())
@@ -110,23 +109,23 @@ var _ = Describe("ClientWithWatch", func() {
 			}
 		}
 
-		It("should receive a create event when watching the typed object", func() {
-			watchSuite(&appsv1.DeploymentList{}, &appsv1.Deployment{}, false)
+		It("should receive a create event when watching the typed object", func(ctx SpecContext) {
+			watchSuite(ctx, &appsv1.DeploymentList{}, &appsv1.Deployment{}, false)
 		})
 
-		It("should receive a create event when watching the unstructured object", func() {
+		It("should receive a create event when watching the unstructured object", func(ctx SpecContext) {
 			u := &unstructured.UnstructuredList{}
 			u.SetGroupVersionKind(schema.GroupVersionKind{
 				Group:   "apps",
 				Kind:    "Deployment",
 				Version: "v1",
 			})
-			watchSuite(u, &unstructured.Unstructured{}, true)
+			watchSuite(ctx, u, &unstructured.Unstructured{}, true)
 		})
 
-		It("should receive a create event when watching the metadata object", func() {
+		It("should receive a create event when watching the metadata object", func(ctx SpecContext) {
 			m := &metav1.PartialObjectMetadataList{TypeMeta: metav1.TypeMeta{Kind: "Deployment", APIVersion: "apps/v1"}}
-			watchSuite(m, &metav1.PartialObjectMetadata{}, false)
+			watchSuite(ctx, m, &metav1.PartialObjectMetadata{}, false)
 		})
 	})
 
diff --git a/pkg/cluster/cluster.go b/pkg/cluster/cluster.go
index 248893ea31..0603f4cde5 100644
--- a/pkg/cluster/cluster.go
+++ b/pkg/cluster/cluster.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"errors"
 	"net/http"
-	"time"
 
 	"github.com/go-logr/logr"
 	"k8s.io/apimachinery/pkg/api/meta"
@@ -65,8 +64,8 @@ type Cluster interface {
 	// GetRESTMapper returns a RESTMapper
 	GetRESTMapper() meta.RESTMapper
 
-	// GetAPIReader returns a reader that will be configured to use the API server.
-	// This should be used sparingly and only when the client does not fit your
+	// GetAPIReader returns a reader that will be configured to use the API server directly.
+	// This should be used sparingly and only when the cached client does not fit your
 	// use case.
 	GetAPIReader() client.Reader
 
@@ -88,16 +87,6 @@ type Options struct {
 	// If none is set, it defaults to log.Log global logger.
 	Logger logr.Logger
 
-	// SyncPeriod determines the minimum frequency at which watched resources are
-	// reconciled. A lower period will correct entropy more quickly, but reduce
-	// responsiveness to change if there are many watched resources. Change this
-	// value only if you know what you are doing. Defaults to 10 hours if unset.
-	// there will a 10 percent jitter between the SyncPeriod of all controllers
-	// so that all controllers will not send list requests simultaneously.
-	//
-	// Deprecated: Use Cache.SyncPeriod instead.
-	SyncPeriod *time.Duration
-
 	// HTTPClient is the http client that will be used to create the default
 	// Cache and Client. If not set the rest.HTTPClientFor function will be used
 	// to create the http client.
@@ -194,9 +183,6 @@ func New(config *rest.Config, opts ...Option) (Cluster, error) {
 		if cacheOpts.HTTPClient == nil {
 			cacheOpts.HTTPClient = options.HTTPClient
 		}
-		if cacheOpts.SyncPeriod == nil {
-			cacheOpts.SyncPeriod = options.SyncPeriod
-		}
 	}
 	cache, err := options.NewCache(config, cacheOpts)
 	if err != nil {
diff --git a/pkg/cluster/cluster_test.go b/pkg/cluster/cluster_test.go
index dc52b2d9b3..c08a742403 100644
--- a/pkg/cluster/cluster_test.go
+++ b/pkg/cluster/cluster_test.go
@@ -100,22 +100,22 @@ var _ = Describe("cluster.Cluster", func() {
 	})
 
 	Describe("Start", func() {
-		It("should stop when context is cancelled", func() {
+		It("should stop when context is cancelled", func(specCtx SpecContext) {
 			c, err := New(cfg)
 			Expect(err).NotTo(HaveOccurred())
-			ctx, cancel := context.WithCancel(context.Background())
+			ctx, cancel := context.WithCancel(specCtx)
 			cancel()
 			Expect(c.Start(ctx)).NotTo(HaveOccurred())
 		})
 	})
 
-	It("should not leak goroutines when stopped", func() {
+	It("should not leak goroutines when stopped", func(specCtx SpecContext) {
 		currentGRs := goleak.IgnoreCurrent()
 
 		c, err := New(cfg)
 		Expect(err).NotTo(HaveOccurred())
 
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(specCtx)
 		cancel()
 		Expect(c.Start(ctx)).NotTo(HaveOccurred())
 
diff --git a/pkg/config/controller.go b/pkg/config/controller.go
index 999ef07e21..3dafaef93b 100644
--- a/pkg/config/controller.go
+++ b/pkg/config/controller.go
@@ -16,9 +16,15 @@ limitations under the License.
 
 package config
 
-import "time"
+import (
+	"time"
 
-// Controller contains configuration options for a controller.
+	"github.com/go-logr/logr"
+)
+
+// Controller contains configuration options for controllers. It only includes options
+// that makes sense for a set of controllers and is used for defaulting the options
+// of multiple controllers.
 type Controller struct {
 	// SkipNameValidation allows skipping the name validation that ensures that every controller name is unique.
 	// Unique controller names are important to get unique metrics and logs for a controller.
@@ -53,4 +59,34 @@ type Controller struct {
 	// NeedLeaderElection indicates whether the controller needs to use leader election.
 	// Defaults to true, which means the controller will use leader election.
 	NeedLeaderElection *bool
+
+	// EnableWarmup specifies whether the controller should start its sources when the manager is not
+	// the leader. This is useful for cases where sources take a long time to start, as it allows
+	// for the controller to warm up its caches even before it is elected as the leader. This
+	// improves leadership failover time, as the caches will be prepopulated before the controller
+	// transitions to be leader.
+	//
+	// Setting EnableWarmup to true and NeedLeaderElection to true means the controller will start its
+	// sources without waiting to become leader.
+	// Setting EnableWarmup to true and NeedLeaderElection to false is a no-op as controllers without
+	// leader election do not wait on leader election to start their sources.
+	// Defaults to false.
+	//
+	// Note: This feature is currently in beta and subject to change.
+	// For more details, see: https://github.com/kubernetes-sigs/controller-runtime/issues/3220.
+	EnableWarmup *bool
+
+	// UsePriorityQueue configures the controllers queue to use the controller-runtime provided
+	// priority queue.
+	//
+	// Note: This flag is disabled by default until a future version. This feature is currently in beta.
+	// For more details, see: https://github.com/kubernetes-sigs/controller-runtime/issues/2374.
+	UsePriorityQueue *bool
+
+	// Logger is the logger controllers should use.
+	Logger logr.Logger
+
+	// ReconciliationTimeout is used as the timeout passed to the context of each Reconcile call.
+	// By default, there is no timeout.
+	ReconciliationTimeout time.Duration
 }
diff --git a/pkg/controller/controller.go b/pkg/controller/controller.go
index f2496236db..afa15aebec 100644
--- a/pkg/controller/controller.go
+++ b/pkg/controller/controller.go
@@ -24,7 +24,10 @@ import (
 	"github.com/go-logr/logr"
 	"k8s.io/client-go/util/workqueue"
 	"k8s.io/klog/v2"
+	"k8s.io/utils/ptr"
 
+	"sigs.k8s.io/controller-runtime/pkg/config"
+	"sigs.k8s.io/controller-runtime/pkg/controller/priorityqueue"
 	"sigs.k8s.io/controller-runtime/pkg/internal/controller"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
@@ -78,13 +81,82 @@ type TypedOptions[request comparable] struct {
 	// Only use a custom NewQueue if you know what you are doing.
 	NewQueue func(controllerName string, rateLimiter workqueue.TypedRateLimiter[request]) workqueue.TypedRateLimitingInterface[request]
 
+	// Logger will be used to build a default LogConstructor if unset.
+	Logger logr.Logger
+
 	// LogConstructor is used to construct a logger used for this controller and passed
 	// to each reconciliation via the context field.
 	LogConstructor func(request *request) logr.Logger
+
+	// UsePriorityQueue configures the controllers queue to use the controller-runtime provided
+	// priority queue.
+	//
+	// Note: This flag is disabled by default until a future version. This feature is currently in beta.
+	// For more details, see: https://github.com/kubernetes-sigs/controller-runtime/issues/2374.
+	UsePriorityQueue *bool
+
+	// EnableWarmup specifies whether the controller should start its sources when the manager is not
+	// the leader. This is useful for cases where sources take a long time to start, as it allows
+	// for the controller to warm up its caches even before it is elected as the leader. This
+	// improves leadership failover time, as the caches will be prepopulated before the controller
+	// transitions to be leader.
+	//
+	// Setting EnableWarmup to true and NeedLeaderElection to true means the controller will start its
+	// sources without waiting to become leader.
+	// Setting EnableWarmup to true and NeedLeaderElection to false is a no-op as controllers without
+	// leader election do not wait on leader election to start their sources.
+	// Defaults to false.
+	//
+	// Note: This feature is currently in beta and subject to change.
+	// For more details, see: https://github.com/kubernetes-sigs/controller-runtime/issues/3220.
+	EnableWarmup *bool
+
+	// ReconciliationTimeout is used as the timeout passed to the context of each Reconcile call.
+	// By default, there is no timeout.
+	ReconciliationTimeout time.Duration
+}
+
+// DefaultFromConfig defaults the config from a config.Controller
+func (options *TypedOptions[request]) DefaultFromConfig(config config.Controller) {
+	if options.Logger.GetSink() == nil {
+		options.Logger = config.Logger
+	}
+
+	if options.SkipNameValidation == nil {
+		options.SkipNameValidation = config.SkipNameValidation
+	}
+
+	if options.MaxConcurrentReconciles <= 0 && config.MaxConcurrentReconciles > 0 {
+		options.MaxConcurrentReconciles = config.MaxConcurrentReconciles
+	}
+
+	if options.CacheSyncTimeout == 0 && config.CacheSyncTimeout > 0 {
+		options.CacheSyncTimeout = config.CacheSyncTimeout
+	}
+
+	if options.UsePriorityQueue == nil {
+		options.UsePriorityQueue = config.UsePriorityQueue
+	}
+
+	if options.RecoverPanic == nil {
+		options.RecoverPanic = config.RecoverPanic
+	}
+
+	if options.NeedLeaderElection == nil {
+		options.NeedLeaderElection = config.NeedLeaderElection
+	}
+
+	if options.EnableWarmup == nil {
+		options.EnableWarmup = config.EnableWarmup
+	}
+
+	if options.ReconciliationTimeout == 0 {
+		options.ReconciliationTimeout = config.ReconciliationTimeout
+	}
 }
 
-// Controller implements a Kubernetes API.  A Controller manages a work queue fed reconcile.Requests
-// from source.Sources.  Work is performed through the reconcile.Reconciler for each enqueued item.
+// Controller implements an API. A Controller manages a work queue fed reconcile.Requests
+// from source.Sources. Work is performed through the reconcile.Reconciler for each enqueued item.
 // Work typically is reads and writes Kubernetes objects to make the system state match the state specified
 // in the object Spec.
 type Controller = TypedController[reconcile.Request]
@@ -117,7 +189,8 @@ func New(name string, mgr manager.Manager, options Options) (Controller, error)
 //
 // The name must be unique as it is used to identify the controller in metrics and logs.
 func NewTyped[request comparable](name string, mgr manager.Manager, options TypedOptions[request]) (TypedController[request], error) {
-	c, err := NewTypedUnmanaged(name, mgr, options)
+	options.DefaultFromConfig(mgr.GetControllerOptions())
+	c, err := NewTypedUnmanaged(name, options)
 	if err != nil {
 		return nil, err
 	}
@@ -130,14 +203,14 @@ func NewTyped[request comparable](name string, mgr manager.Manager, options Type
 // caller is responsible for starting the returned controller.
 //
 // The name must be unique as it is used to identify the controller in metrics and logs.
-func NewUnmanaged(name string, mgr manager.Manager, options Options) (Controller, error) {
-	return NewTypedUnmanaged(name, mgr, options)
+func NewUnmanaged(name string, options Options) (Controller, error) {
+	return NewTypedUnmanaged(name, options)
 }
 
 // NewTypedUnmanaged returns a new typed controller without adding it to the manager.
 //
 // The name must be unique as it is used to identify the controller in metrics and logs.
-func NewTypedUnmanaged[request comparable](name string, mgr manager.Manager, options TypedOptions[request]) (TypedController[request], error) {
+func NewTypedUnmanaged[request comparable](name string, options TypedOptions[request]) (TypedController[request], error) {
 	if options.Reconciler == nil {
 		return nil, fmt.Errorf("must specify Reconciler")
 	}
@@ -146,10 +219,6 @@ func NewTypedUnmanaged[request comparable](name string, mgr manager.Manager, opt
 		return nil, fmt.Errorf("must specify Name for Controller")
 	}
 
-	if options.SkipNameValidation == nil {
-		options.SkipNameValidation = mgr.GetControllerOptions().SkipNameValidation
-	}
-
 	if options.SkipNameValidation == nil || !*options.SkipNameValidation {
 		if err := checkName(name); err != nil {
 			return nil, err
@@ -157,7 +226,7 @@ func NewTypedUnmanaged[request comparable](name string, mgr manager.Manager, opt
 	}
 
 	if options.LogConstructor == nil {
-		log := mgr.GetLogger().WithValues(
+		log := options.Logger.WithValues(
 			"controller", name,
 		)
 		options.LogConstructor = func(in *request) logr.Logger {
@@ -173,43 +242,37 @@ func NewTypedUnmanaged[request comparable](name string, mgr manager.Manager, opt
 	}
 
 	if options.MaxConcurrentReconciles <= 0 {
-		if mgr.GetControllerOptions().MaxConcurrentReconciles > 0 {
-			options.MaxConcurrentReconciles = mgr.GetControllerOptions().MaxConcurrentReconciles
-		} else {
-			options.MaxConcurrentReconciles = 1
-		}
+		options.MaxConcurrentReconciles = 1
 	}
 
 	if options.CacheSyncTimeout == 0 {
-		if mgr.GetControllerOptions().CacheSyncTimeout != 0 {
-			options.CacheSyncTimeout = mgr.GetControllerOptions().CacheSyncTimeout
-		} else {
-			options.CacheSyncTimeout = 2 * time.Minute
-		}
+		options.CacheSyncTimeout = 2 * time.Minute
 	}
 
 	if options.RateLimiter == nil {
-		options.RateLimiter = workqueue.DefaultTypedControllerRateLimiter[request]()
+		if ptr.Deref(options.UsePriorityQueue, false) {
+			options.RateLimiter = workqueue.NewTypedItemExponentialFailureRateLimiter[request](5*time.Millisecond, 1000*time.Second)
+		} else {
+			options.RateLimiter = workqueue.DefaultTypedControllerRateLimiter[request]()
+		}
 	}
 
 	if options.NewQueue == nil {
 		options.NewQueue = func(controllerName string, rateLimiter workqueue.TypedRateLimiter[request]) workqueue.TypedRateLimitingInterface[request] {
+			if ptr.Deref(options.UsePriorityQueue, false) {
+				return priorityqueue.New(controllerName, func(o *priorityqueue.Opts[request]) {
+					o.Log = options.Logger.WithValues("controller", controllerName)
+					o.RateLimiter = rateLimiter
+				})
+			}
 			return workqueue.NewTypedRateLimitingQueueWithConfig(rateLimiter, workqueue.TypedRateLimitingQueueConfig[request]{
 				Name: controllerName,
 			})
 		}
 	}
 
-	if options.RecoverPanic == nil {
-		options.RecoverPanic = mgr.GetControllerOptions().RecoverPanic
-	}
-
-	if options.NeedLeaderElection == nil {
-		options.NeedLeaderElection = mgr.GetControllerOptions().NeedLeaderElection
-	}
-
 	// Create controller with dependencies set
-	return &controller.Controller[request]{
+	return controller.New[request](controller.Options[request]{
 		Do:                      options.Reconciler,
 		RateLimiter:             options.RateLimiter,
 		NewQueue:                options.NewQueue,
@@ -219,7 +282,9 @@ func NewTypedUnmanaged[request comparable](name string, mgr manager.Manager, opt
 		LogConstructor:          options.LogConstructor,
 		RecoverPanic:            options.RecoverPanic,
 		LeaderElected:           options.NeedLeaderElection,
-	}, nil
+		EnableWarmup:            options.EnableWarmup,
+		ReconciliationTimeout:   options.ReconciliationTimeout,
+	}), nil
 }
 
 // ReconcileIDFromContext gets the reconcileID from the current context.
diff --git a/pkg/controller/controller_integration_test.go b/pkg/controller/controller_integration_test.go
index c8e8a790fc..e09813eee2 100644
--- a/pkg/controller/controller_integration_test.go
+++ b/pkg/controller/controller_integration_test.go
@@ -18,16 +18,21 @@ package controller_test
 
 import (
 	"context"
+	"fmt"
+	"strconv"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/cache"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllertest"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 
@@ -38,7 +43,6 @@ import (
 
 var _ = Describe("controller", func() {
 	var reconciled chan reconcile.Request
-	ctx := context.Background()
 
 	BeforeEach(func() {
 		reconciled = make(chan reconcile.Request)
@@ -48,30 +52,48 @@ var _ = Describe("controller", func() {
 	Describe("controller", func() {
 		// TODO(directxman12): write a whole suite of controller-client interaction tests
 
-		It("should reconcile", func() {
+		// The watches in this test are setup with a namespace predicate to avoid each table entry
+		// from interfering with the others. We cannot add a delete call for the pods created in the
+		// test, as it causes flakes with the api-server termination timing out.
+		// See https://github.com/kubernetes-sigs/controller-runtime/issues/1571 for a description
+		// of the issue, and a discussion here: https://github.com/kubernetes-sigs/controller-runtime/pull/3192#discussion_r2186967799
+		DescribeTable("should reconcile", func(ctx SpecContext, enableWarmup bool) {
 			By("Creating the Manager")
 			cm, err := manager.New(cfg, manager.Options{})
 			Expect(err).NotTo(HaveOccurred())
 
 			By("Creating the Controller")
-			instance, err := controller.New("foo-controller", cm, controller.Options{
-				Reconciler: reconcile.Func(
-					func(_ context.Context, request reconcile.Request) (reconcile.Result, error) {
-						reconciled <- request
-						return reconcile.Result{}, nil
-					}),
-			})
+			instance, err := controller.New(
+				fmt.Sprintf("foo-controller-%t", enableWarmup),
+				cm,
+				controller.Options{
+					Reconciler: reconcile.Func(
+						func(_ context.Context, request reconcile.Request) (reconcile.Result, error) {
+							reconciled <- request
+							return reconcile.Result{}, nil
+						}),
+					EnableWarmup: ptr.To(enableWarmup),
+				},
+			)
 			Expect(err).NotTo(HaveOccurred())
 
+			testNamespace := strconv.FormatBool(enableWarmup)
+
 			By("Watching Resources")
 			err = instance.Watch(
 				source.Kind(cm.GetCache(), &appsv1.ReplicaSet{},
 					handler.TypedEnqueueRequestForOwner[*appsv1.ReplicaSet](cm.GetScheme(), cm.GetRESTMapper(), &appsv1.Deployment{}),
+					makeNamespacePredicate[*appsv1.ReplicaSet](testNamespace),
 				),
 			)
 			Expect(err).NotTo(HaveOccurred())
 
-			err = instance.Watch(source.Kind(cm.GetCache(), &appsv1.Deployment{}, &handler.TypedEnqueueRequestForObject[*appsv1.Deployment]{}))
+			err = instance.Watch(
+				source.Kind(cm.GetCache(), &appsv1.Deployment{},
+					&handler.TypedEnqueueRequestForObject[*appsv1.Deployment]{},
+					makeNamespacePredicate[*appsv1.Deployment](testNamespace),
+				),
+			)
 			Expect(err).NotTo(HaveOccurred())
 
 			err = cm.GetClient().Get(ctx, types.NamespacedName{Name: "foo"}, &corev1.Namespace{})
@@ -80,8 +102,6 @@ var _ = Describe("controller", func() {
 			Expect(err).To(Equal(&cache.ErrCacheNotStarted{}))
 
 			By("Starting the Manager")
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			go func() {
 				defer GinkgoRecover()
 				Expect(cm.Start(ctx)).NotTo(HaveOccurred())
@@ -110,19 +130,25 @@ var _ = Describe("controller", func() {
 				},
 			}
 			expectedReconcileRequest := reconcile.Request{NamespacedName: types.NamespacedName{
-				Namespace: "default",
+				Namespace: testNamespace,
 				Name:      "deployment-name",
 			}}
 
+			By("Creating the test namespace")
+			_, err = clientset.CoreV1().Namespaces().Create(ctx, &corev1.Namespace{
+				ObjectMeta: metav1.ObjectMeta{Name: testNamespace},
+			}, metav1.CreateOptions{})
+			Expect(err).NotTo(HaveOccurred())
+
 			By("Invoking Reconciling for Create")
-			deployment, err = clientset.AppsV1().Deployments("default").Create(ctx, deployment, metav1.CreateOptions{})
+			deployment, err = clientset.AppsV1().Deployments(testNamespace).Create(ctx, deployment, metav1.CreateOptions{})
 			Expect(err).NotTo(HaveOccurred())
 			Expect(<-reconciled).To(Equal(expectedReconcileRequest))
 
 			By("Invoking Reconciling for Update")
 			newDeployment := deployment.DeepCopy()
 			newDeployment.Labels = map[string]string{"foo": "bar"}
-			_, err = clientset.AppsV1().Deployments("default").Update(ctx, newDeployment, metav1.UpdateOptions{})
+			_, err = clientset.AppsV1().Deployments(testNamespace).Update(ctx, newDeployment, metav1.UpdateOptions{})
 			Expect(err).NotTo(HaveOccurred())
 			Expect(<-reconciled).To(Equal(expectedReconcileRequest))
 
@@ -145,36 +171,41 @@ var _ = Describe("controller", func() {
 					Template: deployment.Spec.Template,
 				},
 			}
-			replicaset, err = clientset.AppsV1().ReplicaSets("default").Create(ctx, replicaset, metav1.CreateOptions{})
+			replicaset, err = clientset.AppsV1().ReplicaSets(testNamespace).Create(ctx, replicaset, metav1.CreateOptions{})
 			Expect(err).NotTo(HaveOccurred())
 			Expect(<-reconciled).To(Equal(expectedReconcileRequest))
 
 			By("Invoking Reconciling for an OwnedObject when it is updated")
 			newReplicaset := replicaset.DeepCopy()
 			newReplicaset.Labels = map[string]string{"foo": "bar"}
-			_, err = clientset.AppsV1().ReplicaSets("default").Update(ctx, newReplicaset, metav1.UpdateOptions{})
+			_, err = clientset.AppsV1().ReplicaSets(testNamespace).Update(ctx, newReplicaset, metav1.UpdateOptions{})
 			Expect(err).NotTo(HaveOccurred())
 			Expect(<-reconciled).To(Equal(expectedReconcileRequest))
 
 			By("Invoking Reconciling for an OwnedObject when it is deleted")
-			err = clientset.AppsV1().ReplicaSets("default").Delete(ctx, replicaset.Name, metav1.DeleteOptions{})
+			err = clientset.AppsV1().ReplicaSets(testNamespace).Delete(ctx, replicaset.Name, metav1.DeleteOptions{})
 			Expect(err).NotTo(HaveOccurred())
 			Expect(<-reconciled).To(Equal(expectedReconcileRequest))
 
 			By("Invoking Reconciling for Delete")
-			err = clientset.AppsV1().Deployments("default").
+			err = clientset.AppsV1().Deployments(testNamespace).
 				Delete(ctx, "deployment-name", metav1.DeleteOptions{})
 			Expect(err).NotTo(HaveOccurred())
 			Expect(<-reconciled).To(Equal(expectedReconcileRequest))
 
 			By("Listing a type with a slice of pointers as items field")
 			err = cm.GetClient().
-				List(context.Background(), &controllertest.UnconventionalListTypeList{})
+				List(ctx, &controllertest.UnconventionalListTypeList{})
 			Expect(err).NotTo(HaveOccurred())
 
 			By("Invoking Reconciling for a pod when it is created when adding watcher dynamically")
 			// Add new watcher dynamically
-			err = instance.Watch(source.Kind(cm.GetCache(), &corev1.Pod{}, &handler.TypedEnqueueRequestForObject[*corev1.Pod]{}))
+			err = instance.Watch(
+				source.Kind(cm.GetCache(), &corev1.Pod{},
+					&handler.TypedEnqueueRequestForObject[*corev1.Pod]{},
+					makeNamespacePredicate[*corev1.Pod](testNamespace),
+				),
+			)
 			Expect(err).NotTo(HaveOccurred())
 
 			pod := &corev1.Pod{
@@ -194,16 +225,27 @@ var _ = Describe("controller", func() {
 				},
 			}
 			expectedReconcileRequest = reconcile.Request{NamespacedName: types.NamespacedName{
-				Namespace: "default",
+				Namespace: testNamespace,
 				Name:      "pod-name",
 			}}
-			_, err = clientset.CoreV1().Pods("default").Create(ctx, pod, metav1.CreateOptions{})
+			_, err = clientset.CoreV1().Pods(testNamespace).Create(ctx, pod, metav1.CreateOptions{})
 			Expect(err).NotTo(HaveOccurred())
 			Expect(<-reconciled).To(Equal(expectedReconcileRequest))
-		})
+		},
+			Entry("with controller warmup enabled", true),
+			Entry("with controller warmup not enabled", false),
+		)
 	})
 })
 
+// makeNamespacePredicate returns a predicate that filters out all objects not in the passed in
+// namespace.
+func makeNamespacePredicate[object client.Object](namespace string) predicate.TypedPredicate[object] {
+	return predicate.NewTypedPredicateFuncs[object](func(obj object) bool {
+		return obj.GetNamespace() == namespace
+	})
+}
+
 func truePtr() *bool {
 	t := true
 	return &t
diff --git a/pkg/controller/controller_test.go b/pkg/controller/controller_test.go
index b69840af84..335e6d830e 100644
--- a/pkg/controller/controller_test.go
+++ b/pkg/controller/controller_test.go
@@ -29,6 +29,7 @@ import (
 
 	"sigs.k8s.io/controller-runtime/pkg/config"
 	"sigs.k8s.io/controller-runtime/pkg/controller"
+	"sigs.k8s.io/controller-runtime/pkg/controller/priorityqueue"
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	internalcontroller "sigs.k8s.io/controller-runtime/pkg/internal/controller"
@@ -135,10 +136,10 @@ var _ = Describe("controller.Controller", func() {
 			Expect(c2).ToNot(BeNil())
 		})
 
-		It("should not leak goroutines when stopped", func() {
+		It("should not leak goroutines when stopped", func(specCtx SpecContext) {
 			currentGRs := goleak.IgnoreCurrent()
 
-			ctx, cancel := context.WithCancel(context.Background())
+			ctx, cancel := context.WithCancel(specCtx)
 			watchChan := make(chan event.GenericEvent, 1)
 			watch := source.Channel(watchChan, &handler.EnqueueRequestForObject{})
 			watchChan <- event.GenericEvent{Object: &corev1.Pod{}}
@@ -437,5 +438,142 @@ var _ = Describe("controller.Controller", func() {
 			_, ok := c.(manager.LeaderElectionRunnable)
 			Expect(ok).To(BeTrue())
 		})
+
+		It("should configure a priority queue if UsePriorityQueue is set", func() {
+			m, err := manager.New(cfg, manager.Options{
+				Controller: config.Controller{UsePriorityQueue: ptr.To(true)},
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			c, err := controller.New("new-controller-16", m, controller.Options{
+				Reconciler: rec,
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			ctrl, ok := c.(*internalcontroller.Controller[reconcile.Request])
+			Expect(ok).To(BeTrue())
+
+			q := ctrl.NewQueue("foo", nil)
+			_, ok = q.(priorityqueue.PriorityQueue[reconcile.Request])
+			Expect(ok).To(BeTrue())
+		})
+
+		It("should not configure a priority queue if UsePriorityQueue is not set", func() {
+			m, err := manager.New(cfg, manager.Options{})
+			Expect(err).NotTo(HaveOccurred())
+
+			c, err := controller.New("new-controller-17", m, controller.Options{
+				Reconciler: rec,
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			ctrl, ok := c.(*internalcontroller.Controller[reconcile.Request])
+			Expect(ok).To(BeTrue())
+
+			q := ctrl.NewQueue("foo", nil)
+			_, ok = q.(priorityqueue.PriorityQueue[reconcile.Request])
+			Expect(ok).To(BeFalse())
+		})
+
+		It("should set EnableWarmup correctly", func() {
+			m, err := manager.New(cfg, manager.Options{})
+			Expect(err).NotTo(HaveOccurred())
+
+			// Test with EnableWarmup set to true
+			ctrlWithWarmup, err := controller.New("warmup-enabled-ctrl", m, controller.Options{
+				Reconciler:   reconcile.Func(nil),
+				EnableWarmup: ptr.To(true),
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			internalCtrlWithWarmup, ok := ctrlWithWarmup.(*internalcontroller.Controller[reconcile.Request])
+			Expect(ok).To(BeTrue())
+			Expect(internalCtrlWithWarmup.EnableWarmup).To(HaveValue(BeTrue()))
+
+			// Test with EnableWarmup set to false
+			ctrlWithoutWarmup, err := controller.New("warmup-disabled-ctrl", m, controller.Options{
+				Reconciler:   reconcile.Func(nil),
+				EnableWarmup: ptr.To(false),
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			internalCtrlWithoutWarmup, ok := ctrlWithoutWarmup.(*internalcontroller.Controller[reconcile.Request])
+			Expect(ok).To(BeTrue())
+			Expect(internalCtrlWithoutWarmup.EnableWarmup).To(HaveValue(BeFalse()))
+
+			// Test with EnableWarmup not set (should default to nil)
+			ctrlWithDefaultWarmup, err := controller.New("warmup-default-ctrl", m, controller.Options{
+				Reconciler: reconcile.Func(nil),
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			internalCtrlWithDefaultWarmup, ok := ctrlWithDefaultWarmup.(*internalcontroller.Controller[reconcile.Request])
+			Expect(ok).To(BeTrue())
+			Expect(internalCtrlWithDefaultWarmup.EnableWarmup).To(BeNil())
+		})
+
+		It("should inherit EnableWarmup from manager config", func() {
+			// Test with manager default setting EnableWarmup to true
+			managerWithWarmup, err := manager.New(cfg, manager.Options{
+				Controller: config.Controller{
+					EnableWarmup: ptr.To(true),
+				},
+			})
+			Expect(err).NotTo(HaveOccurred())
+			ctrlInheritingWarmup, err := controller.New("inherit-warmup-enabled", managerWithWarmup, controller.Options{
+				Reconciler: reconcile.Func(nil),
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			internalCtrlInheritingWarmup, ok := ctrlInheritingWarmup.(*internalcontroller.Controller[reconcile.Request])
+			Expect(ok).To(BeTrue())
+			Expect(internalCtrlInheritingWarmup.EnableWarmup).To(HaveValue(BeTrue()))
+
+			// Test that explicit controller setting overrides manager setting
+			ctrlOverridingWarmup, err := controller.New("override-warmup-disabled", managerWithWarmup, controller.Options{
+				Reconciler:   reconcile.Func(nil),
+				EnableWarmup: ptr.To(false),
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			internalCtrlOverridingWarmup, ok := ctrlOverridingWarmup.(*internalcontroller.Controller[reconcile.Request])
+			Expect(ok).To(BeTrue())
+			Expect(internalCtrlOverridingWarmup.EnableWarmup).To(HaveValue(BeFalse()))
+		})
+
+		It("should default ReconciliationTimeout from manager if unset", func() {
+			m, err := manager.New(cfg, manager.Options{
+				Controller: config.Controller{ReconciliationTimeout: 30 * time.Second},
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			c, err := controller.New("mgr-reconciliation-timeout", m, controller.Options{
+				Reconciler: rec,
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			ctrl, ok := c.(*internalcontroller.Controller[reconcile.Request])
+			Expect(ok).To(BeTrue())
+
+			Expect(ctrl.ReconciliationTimeout).To(Equal(30 * time.Second))
+		})
+
+		It("should not override an existing ReconciliationTimeout", func() {
+			m, err := manager.New(cfg, manager.Options{
+				Controller: config.Controller{ReconciliationTimeout: 30 * time.Second},
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			c, err := controller.New("ctrl-reconciliation-timeout", m, controller.Options{
+				Reconciler:            rec,
+				ReconciliationTimeout: time.Minute,
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			ctrl, ok := c.(*internalcontroller.Controller[reconcile.Request])
+			Expect(ok).To(BeTrue())
+
+			Expect(ctrl.ReconciliationTimeout).To(Equal(time.Minute))
+		})
 	})
 })
diff --git a/pkg/controller/controllertest/util.go b/pkg/controller/controllertest/util.go
index 60ec61edec..2c9a248899 100644
--- a/pkg/controller/controllertest/util.go
+++ b/pkg/controller/controllertest/util.go
@@ -17,6 +17,7 @@ limitations under the License.
 package controllertest
 
 import (
+	"context"
 	"time"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -33,49 +34,7 @@ type FakeInformer struct {
 	// RunCount is incremented each time RunInformersAndControllers is called
 	RunCount int
 
-	handlers []eventHandlerWrapper
-}
-
-type modernResourceEventHandler interface {
-	OnAdd(obj interface{}, isInInitialList bool)
-	OnUpdate(oldObj, newObj interface{})
-	OnDelete(obj interface{})
-}
-
-type legacyResourceEventHandler interface {
-	OnAdd(obj interface{})
-	OnUpdate(oldObj, newObj interface{})
-	OnDelete(obj interface{})
-}
-
-// eventHandlerWrapper wraps a ResourceEventHandler in a manner that is compatible with client-go 1.27+ and older.
-// The interface was changed in these versions.
-type eventHandlerWrapper struct {
-	handler any
-}
-
-func (e eventHandlerWrapper) OnAdd(obj interface{}) {
-	if m, ok := e.handler.(modernResourceEventHandler); ok {
-		m.OnAdd(obj, false)
-		return
-	}
-	e.handler.(legacyResourceEventHandler).OnAdd(obj)
-}
-
-func (e eventHandlerWrapper) OnUpdate(oldObj, newObj interface{}) {
-	if m, ok := e.handler.(modernResourceEventHandler); ok {
-		m.OnUpdate(oldObj, newObj)
-		return
-	}
-	e.handler.(legacyResourceEventHandler).OnUpdate(oldObj, newObj)
-}
-
-func (e eventHandlerWrapper) OnDelete(obj interface{}) {
-	if m, ok := e.handler.(modernResourceEventHandler); ok {
-		m.OnDelete(obj)
-		return
-	}
-	e.handler.(legacyResourceEventHandler).OnDelete(obj)
+	handlers []cache.ResourceEventHandler
 }
 
 // AddIndexers does nothing.  TODO(community): Implement this.
@@ -98,9 +57,21 @@ func (f *FakeInformer) HasSynced() bool {
 	return f.Synced
 }
 
-// AddEventHandler implements the Informer interface.  Adds an EventHandler to the fake Informers. TODO(community): Implement Registration.
+// AddEventHandler implements the Informer interface. Adds an EventHandler to the fake Informers. TODO(community): Implement Registration.
 func (f *FakeInformer) AddEventHandler(handler cache.ResourceEventHandler) (cache.ResourceEventHandlerRegistration, error) {
-	f.handlers = append(f.handlers, eventHandlerWrapper{handler})
+	f.handlers = append(f.handlers, handler)
+	return nil, nil
+}
+
+// AddEventHandlerWithResyncPeriod implements the Informer interface. Adds an EventHandler to the fake Informers (ignores resyncPeriod). TODO(community): Implement Registration.
+func (f *FakeInformer) AddEventHandlerWithResyncPeriod(handler cache.ResourceEventHandler, _ time.Duration) (cache.ResourceEventHandlerRegistration, error) {
+	f.handlers = append(f.handlers, handler)
+	return nil, nil
+}
+
+// AddEventHandlerWithOptions implements the Informer interface. Adds an EventHandler to the fake Informers (ignores options). TODO(community): Implement Registration.
+func (f *FakeInformer) AddEventHandlerWithOptions(handler cache.ResourceEventHandler, _ cache.HandlerOptions) (cache.ResourceEventHandlerRegistration, error) {
+	f.handlers = append(f.handlers, handler)
 	return nil, nil
 }
 
@@ -109,10 +80,14 @@ func (f *FakeInformer) Run(<-chan struct{}) {
 	f.RunCount++
 }
 
+func (f *FakeInformer) RunWithContext(_ context.Context) {
+	f.RunCount++
+}
+
 // Add fakes an Add event for obj.
 func (f *FakeInformer) Add(obj metav1.Object) {
 	for _, h := range f.handlers {
-		h.OnAdd(obj)
+		h.OnAdd(obj, false)
 	}
 }
 
@@ -130,11 +105,6 @@ func (f *FakeInformer) Delete(obj metav1.Object) {
 	}
 }
 
-// AddEventHandlerWithResyncPeriod does nothing.  TODO(community): Implement this.
-func (f *FakeInformer) AddEventHandlerWithResyncPeriod(handler cache.ResourceEventHandler, resyncPeriod time.Duration) (cache.ResourceEventHandlerRegistration, error) {
-	return nil, nil
-}
-
 // RemoveEventHandler does nothing.  TODO(community): Implement this.
 func (f *FakeInformer) RemoveEventHandler(handle cache.ResourceEventHandlerRegistration) error {
 	return nil
@@ -160,6 +130,11 @@ func (f *FakeInformer) SetWatchErrorHandler(cache.WatchErrorHandler) error {
 	return nil
 }
 
+// SetWatchErrorHandlerWithContext does nothing.  TODO(community): Implement this.
+func (f *FakeInformer) SetWatchErrorHandlerWithContext(cache.WatchErrorHandlerWithContext) error {
+	return nil
+}
+
 // SetTransform does nothing.  TODO(community): Implement this.
 func (f *FakeInformer) SetTransform(t cache.TransformFunc) error {
 	return nil
diff --git a/pkg/controller/controllerutil/controllerutil.go b/pkg/controller/controllerutil/controllerutil.go
index 176ce0db0f..0088f88e5d 100644
--- a/pkg/controller/controllerutil/controllerutil.go
+++ b/pkg/controller/controllerutil/controllerutil.go
@@ -181,6 +181,21 @@ func HasControllerReference(object metav1.Object) bool {
 	return false
 }
 
+// HasOwnerReference returns true if the owners list contains an owner reference
+// that matches the object's group, kind, and name.
+func HasOwnerReference(ownerRefs []metav1.OwnerReference, obj client.Object, scheme *runtime.Scheme) (bool, error) {
+	gvk, err := apiutil.GVKForObject(obj, scheme)
+	if err != nil {
+		return false, err
+	}
+	idx := indexOwnerRef(ownerRefs, metav1.OwnerReference{
+		APIVersion: gvk.GroupVersion().String(),
+		Name:       obj.GetName(),
+		Kind:       gvk.Kind,
+	})
+	return idx != -1, nil
+}
+
 // RemoveControllerReference removes an owner reference where the controller
 // equals true
 func RemoveControllerReference(owner, object metav1.Object, scheme *runtime.Scheme) error {
@@ -263,7 +278,7 @@ func referSameObject(a, b metav1.OwnerReference) bool {
 	return aGV.Group == bGV.Group && a.Kind == b.Kind && a.Name == b.Name
 }
 
-// OperationResult is the action result of a CreateOrUpdate call.
+// OperationResult is the action result of a CreateOrUpdate or CreateOrPatch call.
 type OperationResult string
 
 const ( // They should complete the sentence "Deployment default/foo has been ..."
@@ -279,13 +294,26 @@ const ( // They should complete the sentence "Deployment default/foo has been ..
 	OperationResultUpdatedStatusOnly OperationResult = "updatedStatusOnly"
 )
 
-// CreateOrUpdate creates or updates the given object in the Kubernetes
-// cluster. The object's desired state must be reconciled with the existing
-// state inside the passed in callback MutateFn.
+// CreateOrUpdate attempts to fetch the given object from the Kubernetes cluster.
+// If the object didn't exist, MutateFn will be called, and it will be created.
+// If the object did exist, MutateFn will be called, and if it changed the
+// object, it will be updated.
+// Otherwise, it will be left unchanged.
+// The executed operation (and an error) will be returned.
 //
-// The MutateFn is called regardless of creating or updating an object.
+// WARNING: If the MutateFn resets a value on obj that has a default value,
+// CreateOrUpdate will *always* perform an update. This is because when the
+// object is fetched from the API server, the value will have taken on the
+// default value, and the check for equality will fail. For example, Deployments
+// must have a Replicas value set. If the MutateFn sets a Deployment's Replicas
+// to nil, then it will never match with the object returned from the API
+// server, which defaults the value to 1.
 //
-// It returns the executed operation and an error.
+// WARNING: CreateOrUpdate assumes that no values have been set on obj aside
+// from the Name/Namespace. Values other than Name and Namespace that existed on
+// obj may be overwritten by the corresponding values in the object returned
+// from the Kubernetes API server. When this happens, the Update will not work
+// as expected.
 //
 // Note: changes made by MutateFn to any sub-resource (status...), will be
 // discarded.
@@ -295,9 +323,12 @@ func CreateOrUpdate(ctx context.Context, c client.Client, obj client.Object, f M
 		if !apierrors.IsNotFound(err) {
 			return OperationResultNone, err
 		}
-		if err := mutate(f, key, obj); err != nil {
-			return OperationResultNone, err
+		if f != nil {
+			if err := mutate(f, key, obj); err != nil {
+				return OperationResultNone, err
+			}
 		}
+
 		if err := c.Create(ctx, obj); err != nil {
 			return OperationResultNone, err
 		}
@@ -305,8 +336,10 @@ func CreateOrUpdate(ctx context.Context, c client.Client, obj client.Object, f M
 	}
 
 	existing := obj.DeepCopyObject()
-	if err := mutate(f, key, obj); err != nil {
-		return OperationResultNone, err
+	if f != nil {
+		if err := mutate(f, key, obj); err != nil {
+			return OperationResultNone, err
+		}
 	}
 
 	if equality.Semantic.DeepEqual(existing, obj) {
@@ -319,13 +352,26 @@ func CreateOrUpdate(ctx context.Context, c client.Client, obj client.Object, f M
 	return OperationResultUpdated, nil
 }
 
-// CreateOrPatch creates or patches the given object in the Kubernetes
-// cluster. The object's desired state must be reconciled with the before
-// state inside the passed in callback MutateFn.
+// CreateOrPatch attempts to fetch the given object from the Kubernetes cluster.
+// If the object didn't exist, MutateFn will be called, and it will be created.
+// If the object did exist, MutateFn will be called, and if it changed the
+// object, it will be patched.
+// Otherwise, it will be left unchanged.
+// The executed operation (and an error) will be returned.
 //
-// The MutateFn is called regardless of creating or updating an object.
+// WARNING: If the MutateFn resets a value on obj that has a default value,
+// CreateOrPatch will *always* perform a patch. This is because when the
+// object is fetched from the API server, the value will have taken on the
+// default value, and the check for equality will fail.
+// For example, Deployments must have a Replicas value set. If the MutateFn sets
+// a Deployment's Replicas to nil, then it will never match with the object
+// returned from the API server, which defaults the value to 1.
 //
-// It returns the executed operation and an error.
+// WARNING: CreateOrPatch assumes that no values have been set on obj aside
+// from the Name/Namespace. Values other than Name and Namespace that existed on
+// obj may be overwritten by the corresponding values in the object returned
+// from the Kubernetes API server. When this happens, the Patch will not work
+// as expected.
 //
 // Note: changes to any sub-resource other than status will be ignored.
 // Changes to the status sub-resource will only be applied if the object
diff --git a/pkg/controller/controllerutil/controllerutil_test.go b/pkg/controller/controllerutil/controllerutil_test.go
index d56d59296b..a716667f6a 100644
--- a/pkg/controller/controllerutil/controllerutil_test.go
+++ b/pkg/controller/controllerutil/controllerutil_test.go
@@ -457,7 +457,7 @@ var _ = Describe("Controllerutil", func() {
 		BeforeEach(func() {
 			deploy = &appsv1.Deployment{
 				ObjectMeta: metav1.ObjectMeta{
-					Name:      fmt.Sprintf("deploy-%d", rand.Int31()), //nolint:gosec
+					Name:      fmt.Sprintf("deploy-%d", rand.Int31()),
 					Namespace: "default",
 				},
 			}
@@ -491,8 +491,8 @@ var _ = Describe("Controllerutil", func() {
 			specr = deploymentSpecr(deploy, deplSpec)
 		})
 
-		It("creates a new object if one doesn't exists", func() {
-			op, err := controllerutil.CreateOrUpdate(context.TODO(), c, deploy, specr)
+		It("creates a new object if one doesn't exists", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrUpdate(ctx, c, deploy, specr)
 
 			By("returning no error")
 			Expect(err).NotTo(HaveOccurred())
@@ -502,7 +502,7 @@ var _ = Describe("Controllerutil", func() {
 
 			By("actually having the deployment created")
 			fetched := &appsv1.Deployment{}
-			Expect(c.Get(context.TODO(), deplKey, fetched)).To(Succeed())
+			Expect(c.Get(ctx, deplKey, fetched)).To(Succeed())
 
 			By("being mutated by MutateFn")
 			Expect(fetched.Spec.Template.Spec.Containers).To(HaveLen(1))
@@ -510,13 +510,13 @@ var _ = Describe("Controllerutil", func() {
 			Expect(fetched.Spec.Template.Spec.Containers[0].Image).To(Equal(deplSpec.Template.Spec.Containers[0].Image))
 		})
 
-		It("updates existing object", func() {
+		It("updates existing object", func(ctx SpecContext) {
 			var scale int32 = 2
-			op, err := controllerutil.CreateOrUpdate(context.TODO(), c, deploy, specr)
+			op, err := controllerutil.CreateOrUpdate(ctx, c, deploy, specr)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultCreated))
 
-			op, err = controllerutil.CreateOrUpdate(context.TODO(), c, deploy, deploymentScaler(deploy, scale))
+			op, err = controllerutil.CreateOrUpdate(ctx, c, deploy, deploymentScaler(deploy, scale))
 			By("returning no error")
 			Expect(err).NotTo(HaveOccurred())
 
@@ -525,17 +525,17 @@ var _ = Describe("Controllerutil", func() {
 
 			By("actually having the deployment scaled")
 			fetched := &appsv1.Deployment{}
-			Expect(c.Get(context.TODO(), deplKey, fetched)).To(Succeed())
+			Expect(c.Get(ctx, deplKey, fetched)).To(Succeed())
 			Expect(*fetched.Spec.Replicas).To(Equal(scale))
 		})
 
-		It("updates only changed objects", func() {
-			op, err := controllerutil.CreateOrUpdate(context.TODO(), c, deploy, specr)
+		It("updates only changed objects", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrUpdate(ctx, c, deploy, specr)
 
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultCreated))
 			Expect(err).NotTo(HaveOccurred())
 
-			op, err = controllerutil.CreateOrUpdate(context.TODO(), c, deploy, deploymentIdentity)
+			op, err = controllerutil.CreateOrUpdate(ctx, c, deploy, deploymentIdentity)
 			By("returning no error")
 			Expect(err).NotTo(HaveOccurred())
 
@@ -543,8 +543,8 @@ var _ = Describe("Controllerutil", func() {
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultNone))
 		})
 
-		It("errors when MutateFn changes object name on creation", func() {
-			op, err := controllerutil.CreateOrUpdate(context.TODO(), c, deploy, func() error {
+		It("errors when MutateFn changes object name on creation", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrUpdate(ctx, c, deploy, func() error {
 				Expect(specr()).To(Succeed())
 				return deploymentRenamer(deploy)()
 			})
@@ -556,13 +556,13 @@ var _ = Describe("Controllerutil", func() {
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultNone))
 		})
 
-		It("errors when MutateFn renames an object", func() {
-			op, err := controllerutil.CreateOrUpdate(context.TODO(), c, deploy, specr)
+		It("errors when MutateFn renames an object", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrUpdate(ctx, c, deploy, specr)
 
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultCreated))
 			Expect(err).NotTo(HaveOccurred())
 
-			op, err = controllerutil.CreateOrUpdate(context.TODO(), c, deploy, deploymentRenamer(deploy))
+			op, err = controllerutil.CreateOrUpdate(ctx, c, deploy, deploymentRenamer(deploy))
 
 			By("returning error")
 			Expect(err).To(HaveOccurred())
@@ -571,13 +571,13 @@ var _ = Describe("Controllerutil", func() {
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultNone))
 		})
 
-		It("errors when object namespace changes", func() {
-			op, err := controllerutil.CreateOrUpdate(context.TODO(), c, deploy, specr)
+		It("errors when object namespace changes", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrUpdate(ctx, c, deploy, specr)
 
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultCreated))
 			Expect(err).NotTo(HaveOccurred())
 
-			op, err = controllerutil.CreateOrUpdate(context.TODO(), c, deploy, deploymentNamespaceChanger(deploy))
+			op, err = controllerutil.CreateOrUpdate(ctx, c, deploy, deploymentNamespaceChanger(deploy))
 
 			By("returning error")
 			Expect(err).To(HaveOccurred())
@@ -586,8 +586,8 @@ var _ = Describe("Controllerutil", func() {
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultNone))
 		})
 
-		It("aborts immediately if there was an error initially retrieving the object", func() {
-			op, err := controllerutil.CreateOrUpdate(context.TODO(), errorReader{c}, deploy, func() error {
+		It("aborts immediately if there was an error initially retrieving the object", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrUpdate(ctx, errorReader{c}, deploy, func() error {
 				Fail("Mutation method should not run")
 				return nil
 			})
@@ -606,7 +606,7 @@ var _ = Describe("Controllerutil", func() {
 		BeforeEach(func() {
 			deploy = &appsv1.Deployment{
 				ObjectMeta: metav1.ObjectMeta{
-					Name:      fmt.Sprintf("deploy-%d", rand.Int31()), //nolint:gosec
+					Name:      fmt.Sprintf("deploy-%d", rand.Int31()),
 					Namespace: "default",
 				},
 			}
@@ -640,22 +640,22 @@ var _ = Describe("Controllerutil", func() {
 			specr = deploymentSpecr(deploy, deplSpec)
 		})
 
-		assertLocalDeployWasUpdated := func(fetched *appsv1.Deployment) {
+		assertLocalDeployWasUpdated := func(ctx context.Context, fetched *appsv1.Deployment) {
 			By("local deploy object was updated during patch & has same spec, status, resource version as fetched")
 			if fetched == nil {
 				fetched = &appsv1.Deployment{}
-				ExpectWithOffset(1, c.Get(context.TODO(), deplKey, fetched)).To(Succeed())
+				ExpectWithOffset(1, c.Get(ctx, deplKey, fetched)).To(Succeed())
 			}
 			ExpectWithOffset(1, fetched.ResourceVersion).To(Equal(deploy.ResourceVersion))
 			ExpectWithOffset(1, fetched.Spec).To(BeEquivalentTo(deploy.Spec))
 			ExpectWithOffset(1, fetched.Status).To(BeEquivalentTo(deploy.Status))
 		}
 
-		assertLocalDeployStatusWasUpdated := func(fetched *appsv1.Deployment) {
+		assertLocalDeployStatusWasUpdated := func(ctx context.Context, fetched *appsv1.Deployment) {
 			By("local deploy object was updated during patch & has same spec, status, resource version as fetched")
 			if fetched == nil {
 				fetched = &appsv1.Deployment{}
-				ExpectWithOffset(1, c.Get(context.TODO(), deplKey, fetched)).To(Succeed())
+				ExpectWithOffset(1, c.Get(ctx, deplKey, fetched)).To(Succeed())
 			}
 			ExpectWithOffset(1, fetched.ResourceVersion).To(Equal(deploy.ResourceVersion))
 			ExpectWithOffset(1, *fetched.Spec.Replicas).To(BeEquivalentTo(int32(5)))
@@ -663,8 +663,8 @@ var _ = Describe("Controllerutil", func() {
 			ExpectWithOffset(1, len(fetched.Status.Conditions)).To(BeEquivalentTo(1))
 		}
 
-		It("creates a new object if one doesn't exists", func() {
-			op, err := controllerutil.CreateOrPatch(context.TODO(), c, deploy, specr)
+		It("creates a new object if one doesn't exists", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrPatch(ctx, c, deploy, specr)
 
 			By("returning no error")
 			Expect(err).NotTo(HaveOccurred())
@@ -674,7 +674,7 @@ var _ = Describe("Controllerutil", func() {
 
 			By("actually having the deployment created")
 			fetched := &appsv1.Deployment{}
-			Expect(c.Get(context.TODO(), deplKey, fetched)).To(Succeed())
+			Expect(c.Get(ctx, deplKey, fetched)).To(Succeed())
 
 			By("being mutated by MutateFn")
 			Expect(fetched.Spec.Template.Spec.Containers).To(HaveLen(1))
@@ -682,13 +682,13 @@ var _ = Describe("Controllerutil", func() {
 			Expect(fetched.Spec.Template.Spec.Containers[0].Image).To(Equal(deplSpec.Template.Spec.Containers[0].Image))
 		})
 
-		It("patches existing object", func() {
+		It("patches existing object", func(ctx SpecContext) {
 			var scale int32 = 2
-			op, err := controllerutil.CreateOrPatch(context.TODO(), c, deploy, specr)
+			op, err := controllerutil.CreateOrPatch(ctx, c, deploy, specr)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultCreated))
 
-			op, err = controllerutil.CreateOrPatch(context.TODO(), c, deploy, deploymentScaler(deploy, scale))
+			op, err = controllerutil.CreateOrPatch(ctx, c, deploy, deploymentScaler(deploy, scale))
 			By("returning no error")
 			Expect(err).NotTo(HaveOccurred())
 
@@ -697,29 +697,29 @@ var _ = Describe("Controllerutil", func() {
 
 			By("actually having the deployment scaled")
 			fetched := &appsv1.Deployment{}
-			Expect(c.Get(context.TODO(), deplKey, fetched)).To(Succeed())
+			Expect(c.Get(ctx, deplKey, fetched)).To(Succeed())
 			Expect(*fetched.Spec.Replicas).To(Equal(scale))
-			assertLocalDeployWasUpdated(fetched)
+			assertLocalDeployWasUpdated(ctx, fetched)
 		})
 
-		It("patches only changed objects", func() {
-			op, err := controllerutil.CreateOrPatch(context.TODO(), c, deploy, specr)
+		It("patches only changed objects", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrPatch(ctx, c, deploy, specr)
 
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultCreated))
 			Expect(err).NotTo(HaveOccurred())
 
-			op, err = controllerutil.CreateOrPatch(context.TODO(), c, deploy, deploymentIdentity)
+			op, err = controllerutil.CreateOrPatch(ctx, c, deploy, deploymentIdentity)
 			By("returning no error")
 			Expect(err).NotTo(HaveOccurred())
 
 			By("returning OperationResultNone")
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultNone))
 
-			assertLocalDeployWasUpdated(nil)
+			assertLocalDeployWasUpdated(ctx, nil)
 		})
 
-		It("patches only changed status", func() {
-			op, err := controllerutil.CreateOrPatch(context.TODO(), c, deploy, specr)
+		It("patches only changed status", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrPatch(ctx, c, deploy, specr)
 
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultCreated))
 			Expect(err).NotTo(HaveOccurred())
@@ -728,18 +728,18 @@ var _ = Describe("Controllerutil", func() {
 				ReadyReplicas: 1,
 				Replicas:      3,
 			}
-			op, err = controllerutil.CreateOrPatch(context.TODO(), c, deploy, deploymentStatusr(deploy, deployStatus))
+			op, err = controllerutil.CreateOrPatch(ctx, c, deploy, deploymentStatusr(deploy, deployStatus))
 			By("returning no error")
 			Expect(err).NotTo(HaveOccurred())
 
 			By("returning OperationResultUpdatedStatusOnly")
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultUpdatedStatusOnly))
 
-			assertLocalDeployWasUpdated(nil)
+			assertLocalDeployWasUpdated(ctx, nil)
 		})
 
-		It("patches resource and status", func() {
-			op, err := controllerutil.CreateOrPatch(context.TODO(), c, deploy, specr)
+		It("patches resource and status", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrPatch(ctx, c, deploy, specr)
 
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultCreated))
 			Expect(err).NotTo(HaveOccurred())
@@ -749,7 +749,7 @@ var _ = Describe("Controllerutil", func() {
 				ReadyReplicas: 1,
 				Replicas:      replicas,
 			}
-			op, err = controllerutil.CreateOrPatch(context.TODO(), c, deploy, func() error {
+			op, err = controllerutil.CreateOrPatch(ctx, c, deploy, func() error {
 				Expect(deploymentScaler(deploy, replicas)()).To(Succeed())
 				return deploymentStatusr(deploy, deployStatus)()
 			})
@@ -759,11 +759,11 @@ var _ = Describe("Controllerutil", func() {
 			By("returning OperationResultUpdatedStatus")
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultUpdatedStatus))
 
-			assertLocalDeployWasUpdated(nil)
+			assertLocalDeployWasUpdated(ctx, nil)
 		})
 
-		It("patches resource and not empty status", func() {
-			op, err := controllerutil.CreateOrPatch(context.TODO(), c, deploy, specr)
+		It("patches resource and not empty status", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrPatch(ctx, c, deploy, specr)
 
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultCreated))
 			Expect(err).NotTo(HaveOccurred())
@@ -773,7 +773,7 @@ var _ = Describe("Controllerutil", func() {
 				ReadyReplicas: 1,
 				Replicas:      replicas,
 			}
-			op, err = controllerutil.CreateOrPatch(context.TODO(), c, deploy, func() error {
+			op, err = controllerutil.CreateOrPatch(ctx, c, deploy, func() error {
 				Expect(deploymentScaler(deploy, replicas)()).To(Succeed())
 				return deploymentStatusr(deploy, deployStatus)()
 			})
@@ -783,9 +783,9 @@ var _ = Describe("Controllerutil", func() {
 			By("returning OperationResultUpdatedStatus")
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultUpdatedStatus))
 
-			assertLocalDeployWasUpdated(nil)
+			assertLocalDeployWasUpdated(ctx, nil)
 
-			op, err = controllerutil.CreateOrPatch(context.TODO(), c, deploy, func() error {
+			op, err = controllerutil.CreateOrPatch(ctx, c, deploy, func() error {
 				deploy.Spec.Replicas = ptr.To(int32(5))
 				deploy.Status.Conditions = []appsv1.DeploymentCondition{{
 					Type:   appsv1.DeploymentProgressing,
@@ -799,11 +799,11 @@ var _ = Describe("Controllerutil", func() {
 			By("returning OperationResultUpdatedStatus")
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultUpdatedStatus))
 
-			assertLocalDeployStatusWasUpdated(nil)
+			assertLocalDeployStatusWasUpdated(ctx, nil)
 		})
 
-		It("errors when MutateFn changes object name on creation", func() {
-			op, err := controllerutil.CreateOrPatch(context.TODO(), c, deploy, func() error {
+		It("errors when MutateFn changes object name on creation", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrPatch(ctx, c, deploy, func() error {
 				Expect(specr()).To(Succeed())
 				return deploymentRenamer(deploy)()
 			})
@@ -815,13 +815,13 @@ var _ = Describe("Controllerutil", func() {
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultNone))
 		})
 
-		It("errors when MutateFn renames an object", func() {
-			op, err := controllerutil.CreateOrPatch(context.TODO(), c, deploy, specr)
+		It("errors when MutateFn renames an object", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrPatch(ctx, c, deploy, specr)
 
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultCreated))
 			Expect(err).NotTo(HaveOccurred())
 
-			op, err = controllerutil.CreateOrPatch(context.TODO(), c, deploy, deploymentRenamer(deploy))
+			op, err = controllerutil.CreateOrPatch(ctx, c, deploy, deploymentRenamer(deploy))
 
 			By("returning error")
 			Expect(err).To(HaveOccurred())
@@ -830,13 +830,13 @@ var _ = Describe("Controllerutil", func() {
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultNone))
 		})
 
-		It("errors when object namespace changes", func() {
-			op, err := controllerutil.CreateOrPatch(context.TODO(), c, deploy, specr)
+		It("errors when object namespace changes", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrPatch(ctx, c, deploy, specr)
 
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultCreated))
 			Expect(err).NotTo(HaveOccurred())
 
-			op, err = controllerutil.CreateOrPatch(context.TODO(), c, deploy, deploymentNamespaceChanger(deploy))
+			op, err = controllerutil.CreateOrPatch(ctx, c, deploy, deploymentNamespaceChanger(deploy))
 
 			By("returning error")
 			Expect(err).To(HaveOccurred())
@@ -845,8 +845,8 @@ var _ = Describe("Controllerutil", func() {
 			Expect(op).To(BeEquivalentTo(controllerutil.OperationResultNone))
 		})
 
-		It("aborts immediately if there was an error initially retrieving the object", func() {
-			op, err := controllerutil.CreateOrPatch(context.TODO(), errorReader{c}, deploy, func() error {
+		It("aborts immediately if there was an error initially retrieving the object", func(ctx SpecContext) {
+			op, err := controllerutil.CreateOrPatch(ctx, errorReader{c}, deploy, func() error {
 				Fail("Mutation method should not run")
 				return nil
 			})
@@ -957,6 +957,33 @@ var _ = Describe("Controllerutil", func() {
 				Expect(controllerutil.ContainsFinalizer(deploy, testFinalizer)).To(BeFalse())
 			})
 		})
+
+		Describe("HasOwnerReference", func() {
+			It("should return true if the object has the owner reference", func() {
+				rs := &appsv1.ReplicaSet{
+					ObjectMeta: metav1.ObjectMeta{Name: "foo", UID: "foo-uid"},
+				}
+				dep := &extensionsv1beta1.Deployment{
+					ObjectMeta: metav1.ObjectMeta{Name: "foo", UID: "foo-uid"},
+				}
+				Expect(controllerutil.SetOwnerReference(dep, rs, scheme.Scheme)).ToNot(HaveOccurred())
+				b, err := controllerutil.HasOwnerReference(rs.GetOwnerReferences(), dep, scheme.Scheme)
+				Expect(err).NotTo(HaveOccurred())
+				Expect(b).To(BeTrue())
+			})
+
+			It("should return false if the object does not have the owner reference", func() {
+				rs := &appsv1.ReplicaSet{
+					ObjectMeta: metav1.ObjectMeta{Name: "foo", UID: "foo-uid"},
+				}
+				dep := &extensionsv1beta1.Deployment{
+					ObjectMeta: metav1.ObjectMeta{Name: "foo", UID: "foo-uid"},
+				}
+				b, err := controllerutil.HasOwnerReference(rs.GetOwnerReferences(), dep, scheme.Scheme)
+				Expect(err).NotTo(HaveOccurred())
+				Expect(b).To(BeFalse())
+			})
+		})
 	})
 })
 
diff --git a/pkg/controller/example_test.go b/pkg/controller/example_test.go
index aea5943450..e3c4b6a092 100644
--- a/pkg/controller/example_test.go
+++ b/pkg/controller/example_test.go
@@ -129,7 +129,7 @@ func ExampleNewUnmanaged() {
 
 	// Configure creates a new controller but does not add it to the supplied
 	// manager.
-	c, err := controller.NewUnmanaged("pod-controller", mgr, controller.Options{
+	c, err := controller.NewUnmanaged("pod-controller", controller.Options{
 		Reconciler: reconcile.Func(func(context.Context, reconcile.Request) (reconcile.Result, error) {
 			return reconcile.Result{}, nil
 		}),
diff --git a/pkg/controller/name.go b/pkg/controller/name.go
index 0e71a01c66..00ca655128 100644
--- a/pkg/controller/name.go
+++ b/pkg/controller/name.go
@@ -34,7 +34,7 @@ func checkName(name string) error {
 	}
 
 	if usedNames.Has(name) {
-		return fmt.Errorf("controller with name %s already exists. Controller names must be unique to avoid multiple controllers reporting to the same metric", name)
+		return fmt.Errorf("controller with name %s already exists. Controller names must be unique to avoid multiple controllers reporting the same metric. This validation can be disabled via the SkipNameValidation option", name)
 	}
 
 	usedNames.Insert(name)
diff --git a/pkg/controller/priorityqueue/metrics.go b/pkg/controller/priorityqueue/metrics.go
new file mode 100644
index 0000000000..967a252dfb
--- /dev/null
+++ b/pkg/controller/priorityqueue/metrics.go
@@ -0,0 +1,172 @@
+package priorityqueue
+
+import (
+	"sync"
+	"time"
+
+	"k8s.io/client-go/util/workqueue"
+	"k8s.io/utils/clock"
+	"sigs.k8s.io/controller-runtime/pkg/internal/metrics"
+)
+
+// This file is mostly a copy of unexported code from
+// https://github.com/kubernetes/kubernetes/blob/1d8828ce707ed9dd7a6a9756385419cce1d202ac/staging/src/k8s.io/client-go/util/workqueue/metrics.go
+//
+// The only two differences are the addition of mapLock in defaultQueueMetrics and converging retryMetrics into queueMetrics.
+
+type queueMetrics[T comparable] interface {
+	add(item T, priority int)
+	get(item T, priority int)
+	updateDepthWithPriorityMetric(oldPriority, newPriority int)
+	done(item T)
+	updateUnfinishedWork()
+	retry()
+}
+
+func newQueueMetrics[T comparable](mp workqueue.MetricsProvider, name string, clock clock.Clock) queueMetrics[T] {
+	if len(name) == 0 {
+		return noMetrics[T]{}
+	}
+
+	dqm := &defaultQueueMetrics[T]{
+		clock:                   clock,
+		adds:                    mp.NewAddsMetric(name),
+		latency:                 mp.NewLatencyMetric(name),
+		workDuration:            mp.NewWorkDurationMetric(name),
+		unfinishedWorkSeconds:   mp.NewUnfinishedWorkSecondsMetric(name),
+		longestRunningProcessor: mp.NewLongestRunningProcessorSecondsMetric(name),
+		addTimes:                map[T]time.Time{},
+		processingStartTimes:    map[T]time.Time{},
+		retries:                 mp.NewRetriesMetric(name),
+	}
+
+	if mpp, ok := mp.(metrics.MetricsProviderWithPriority); ok {
+		dqm.depthWithPriority = mpp.NewDepthMetricWithPriority(name)
+	} else {
+		dqm.depth = mp.NewDepthMetric(name)
+	}
+	return dqm
+}
+
+// defaultQueueMetrics expects the caller to lock before setting any metrics.
+type defaultQueueMetrics[T comparable] struct {
+	clock clock.Clock
+
+	// current depth of a workqueue
+	depth             workqueue.GaugeMetric
+	depthWithPriority metrics.DepthMetricWithPriority
+	// total number of adds handled by a workqueue
+	adds workqueue.CounterMetric
+	// how long an item stays in a workqueue
+	latency workqueue.HistogramMetric
+	// how long processing an item from a workqueue takes
+	workDuration workqueue.HistogramMetric
+
+	mapLock              sync.RWMutex
+	addTimes             map[T]time.Time
+	processingStartTimes map[T]time.Time
+
+	// how long have current threads been working?
+	unfinishedWorkSeconds   workqueue.SettableGaugeMetric
+	longestRunningProcessor workqueue.SettableGaugeMetric
+
+	retries workqueue.CounterMetric
+}
+
+// add is called for ready items only
+func (m *defaultQueueMetrics[T]) add(item T, priority int) {
+	if m == nil {
+		return
+	}
+
+	m.adds.Inc()
+	if m.depthWithPriority != nil {
+		m.depthWithPriority.Inc(priority)
+	} else {
+		m.depth.Inc()
+	}
+
+	m.mapLock.Lock()
+	defer m.mapLock.Unlock()
+
+	if _, exists := m.addTimes[item]; !exists {
+		m.addTimes[item] = m.clock.Now()
+	}
+}
+
+func (m *defaultQueueMetrics[T]) get(item T, priority int) {
+	if m == nil {
+		return
+	}
+
+	if m.depthWithPriority != nil {
+		m.depthWithPriority.Dec(priority)
+	} else {
+		m.depth.Dec()
+	}
+
+	m.mapLock.Lock()
+	defer m.mapLock.Unlock()
+
+	m.processingStartTimes[item] = m.clock.Now()
+	if startTime, exists := m.addTimes[item]; exists {
+		m.latency.Observe(m.sinceInSeconds(startTime))
+		delete(m.addTimes, item)
+	}
+}
+
+func (m *defaultQueueMetrics[T]) updateDepthWithPriorityMetric(oldPriority, newPriority int) {
+	if m.depthWithPriority != nil {
+		m.depthWithPriority.Dec(oldPriority)
+		m.depthWithPriority.Inc(newPriority)
+	}
+}
+
+func (m *defaultQueueMetrics[T]) done(item T) {
+	if m == nil {
+		return
+	}
+
+	m.mapLock.Lock()
+	defer m.mapLock.Unlock()
+	if startTime, exists := m.processingStartTimes[item]; exists {
+		m.workDuration.Observe(m.sinceInSeconds(startTime))
+		delete(m.processingStartTimes, item)
+	}
+}
+
+func (m *defaultQueueMetrics[T]) updateUnfinishedWork() {
+	m.mapLock.RLock()
+	defer m.mapLock.RUnlock()
+	// Note that a summary metric would be better for this, but prometheus
+	// doesn't seem to have non-hacky ways to reset the summary metrics.
+	var total float64
+	var oldest float64
+	for _, t := range m.processingStartTimes {
+		age := m.sinceInSeconds(t)
+		total += age
+		if age > oldest {
+			oldest = age
+		}
+	}
+	m.unfinishedWorkSeconds.Set(total)
+	m.longestRunningProcessor.Set(oldest)
+}
+
+// Gets the time since the specified start in seconds.
+func (m *defaultQueueMetrics[T]) sinceInSeconds(start time.Time) float64 {
+	return m.clock.Since(start).Seconds()
+}
+
+func (m *defaultQueueMetrics[T]) retry() {
+	m.retries.Inc()
+}
+
+type noMetrics[T any] struct{}
+
+func (noMetrics[T]) add(item T, priority int)                                   {}
+func (noMetrics[T]) get(item T, priority int)                                   {}
+func (noMetrics[T]) updateDepthWithPriorityMetric(oldPriority, newPriority int) {}
+func (noMetrics[T]) done(item T)                                                {}
+func (noMetrics[T]) updateUnfinishedWork()                                      {}
+func (noMetrics[T]) retry()                                                     {}
diff --git a/pkg/controller/priorityqueue/metrics_test.go b/pkg/controller/priorityqueue/metrics_test.go
new file mode 100644
index 0000000000..3be3989d89
--- /dev/null
+++ b/pkg/controller/priorityqueue/metrics_test.go
@@ -0,0 +1,141 @@
+package priorityqueue
+
+import (
+	"sync"
+
+	"k8s.io/client-go/util/workqueue"
+	"sigs.k8s.io/controller-runtime/pkg/internal/metrics"
+)
+
+func newFakeMetricsProvider() *fakeMetricsProvider {
+	return &fakeMetricsProvider{
+		depth:                   make(map[string]map[int]int),
+		adds:                    make(map[string]int),
+		latency:                 make(map[string][]float64),
+		workDuration:            make(map[string][]float64),
+		unfinishedWorkSeconds:   make(map[string]float64),
+		longestRunningProcessor: make(map[string]float64),
+		retries:                 make(map[string]int),
+		mu:                      sync.Mutex{},
+	}
+}
+
+var _ metrics.MetricsProviderWithPriority = &fakeMetricsProvider{}
+
+type fakeMetricsProvider struct {
+	depth                   map[string]map[int]int
+	adds                    map[string]int
+	latency                 map[string][]float64
+	workDuration            map[string][]float64
+	unfinishedWorkSeconds   map[string]float64
+	longestRunningProcessor map[string]float64
+	retries                 map[string]int
+	mu                      sync.Mutex
+}
+
+func (f *fakeMetricsProvider) NewDepthMetric(name string) workqueue.GaugeMetric {
+	panic("Should never be called. Expected NewDepthMetricWithPriority to be called instead")
+}
+
+func (f *fakeMetricsProvider) NewDepthMetricWithPriority(name string) metrics.DepthMetricWithPriority {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.depth[name] = map[int]int{}
+	return &fakeGaugeMetric{m: &f.depth, mu: &f.mu, name: name}
+}
+
+func (f *fakeMetricsProvider) NewAddsMetric(name string) workqueue.CounterMetric {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.adds[name] = 0
+	return &fakeCounterMetric{m: &f.adds, mu: &f.mu, name: name}
+}
+
+func (f *fakeMetricsProvider) NewLatencyMetric(name string) workqueue.HistogramMetric {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.latency[name] = []float64{}
+	return &fakeHistogramMetric{m: &f.latency, mu: &f.mu, name: name}
+}
+
+func (f *fakeMetricsProvider) NewWorkDurationMetric(name string) workqueue.HistogramMetric {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.workDuration[name] = []float64{}
+	return &fakeHistogramMetric{m: &f.workDuration, mu: &f.mu, name: name}
+}
+
+func (f *fakeMetricsProvider) NewUnfinishedWorkSecondsMetric(name string) workqueue.SettableGaugeMetric {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.unfinishedWorkSeconds[name] = 0
+	return &fakeSettableGaugeMetric{m: &f.unfinishedWorkSeconds, mu: &f.mu, name: name}
+}
+
+func (f *fakeMetricsProvider) NewLongestRunningProcessorSecondsMetric(name string) workqueue.SettableGaugeMetric {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.longestRunningProcessor[name] = 0
+	return &fakeSettableGaugeMetric{m: &f.longestRunningProcessor, mu: &f.mu, name: name}
+}
+
+func (f *fakeMetricsProvider) NewRetriesMetric(name string) workqueue.CounterMetric {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.retries[name] = 0
+	return &fakeCounterMetric{m: &f.retries, mu: &f.mu, name: name}
+}
+
+type fakeGaugeMetric struct {
+	m    *map[string]map[int]int
+	mu   *sync.Mutex
+	name string
+}
+
+func (fg *fakeGaugeMetric) Inc(priority int) {
+	fg.mu.Lock()
+	defer fg.mu.Unlock()
+	(*fg.m)[fg.name][priority]++
+}
+
+func (fg *fakeGaugeMetric) Dec(priority int) {
+	fg.mu.Lock()
+	defer fg.mu.Unlock()
+	(*fg.m)[fg.name][priority]--
+}
+
+type fakeCounterMetric struct {
+	m    *map[string]int
+	mu   *sync.Mutex
+	name string
+}
+
+func (fc *fakeCounterMetric) Inc() {
+	fc.mu.Lock()
+	defer fc.mu.Unlock()
+	(*fc.m)[fc.name]++
+}
+
+type fakeHistogramMetric struct {
+	m    *map[string][]float64
+	mu   *sync.Mutex
+	name string
+}
+
+func (fh *fakeHistogramMetric) Observe(v float64) {
+	fh.mu.Lock()
+	defer fh.mu.Unlock()
+	(*fh.m)[fh.name] = append((*fh.m)[fh.name], v)
+}
+
+type fakeSettableGaugeMetric struct {
+	m    *map[string]float64
+	mu   *sync.Mutex
+	name string
+}
+
+func (fs *fakeSettableGaugeMetric) Set(v float64) {
+	fs.mu.Lock()
+	defer fs.mu.Unlock()
+	(*fs.m)[fs.name] = v
+}
diff --git a/pkg/controller/priorityqueue/priorityqueue.go b/pkg/controller/priorityqueue/priorityqueue.go
new file mode 100644
index 0000000000..98df84c56b
--- /dev/null
+++ b/pkg/controller/priorityqueue/priorityqueue.go
@@ -0,0 +1,460 @@
+package priorityqueue
+
+import (
+	"math"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/go-logr/logr"
+	"github.com/google/btree"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/client-go/util/workqueue"
+	"k8s.io/utils/clock"
+	"k8s.io/utils/ptr"
+
+	"sigs.k8s.io/controller-runtime/pkg/internal/metrics"
+)
+
+// AddOpts describes the options for adding items to the queue.
+type AddOpts struct {
+	After       time.Duration
+	RateLimited bool
+	// Priority is the priority of the item. Higher values
+	// indicate higher priority.
+	// Defaults to zero if unset.
+	Priority *int
+}
+
+// PriorityQueue is a priority queue for a controller. It
+// internally de-duplicates all items that are added to
+// it. It will use the max of the passed priorities and the
+// min of possible durations.
+type PriorityQueue[T comparable] interface {
+	workqueue.TypedRateLimitingInterface[T]
+	AddWithOpts(o AddOpts, Items ...T)
+	GetWithPriority() (item T, priority int, shutdown bool)
+}
+
+// Opts contains the options for a PriorityQueue.
+type Opts[T comparable] struct {
+	// Ratelimiter is being used when AddRateLimited is called. Defaults to a per-item exponential backoff
+	// limiter with an initial delay of five milliseconds and a max delay of 1000 seconds.
+	RateLimiter    workqueue.TypedRateLimiter[T]
+	MetricProvider workqueue.MetricsProvider
+	Log            logr.Logger
+}
+
+// Opt allows to configure a PriorityQueue.
+type Opt[T comparable] func(*Opts[T])
+
+// New constructs a new PriorityQueue.
+func New[T comparable](name string, o ...Opt[T]) PriorityQueue[T] {
+	opts := &Opts[T]{}
+	for _, f := range o {
+		f(opts)
+	}
+
+	if opts.RateLimiter == nil {
+		opts.RateLimiter = workqueue.NewTypedItemExponentialFailureRateLimiter[T](5*time.Millisecond, 1000*time.Second)
+	}
+
+	if opts.MetricProvider == nil {
+		opts.MetricProvider = metrics.WorkqueueMetricsProvider{}
+	}
+
+	pq := &priorityqueue[T]{
+		log:         opts.Log,
+		items:       map[T]*item[T]{},
+		queue:       btree.NewG(32, less[T]),
+		becameReady: sets.Set[T]{},
+		metrics:     newQueueMetrics[T](opts.MetricProvider, name, clock.RealClock{}),
+		// itemOrWaiterAdded indicates that an item or
+		// waiter was added. It must be buffered, because
+		// if we currently process items we can't tell
+		// if that included the new item/waiter.
+		itemOrWaiterAdded: make(chan struct{}, 1),
+		rateLimiter:       opts.RateLimiter,
+		locked:            sets.Set[T]{},
+		done:              make(chan struct{}),
+		get:               make(chan item[T]),
+		now:               time.Now,
+		tick:              time.Tick,
+	}
+
+	go pq.spin()
+	go pq.logState()
+	if _, ok := pq.metrics.(noMetrics[T]); !ok {
+		go pq.updateUnfinishedWorkLoop()
+	}
+
+	return pq
+}
+
+type priorityqueue[T comparable] struct {
+	log logr.Logger
+	// lock has to be acquired for any access any of items, queue, addedCounter
+	// or becameReady
+	lock  sync.Mutex
+	items map[T]*item[T]
+	queue bTree[*item[T]]
+
+	// addedCounter is a counter of elements added, we need it
+	// because unixNano is not guaranteed to be unique.
+	addedCounter uint64
+
+	// becameReady holds items that are in the queue, were added
+	// with non-zero after and became ready. We need it to call the
+	// metrics add exactly once for them.
+	becameReady sets.Set[T]
+	metrics     queueMetrics[T]
+
+	itemOrWaiterAdded chan struct{}
+
+	rateLimiter workqueue.TypedRateLimiter[T]
+
+	// locked contains the keys we handed out through Get() and that haven't
+	// yet been returned through Done().
+	locked     sets.Set[T]
+	lockedLock sync.RWMutex
+
+	shutdown atomic.Bool
+	done     chan struct{}
+
+	get chan item[T]
+
+	// waiters is the number of routines blocked in Get, we use it to determine
+	// if we can push items.
+	waiters atomic.Int64
+
+	// Configurable for testing
+	now  func() time.Time
+	tick func(time.Duration) <-chan time.Time
+}
+
+func (w *priorityqueue[T]) AddWithOpts(o AddOpts, items ...T) {
+	if w.shutdown.Load() {
+		return
+	}
+
+	w.lock.Lock()
+	defer w.lock.Unlock()
+
+	for _, key := range items {
+		after := o.After
+		if o.RateLimited {
+			rlAfter := w.rateLimiter.When(key)
+			if after == 0 || rlAfter < after {
+				after = rlAfter
+			}
+		}
+
+		var readyAt *time.Time
+		if after > 0 {
+			readyAt = ptr.To(w.now().Add(after))
+			w.metrics.retry()
+		}
+		if _, ok := w.items[key]; !ok {
+			item := &item[T]{
+				Key:          key,
+				AddedCounter: w.addedCounter,
+				Priority:     ptr.Deref(o.Priority, 0),
+				ReadyAt:      readyAt,
+			}
+			w.items[key] = item
+			w.queue.ReplaceOrInsert(item)
+			if item.ReadyAt == nil {
+				w.metrics.add(key, item.Priority)
+			}
+			w.addedCounter++
+			continue
+		}
+
+		// The b-tree de-duplicates based on ordering and any change here
+		// will affect the order - Just delete and re-add.
+		item, _ := w.queue.Delete(w.items[key])
+		if newPriority := ptr.Deref(o.Priority, 0); newPriority > item.Priority {
+			// Update depth metric only if the item in the queue was already added to the depth metric.
+			if item.ReadyAt == nil || w.becameReady.Has(key) {
+				w.metrics.updateDepthWithPriorityMetric(item.Priority, newPriority)
+			}
+			item.Priority = newPriority
+		}
+
+		if item.ReadyAt != nil && (readyAt == nil || readyAt.Before(*item.ReadyAt)) {
+			if readyAt == nil && !w.becameReady.Has(key) {
+				w.metrics.add(key, item.Priority)
+			}
+			item.ReadyAt = readyAt
+		}
+
+		w.queue.ReplaceOrInsert(item)
+	}
+
+	if len(items) > 0 {
+		w.notifyItemOrWaiterAdded()
+	}
+}
+
+func (w *priorityqueue[T]) notifyItemOrWaiterAdded() {
+	select {
+	case w.itemOrWaiterAdded <- struct{}{}:
+	default:
+	}
+}
+
+func (w *priorityqueue[T]) spin() {
+	blockForever := make(chan time.Time)
+	var nextReady <-chan time.Time
+	nextReady = blockForever
+	var nextItemReadyAt time.Time
+
+	for {
+		select {
+		case <-w.done:
+			return
+		case <-w.itemOrWaiterAdded:
+		case <-nextReady:
+			nextReady = blockForever
+			nextItemReadyAt = time.Time{}
+		}
+
+		func() {
+			w.lock.Lock()
+			defer w.lock.Unlock()
+
+			w.lockedLock.Lock()
+			defer w.lockedLock.Unlock()
+
+			// manipulating the tree from within Ascend might lead to panics, so
+			// track what we want to delete and do it after we are done ascending.
+			var toDelete []*item[T]
+
+			var key T
+
+			// Items in the queue tree are sorted first by priority and second by readiness, so
+			// items with a lower priority might be ready further down in the queue.
+			// We iterate through the priorities high to low until we find a ready item
+			pivot := item[T]{
+				Key:          key,
+				AddedCounter: 0,
+				Priority:     math.MaxInt,
+				ReadyAt:      nil,
+			}
+
+			for {
+				pivotChange := false
+
+				w.queue.AscendGreaterOrEqual(&pivot, func(item *item[T]) bool {
+					// Item is locked, we can not hand it out
+					if w.locked.Has(item.Key) {
+						return true
+					}
+
+					if item.ReadyAt != nil {
+						if readyAt := item.ReadyAt.Sub(w.now()); readyAt > 0 {
+							if nextItemReadyAt.After(*item.ReadyAt) || nextItemReadyAt.IsZero() {
+								nextReady = w.tick(readyAt)
+								nextItemReadyAt = *item.ReadyAt
+							}
+
+							// Adjusting the pivot item moves the ascend to the next lower priority
+							pivot.Priority = item.Priority - 1
+							pivotChange = true
+							return false
+						}
+						if !w.becameReady.Has(item.Key) {
+							w.metrics.add(item.Key, item.Priority)
+							w.becameReady.Insert(item.Key)
+						}
+					}
+
+					if w.waiters.Load() == 0 {
+						// Have to keep iterating here to ensure we update metrics
+						// for further items that became ready and set nextReady.
+						return true
+					}
+
+					w.metrics.get(item.Key, item.Priority)
+					w.locked.Insert(item.Key)
+					w.waiters.Add(-1)
+					delete(w.items, item.Key)
+					toDelete = append(toDelete, item)
+					w.becameReady.Delete(item.Key)
+					w.get <- *item
+
+					return true
+				})
+
+				if !pivotChange {
+					break
+				}
+			}
+
+			for _, item := range toDelete {
+				w.queue.Delete(item)
+			}
+		}()
+	}
+}
+
+func (w *priorityqueue[T]) Add(item T) {
+	w.AddWithOpts(AddOpts{}, item)
+}
+
+func (w *priorityqueue[T]) AddAfter(item T, after time.Duration) {
+	w.AddWithOpts(AddOpts{After: after}, item)
+}
+
+func (w *priorityqueue[T]) AddRateLimited(item T) {
+	w.AddWithOpts(AddOpts{RateLimited: true}, item)
+}
+
+func (w *priorityqueue[T]) GetWithPriority() (_ T, priority int, shutdown bool) {
+	if w.shutdown.Load() {
+		var zero T
+		return zero, 0, true
+	}
+
+	w.waiters.Add(1)
+
+	w.notifyItemOrWaiterAdded()
+
+	select {
+	case <-w.done:
+		// Return if the queue was shutdown while we were already waiting for an item here.
+		// For example controller workers are continuously calling GetWithPriority and
+		// GetWithPriority is blocking the workers if there are no items in the queue.
+		// If the controller and accordingly the queue is then shut down, without this code
+		// branch the controller workers remain blocked here and are unable to shut down.
+		var zero T
+		return zero, 0, true
+	case item := <-w.get:
+		return item.Key, item.Priority, w.shutdown.Load()
+	}
+}
+
+func (w *priorityqueue[T]) Get() (item T, shutdown bool) {
+	key, _, shutdown := w.GetWithPriority()
+	return key, shutdown
+}
+
+func (w *priorityqueue[T]) Forget(item T) {
+	w.rateLimiter.Forget(item)
+}
+
+func (w *priorityqueue[T]) NumRequeues(item T) int {
+	return w.rateLimiter.NumRequeues(item)
+}
+
+func (w *priorityqueue[T]) ShuttingDown() bool {
+	return w.shutdown.Load()
+}
+
+func (w *priorityqueue[T]) Done(item T) {
+	w.lockedLock.Lock()
+	defer w.lockedLock.Unlock()
+	w.locked.Delete(item)
+	w.metrics.done(item)
+	w.notifyItemOrWaiterAdded()
+}
+
+func (w *priorityqueue[T]) ShutDown() {
+	w.shutdown.Store(true)
+	close(w.done)
+}
+
+// ShutDownWithDrain just calls ShutDown, as the draining
+// functionality is not used by controller-runtime.
+func (w *priorityqueue[T]) ShutDownWithDrain() {
+	w.ShutDown()
+}
+
+// Len returns the number of items that are ready to be
+// picked up. It does not include items that are not yet
+// ready.
+func (w *priorityqueue[T]) Len() int {
+	w.lock.Lock()
+	defer w.lock.Unlock()
+
+	var result int
+	w.queue.Ascend(func(item *item[T]) bool {
+		if item.ReadyAt == nil || item.ReadyAt.Compare(w.now()) <= 0 {
+			result++
+			return true
+		}
+		return false
+	})
+
+	return result
+}
+
+func (w *priorityqueue[T]) logState() {
+	t := time.Tick(10 * time.Second)
+	for {
+		select {
+		case <-w.done:
+			return
+		case <-t:
+		}
+
+		// Log level may change at runtime, so keep the
+		// loop going even if a given level is currently
+		// not enabled.
+		if !w.log.V(5).Enabled() {
+			continue
+		}
+		w.lock.Lock()
+		items := make([]*item[T], 0, len(w.items))
+		w.queue.Ascend(func(item *item[T]) bool {
+			items = append(items, item)
+			return true
+		})
+		w.lock.Unlock()
+
+		w.log.V(5).Info("workqueue_items", "items", items)
+	}
+}
+
+func less[T comparable](a, b *item[T]) bool {
+	if a.Priority != b.Priority {
+		return a.Priority > b.Priority
+	}
+	if a.ReadyAt == nil && b.ReadyAt != nil {
+		return true
+	}
+	if b.ReadyAt == nil && a.ReadyAt != nil {
+		return false
+	}
+	if a.ReadyAt != nil && b.ReadyAt != nil && !a.ReadyAt.Equal(*b.ReadyAt) {
+		return a.ReadyAt.Before(*b.ReadyAt)
+	}
+
+	return a.AddedCounter < b.AddedCounter
+}
+
+type item[T comparable] struct {
+	Key          T          `json:"key"`
+	AddedCounter uint64     `json:"addedCounter"`
+	Priority     int        `json:"priority"`
+	ReadyAt      *time.Time `json:"readyAt,omitempty"`
+}
+
+func (w *priorityqueue[T]) updateUnfinishedWorkLoop() {
+	t := time.Tick(500 * time.Millisecond) // borrowed from workqueue: https://github.com/kubernetes/kubernetes/blob/67a807bf142c7a2a5ecfdb2a5d24b4cdea4cc79c/staging/src/k8s.io/client-go/util/workqueue/queue.go#L182
+	for {
+		select {
+		case <-w.done:
+			return
+		case <-t:
+		}
+		w.metrics.updateUnfinishedWork()
+	}
+}
+
+type bTree[T any] interface {
+	ReplaceOrInsert(item T) (_ T, _ bool)
+	Delete(item T) (T, bool)
+	Ascend(iterator btree.ItemIteratorG[T])
+	AscendGreaterOrEqual(pivot T, iterator btree.ItemIteratorG[T])
+}
diff --git a/pkg/controller/priorityqueue/priorityqueue_suite_test.go b/pkg/controller/priorityqueue/priorityqueue_suite_test.go
new file mode 100644
index 0000000000..71bc5ba049
--- /dev/null
+++ b/pkg/controller/priorityqueue/priorityqueue_suite_test.go
@@ -0,0 +1,13 @@
+package priorityqueue
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+func TestControllerWorkqueue(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "ControllerWorkqueue Suite")
+}
diff --git a/pkg/controller/priorityqueue/priorityqueue_test.go b/pkg/controller/priorityqueue/priorityqueue_test.go
new file mode 100644
index 0000000000..d0cc51f7c5
--- /dev/null
+++ b/pkg/controller/priorityqueue/priorityqueue_test.go
@@ -0,0 +1,803 @@
+package priorityqueue
+
+import (
+	"fmt"
+	"math/rand/v2"
+	"sync"
+	"testing"
+	"time"
+
+	fuzz "github.com/google/gofuzz"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/client-go/util/workqueue"
+	"k8s.io/utils/ptr"
+)
+
+var _ = Describe("Controllerworkqueue", func() {
+	It("returns an item", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+		q.AddWithOpts(AddOpts{}, "foo")
+
+		item, _, _ := q.GetWithPriority()
+		Expect(item).To(Equal("foo"))
+
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 0}))
+		Expect(metrics.adds["test"]).To(Equal(1))
+		Expect(metrics.retries["test"]).To(Equal(0))
+	})
+
+	It("returns items in order", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		q.AddWithOpts(AddOpts{}, "foo")
+		q.AddWithOpts(AddOpts{}, "bar")
+
+		item, _, _ := q.GetWithPriority()
+		Expect(item).To(Equal("foo"))
+		item, _, _ = q.GetWithPriority()
+		Expect(item).To(Equal("bar"))
+
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 0}))
+		Expect(metrics.adds["test"]).To(Equal(2))
+	})
+
+	It("doesn't return an item that is currently locked", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		q.AddWithOpts(AddOpts{}, "foo")
+
+		item, _, _ := q.GetWithPriority()
+		Expect(item).To(Equal("foo"))
+
+		q.AddWithOpts(AddOpts{}, "foo")
+		q.AddWithOpts(AddOpts{}, "bar")
+		item, _, _ = q.GetWithPriority()
+		Expect(item).To(Equal("bar"))
+
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 1}))
+		Expect(metrics.adds["test"]).To(Equal(3))
+	})
+
+	It("returns an item as soon as its unlocked", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		q.AddWithOpts(AddOpts{}, "foo")
+
+		item, _, _ := q.GetWithPriority()
+		Expect(item).To(Equal("foo"))
+
+		q.AddWithOpts(AddOpts{}, "foo")
+		q.AddWithOpts(AddOpts{}, "bar")
+		item, _, _ = q.GetWithPriority()
+		Expect(item).To(Equal("bar"))
+
+		q.AddWithOpts(AddOpts{}, "baz")
+		q.Done("foo")
+		item, _, _ = q.GetWithPriority()
+		Expect(item).To(Equal("foo"))
+
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 1}))
+		Expect(metrics.adds["test"]).To(Equal(4))
+	})
+
+	It("de-duplicates items", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		q.AddWithOpts(AddOpts{}, "foo")
+		q.AddWithOpts(AddOpts{}, "foo")
+
+		Consistently(q.Len).Should(Equal(1))
+
+		cwq := q.(*priorityqueue[string])
+		cwq.lockedLock.Lock()
+		Expect(cwq.locked.Len()).To(Equal(0))
+
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 1}))
+		Expect(metrics.adds["test"]).To(Equal(1))
+	})
+
+	It("retains the highest priority", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		q.AddWithOpts(AddOpts{Priority: ptr.To(1)}, "foo")
+		q.AddWithOpts(AddOpts{Priority: ptr.To(2)}, "foo")
+
+		item, priority, _ := q.GetWithPriority()
+		Expect(item).To(Equal("foo"))
+		Expect(priority).To(Equal(2))
+
+		Expect(q.Len()).To(Equal(0))
+
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{1: 0, 2: 0}))
+		Expect(metrics.adds["test"]).To(Equal(1))
+	})
+
+	It("gets pushed to the front if the priority increases", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		q.AddWithOpts(AddOpts{}, "foo")
+		q.AddWithOpts(AddOpts{}, "bar")
+		q.AddWithOpts(AddOpts{}, "baz")
+		q.AddWithOpts(AddOpts{Priority: ptr.To(1)}, "baz")
+
+		item, priority, _ := q.GetWithPriority()
+		Expect(item).To(Equal("baz"))
+		Expect(priority).To(Equal(1))
+
+		Expect(q.Len()).To(Equal(2))
+
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 2, 1: 0}))
+		Expect(metrics.adds["test"]).To(Equal(3))
+	})
+
+	It("retains the lowest after duration", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		q.AddWithOpts(AddOpts{After: 0}, "foo")
+		q.AddWithOpts(AddOpts{After: time.Hour}, "foo")
+
+		item, priority, _ := q.GetWithPriority()
+		Expect(item).To(Equal("foo"))
+		Expect(priority).To(Equal(0))
+
+		Expect(q.Len()).To(Equal(0))
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 0}))
+		Expect(metrics.adds["test"]).To(Equal(1))
+	})
+
+	It("returns an item only after after has passed", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		now := time.Now().Round(time.Second)
+		nowLock := sync.Mutex{}
+		tick := make(chan time.Time)
+
+		cwq := q.(*priorityqueue[string])
+		cwq.now = func() time.Time {
+			nowLock.Lock()
+			defer nowLock.Unlock()
+			return now
+		}
+		cwq.tick = func(d time.Duration) <-chan time.Time {
+			Expect(d).To(Equal(time.Second))
+			return tick
+		}
+
+		retrievedItem := make(chan struct{})
+
+		go func() {
+			defer GinkgoRecover()
+			q.GetWithPriority()
+			close(retrievedItem)
+		}()
+
+		q.AddWithOpts(AddOpts{After: time.Second}, "foo")
+
+		Consistently(retrievedItem).ShouldNot(BeClosed())
+
+		nowLock.Lock()
+		now = now.Add(time.Second)
+		nowLock.Unlock()
+		tick <- now
+		Eventually(retrievedItem).Should(BeClosed())
+
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 0}))
+		Expect(metrics.adds["test"]).To(Equal(1))
+		Expect(metrics.retries["test"]).To(Equal(1))
+	})
+
+	It("returns high priority item that became ready before low priority item", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		now := time.Now().Round(time.Second)
+		nowLock := sync.Mutex{}
+		tick := make(chan time.Time)
+
+		cwq := q.(*priorityqueue[string])
+		cwq.now = func() time.Time {
+			nowLock.Lock()
+			defer nowLock.Unlock()
+			return now
+		}
+		tickSetup := make(chan any)
+		cwq.tick = func(d time.Duration) <-chan time.Time {
+			Expect(d).To(Equal(time.Second))
+			close(tickSetup)
+			return tick
+		}
+
+		lowPriority := -100
+		highPriority := 0
+		q.AddWithOpts(AddOpts{After: 0, Priority: &lowPriority}, "foo")
+		q.AddWithOpts(AddOpts{After: time.Second, Priority: &highPriority}, "prio")
+
+		Eventually(tickSetup).Should(BeClosed())
+
+		nowLock.Lock()
+		now = now.Add(time.Second)
+		nowLock.Unlock()
+		tick <- now
+		key, prio, _ := q.GetWithPriority()
+
+		Expect(key).To(Equal("prio"))
+		Expect(prio).To(Equal(0))
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{-100: 1, 0: 0}))
+		Expect(metrics.adds["test"]).To(Equal(2))
+		Expect(metrics.retries["test"]).To(Equal(1))
+	})
+
+	It("returns an item to a waiter as soon as it has one", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		retrieved := make(chan struct{})
+		go func() {
+			defer GinkgoRecover()
+			item, _, _ := q.GetWithPriority()
+			Expect(item).To(Equal("foo"))
+			close(retrieved)
+		}()
+
+		// We are waiting for the GetWithPriority() call to be blocked
+		// on retrieving an item. As golang doesn't provide a way to
+		// check if something is listening on a channel without
+		// sending them a message, I can't think of a way to do this
+		// without sleeping.
+		time.Sleep(time.Second)
+		q.AddWithOpts(AddOpts{}, "foo")
+		Eventually(retrieved).Should(BeClosed())
+
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 0}))
+		Expect(metrics.adds["test"]).To(Equal(1))
+	})
+
+	It("returns multiple items with after in correct order", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		now := time.Now().Round(time.Second)
+		nowLock := sync.Mutex{}
+		tick := make(chan time.Time)
+
+		cwq := q.(*priorityqueue[string])
+		cwq.now = func() time.Time {
+			nowLock.Lock()
+			defer nowLock.Unlock()
+			return now
+		}
+		cwq.tick = func(d time.Duration) <-chan time.Time {
+			// What a bunch of bs. Deferring in here causes
+			// ginkgo to deadlock, presumably because it
+			// never returns after the defer. Not deferring
+			// hides the actual assertion result and makes
+			// it complain that there should be a defer.
+			// Move the assertion into a goroutine just to
+			// get around that mess.
+			done := make(chan struct{})
+			go func() {
+				defer GinkgoRecover()
+				defer close(done)
+
+				// This is not deterministic and depends on which of
+				// Add() or Spin() gets the lock first.
+				Expect(d).To(Or(Equal(200*time.Millisecond), Equal(time.Second)))
+			}()
+			<-done
+			return tick
+		}
+
+		retrievedItem := make(chan struct{})
+		retrievedSecondItem := make(chan struct{})
+
+		go func() {
+			defer GinkgoRecover()
+			first, _, _ := q.GetWithPriority()
+			Expect(first).To(Equal("bar"))
+			close(retrievedItem)
+
+			second, _, _ := q.GetWithPriority()
+			Expect(second).To(Equal("foo"))
+			close(retrievedSecondItem)
+		}()
+
+		q.AddWithOpts(AddOpts{After: time.Second}, "foo")
+		q.AddWithOpts(AddOpts{After: 200 * time.Millisecond}, "bar")
+
+		Consistently(retrievedItem).ShouldNot(BeClosed())
+
+		nowLock.Lock()
+		now = now.Add(time.Second)
+		nowLock.Unlock()
+		tick <- now
+		Eventually(retrievedItem).Should(BeClosed())
+		Eventually(retrievedSecondItem).Should(BeClosed())
+
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 0}))
+		Expect(metrics.adds["test"]).To(Equal(2))
+	})
+
+	It("doesn't include non-ready items in Len()", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		q.AddWithOpts(AddOpts{After: time.Minute}, "foo")
+		q.AddWithOpts(AddOpts{}, "baz")
+		q.AddWithOpts(AddOpts{After: time.Minute}, "bar")
+		q.AddWithOpts(AddOpts{}, "bal")
+
+		Expect(q.Len()).To(Equal(2))
+		Expect(metrics.depth).To(HaveLen(1))
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 2}))
+	})
+
+	// ref: https://github.com/kubernetes-sigs/controller-runtime/issues/3239
+	It("Get from priority queue might get stuck when the priority queue is shut down", func() {
+		q, _ := newQueue()
+
+		q.Add("baz")
+		// shut down
+		q.ShutDown()
+		q.AddWithOpts(AddOpts{After: time.Second}, "foo")
+
+		item, priority, isShutDown := q.GetWithPriority()
+		Expect(item).To(Equal(""))
+		Expect(priority).To(Equal(0))
+		Expect(isShutDown).To(BeTrue())
+
+		item1, priority1, isShutDown := q.GetWithPriority()
+		Expect(item1).To(Equal(""))
+		Expect(priority1).To(Equal(0))
+		Expect(isShutDown).To(BeTrue())
+	})
+
+	It("Get from priority queue should get unblocked when the priority queue is shut down", func() {
+		q, _ := newQueue()
+
+		getUnblocked := make(chan struct{})
+
+		go func() {
+			defer GinkgoRecover()
+			defer close(getUnblocked)
+
+			item, priority, isShutDown := q.GetWithPriority()
+			Expect(item).To(Equal(""))
+			Expect(priority).To(Equal(0))
+			Expect(isShutDown).To(BeTrue())
+		}()
+
+		// Verify the go routine above is now waiting for an item.
+		Eventually(q.(*priorityqueue[string]).waiters.Load).Should(Equal(int64(1)))
+		Consistently(getUnblocked).ShouldNot(BeClosed())
+
+		// shut down
+		q.ShutDown()
+
+		// Verify the shutdown unblocked the go routine.
+		Eventually(getUnblocked).Should(BeClosed())
+	})
+
+	It("items are included in Len() and the queueDepth metric once they are ready", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		q.AddWithOpts(AddOpts{After: 500 * time.Millisecond}, "foo")
+		q.AddWithOpts(AddOpts{}, "baz")
+		q.AddWithOpts(AddOpts{After: 500 * time.Millisecond}, "bar")
+		q.AddWithOpts(AddOpts{}, "bal")
+
+		Expect(q.Len()).To(Equal(2))
+		metrics.mu.Lock()
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 2}))
+		metrics.mu.Unlock()
+		time.Sleep(time.Second)
+		Expect(q.Len()).To(Equal(4))
+		metrics.mu.Lock()
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 4}))
+		metrics.mu.Unlock()
+
+		// Drain queue
+		for range 4 {
+			item, _ := q.Get()
+			q.Done(item)
+		}
+		Expect(q.Len()).To(Equal(0))
+		metrics.mu.Lock()
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 0}))
+		metrics.mu.Unlock()
+
+		// Validate that doing it again still works to notice bugs with removing
+		// it from the queues becameReady tracking.
+		q.AddWithOpts(AddOpts{After: 500 * time.Millisecond}, "foo")
+		q.AddWithOpts(AddOpts{}, "baz")
+		q.AddWithOpts(AddOpts{After: 500 * time.Millisecond}, "bar")
+		q.AddWithOpts(AddOpts{}, "bal")
+
+		Expect(q.Len()).To(Equal(2))
+		metrics.mu.Lock()
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 2}))
+		metrics.mu.Unlock()
+		time.Sleep(time.Second)
+		Expect(q.Len()).To(Equal(4))
+		metrics.mu.Lock()
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 4}))
+		metrics.mu.Unlock()
+	})
+
+	It("returns many items", func() {
+		// This test ensures the queue is able to drain a large queue without panic'ing.
+		// In a previous version of the code we were calling queue.Delete within q.Ascend
+		// which led to a panic in queue.Ascend > iterate:
+		// "panic: runtime error: index out of range [0] with length 0"
+		q, _ := newQueue()
+		defer q.ShutDown()
+
+		for range 20 {
+			for i := range 1000 {
+				rn := rand.N(100)
+				if rn < 10 {
+					q.AddWithOpts(AddOpts{After: time.Duration(rn) * time.Millisecond}, fmt.Sprintf("foo%d", i))
+				} else {
+					q.AddWithOpts(AddOpts{Priority: &rn}, fmt.Sprintf("foo%d", i))
+				}
+			}
+
+			wg := sync.WaitGroup{}
+			for range 100 { // The panic only occurred relatively frequently with a high number of go routines.
+				wg.Add(1)
+				go func() {
+					defer wg.Done()
+					for range 10 {
+						obj, _, _ := q.GetWithPriority()
+						q.Done(obj)
+					}
+				}()
+			}
+
+			wg.Wait()
+		}
+	})
+
+	It("updates metrics correctly for an item that gets initially added with after and then without", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		q.AddWithOpts(AddOpts{After: time.Hour}, "foo")
+		Expect(q.Len()).To(Equal(0))
+		metrics.mu.Lock()
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{}))
+		metrics.mu.Unlock()
+
+		q.AddWithOpts(AddOpts{}, "foo")
+
+		Expect(q.Len()).To(Equal(1))
+		metrics.mu.Lock()
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 1}))
+		metrics.mu.Unlock()
+
+		// Get the item to ensure the codepath in
+		// `spin` for the metrics is passed by so
+		// that this starts failing if it incorrectly
+		// calls `metrics.add` again.
+		item, _ := q.Get()
+		Expect(item).To(Equal("foo"))
+		Expect(q.Len()).To(Equal(0))
+		metrics.mu.Lock()
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 0}))
+		metrics.mu.Unlock()
+	})
+
+	It("Updates metrics correctly for an item whose requeueAfter expired that gets added again without requeueAfter", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		q.AddWithOpts(AddOpts{After: 50 * time.Millisecond}, "foo")
+		time.Sleep(100 * time.Millisecond)
+
+		Expect(q.Len()).To(Equal(1))
+		metrics.mu.Lock()
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 1}))
+		metrics.mu.Unlock()
+
+		q.AddWithOpts(AddOpts{}, "foo")
+		Expect(q.Len()).To(Equal(1))
+		metrics.mu.Lock()
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 1}))
+		metrics.mu.Unlock()
+
+		// Get the item to ensure the codepath in
+		// `spin` for the metrics is passed by so
+		// that this starts failing if it incorrectly
+		// calls `metrics.add` again.
+		item, _ := q.Get()
+		Expect(item).To(Equal("foo"))
+		Expect(q.Len()).To(Equal(0))
+		metrics.mu.Lock()
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 0}))
+		metrics.mu.Unlock()
+	})
+
+	It("When adding items with rateLimit, previous items' rateLimit should not affect subsequent items", func() {
+		q, metrics := newQueue()
+		defer q.ShutDown()
+
+		now := time.Now().Round(time.Second)
+		nowLock := sync.Mutex{}
+		tick := make(chan time.Time)
+
+		cwq := q.(*priorityqueue[string])
+		cwq.rateLimiter = workqueue.NewTypedItemExponentialFailureRateLimiter[string](5*time.Millisecond, 1000*time.Second)
+		cwq.now = func() time.Time {
+			nowLock.Lock()
+			defer nowLock.Unlock()
+			return now
+		}
+		cwq.tick = func(d time.Duration) <-chan time.Time {
+			done := make(chan struct{})
+			go func() {
+				defer GinkgoRecover()
+				defer close(done)
+
+				Expect(d).To(Or(Equal(5*time.Millisecond), Equal(635*time.Millisecond)))
+			}()
+			<-done
+			return tick
+		}
+
+		retrievedItem := make(chan struct{})
+		retrievedSecondItem := make(chan struct{})
+
+		go func() {
+			defer GinkgoRecover()
+			first, _, _ := q.GetWithPriority()
+			Expect(first).To(Equal("foo"))
+			close(retrievedItem)
+
+			second, _, _ := q.GetWithPriority()
+			Expect(second).To(Equal("bar"))
+			close(retrievedSecondItem)
+		}()
+
+		// after 7 calls, the next When("bar") call will return 640ms.
+		for range 7 {
+			cwq.rateLimiter.When("bar")
+		}
+		q.AddWithOpts(AddOpts{RateLimited: true}, "foo", "bar")
+
+		Consistently(retrievedItem).ShouldNot(BeClosed())
+		nowLock.Lock()
+		now = now.Add(5 * time.Millisecond)
+		nowLock.Unlock()
+		tick <- now
+		Eventually(retrievedItem).Should(BeClosed())
+
+		Consistently(retrievedSecondItem).ShouldNot(BeClosed())
+		nowLock.Lock()
+		now = now.Add(635 * time.Millisecond)
+		nowLock.Unlock()
+		tick <- now
+		Eventually(retrievedSecondItem).Should(BeClosed())
+
+		Expect(metrics.depth["test"]).To(Equal(map[int]int{0: 0}))
+		Expect(metrics.adds["test"]).To(Equal(2))
+		Expect(metrics.retries["test"]).To(Equal(2))
+	})
+})
+
+func BenchmarkAddGetDone(b *testing.B) {
+	q := New[int]("")
+	defer q.ShutDown()
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		for i := 0; i < 1000; i++ {
+			q.Add(i)
+		}
+		for range 1000 {
+			item, _ := q.Get()
+			q.Done(item)
+		}
+	}
+}
+
+func BenchmarkAddOnly(b *testing.B) {
+	q := New[int]("")
+	defer q.ShutDown()
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		for i := 0; i < 1000; i++ {
+			q.Add(i)
+		}
+	}
+}
+
+func BenchmarkAddLockContended(b *testing.B) {
+	q := New[int]("")
+	defer q.ShutDown()
+	go func() {
+		for range 1000 {
+			item, _ := q.Get()
+			q.Done(item)
+		}
+	}()
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		for i := 0; i < 1000; i++ {
+			q.Add(i)
+		}
+	}
+}
+
+// TestFuzzPrioriorityQueue validates a set of basic
+// invariants that should always be true:
+//
+//   - The queue is threadsafe when multiple producers and consumers
+//     are involved
+//   - There are no deadlocks
+//   - An item is never handed out again before it is returned
+//   - Items in the queue are de-duplicated
+//   - max(existing priority, new priority) is used
+func TestFuzzPriorityQueue(t *testing.T) {
+	t.Parallel()
+
+	seed := time.Now().UnixNano()
+	t.Logf("seed: %d", seed)
+	f := fuzz.NewWithSeed(seed)
+	fuzzLock := sync.Mutex{}
+	fuzz := func(in any) {
+		fuzzLock.Lock()
+		defer fuzzLock.Unlock()
+
+		f.Fuzz(in)
+	}
+
+	inQueue := map[string]int{}
+	inQueueLock := sync.Mutex{}
+
+	handedOut := sets.Set[string]{}
+	handedOutLock := sync.Mutex{}
+
+	wg := sync.WaitGroup{}
+	q, metrics := newQueue()
+
+	for range 10 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+
+			for range 1000 {
+				opts, item := AddOpts{}, ""
+
+				fuzz(&opts)
+				fuzz(&item)
+
+				if opts.After > 100*time.Millisecond {
+					opts.After = 10 * time.Millisecond
+				}
+				opts.RateLimited = false
+
+				func() {
+					inQueueLock.Lock()
+					defer inQueueLock.Unlock()
+
+					q.AddWithOpts(opts, item)
+					if existingPriority, exists := inQueue[item]; !exists || existingPriority < ptr.Deref(opts.Priority, 0) {
+						inQueue[item] = ptr.Deref(opts.Priority, 0)
+					}
+				}()
+			}
+		}()
+	}
+
+	for range 100 {
+		wg.Add(1)
+
+		go func() {
+			defer wg.Done()
+
+			for {
+				item, cont := func() (string, bool) {
+					inQueueLock.Lock()
+					defer inQueueLock.Unlock()
+
+					if len(inQueue) == 0 {
+						return "", false
+					}
+
+					item, priority, _ := q.GetWithPriority()
+					if expected := inQueue[item]; expected != priority {
+						t.Errorf("got priority %d, expected %d", priority, expected)
+					}
+					delete(inQueue, item)
+					return item, true
+				}()
+
+				if !cont {
+					return
+				}
+
+				func() {
+					handedOutLock.Lock()
+					defer handedOutLock.Unlock()
+
+					if handedOut.Has(item) {
+						t.Errorf("item %s got handed out more than once", item)
+					}
+
+					metrics.mu.Lock()
+					for priority, depth := range metrics.depth["test"] {
+						if depth < 0 {
+							t.Errorf("negative depth of %d for priority %d:", depth, priority)
+						}
+					}
+
+					metrics.mu.Unlock()
+					handedOut.Insert(item)
+				}()
+
+				func() {
+					handedOutLock.Lock()
+					defer handedOutLock.Unlock()
+
+					handedOut.Delete(item)
+					q.Done(item)
+				}()
+			}
+		}()
+	}
+
+	wg.Wait()
+}
+
+func newQueue() (PriorityQueue[string], *fakeMetricsProvider) {
+	metrics := newFakeMetricsProvider()
+	q := New("test", func(o *Opts[string]) {
+		o.MetricProvider = metrics
+	})
+	q.(*priorityqueue[string]).queue = &btreeInteractionValidator{
+		bTree: q.(*priorityqueue[string]).queue,
+	}
+
+	// validate that tick always gets a positive value as it will just return
+	// nil otherwise, which results in blocking forever.
+	upstreamTick := q.(*priorityqueue[string]).tick
+	q.(*priorityqueue[string]).tick = func(d time.Duration) <-chan time.Time {
+		if d <= 0 {
+			panic(fmt.Sprintf("got non-positive tick: %v", d))
+		}
+		return upstreamTick(d)
+	}
+	return q, metrics
+}
+
+type btreeInteractionValidator struct {
+	bTree[*item[string]]
+}
+
+func (b *btreeInteractionValidator) ReplaceOrInsert(item *item[string]) (*item[string], bool) {
+	// There is no codepath that updates an item
+	item, alreadyExist := b.bTree.ReplaceOrInsert(item)
+	if alreadyExist {
+		panic(fmt.Sprintf("ReplaceOrInsert: item %v already existed", item))
+	}
+	return item, alreadyExist
+}
+
+func (b *btreeInteractionValidator) Delete(item *item[string]) (*item[string], bool) {
+	// There is no codepath that deletes an item that doesn't exist
+	old, existed := b.bTree.Delete(item)
+	if !existed {
+		panic(fmt.Sprintf("Delete: item %v not found", item))
+	}
+	return old, existed
+}
diff --git a/pkg/doc.go b/pkg/doc.go
index 89b380c108..64693b4829 100644
--- a/pkg/doc.go
+++ b/pkg/doc.go
@@ -137,11 +137,11 @@ Source provides event:
 
 EventHandler enqueues Request:
 
-* &handler.EnqueueRequestForObject{} -> (reconcile.Request{types.NamespaceName{Name: "foo", Namespace: "bar"}})
+* &handler.EnqueueRequestForObject{} -> (reconcile.Request{types.NamespaceName{Namespace: "foo", Name: "bar"}})
 
 Reconciler is called with the Request:
 
-* Reconciler(reconcile.Request{types.NamespaceName{Name: "foo", Namespace: "bar"}})
+* Reconciler(reconcile.Request{types.NamespaceName{Namespace: "foo", Name: "bar"}})
 
 # Usage
 
diff --git a/pkg/envtest/binaries.go b/pkg/envtest/binaries.go
new file mode 100644
index 0000000000..5110d32658
--- /dev/null
+++ b/pkg/envtest/binaries.go
@@ -0,0 +1,387 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package envtest
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/sha512"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/util/version"
+	"sigs.k8s.io/yaml"
+)
+
+// DefaultBinaryAssetsIndexURL is the default index used in HTTPClient.
+var DefaultBinaryAssetsIndexURL = "https://raw.githubusercontent.com/kubernetes-sigs/controller-tools/HEAD/envtest-releases.yaml"
+
+// SetupEnvtestDefaultBinaryAssetsDirectory returns the default location that setup-envtest uses to store envtest binaries.
+// Setting BinaryAssetsDirectory to this directory allows sharing envtest binaries with setup-envtest.
+//
+// The directory is dependent on operating system:
+//
+// - Windows: %LocalAppData%\kubebuilder-envtest
+// - OSX: ~/Library/Application Support/io.kubebuilder.envtest
+// - Others: ${XDG_DATA_HOME:-~/.local/share}/kubebuilder-envtest
+//
+// Otherwise, it errors out.  Note that these paths must not be relied upon
+// manually.
+func SetupEnvtestDefaultBinaryAssetsDirectory() (string, error) {
+	var baseDir string
+
+	// find the base data directory
+	switch runtime.GOOS {
+	case "windows":
+		baseDir = os.Getenv("LocalAppData")
+		if baseDir == "" {
+			return "", errors.New("%LocalAppData% is not defined")
+		}
+	case "darwin":
+		homeDir := os.Getenv("HOME")
+		if homeDir == "" {
+			return "", errors.New("$HOME is not defined")
+		}
+		baseDir = filepath.Join(homeDir, "Library/Application Support")
+	default:
+		baseDir = os.Getenv("XDG_DATA_HOME")
+		if baseDir == "" {
+			homeDir := os.Getenv("HOME")
+			if homeDir == "" {
+				return "", errors.New("neither $XDG_DATA_HOME nor $HOME are defined")
+			}
+			baseDir = filepath.Join(homeDir, ".local/share")
+		}
+	}
+
+	// append our program-specific dir to it (OSX has a slightly different
+	// convention so try to follow that).
+	switch runtime.GOOS {
+	case "darwin", "ios":
+		return filepath.Join(baseDir, "io.kubebuilder.envtest", "k8s"), nil
+	default:
+		return filepath.Join(baseDir, "kubebuilder-envtest", "k8s"), nil
+	}
+}
+
+// index represents an index of envtest binary archives. Example:
+//
+//	releases:
+//		v1.28.0:
+//			envtest-v1.28.0-darwin-amd64.tar.gz:
+//	    		hash: <sha512-hash>
+//				selfLink: <url-to-archive-with-envtest-binaries>
+type index struct {
+	// Releases maps Kubernetes versions to Releases (envtest archives).
+	Releases map[string]release `json:"releases"`
+}
+
+// release maps an archive name to an archive.
+type release map[string]archive
+
+// archive contains the self link to an archive and its hash.
+type archive struct {
+	Hash     string `json:"hash"`
+	SelfLink string `json:"selfLink"`
+}
+
+// parseKubernetesVersion returns:
+//  1. the SemVer form of s when it refers to a specific Kubernetes release, or
+//  2. the major and minor portions of s when it refers to a release series, or
+//  3. an error
+func parseKubernetesVersion(s string) (exact string, major, minor uint, err error) {
+	if v, err := version.ParseSemantic(s); err == nil {
+		return v.String(), 0, 0, nil
+	}
+
+	// See two parseable components and nothing else.
+	if v, err := version.ParseGeneric(s); err == nil && len(v.Components()) == 2 {
+		if v.String() == strings.TrimPrefix(s, "v") {
+			return "", v.Major(), v.Minor(), nil
+		}
+	}
+
+	return "", 0, 0, fmt.Errorf("could not parse %q as version", s)
+}
+
+func downloadBinaryAssets(ctx context.Context, binaryAssetsDirectory, binaryAssetsVersion, binaryAssetsIndexURL string) (string, string, string, error) {
+	if binaryAssetsIndexURL == "" {
+		binaryAssetsIndexURL = DefaultBinaryAssetsIndexURL
+	}
+
+	downloadRootDir := binaryAssetsDirectory
+	if downloadRootDir == "" {
+		var err error
+		if downloadRootDir, err = os.MkdirTemp("", "envtest-binaries-"); err != nil {
+			return "", "", "", fmt.Errorf("failed to create tmp directory for envtest binaries: %w", err)
+		}
+	}
+
+	var binaryAssetsIndex *index
+	switch exact, major, minor, err := parseKubernetesVersion(binaryAssetsVersion); {
+	case binaryAssetsVersion != "" && err != nil:
+		return "", "", "", err
+
+	case binaryAssetsVersion != "" && exact != "":
+		// Look for these specific binaries locally before downloading them from the release index.
+		// Use the canonical form of the version from here on.
+		binaryAssetsVersion = "v" + exact
+
+	case binaryAssetsVersion == "" || major != 0 || minor != 0:
+		// Select a stable version from the release index before continuing.
+		binaryAssetsIndex, err = getIndex(ctx, binaryAssetsIndexURL)
+		if err != nil {
+			return "", "", "", err
+		}
+
+		binaryAssetsVersion, err = latestStableVersionFromIndex(binaryAssetsIndex, major, minor)
+		if err != nil {
+			return "", "", "", err
+		}
+	}
+
+	// Storing the envtest binaries in a directory structure that is compatible with setup-envtest.
+	// This makes it possible to share the envtest binaries with setup-envtest if the BinaryAssetsDirectory is set to SetupEnvtestDefaultBinaryAssetsDirectory().
+	downloadDir := path.Join(downloadRootDir, fmt.Sprintf("%s-%s-%s", strings.TrimPrefix(binaryAssetsVersion, "v"), runtime.GOOS, runtime.GOARCH))
+	if !fileExists(downloadDir) {
+		if err := os.MkdirAll(downloadDir, 0700); err != nil {
+			return "", "", "", fmt.Errorf("failed to create directory %q for envtest binaries: %w", downloadDir, err)
+		}
+	}
+
+	apiServerPath := path.Join(downloadDir, "kube-apiserver")
+	etcdPath := path.Join(downloadDir, "etcd")
+	kubectlPath := path.Join(downloadDir, "kubectl")
+
+	if fileExists(apiServerPath) && fileExists(etcdPath) && fileExists(kubectlPath) {
+		// Nothing to do if the binaries already exist.
+		return apiServerPath, etcdPath, kubectlPath, nil
+	}
+
+	// Get Index if we didn't have to get it above to get the latest stable version.
+	if binaryAssetsIndex == nil {
+		var err error
+		binaryAssetsIndex, err = getIndex(ctx, binaryAssetsIndexURL)
+		if err != nil {
+			return "", "", "", err
+		}
+	}
+
+	buf := &bytes.Buffer{}
+	if err := downloadBinaryAssetsArchive(ctx, binaryAssetsIndex, binaryAssetsVersion, buf); err != nil {
+		return "", "", "", err
+	}
+
+	gzStream, err := gzip.NewReader(buf)
+	if err != nil {
+		return "", "", "", fmt.Errorf("failed to create gzip reader to extract envtest binaries: %w", err)
+	}
+	tarReader := tar.NewReader(gzStream)
+
+	var header *tar.Header
+	for header, err = tarReader.Next(); err == nil; header, err = tarReader.Next() {
+		if header.Typeflag != tar.TypeReg {
+			// Skip non-regular file entry in archive.
+			continue
+		}
+
+		// Just dump all files directly into the download directory, ignoring the prefixed directory paths.
+		// We also ignore bits for the most part (except for X).
+		fileName := filepath.Base(header.Name)
+		perms := 0555 & header.Mode // make sure we're at most r+x
+
+		// Setting O_EXCL to get an error if the file already exists.
+		f, err := os.OpenFile(path.Join(downloadDir, fileName), os.O_RDWR|os.O_CREATE|os.O_EXCL|os.O_TRUNC, os.FileMode(perms))
+		if err != nil {
+			if os.IsExist(err) {
+				// Nothing to do if the file already exists. We assume another process created the file concurrently.
+				continue
+			}
+			return "", "", "", fmt.Errorf("failed to create file %s in directory %s: %w", fileName, downloadDir, err)
+		}
+		if err := func() error {
+			defer f.Close()
+			if _, err := io.Copy(f, tarReader); err != nil {
+				return fmt.Errorf("failed to write file %s in directory %s: %w", fileName, downloadDir, err)
+			}
+			return nil
+		}(); err != nil {
+			return "", "", "", fmt.Errorf("failed to close file %s in directory %s: %w", fileName, downloadDir, err)
+		}
+	}
+
+	return apiServerPath, etcdPath, kubectlPath, nil
+}
+
+func fileExists(path string) bool {
+	if _, err := os.Stat(path); err == nil {
+		return true
+	}
+	return false
+}
+
+func downloadBinaryAssetsArchive(ctx context.Context, index *index, version string, out io.Writer) error {
+	archives, ok := index.Releases[version]
+	if !ok {
+		return fmt.Errorf("failed to find envtest binaries for version %s", version)
+	}
+
+	archiveName := fmt.Sprintf("envtest-%s-%s-%s.tar.gz", version, runtime.GOOS, runtime.GOARCH)
+	archive, ok := archives[archiveName]
+	if !ok {
+		return fmt.Errorf("failed to find envtest binaries for version %s with archiveName %s", version, archiveName)
+	}
+
+	archiveURL, err := url.Parse(archive.SelfLink)
+	if err != nil {
+		return fmt.Errorf("failed to parse envtest binaries archive URL %q: %w", archiveURL, err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", archiveURL.String(), nil)
+	if err != nil {
+		return fmt.Errorf("failed to create request to download %s: %w", archiveURL.String(), err)
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to download %s: %w", archiveURL.String(), err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		return fmt.Errorf("failed to download %s, got status %q", archiveURL.String(), resp.Status)
+	}
+
+	return readBody(resp, out, archiveName, archive.Hash)
+}
+
+// latestStableVersionFromIndex returns the version with highest [precedence] in index that is not a prerelease.
+// When either major or minor are not zero, the returned version will have those major and minor versions.
+// Note that the version cannot be limited to 0.0.x this way.
+//
+// It is an error when there is no appropriate version in index.
+//
+// [precedence]: https://semver.org/spec/v2.0.0.html#spec-item-11
+func latestStableVersionFromIndex(index *index, major, minor uint) (string, error) {
+	if len(index.Releases) == 0 {
+		return "", fmt.Errorf("failed to find latest stable version from index: index is empty")
+	}
+
+	var found *version.Version
+	for releaseVersion := range index.Releases {
+		v, err := version.ParseSemantic(releaseVersion)
+		if err != nil {
+			return "", fmt.Errorf("failed to parse version %q: %w", releaseVersion, err)
+		}
+
+		// Filter out pre-releases.
+		if len(v.PreRelease()) > 0 {
+			continue
+		}
+
+		// Filter on release series, if any.
+		if (major != 0 || minor != 0) && (v.Major() != major || v.Minor() != minor) {
+			continue
+		}
+
+		if found == nil || v.GreaterThan(found) {
+			found = v
+		}
+	}
+
+	if found == nil {
+		search := "any"
+		if major != 0 || minor != 0 {
+			search = fmt.Sprint(major, ".", minor)
+		}
+
+		return "", fmt.Errorf("failed to find latest stable version from index: index does not have %s stable versions", search)
+	}
+
+	return "v" + found.String(), nil
+}
+
+func getIndex(ctx context.Context, indexURL string) (*index, error) {
+	loc, err := url.Parse(indexURL)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse index URL: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", loc.String(), nil)
+	if err != nil {
+		return nil, fmt.Errorf("unable to construct request to get index: %w", err)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("unable to perform request to get index: %w", err)
+	}
+
+	defer resp.Body.Close()
+	if resp.StatusCode != 200 {
+		return nil, fmt.Errorf("unable to get index -- got status %q", resp.Status)
+	}
+
+	responseBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("unable to get index -- unable to read body %w", err)
+	}
+
+	var index index
+	if err := yaml.Unmarshal(responseBody, &index); err != nil {
+		return nil, fmt.Errorf("unable to unmarshal index: %w", err)
+	}
+	return &index, nil
+}
+
+func readBody(resp *http.Response, out io.Writer, archiveName string, expectedHash string) error {
+	// Stream in chunks to do the checksum
+	buf := make([]byte, 32*1024) // 32KiB, same as io.Copy
+	hasher := sha512.New()
+
+	for cont := true; cont; {
+		amt, err := resp.Body.Read(buf)
+		if err != nil && !errors.Is(err, io.EOF) {
+			return fmt.Errorf("unable read next chunk of %s: %w", archiveName, err)
+		}
+		if amt > 0 {
+			// checksum never returns errors according to docs
+			hasher.Write(buf[:amt])
+			if _, err := out.Write(buf[:amt]); err != nil {
+				return fmt.Errorf("unable write next chunk of %s: %w", archiveName, err)
+			}
+		}
+		cont = amt > 0 && !errors.Is(err, io.EOF)
+	}
+
+	actualHash := hex.EncodeToString(hasher.Sum(nil))
+	if actualHash != expectedHash {
+		return fmt.Errorf("checksum mismatch for %s: %s (computed) != %s (expected)", archiveName, actualHash, expectedHash)
+	}
+
+	return nil
+}
diff --git a/pkg/envtest/binaries_test.go b/pkg/envtest/binaries_test.go
new file mode 100644
index 0000000000..aa83963381
--- /dev/null
+++ b/pkg/envtest/binaries_test.go
@@ -0,0 +1,357 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package envtest
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"crypto/rand"
+	"crypto/sha512"
+	"encoding/hex"
+	"fmt"
+	"net/http"
+	"os"
+	"path"
+	"runtime"
+	"strings"
+	"testing"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/onsi/gomega/ghttp"
+	"sigs.k8s.io/yaml"
+)
+
+func TestParseKubernetesVersion(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name   string
+		inputs []string
+
+		expectError       string
+		expectExact       bool
+		expectSeriesMajor uint
+		expectSeriesMinor uint
+	}{
+		{
+			name: `SemVer and "v" prefix are exact`,
+			inputs: []string{
+				"1.2.3", "v1.2.3", "v1.30.2", "v1.31.0-beta.0", "v1.33.0-alpha.2",
+			},
+			expectExact: true,
+		},
+		{
+			name:        "empty string is not a version",
+			inputs:      []string{""},
+			expectError: "could not parse",
+		},
+		{
+			name: "leading zeroes are not a version",
+			inputs: []string{
+				"01.2.0", "00001.2.3", "1.2.03", "v01.02.0003",
+			},
+			expectError: "could not parse",
+		},
+		{
+			name: "weird stuff is not a version",
+			inputs: []string{
+				"asdf", "version", "vegeta4", "the.1", "2ne1", "=7.8.9", "10.x", "*",
+				"0.0001", "1.00002", "v1.2anything", "1.2.x", "1.2.z", "1.2.*",
+			},
+			expectError: "could not parse",
+		},
+		{
+			name: "one number is not a version",
+			inputs: []string{
+				"1", "v1", "v001", "1.", "v1.", "1.x",
+			},
+			expectError: "could not parse",
+		},
+		{
+			name:   "two numbers are a release series",
+			inputs: []string{"0.1", "v0.1"},
+
+			expectSeriesMajor: 0,
+			expectSeriesMinor: 1,
+		},
+		{
+			name:   "two numbers are a release series",
+			inputs: []string{"1.2", "v1.2"},
+
+			expectSeriesMajor: 1,
+			expectSeriesMinor: 2,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			for _, input := range tc.inputs {
+				exact, major, minor, err := parseKubernetesVersion(input)
+
+				if tc.expectError != "" && err == nil {
+					t.Errorf("expected error %q, got none", tc.expectError)
+				}
+				if tc.expectError != "" && !strings.Contains(err.Error(), tc.expectError) {
+					t.Errorf("expected error %q, got %q", tc.expectError, err)
+				}
+				if tc.expectError == "" && err != nil {
+					t.Errorf("expected no error, got %q", err)
+					continue
+				}
+
+				if tc.expectExact {
+					if expected := strings.TrimPrefix(input, "v"); exact != expected {
+						t.Errorf("expected canonical %q for %q, got %q", expected, input, exact)
+					}
+					if major != 0 || minor != 0 {
+						t.Errorf("expected no release series for %q, got (%v, %v)", input, major, minor)
+					}
+					continue
+				}
+
+				if major != tc.expectSeriesMajor {
+					t.Errorf("expected major %v for %q, got %v", tc.expectSeriesMajor, input, major)
+				}
+				if minor != tc.expectSeriesMinor {
+					t.Errorf("expected minor %v for %q, got %v", tc.expectSeriesMinor, input, minor)
+				}
+				if exact != "" {
+					t.Errorf("expected no canonical version for %q, got %q", input, exact)
+				}
+			}
+		})
+	}
+}
+
+var _ = Describe("Test download binaries", func() {
+	var downloadDirectory string
+	var server *ghttp.Server
+
+	BeforeEach(func() {
+		downloadDirectory = GinkgoT().TempDir()
+
+		server = ghttp.NewServer()
+		DeferCleanup(func() {
+			server.Close()
+		})
+		setupServer(server)
+	})
+
+	It("should download binaries of latest stable version", func(ctx SpecContext) {
+		apiServerPath, etcdPath, kubectlPath, err := downloadBinaryAssets(ctx, downloadDirectory, "", fmt.Sprintf("http://%s/%s", server.Addr(), "envtest-releases.yaml"))
+		Expect(err).ToNot(HaveOccurred())
+
+		// Verify latest stable version (v1.32.0) was downloaded
+		versionDownloadDirectory := path.Join(downloadDirectory, fmt.Sprintf("1.32.0-%s-%s", runtime.GOOS, runtime.GOARCH))
+		Expect(apiServerPath).To(Equal(path.Join(versionDownloadDirectory, "kube-apiserver")))
+		Expect(etcdPath).To(Equal(path.Join(versionDownloadDirectory, "etcd")))
+		Expect(kubectlPath).To(Equal(path.Join(versionDownloadDirectory, "kubectl")))
+
+		dirEntries, err := os.ReadDir(versionDownloadDirectory)
+		Expect(err).ToNot(HaveOccurred())
+		var actualFiles []string
+		for _, e := range dirEntries {
+			actualFiles = append(actualFiles, e.Name())
+		}
+		Expect(actualFiles).To(ConsistOf("some-file"))
+	})
+
+	It("should download binaries of an exact version", func(ctx SpecContext) {
+		apiServerPath, etcdPath, kubectlPath, err := downloadBinaryAssets(ctx, downloadDirectory, "v1.31.0", fmt.Sprintf("http://%s/%s", server.Addr(), "envtest-releases.yaml"))
+		Expect(err).ToNot(HaveOccurred())
+
+		// Verify exact version (v1.31.0) was downloaded
+		versionDownloadDirectory := path.Join(downloadDirectory, fmt.Sprintf("1.31.0-%s-%s", runtime.GOOS, runtime.GOARCH))
+		Expect(apiServerPath).To(Equal(path.Join(versionDownloadDirectory, "kube-apiserver")))
+		Expect(etcdPath).To(Equal(path.Join(versionDownloadDirectory, "etcd")))
+		Expect(kubectlPath).To(Equal(path.Join(versionDownloadDirectory, "kubectl")))
+
+		dirEntries, err := os.ReadDir(versionDownloadDirectory)
+		Expect(err).ToNot(HaveOccurred())
+		var actualFiles []string
+		for _, e := range dirEntries {
+			actualFiles = append(actualFiles, e.Name())
+		}
+		Expect(actualFiles).To(ConsistOf("some-file"))
+	})
+
+	It("should download binaries of latest stable version of a release series", func(ctx SpecContext) {
+		apiServerPath, etcdPath, kubectlPath, err := downloadBinaryAssets(ctx, downloadDirectory, "1.31", fmt.Sprintf("http://%s/%s", server.Addr(), "envtest-releases.yaml"))
+		Expect(err).ToNot(HaveOccurred())
+
+		// Verify stable version (v1.31.4) was downloaded
+		versionDownloadDirectory := path.Join(downloadDirectory, fmt.Sprintf("1.31.4-%s-%s", runtime.GOOS, runtime.GOARCH))
+		Expect(apiServerPath).To(Equal(path.Join(versionDownloadDirectory, "kube-apiserver")))
+		Expect(etcdPath).To(Equal(path.Join(versionDownloadDirectory, "etcd")))
+		Expect(kubectlPath).To(Equal(path.Join(versionDownloadDirectory, "kubectl")))
+
+		dirEntries, err := os.ReadDir(versionDownloadDirectory)
+		Expect(err).ToNot(HaveOccurred())
+		var actualFiles []string
+		for _, e := range dirEntries {
+			actualFiles = append(actualFiles, e.Name())
+		}
+		Expect(actualFiles).To(ConsistOf("some-file"))
+	})
+
+	It("should error when the asset version is not a version", func(ctx SpecContext) {
+		_, _, _, err := downloadBinaryAssets(ctx, downloadDirectory, "wonky", fmt.Sprintf("http://%s/%s", server.Addr(), "envtest-releases.yaml"))
+		Expect(err).To(MatchError(`could not parse "wonky" as version`))
+	})
+
+	It("should error when the asset version is not in the index", func(ctx SpecContext) {
+		_, _, _, err := downloadBinaryAssets(ctx, downloadDirectory, "v1.5.0", fmt.Sprintf("http://%s/%s", server.Addr(), "envtest-releases.yaml"))
+		Expect(err).To(MatchError("failed to find envtest binaries for version v1.5.0"))
+
+		_, _, _, err = downloadBinaryAssets(ctx, downloadDirectory, "v1.5", fmt.Sprintf("http://%s/%s", server.Addr(), "envtest-releases.yaml"))
+		Expect(err).To(MatchError("failed to find latest stable version from index: index does not have 1.5 stable versions"))
+	})
+})
+
+var (
+	envtestBinaryArchives = index{
+		Releases: map[string]release{
+			"v1.32.0": map[string]archive{
+				"envtest-v1.32.0-darwin-amd64.tar.gz":  {},
+				"envtest-v1.32.0-darwin-arm64.tar.gz":  {},
+				"envtest-v1.32.0-linux-amd64.tar.gz":   {},
+				"envtest-v1.32.0-linux-arm64.tar.gz":   {},
+				"envtest-v1.32.0-linux-ppc64le.tar.gz": {},
+				"envtest-v1.32.0-linux-s390x.tar.gz":   {},
+				"envtest-v1.32.0-windows-amd64.tar.gz": {},
+			},
+			"v1.31.4": map[string]archive{
+				"envtest-v1.31.4-darwin-amd64.tar.gz":  {},
+				"envtest-v1.31.4-darwin-arm64.tar.gz":  {},
+				"envtest-v1.31.4-linux-amd64.tar.gz":   {},
+				"envtest-v1.31.4-linux-arm64.tar.gz":   {},
+				"envtest-v1.31.4-linux-ppc64le.tar.gz": {},
+				"envtest-v1.31.4-linux-s390x.tar.gz":   {},
+				"envtest-v1.31.4-windows-amd64.tar.gz": {},
+			},
+			"v1.31.0": map[string]archive{
+				"envtest-v1.31.0-darwin-amd64.tar.gz":  {},
+				"envtest-v1.31.0-darwin-arm64.tar.gz":  {},
+				"envtest-v1.31.0-linux-amd64.tar.gz":   {},
+				"envtest-v1.31.0-linux-arm64.tar.gz":   {},
+				"envtest-v1.31.0-linux-ppc64le.tar.gz": {},
+				"envtest-v1.31.0-linux-s390x.tar.gz":   {},
+				"envtest-v1.31.0-windows-amd64.tar.gz": {},
+			},
+		},
+	}
+)
+
+func setupServer(server *ghttp.Server) {
+	itemsHTTP := makeArchives(envtestBinaryArchives)
+
+	// The index from itemsHTTP contains only relative SelfLinks.
+	// finalIndex will contain the full links based on server.Addr().
+	finalIndex := index{
+		Releases: map[string]release{},
+	}
+
+	for releaseVersion, releases := range itemsHTTP.index.Releases {
+		finalIndex.Releases[releaseVersion] = release{}
+
+		for archiveName, a := range releases {
+			finalIndex.Releases[releaseVersion][archiveName] = archive{
+				Hash:     a.Hash,
+				SelfLink: fmt.Sprintf("http://%s/%s", server.Addr(), a.SelfLink),
+			}
+			content := itemsHTTP.contents[archiveName]
+
+			// Note: Using the relative path from archive here instead of the full path.
+			server.RouteToHandler("GET", "/"+a.SelfLink, func(resp http.ResponseWriter, req *http.Request) {
+				resp.WriteHeader(http.StatusOK)
+				Expect(resp.Write(content)).To(Equal(len(content)))
+			})
+		}
+	}
+
+	indexYAML, err := yaml.Marshal(finalIndex)
+	Expect(err).ToNot(HaveOccurred())
+
+	server.RouteToHandler("GET", "/envtest-releases.yaml", ghttp.RespondWith(
+		http.StatusOK,
+		indexYAML,
+	))
+}
+
+type itemsHTTP struct {
+	index    index
+	contents map[string][]byte
+}
+
+func makeArchives(i index) itemsHTTP {
+	// This creates a new copy of the index so modifying the index
+	// in some tests doesn't affect others.
+	res := itemsHTTP{
+		index: index{
+			Releases: map[string]release{},
+		},
+		contents: map[string][]byte{},
+	}
+
+	for releaseVersion, releases := range i.Releases {
+		res.index.Releases[releaseVersion] = release{}
+		for archiveName := range releases {
+			var chunk [1024 * 48]byte // 1.5 times our chunk read size in GetVersion
+			copy(chunk[:], archiveName)
+			if _, err := rand.Read(chunk[len(archiveName):]); err != nil {
+				panic(err)
+			}
+			content, hash := makeArchive(chunk[:])
+
+			res.index.Releases[releaseVersion][archiveName] = archive{
+				Hash: hash,
+				// Note: Only storing the name of the archive for now.
+				// This will be expanded later to a full URL once the server is running.
+				SelfLink: archiveName,
+			}
+			res.contents[archiveName] = content
+		}
+	}
+	return res
+}
+
+func makeArchive(contents []byte) ([]byte, string) {
+	out := new(bytes.Buffer)
+	gzipWriter := gzip.NewWriter(out)
+	tarWriter := tar.NewWriter(gzipWriter)
+	err := tarWriter.WriteHeader(&tar.Header{
+		Name: "controller-tools/envtest/some-file",
+		Size: int64(len(contents)),
+		Mode: 0777, // so we can check that we fix this later
+	})
+	if err != nil {
+		panic(err)
+	}
+	_, err = tarWriter.Write(contents)
+	if err != nil {
+		panic(err)
+	}
+	tarWriter.Close()
+	gzipWriter.Close()
+	content := out.Bytes()
+	// controller-tools is using sha512
+	hash := sha512.Sum512(content)
+	hashEncoded := hex.EncodeToString(hash[:])
+	return content, hashEncoded
+}
diff --git a/pkg/envtest/crd.go b/pkg/envtest/crd.go
index 5fdd657cd7..8ed2224cfe 100644
--- a/pkg/envtest/crd.go
+++ b/pkg/envtest/crd.go
@@ -94,7 +94,7 @@ func InstallCRDs(config *rest.Config, options CRDInstallOptions) ([]*apiextensio
 	defaultCRDOptions(&options)
 
 	// Read the CRD yamls into options.CRDs
-	if err := readCRDFiles(&options); err != nil {
+	if err := ReadCRDFiles(&options); err != nil {
 		return nil, fmt.Errorf("unable to read CRD files: %w", err)
 	}
 
@@ -115,8 +115,8 @@ func InstallCRDs(config *rest.Config, options CRDInstallOptions) ([]*apiextensio
 	return options.CRDs, nil
 }
 
-// readCRDFiles reads the directories of CRDs in options.Paths and adds the CRD structs to options.CRDs.
-func readCRDFiles(options *CRDInstallOptions) error {
+// ReadCRDFiles reads the directories of CRDs in options.Paths and adds the CRD structs to options.CRDs.
+func ReadCRDFiles(options *CRDInstallOptions) error {
 	if len(options.Paths) > 0 {
 		crdList, err := renderCRDs(options)
 		if err != nil {
@@ -217,7 +217,7 @@ func (p *poller) poll(ctx context.Context) (done bool, err error) {
 // UninstallCRDs uninstalls a collection of CRDs by reading the crd yaml files from a directory.
 func UninstallCRDs(config *rest.Config, options CRDInstallOptions) error {
 	// Read the CRD yamls into options.CRDs
-	if err := readCRDFiles(&options); err != nil {
+	if err := ReadCRDFiles(&options); err != nil {
 		return err
 	}
 
@@ -229,7 +229,6 @@ func UninstallCRDs(config *rest.Config, options CRDInstallOptions) error {
 
 	// Uninstall each CRD
 	for _, crd := range options.CRDs {
-		crd := crd
 		log.V(1).Info("uninstalling CRD", "crd", crd.GetName())
 		if err := cs.Delete(context.TODO(), crd); err != nil {
 			// If CRD is not found, we can consider success
@@ -251,7 +250,6 @@ func CreateCRDs(config *rest.Config, crds []*apiextensionsv1.CustomResourceDefin
 
 	// Create each CRD
 	for _, crd := range crds {
-		crd := crd
 		log.V(1).Info("installing CRD", "crd", crd.GetName())
 		existingCrd := crd.DeepCopy()
 		err := cs.Get(context.TODO(), client.ObjectKey{Name: crd.GetName()}, existingCrd)
diff --git a/pkg/envtest/crd_test.go b/pkg/envtest/crd_test.go
index 92dc48e963..a1406615d6 100644
--- a/pkg/envtest/crd_test.go
+++ b/pkg/envtest/crd_test.go
@@ -31,7 +31,7 @@ var _ = Describe("Test", func() {
 					"testdata/crdv1_original",
 				},
 			}
-			err := readCRDFiles(&opt)
+			err := ReadCRDFiles(&opt)
 			Expect(err).NotTo(HaveOccurred())
 
 			expectedCRDs := sets.NewString(
diff --git a/pkg/envtest/envtest_test.go b/pkg/envtest/envtest_test.go
index 21464e10be..ce3e9a4d3f 100644
--- a/pkg/envtest/envtest_test.go
+++ b/pkg/envtest/envtest_test.go
@@ -17,7 +17,6 @@ limitations under the License.
 package envtest
 
 import (
-	"context"
 	"path/filepath"
 	"time"
 
@@ -28,7 +27,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/kubernetes/scheme"
-
+	"k8s.io/client-go/tools/clientcmd"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
@@ -55,30 +54,29 @@ var _ = Describe("Test", func() {
 	})
 
 	// Cleanup CRDs
-	AfterEach(func() {
+	AfterEach(func(ctx SpecContext) {
 		for _, crd := range crds {
-			crd := crd
 			// Delete only if CRD exists.
 			crdObjectKey := client.ObjectKey{
 				Name: crd.GetName(),
 			}
 			var placeholder apiextensionsv1.CustomResourceDefinition
-			if err = c.Get(context.TODO(), crdObjectKey, &placeholder); err != nil &&
+			if err = c.Get(ctx, crdObjectKey, &placeholder); err != nil &&
 				apierrors.IsNotFound(err) {
 				// CRD doesn't need to be deleted.
 				continue
 			}
 			Expect(err).NotTo(HaveOccurred())
-			Expect(c.Delete(context.TODO(), crd)).To(Succeed())
+			Expect(c.Delete(ctx, crd)).To(Succeed())
 			Eventually(func() bool {
-				err := c.Get(context.TODO(), crdObjectKey, &placeholder)
+				err := c.Get(ctx, crdObjectKey, &placeholder)
 				return apierrors.IsNotFound(err)
 			}, 5*time.Second).Should(BeTrue())
 		}
 	}, teardownTimeoutSeconds)
 
 	Describe("InstallCRDs", func() {
-		It("should install the unserved CRDs into the cluster", func() {
+		It("should install the unserved CRDs into the cluster", func(ctx SpecContext) {
 			crds, err = InstallCRDs(env.Config, CRDInstallOptions{
 				Paths: []string{filepath.Join(".", "testdata", "crds", "examplecrd_unserved.yaml")},
 			})
@@ -87,7 +85,7 @@ var _ = Describe("Test", func() {
 			// Expect to find the CRDs
 
 			crd := &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "frigates.ship.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "frigates.ship.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Frigate"))
 
@@ -116,7 +114,7 @@ var _ = Describe("Test", func() {
 			)
 			Expect(err).NotTo(HaveOccurred())
 		})
-		It("should install the CRDs into the cluster using directory", func() {
+		It("should install the CRDs into the cluster using directory", func(ctx SpecContext) {
 			crds, err = InstallCRDs(env.Config, CRDInstallOptions{
 				Paths: []string{validDirectory},
 			})
@@ -125,27 +123,27 @@ var _ = Describe("Test", func() {
 			// Expect to find the CRDs
 
 			crd := &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "foos.bar.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "foos.bar.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Foo"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "bazs.qux.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "bazs.qux.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Baz"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "captains.crew.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "captains.crew.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Captain"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "firstmates.crew.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "firstmates.crew.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("FirstMate"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "drivers.crew.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "drivers.crew.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Driver"))
 
@@ -245,14 +243,14 @@ var _ = Describe("Test", func() {
 			Expect(err).NotTo(HaveOccurred())
 		})
 
-		It("should install the CRDs into the cluster using file", func() {
+		It("should install the CRDs into the cluster using file", func(ctx SpecContext) {
 			crds, err = InstallCRDs(env.Config, CRDInstallOptions{
 				Paths: []string{filepath.Join(".", "testdata", "crds", "examplecrd3.yaml")},
 			})
 			Expect(err).NotTo(HaveOccurred())
 
 			crd := &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "configs.foo.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "configs.foo.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Config"))
 
@@ -291,7 +289,7 @@ var _ = Describe("Test", func() {
 			Expect(crds).To(HaveLen(2))
 		})
 
-		It("should filter out already existent CRD", func() {
+		It("should filter out already existent CRD", func(ctx SpecContext) {
 			crds, err = InstallCRDs(env.Config, CRDInstallOptions{
 				Paths: []string{
 					filepath.Join(".", "testdata"),
@@ -301,7 +299,7 @@ var _ = Describe("Test", func() {
 			Expect(err).NotTo(HaveOccurred())
 
 			crd := &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "foos.bar.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "foos.bar.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Foo"))
 
@@ -423,7 +421,7 @@ var _ = Describe("Test", func() {
 			Expect(err).To(HaveOccurred())
 		})
 
-		It("should reinstall the CRDs if already present in the cluster", func() {
+		It("should reinstall the CRDs if already present in the cluster", func(ctx SpecContext) {
 
 			crds, err = InstallCRDs(env.Config, CRDInstallOptions{
 				Paths: []string{filepath.Join(".", "testdata")},
@@ -433,27 +431,27 @@ var _ = Describe("Test", func() {
 			// Expect to find the CRDs
 
 			crd := &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "foos.bar.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "foos.bar.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Foo"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "bazs.qux.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "bazs.qux.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Baz"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "captains.crew.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "captains.crew.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Captain"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "firstmates.crew.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "firstmates.crew.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("FirstMate"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "drivers.crew.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "drivers.crew.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Driver"))
 
@@ -562,27 +560,27 @@ var _ = Describe("Test", func() {
 			// Expect to find the CRDs
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "foos.bar.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "foos.bar.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Foo"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "bazs.qux.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "bazs.qux.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Baz"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "captains.crew.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "captains.crew.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Captain"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "firstmates.crew.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "firstmates.crew.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("FirstMate"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "drivers.crew.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "drivers.crew.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Driver"))
 
@@ -683,7 +681,15 @@ var _ = Describe("Test", func() {
 		})
 	})
 
-	It("should update CRDs if already present in the cluster", func() {
+	It("should set a working KubeConfig", func(ctx SpecContext) {
+		kubeconfigRESTConfig, err := clientcmd.RESTConfigFromKubeConfig(env.KubeConfig)
+		Expect(err).ToNot(HaveOccurred())
+		kubeconfigClient, err := client.New(kubeconfigRESTConfig, client.Options{Scheme: s})
+		Expect(err).NotTo(HaveOccurred())
+		Expect(kubeconfigClient.List(ctx, &apiextensionsv1.CustomResourceDefinitionList{})).To(Succeed())
+	})
+
+	It("should update CRDs if already present in the cluster", func(ctx SpecContext) {
 
 		// Install only the CRDv1 multi-version example
 		crds, err = InstallCRDs(env.Config, CRDInstallOptions{
@@ -694,7 +700,7 @@ var _ = Describe("Test", func() {
 		// Expect to find the CRDs
 
 		crd := &apiextensionsv1.CustomResourceDefinition{}
-		err = c.Get(context.TODO(), types.NamespacedName{Name: "drivers.crew.example.com"}, crd)
+		err = c.Get(ctx, types.NamespacedName{Name: "drivers.crew.example.com"}, crd)
 		Expect(err).NotTo(HaveOccurred())
 		Expect(crd.Spec.Names.Kind).To(Equal("Driver"))
 		Expect(len(crd.Spec.Versions)).To(BeEquivalentTo(2))
@@ -736,7 +742,7 @@ var _ = Describe("Test", func() {
 		// Expect to find updated CRD
 
 		crd = &apiextensionsv1.CustomResourceDefinition{}
-		err = c.Get(context.TODO(), types.NamespacedName{Name: "drivers.crew.example.com"}, crd)
+		err = c.Get(ctx, types.NamespacedName{Name: "drivers.crew.example.com"}, crd)
 		Expect(err).NotTo(HaveOccurred())
 		Expect(crd.Spec.Names.Kind).To(Equal("Driver"))
 		Expect(len(crd.Spec.Versions)).To(BeEquivalentTo(3))
@@ -774,8 +780,7 @@ var _ = Describe("Test", func() {
 	})
 
 	Describe("UninstallCRDs", func() {
-		It("should uninstall the CRDs from the cluster", func() {
-
+		It("should uninstall the CRDs from the cluster", func(ctx SpecContext) {
 			crds, err = InstallCRDs(env.Config, CRDInstallOptions{
 				Paths: []string{validDirectory},
 			})
@@ -784,27 +789,27 @@ var _ = Describe("Test", func() {
 			// Expect to find the CRDs
 
 			crd := &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "foos.bar.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "foos.bar.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Foo"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "bazs.qux.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "bazs.qux.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Baz"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "captains.crew.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "captains.crew.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Captain"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "firstmates.crew.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "firstmates.crew.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("FirstMate"))
 
 			crd = &apiextensionsv1.CustomResourceDefinition{}
-			err = c.Get(context.TODO(), types.NamespacedName{Name: "drivers.crew.example.com"}, crd)
+			err = c.Get(ctx, types.NamespacedName{Name: "drivers.crew.example.com"}, crd)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(crd.Spec.Names.Kind).To(Equal("Driver"))
 
@@ -920,7 +925,7 @@ var _ = Describe("Test", func() {
 			placeholder := &apiextensionsv1.CustomResourceDefinition{}
 			Eventually(func() bool {
 				for _, crd := range crds {
-					err = c.Get(context.TODO(), types.NamespacedName{Name: crd}, placeholder)
+					err = c.Get(ctx, types.NamespacedName{Name: crd}, placeholder)
 					notFound := err != nil && apierrors.IsNotFound(err)
 					if !notFound {
 						return false
diff --git a/pkg/envtest/server.go b/pkg/envtest/server.go
index 8543657645..9bb81ed2ab 100644
--- a/pkg/envtest/server.go
+++ b/pkg/envtest/server.go
@@ -126,6 +126,10 @@ type Environment struct {
 	// loading.
 	Config *rest.Config
 
+	// KubeConfig provides []byte of a kubeconfig file to talk to the apiserver
+	// It's automatically populated if not set based on the `Config`
+	KubeConfig []byte
+
 	// CRDInstallOptions are the options for installing CRDs.
 	CRDInstallOptions CRDInstallOptions
 
@@ -147,8 +151,22 @@ type Environment struct {
 	// values are merged.
 	CRDDirectoryPaths []string
 
+	// DownloadBinaryAssets indicates that the envtest binaries should be downloaded.
+	// If BinaryAssetsDirectory is also set, it is used to store the downloaded binaries,
+	// otherwise a tmp directory is created.
+	DownloadBinaryAssets bool
+
+	// DownloadBinaryAssetsVersion is the version of envtest binaries to download.
+	// Defaults to the latest stable version (i.e. excluding alpha / beta / RC versions).
+	DownloadBinaryAssetsVersion string
+
+	// DownloadBinaryAssetsIndexURL is the index used to discover envtest binaries to download.
+	// Defaults to https://raw.githubusercontent.com/kubernetes-sigs/controller-tools/HEAD/envtest-releases.yaml.
+	DownloadBinaryAssetsIndexURL string
+
 	// BinaryAssetsDirectory is the path where the binaries required for the envtest are
 	// located in the local environment. This field can be overridden by setting KUBEBUILDER_ASSETS.
+	// Set this field to SetupEnvtestDefaultBinaryAssetsDirectory() to share binaries with setup-envtest.
 	BinaryAssetsDirectory string
 
 	// UseExistingCluster indicates that this environments should use an
@@ -233,9 +251,21 @@ func (te *Environment) Start() (*rest.Config, error) {
 			}
 		}
 
-		apiServer.Path = process.BinPathFinder("kube-apiserver", te.BinaryAssetsDirectory)
-		te.ControlPlane.Etcd.Path = process.BinPathFinder("etcd", te.BinaryAssetsDirectory)
-		te.ControlPlane.KubectlPath = process.BinPathFinder("kubectl", te.BinaryAssetsDirectory)
+		if te.DownloadBinaryAssets {
+			apiServerPath, etcdPath, kubectlPath, err := downloadBinaryAssets(context.TODO(),
+				te.BinaryAssetsDirectory, te.DownloadBinaryAssetsVersion, te.DownloadBinaryAssetsIndexURL)
+			if err != nil {
+				return nil, err
+			}
+
+			apiServer.Path = apiServerPath
+			te.ControlPlane.Etcd.Path = etcdPath
+			te.ControlPlane.KubectlPath = kubectlPath
+		} else {
+			apiServer.Path = process.BinPathFinder("kube-apiserver", te.BinaryAssetsDirectory)
+			te.ControlPlane.Etcd.Path = process.BinPathFinder("etcd", te.BinaryAssetsDirectory)
+			te.ControlPlane.KubectlPath = process.BinPathFinder("kubectl", te.BinaryAssetsDirectory)
+		}
 
 		if err := te.defaultTimeouts(); err != nil {
 			return nil, fmt.Errorf("failed to default controlplane timeouts: %w", err)
@@ -265,6 +295,14 @@ func (te *Environment) Start() (*rest.Config, error) {
 		te.Config = adminUser.Config()
 	}
 
+	if len(te.KubeConfig) == 0 {
+		var err error
+		te.KubeConfig, err = controlplane.KubeConfigFromREST(te.Config)
+		if err != nil {
+			return nil, fmt.Errorf("unable to set KubeConfig field: %w", err)
+		}
+	}
+
 	// Set the default scheme if nil.
 	if te.Scheme == nil {
 		te.Scheme = scheme.Scheme
diff --git a/pkg/envtest/webhook.go b/pkg/envtest/webhook.go
index e4e54e472c..a6961bf7c6 100644
--- a/pkg/envtest/webhook.go
+++ b/pkg/envtest/webhook.go
@@ -294,10 +294,10 @@ func (o *WebhookInstallOptions) setupCA() error {
 		return fmt.Errorf("unable to marshal webhook serving certs: %w", err)
 	}
 
-	if err := os.WriteFile(filepath.Join(localServingCertsDir, "tls.crt"), certData, 0640); err != nil { //nolint:gosec
+	if err := os.WriteFile(filepath.Join(localServingCertsDir, "tls.crt"), certData, 0640); err != nil {
 		return fmt.Errorf("unable to write webhook serving cert to disk: %w", err)
 	}
-	if err := os.WriteFile(filepath.Join(localServingCertsDir, "tls.key"), keyData, 0640); err != nil { //nolint:gosec
+	if err := os.WriteFile(filepath.Join(localServingCertsDir, "tls.key"), keyData, 0640); err != nil {
 		return fmt.Errorf("unable to write webhook serving key to disk: %w", err)
 	}
 
@@ -313,14 +313,12 @@ func createWebhooks(config *rest.Config, mutHooks []*admissionv1.MutatingWebhook
 
 	// Create each webhook
 	for _, hook := range mutHooks {
-		hook := hook
 		log.V(1).Info("installing mutating webhook", "webhook", hook.GetName())
 		if err := ensureCreated(cs, hook); err != nil {
 			return err
 		}
 	}
 	for _, hook := range valHooks {
-		hook := hook
 		log.V(1).Info("installing validating webhook", "webhook", hook.GetName())
 		if err := ensureCreated(cs, hook); err != nil {
 			return err
@@ -421,8 +419,8 @@ func readWebhooks(path string) ([]*admissionv1.MutatingWebhookConfiguration, []*
 			const (
 				admissionregv1 = "admissionregistration.k8s.io/v1"
 			)
-			switch {
-			case generic.Kind == "MutatingWebhookConfiguration":
+			switch generic.Kind {
+			case "MutatingWebhookConfiguration":
 				if generic.APIVersion != admissionregv1 {
 					return nil, nil, fmt.Errorf("only v1 is supported right now for MutatingWebhookConfiguration (name: %s)", generic.Name)
 				}
@@ -431,7 +429,7 @@ func readWebhooks(path string) ([]*admissionv1.MutatingWebhookConfiguration, []*
 					return nil, nil, err
 				}
 				mutHooks = append(mutHooks, hook)
-			case generic.Kind == "ValidatingWebhookConfiguration":
+			case "ValidatingWebhookConfiguration":
 				if generic.APIVersion != admissionregv1 {
 					return nil, nil, fmt.Errorf("only v1 is supported right now for ValidatingWebhookConfiguration (name: %s)", generic.Name)
 				}
diff --git a/pkg/envtest/webhook_test.go b/pkg/envtest/webhook_test.go
index 79a5227088..47550fa147 100644
--- a/pkg/envtest/webhook_test.go
+++ b/pkg/envtest/webhook_test.go
@@ -37,9 +37,8 @@ import (
 )
 
 var _ = Describe("Test", func() {
-
 	Describe("Webhook", func() {
-		It("should reject create request for webhook that rejects all requests", func() {
+		It("should reject create request for webhook that rejects all requests", func(specCtx SpecContext) {
 			m, err := manager.New(env.Config, manager.Options{
 				WebhookServer: webhook.NewServer(webhook.Options{
 					Port:    env.WebhookInstallOptions.LocalServingPort,
@@ -52,7 +51,7 @@ var _ = Describe("Test", func() {
 			server := m.GetWebhookServer()
 			server.Register("/failing", &webhook.Admission{Handler: &rejectingValidator{}})
 
-			ctx, cancel := context.WithCancel(context.Background())
+			ctx, cancel := context.WithCancel(specCtx)
 			go func() {
 				_ = server.Start(ctx)
 			}()
@@ -88,7 +87,7 @@ var _ = Describe("Test", func() {
 			}
 
 			Eventually(func() bool {
-				err = c.Create(context.TODO(), obj)
+				err = c.Create(ctx, obj)
 				return err != nil && strings.HasSuffix(err.Error(), "Always denied") && apierrors.ReasonForError(err) == metav1.StatusReasonForbidden
 			}, 1*time.Second).Should(BeTrue())
 
diff --git a/pkg/event/event.go b/pkg/event/event.go
index 81229fc2d3..82b1793f53 100644
--- a/pkg/event/event.go
+++ b/pkg/event/event.go
@@ -40,6 +40,9 @@ type GenericEvent = TypedGenericEvent[client.Object]
 type TypedCreateEvent[object any] struct {
 	// Object is the object from the event
 	Object object
+
+	// IsInInitialList is true if the Create event was triggered by the initial list.
+	IsInInitialList bool
 }
 
 // TypedUpdateEvent is an event where a Kubernetes object was updated. TypedUpdateEvent should be generated
diff --git a/pkg/finalizer/finalizer_test.go b/pkg/finalizer/finalizer_test.go
index 02fbdf003c..c6848f6473 100644
--- a/pkg/finalizer/finalizer_test.go
+++ b/pkg/finalizer/finalizer_test.go
@@ -57,14 +57,14 @@ var _ = Describe("TestFinalizer", func() {
 	})
 
 	Describe("Finalize", func() {
-		It("successfully finalizes and returns true for Updated when deletion timestamp is nil and finalizer does not exist", func() {
+		It("successfully finalizes and returns true for Updated when deletion timestamp is nil and finalizer does not exist", func(ctx SpecContext) {
 			err = finalizers.Register("finalizers.sigs.k8s.io/testfinalizer", f)
 			Expect(err).ToNot(HaveOccurred())
 
 			pod.DeletionTimestamp = nil
 			pod.Finalizers = []string{}
 
-			result, err := finalizers.Finalize(context.TODO(), pod)
+			result, err := finalizers.Finalize(ctx, pod)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(result.Updated).To(BeTrue())
 			// when deletion timestamp is nil and finalizer is not present, the registered finalizer would be added to the obj
@@ -73,7 +73,7 @@ var _ = Describe("TestFinalizer", func() {
 
 		})
 
-		It("successfully finalizes and returns true for Updated when deletion timestamp is not nil and the finalizer exists", func() {
+		It("successfully finalizes and returns true for Updated when deletion timestamp is not nil and the finalizer exists", func(ctx SpecContext) {
 			now := metav1.Now()
 			pod.DeletionTimestamp = &now
 
@@ -82,37 +82,37 @@ var _ = Describe("TestFinalizer", func() {
 
 			pod.Finalizers = []string{"finalizers.sigs.k8s.io/testfinalizer"}
 
-			result, err := finalizers.Finalize(context.TODO(), pod)
+			result, err := finalizers.Finalize(ctx, pod)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(result.Updated).To(BeTrue())
 			// finalizer will be removed from the obj upon successful finalization
 			Expect(pod.Finalizers).To(BeEmpty())
 		})
 
-		It("should return no error and return false for Updated when deletion timestamp is nil and finalizer doesn't exist", func() {
+		It("should return no error and return false for Updated when deletion timestamp is nil and finalizer doesn't exist", func(ctx SpecContext) {
 			pod.DeletionTimestamp = nil
 			pod.Finalizers = []string{}
 
-			result, err := finalizers.Finalize(context.TODO(), pod)
+			result, err := finalizers.Finalize(ctx, pod)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(result.Updated).To(BeFalse())
 			Expect(pod.Finalizers).To(BeEmpty())
 
 		})
 
-		It("should return no error and return false for Updated when deletion timestamp is not nil and the finalizer doesn't exist", func() {
+		It("should return no error and return false for Updated when deletion timestamp is not nil and the finalizer doesn't exist", func(ctx SpecContext) {
 			now := metav1.Now()
 			pod.DeletionTimestamp = &now
 			pod.Finalizers = []string{}
 
-			result, err := finalizers.Finalize(context.TODO(), pod)
+			result, err := finalizers.Finalize(ctx, pod)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(result.Updated).To(BeFalse())
 			Expect(pod.Finalizers).To(BeEmpty())
 
 		})
 
-		It("successfully finalizes multiple finalizers and returns true for Updated when deletion timestamp is not nil and the finalizer exists", func() {
+		It("successfully finalizes multiple finalizers and returns true for Updated when deletion timestamp is not nil and the finalizer exists", func(ctx SpecContext) {
 			now := metav1.Now()
 			pod.DeletionTimestamp = &now
 
@@ -124,14 +124,14 @@ var _ = Describe("TestFinalizer", func() {
 
 			pod.Finalizers = []string{"finalizers.sigs.k8s.io/testfinalizer", "finalizers.sigs.k8s.io/newtestfinalizer"}
 
-			result, err := finalizers.Finalize(context.TODO(), pod)
+			result, err := finalizers.Finalize(ctx, pod)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(result.Updated).To(BeTrue())
 			Expect(result.StatusUpdated).To(BeFalse())
 			Expect(pod.Finalizers).To(BeEmpty())
 		})
 
-		It("should return result as false and a non-nil error", func() {
+		It("should return result as false and a non-nil error", func(ctx SpecContext) {
 			now := metav1.Now()
 			pod.DeletionTimestamp = &now
 			pod.Finalizers = []string{"finalizers.sigs.k8s.io/testfinalizer"}
@@ -143,7 +143,7 @@ var _ = Describe("TestFinalizer", func() {
 			err = finalizers.Register("finalizers.sigs.k8s.io/testfinalizer", f)
 			Expect(err).ToNot(HaveOccurred())
 
-			result, err := finalizers.Finalize(context.TODO(), pod)
+			result, err := finalizers.Finalize(ctx, pod)
 			Expect(err).To(HaveOccurred())
 			Expect(err.Error()).To(ContainSubstring("finalizer failed"))
 			Expect(result.Updated).To(BeFalse())
@@ -152,7 +152,7 @@ var _ = Describe("TestFinalizer", func() {
 			Expect(pod.Finalizers[0]).To(Equal("finalizers.sigs.k8s.io/testfinalizer"))
 		})
 
-		It("should return expected result values and error values when registering multiple finalizers", func() {
+		It("should return expected result values and error values when registering multiple finalizers", func(ctx SpecContext) {
 			now := metav1.Now()
 			pod.DeletionTimestamp = &now
 			pod.Finalizers = []string{
@@ -169,7 +169,7 @@ var _ = Describe("TestFinalizer", func() {
 			err = finalizers.Register("finalizers.sigs.k8s.io/testfinalizer1", f)
 			Expect(err).ToNot(HaveOccurred())
 
-			result, err := finalizers.Finalize(context.TODO(), pod)
+			result, err := finalizers.Finalize(ctx, pod)
 			Expect(err).ToNot(HaveOccurred())
 			Expect(result.Updated).To(BeTrue())
 			Expect(result.StatusUpdated).To(BeFalse())
@@ -186,7 +186,7 @@ var _ = Describe("TestFinalizer", func() {
 			err = finalizers.Register("finalizers.sigs.k8s.io/testfinalizer2", f)
 			Expect(err).ToNot(HaveOccurred())
 
-			result, err = finalizers.Finalize(context.TODO(), pod)
+			result, err = finalizers.Finalize(ctx, pod)
 			Expect(err).To(HaveOccurred())
 			Expect(err.Error()).To(ContainSubstring("finalizer failed"))
 			Expect(result.Updated).To(BeFalse())
@@ -202,7 +202,7 @@ var _ = Describe("TestFinalizer", func() {
 			err = finalizers.Register("finalizers.sigs.k8s.io/testfinalizer3", f)
 			Expect(err).ToNot(HaveOccurred())
 
-			result, err = finalizers.Finalize(context.TODO(), pod)
+			result, err = finalizers.Finalize(ctx, pod)
 			Expect(err).To(HaveOccurred())
 			Expect(err.Error()).To(ContainSubstring("finalizer failed"))
 			Expect(result.Updated).To(BeTrue())
diff --git a/pkg/handler/enqueue.go b/pkg/handler/enqueue.go
index 1a1d1ab2f4..64cbe8a4d1 100644
--- a/pkg/handler/enqueue.go
+++ b/pkg/handler/enqueue.go
@@ -52,25 +52,32 @@ func (e *TypedEnqueueRequestForObject[T]) Create(ctx context.Context, evt event.
 		enqueueLog.Error(nil, "CreateEvent received with no metadata", "event", evt)
 		return
 	}
-	q.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+
+	item := reconcile.Request{NamespacedName: types.NamespacedName{
 		Name:      evt.Object.GetName(),
 		Namespace: evt.Object.GetNamespace(),
-	}})
+	}}
+
+	addToQueueCreate(q, evt, item)
 }
 
 // Update implements EventHandler.
 func (e *TypedEnqueueRequestForObject[T]) Update(ctx context.Context, evt event.TypedUpdateEvent[T], q workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 	switch {
 	case !isNil(evt.ObjectNew):
-		q.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+		item := reconcile.Request{NamespacedName: types.NamespacedName{
 			Name:      evt.ObjectNew.GetName(),
 			Namespace: evt.ObjectNew.GetNamespace(),
-		}})
+		}}
+
+		addToQueueUpdate(q, evt, item)
 	case !isNil(evt.ObjectOld):
-		q.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+		item := reconcile.Request{NamespacedName: types.NamespacedName{
 			Name:      evt.ObjectOld.GetName(),
 			Namespace: evt.ObjectOld.GetNamespace(),
-		}})
+		}}
+
+		addToQueueUpdate(q, evt, item)
 	default:
 		enqueueLog.Error(nil, "UpdateEvent received with no metadata", "event", evt)
 	}
diff --git a/pkg/handler/enqueue_mapped.go b/pkg/handler/enqueue_mapped.go
index 491bc40c42..62d6728151 100644
--- a/pkg/handler/enqueue_mapped.go
+++ b/pkg/handler/enqueue_mapped.go
@@ -20,7 +20,9 @@ import (
 	"context"
 
 	"k8s.io/client-go/util/workqueue"
+	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/priorityqueue"
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
@@ -63,7 +65,8 @@ func EnqueueRequestsFromMapFunc(fn MapFunc) EventHandler {
 // TypedEnqueueRequestsFromMapFunc is experimental and subject to future change.
 func TypedEnqueueRequestsFromMapFunc[object any, request comparable](fn TypedMapFunc[object, request]) TypedEventHandler[object, request] {
 	return &enqueueRequestsFromMapFunc[object, request]{
-		toRequests: fn,
+		toRequests:                   fn,
+		objectImplementsClientObject: implementsClientObject[object](),
 	}
 }
 
@@ -71,7 +74,8 @@ var _ EventHandler = &enqueueRequestsFromMapFunc[client.Object, reconcile.Reques
 
 type enqueueRequestsFromMapFunc[object any, request comparable] struct {
 	// Mapper transforms the argument into a slice of keys to be reconciled
-	toRequests TypedMapFunc[object, request]
+	toRequests                   TypedMapFunc[object, request]
+	objectImplementsClientObject bool
 }
 
 // Create implements EventHandler.
@@ -81,7 +85,14 @@ func (e *enqueueRequestsFromMapFunc[object, request]) Create(
 	q workqueue.TypedRateLimitingInterface[request],
 ) {
 	reqs := map[request]empty{}
-	e.mapAndEnqueue(ctx, q, evt.Object, reqs)
+
+	var lowPriority bool
+	if isPriorityQueue(q) && !isNil(evt.Object) {
+		if evt.IsInInitialList {
+			lowPriority = true
+		}
+	}
+	e.mapAndEnqueue(ctx, q, evt.Object, reqs, lowPriority)
 }
 
 // Update implements EventHandler.
@@ -90,9 +101,13 @@ func (e *enqueueRequestsFromMapFunc[object, request]) Update(
 	evt event.TypedUpdateEvent[object],
 	q workqueue.TypedRateLimitingInterface[request],
 ) {
+	var lowPriority bool
+	if e.objectImplementsClientObject && isPriorityQueue(q) && !isNil(evt.ObjectOld) && !isNil(evt.ObjectNew) {
+		lowPriority = any(evt.ObjectOld).(client.Object).GetResourceVersion() == any(evt.ObjectNew).(client.Object).GetResourceVersion()
+	}
 	reqs := map[request]empty{}
-	e.mapAndEnqueue(ctx, q, evt.ObjectOld, reqs)
-	e.mapAndEnqueue(ctx, q, evt.ObjectNew, reqs)
+	e.mapAndEnqueue(ctx, q, evt.ObjectOld, reqs, lowPriority)
+	e.mapAndEnqueue(ctx, q, evt.ObjectNew, reqs, lowPriority)
 }
 
 // Delete implements EventHandler.
@@ -102,7 +117,7 @@ func (e *enqueueRequestsFromMapFunc[object, request]) Delete(
 	q workqueue.TypedRateLimitingInterface[request],
 ) {
 	reqs := map[request]empty{}
-	e.mapAndEnqueue(ctx, q, evt.Object, reqs)
+	e.mapAndEnqueue(ctx, q, evt.Object, reqs, false)
 }
 
 // Generic implements EventHandler.
@@ -112,14 +127,26 @@ func (e *enqueueRequestsFromMapFunc[object, request]) Generic(
 	q workqueue.TypedRateLimitingInterface[request],
 ) {
 	reqs := map[request]empty{}
-	e.mapAndEnqueue(ctx, q, evt.Object, reqs)
+	e.mapAndEnqueue(ctx, q, evt.Object, reqs, false)
 }
 
-func (e *enqueueRequestsFromMapFunc[object, request]) mapAndEnqueue(ctx context.Context, q workqueue.TypedRateLimitingInterface[request], o object, reqs map[request]empty) {
+func (e *enqueueRequestsFromMapFunc[object, request]) mapAndEnqueue(
+	ctx context.Context,
+	q workqueue.TypedRateLimitingInterface[request],
+	o object,
+	reqs map[request]empty,
+	lowPriority bool,
+) {
 	for _, req := range e.toRequests(ctx, o) {
 		_, ok := reqs[req]
 		if !ok {
-			q.Add(req)
+			if lowPriority {
+				q.(priorityqueue.PriorityQueue[request]).AddWithOpts(priorityqueue.AddOpts{
+					Priority: ptr.To(LowPriority),
+				}, req)
+			} else {
+				q.Add(req)
+			}
 			reqs[req] = empty{}
 		}
 	}
diff --git a/pkg/handler/enqueue_owner.go b/pkg/handler/enqueue_owner.go
index 1680043b46..e8fc8eb46e 100644
--- a/pkg/handler/enqueue_owner.go
+++ b/pkg/handler/enqueue_owner.go
@@ -72,7 +72,7 @@ func TypedEnqueueRequestForOwner[object client.Object](scheme *runtime.Scheme, m
 	for _, opt := range opts {
 		opt(e)
 	}
-	return e
+	return WithLowPriorityWhenUnchanged(e)
 }
 
 // OnlyControllerOwner if provided will only look at the first OwnerReference with Controller: true.
diff --git a/pkg/handler/eventhandler.go b/pkg/handler/eventhandler.go
index ea4bcee31e..88510d29ed 100644
--- a/pkg/handler/eventhandler.go
+++ b/pkg/handler/eventhandler.go
@@ -18,9 +18,13 @@ package handler
 
 import (
 	"context"
+	"reflect"
+	"time"
 
 	"k8s.io/client-go/util/workqueue"
+	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/priorityqueue"
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
@@ -106,10 +110,34 @@ type TypedFuncs[object any, request comparable] struct {
 	GenericFunc func(context.Context, event.TypedGenericEvent[object], workqueue.TypedRateLimitingInterface[request])
 }
 
+var typeForClientObject = reflect.TypeFor[client.Object]()
+
+func implementsClientObject[object any]() bool {
+	return reflect.TypeFor[object]().Implements(typeForClientObject)
+}
+
+func isPriorityQueue[request comparable](q workqueue.TypedRateLimitingInterface[request]) bool {
+	_, ok := q.(priorityqueue.PriorityQueue[request])
+	return ok
+}
+
 // Create implements EventHandler.
 func (h TypedFuncs[object, request]) Create(ctx context.Context, e event.TypedCreateEvent[object], q workqueue.TypedRateLimitingInterface[request]) {
 	if h.CreateFunc != nil {
-		h.CreateFunc(ctx, e, q)
+		if !implementsClientObject[object]() || !isPriorityQueue(q) || isNil(e.Object) {
+			h.CreateFunc(ctx, e, q)
+			return
+		}
+
+		wq := workqueueWithDefaultPriority[request]{
+			// We already know that we have a priority queue, that event.Object implements
+			// client.Object and that its not nil
+			PriorityQueue: q.(priorityqueue.PriorityQueue[request]),
+		}
+		if e.IsInInitialList {
+			wq.priority = ptr.To(LowPriority)
+		}
+		h.CreateFunc(ctx, e, wq)
 	}
 }
 
@@ -123,7 +151,20 @@ func (h TypedFuncs[object, request]) Delete(ctx context.Context, e event.TypedDe
 // Update implements EventHandler.
 func (h TypedFuncs[object, request]) Update(ctx context.Context, e event.TypedUpdateEvent[object], q workqueue.TypedRateLimitingInterface[request]) {
 	if h.UpdateFunc != nil {
-		h.UpdateFunc(ctx, e, q)
+		if !implementsClientObject[object]() || !isPriorityQueue(q) || isNil(e.ObjectOld) || isNil(e.ObjectNew) {
+			h.UpdateFunc(ctx, e, q)
+			return
+		}
+
+		wq := workqueueWithDefaultPriority[request]{
+			// We already know that we have a priority queue, that event.ObjectOld and ObjectNew implement
+			// client.Object and that they are  not nil
+			PriorityQueue: q.(priorityqueue.PriorityQueue[request]),
+		}
+		if any(e.ObjectOld).(client.Object).GetResourceVersion() == any(e.ObjectNew).(client.Object).GetResourceVersion() {
+			wq.priority = ptr.To(LowPriority)
+		}
+		h.UpdateFunc(ctx, e, wq)
 	}
 }
 
@@ -133,3 +174,74 @@ func (h TypedFuncs[object, request]) Generic(ctx context.Context, e event.TypedG
 		h.GenericFunc(ctx, e, q)
 	}
 }
+
+// LowPriority is the priority set by WithLowPriorityWhenUnchanged
+const LowPriority = -100
+
+// WithLowPriorityWhenUnchanged reduces the priority of events stemming from the initial listwatch or from a resync if
+// and only if a priorityqueue.PriorityQueue is used. If not, it does nothing.
+func WithLowPriorityWhenUnchanged[object client.Object, request comparable](u TypedEventHandler[object, request]) TypedEventHandler[object, request] {
+	// TypedFuncs already implements this so just wrap
+	return TypedFuncs[object, request]{
+		CreateFunc:  u.Create,
+		UpdateFunc:  u.Update,
+		DeleteFunc:  u.Delete,
+		GenericFunc: u.Generic,
+	}
+}
+
+type workqueueWithDefaultPriority[request comparable] struct {
+	priorityqueue.PriorityQueue[request]
+	priority *int
+}
+
+func (w workqueueWithDefaultPriority[request]) Add(item request) {
+	w.PriorityQueue.AddWithOpts(priorityqueue.AddOpts{Priority: w.priority}, item)
+}
+
+func (w workqueueWithDefaultPriority[request]) AddAfter(item request, after time.Duration) {
+	w.PriorityQueue.AddWithOpts(priorityqueue.AddOpts{Priority: w.priority, After: after}, item)
+}
+
+func (w workqueueWithDefaultPriority[request]) AddRateLimited(item request) {
+	w.PriorityQueue.AddWithOpts(priorityqueue.AddOpts{Priority: w.priority, RateLimited: true}, item)
+}
+
+func (w workqueueWithDefaultPriority[request]) AddWithOpts(o priorityqueue.AddOpts, items ...request) {
+	if o.Priority == nil {
+		o.Priority = w.priority
+	}
+	w.PriorityQueue.AddWithOpts(o, items...)
+}
+
+// addToQueueCreate adds the reconcile.Request to the priorityqueue in the handler
+// for Create requests if and only if the workqueue being used is of type priorityqueue.PriorityQueue[reconcile.Request]
+func addToQueueCreate[T client.Object, request comparable](q workqueue.TypedRateLimitingInterface[request], evt event.TypedCreateEvent[T], item request) {
+	priorityQueue, isPriorityQueue := q.(priorityqueue.PriorityQueue[request])
+	if !isPriorityQueue {
+		q.Add(item)
+		return
+	}
+
+	var priority *int
+	if evt.IsInInitialList {
+		priority = ptr.To(LowPriority)
+	}
+	priorityQueue.AddWithOpts(priorityqueue.AddOpts{Priority: priority}, item)
+}
+
+// addToQueueUpdate adds the reconcile.Request to the priorityqueue in the handler
+// for Update requests if and only if the workqueue being used is of type priorityqueue.PriorityQueue[reconcile.Request]
+func addToQueueUpdate[T client.Object, request comparable](q workqueue.TypedRateLimitingInterface[request], evt event.TypedUpdateEvent[T], item request) {
+	priorityQueue, isPriorityQueue := q.(priorityqueue.PriorityQueue[request])
+	if !isPriorityQueue {
+		q.Add(item)
+		return
+	}
+
+	var priority *int
+	if evt.ObjectOld.GetResourceVersion() == evt.ObjectNew.GetResourceVersion() {
+		priority = ptr.To(LowPriority)
+	}
+	priorityQueue.AddWithOpts(priorityqueue.AddOpts{Priority: priority}, item)
+}
diff --git a/pkg/handler/eventhandler_test.go b/pkg/handler/eventhandler_test.go
index 38b5040971..2a7453f761 100644
--- a/pkg/handler/eventhandler_test.go
+++ b/pkg/handler/eventhandler_test.go
@@ -18,6 +18,7 @@ package handler_test
 
 import (
 	"context"
+	"time"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -34,13 +35,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllertest"
+	"sigs.k8s.io/controller-runtime/pkg/controller/priorityqueue"
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
 
 var _ = Describe("Eventhandler", func() {
-	var ctx = context.Background()
 	var q workqueue.TypedRateLimitingInterface[reconcile.Request]
 	var instance handler.EnqueueRequestForObject
 	var pod *corev1.Pod
@@ -59,7 +60,7 @@ var _ = Describe("Eventhandler", func() {
 	})
 
 	Describe("EnqueueRequestForObject", func() {
-		It("should enqueue a Request with the Name / Namespace of the object in the CreateEvent.", func() {
+		It("should enqueue a Request with the Name / Namespace of the object in the CreateEvent.", func(ctx SpecContext) {
 			evt := event.CreateEvent{
 				Object: pod,
 			}
@@ -70,7 +71,7 @@ var _ = Describe("Eventhandler", func() {
 			Expect(req.NamespacedName).To(Equal(types.NamespacedName{Namespace: "biz", Name: "baz"}))
 		})
 
-		It("should enqueue a Request with the Name / Namespace of the object in the DeleteEvent.", func() {
+		It("should enqueue a Request with the Name / Namespace of the object in the DeleteEvent.", func(ctx SpecContext) {
 			evt := event.DeleteEvent{
 				Object: pod,
 			}
@@ -82,7 +83,7 @@ var _ = Describe("Eventhandler", func() {
 		})
 
 		It("should enqueue a Request with the Name / Namespace of one object in the UpdateEvent.",
-			func() {
+			func(ctx SpecContext) {
 				newPod := pod.DeepCopy()
 				newPod.Name = "baz2"
 				newPod.Namespace = "biz2"
@@ -98,7 +99,7 @@ var _ = Describe("Eventhandler", func() {
 				Expect(req.NamespacedName).To(Equal(types.NamespacedName{Namespace: "biz2", Name: "baz2"}))
 			})
 
-		It("should enqueue a Request with the Name / Namespace of the object in the GenericEvent.", func() {
+		It("should enqueue a Request with the Name / Namespace of the object in the GenericEvent.", func(ctx SpecContext) {
 			evt := event.GenericEvent{
 				Object: pod,
 			}
@@ -109,7 +110,7 @@ var _ = Describe("Eventhandler", func() {
 		})
 
 		Context("for a runtime.Object without Object", func() {
-			It("should do nothing if the Object is missing for a CreateEvent.", func() {
+			It("should do nothing if the Object is missing for a CreateEvent.", func(ctx SpecContext) {
 				evt := event.CreateEvent{
 					Object: nil,
 				}
@@ -117,7 +118,7 @@ var _ = Describe("Eventhandler", func() {
 				Expect(q.Len()).To(Equal(0))
 			})
 
-			It("should do nothing if the Object is missing for a UpdateEvent.", func() {
+			It("should do nothing if the Object is missing for a UpdateEvent.", func(ctx SpecContext) {
 				newPod := pod.DeepCopy()
 				newPod.Name = "baz2"
 				newPod.Namespace = "biz2"
@@ -139,7 +140,7 @@ var _ = Describe("Eventhandler", func() {
 				Expect(req.NamespacedName).To(Equal(types.NamespacedName{Namespace: "biz", Name: "baz"}))
 			})
 
-			It("should do nothing if the Object is missing for a DeleteEvent.", func() {
+			It("should do nothing if the Object is missing for a DeleteEvent.", func(ctx SpecContext) {
 				evt := event.DeleteEvent{
 					Object: nil,
 				}
@@ -147,7 +148,7 @@ var _ = Describe("Eventhandler", func() {
 				Expect(q.Len()).To(Equal(0))
 			})
 
-			It("should do nothing if the Object is missing for a GenericEvent.", func() {
+			It("should do nothing if the Object is missing for a GenericEvent.", func(ctx SpecContext) {
 				evt := event.GenericEvent{
 					Object: nil,
 				}
@@ -158,7 +159,7 @@ var _ = Describe("Eventhandler", func() {
 	})
 
 	Describe("EnqueueRequestsFromMapFunc", func() {
-		It("should enqueue a Request with the function applied to the CreateEvent.", func() {
+		It("should enqueue a Request with the function applied to the CreateEvent.", func(ctx SpecContext) {
 			req := []reconcile.Request{}
 			instance := handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, a client.Object) []reconcile.Request {
 				defer GinkgoRecover()
@@ -190,7 +191,7 @@ var _ = Describe("Eventhandler", func() {
 			))
 		})
 
-		It("should enqueue a Request with the function applied to the DeleteEvent.", func() {
+		It("should enqueue a Request with the function applied to the DeleteEvent.", func(ctx SpecContext) {
 			req := []reconcile.Request{}
 			instance := handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, a client.Object) []reconcile.Request {
 				defer GinkgoRecover()
@@ -223,7 +224,7 @@ var _ = Describe("Eventhandler", func() {
 		})
 
 		It("should enqueue a Request with the function applied to both objects in the UpdateEvent.",
-			func() {
+			func(ctx SpecContext) {
 				newPod := pod.DeepCopy()
 
 				req := []reconcile.Request{}
@@ -255,7 +256,7 @@ var _ = Describe("Eventhandler", func() {
 				Expect(i).To(Equal(reconcile.Request{NamespacedName: types.NamespacedName{Namespace: "biz", Name: "baz-baz"}}))
 			})
 
-		It("should enqueue a Request with the function applied to the GenericEvent.", func() {
+		It("should enqueue a Request with the function applied to the GenericEvent.", func(ctx SpecContext) {
 			req := []reconcile.Request{}
 			instance := handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, a client.Object) []reconcile.Request {
 				defer GinkgoRecover()
@@ -289,7 +290,7 @@ var _ = Describe("Eventhandler", func() {
 	})
 
 	Describe("EnqueueRequestForOwner", func() {
-		It("should enqueue a Request with the Owner of the object in the CreateEvent.", func() {
+		It("should enqueue a Request with the Owner of the object in the CreateEvent.", func(ctx SpecContext) {
 			instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &appsv1.ReplicaSet{})
 
 			pod.OwnerReferences = []metav1.OwnerReference{
@@ -310,7 +311,7 @@ var _ = Describe("Eventhandler", func() {
 				NamespacedName: types.NamespacedName{Namespace: pod.GetNamespace(), Name: "foo-parent"}}))
 		})
 
-		It("should enqueue a Request with the Owner of the object in the DeleteEvent.", func() {
+		It("should enqueue a Request with the Owner of the object in the DeleteEvent.", func(ctx SpecContext) {
 			instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &appsv1.ReplicaSet{})
 
 			pod.OwnerReferences = []metav1.OwnerReference{
@@ -331,7 +332,7 @@ var _ = Describe("Eventhandler", func() {
 				NamespacedName: types.NamespacedName{Namespace: pod.GetNamespace(), Name: "foo-parent"}}))
 		})
 
-		It("should enqueue a Request with the Owners of both objects in the UpdateEvent.", func() {
+		It("should enqueue a Request with the Owners of both objects in the UpdateEvent.", func(ctx SpecContext) {
 			newPod := pod.DeepCopy()
 			newPod.Name = pod.Name + "2"
 			newPod.Namespace = pod.Namespace + "2"
@@ -369,7 +370,7 @@ var _ = Describe("Eventhandler", func() {
 			))
 		})
 
-		It("should enqueue a Request with the one duplicate Owner of both objects in the UpdateEvent.", func() {
+		It("should enqueue a Request with the one duplicate Owner of both objects in the UpdateEvent.", func(ctx SpecContext) {
 			newPod := pod.DeepCopy()
 			newPod.Name = pod.Name + "2"
 
@@ -401,7 +402,7 @@ var _ = Describe("Eventhandler", func() {
 				NamespacedName: types.NamespacedName{Namespace: pod.GetNamespace(), Name: "foo-parent"}}))
 		})
 
-		It("should enqueue a Request with the Owner of the object in the GenericEvent.", func() {
+		It("should enqueue a Request with the Owner of the object in the GenericEvent.", func(ctx SpecContext) {
 			instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &appsv1.ReplicaSet{})
 			pod.OwnerReferences = []metav1.OwnerReference{
 				{
@@ -421,7 +422,7 @@ var _ = Describe("Eventhandler", func() {
 				NamespacedName: types.NamespacedName{Namespace: pod.GetNamespace(), Name: "foo-parent"}}))
 		})
 
-		It("should not enqueue a Request if there are no owners matching Group and Kind.", func() {
+		It("should not enqueue a Request if there are no owners matching Group and Kind.", func(ctx SpecContext) {
 			instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &appsv1.ReplicaSet{}, handler.OnlyControllerOwner())
 			pod.OwnerReferences = []metav1.OwnerReference{
 				{ // Wrong group
@@ -443,7 +444,7 @@ var _ = Describe("Eventhandler", func() {
 		})
 
 		It("should enqueue a Request if there are owners matching Group "+
-			"and Kind with a different version.", func() {
+			"and Kind with a different version.", func(ctx SpecContext) {
 			instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &autoscalingv1.HorizontalPodAutoscaler{})
 			pod.OwnerReferences = []metav1.OwnerReference{
 				{
@@ -463,7 +464,7 @@ var _ = Describe("Eventhandler", func() {
 				NamespacedName: types.NamespacedName{Namespace: pod.GetNamespace(), Name: "foo-parent"}}))
 		})
 
-		It("should enqueue a Request for a owner that is cluster scoped", func() {
+		It("should enqueue a Request for a owner that is cluster scoped", func(ctx SpecContext) {
 			instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &corev1.Node{})
 			pod.OwnerReferences = []metav1.OwnerReference{
 				{
@@ -484,7 +485,7 @@ var _ = Describe("Eventhandler", func() {
 
 		})
 
-		It("should not enqueue a Request if there are no owners.", func() {
+		It("should not enqueue a Request if there are no owners.", func(ctx SpecContext) {
 			instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &appsv1.ReplicaSet{})
 			evt := event.CreateEvent{
 				Object: pod,
@@ -495,7 +496,7 @@ var _ = Describe("Eventhandler", func() {
 
 		Context("with the Controller field set to true", func() {
 			It("should enqueue reconcile.Requests for only the first the Controller if there are "+
-				"multiple Controller owners.", func() {
+				"multiple Controller owners.", func(ctx SpecContext) {
 				instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &appsv1.ReplicaSet{}, handler.OnlyControllerOwner())
 				pod.OwnerReferences = []metav1.OwnerReference{
 					{
@@ -536,7 +537,7 @@ var _ = Describe("Eventhandler", func() {
 					NamespacedName: types.NamespacedName{Namespace: pod.GetNamespace(), Name: "foo2-parent"}}))
 			})
 
-			It("should not enqueue reconcile.Requests if there are no Controller owners.", func() {
+			It("should not enqueue reconcile.Requests if there are no Controller owners.", func(ctx SpecContext) {
 				instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &appsv1.ReplicaSet{}, handler.OnlyControllerOwner())
 				pod.OwnerReferences = []metav1.OwnerReference{
 					{
@@ -562,7 +563,7 @@ var _ = Describe("Eventhandler", func() {
 				Expect(q.Len()).To(Equal(0))
 			})
 
-			It("should not enqueue reconcile.Requests if there are no owners.", func() {
+			It("should not enqueue reconcile.Requests if there are no owners.", func(ctx SpecContext) {
 				instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &appsv1.ReplicaSet{}, handler.OnlyControllerOwner())
 				evt := event.CreateEvent{
 					Object: pod,
@@ -573,7 +574,7 @@ var _ = Describe("Eventhandler", func() {
 		})
 
 		Context("with the Controller field set to false", func() {
-			It("should enqueue a reconcile.Requests for all owners.", func() {
+			It("should enqueue a reconcile.Requests for all owners.", func(ctx SpecContext) {
 				instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &appsv1.ReplicaSet{})
 				pod.OwnerReferences = []metav1.OwnerReference{
 					{
@@ -613,7 +614,7 @@ var _ = Describe("Eventhandler", func() {
 		})
 
 		Context("with a nil object", func() {
-			It("should do nothing.", func() {
+			It("should do nothing.", func(ctx SpecContext) {
 				instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &appsv1.ReplicaSet{})
 				pod.OwnerReferences = []metav1.OwnerReference{
 					{
@@ -639,7 +640,7 @@ var _ = Describe("Eventhandler", func() {
 		})
 
 		Context("with an invalid APIVersion in the OwnerReference", func() {
-			It("should do nothing.", func() {
+			It("should do nothing.", func(ctx SpecContext) {
 				instance := handler.EnqueueRequestForOwner(scheme.Scheme, mapper, &appsv1.ReplicaSet{})
 				pod.OwnerReferences = []metav1.OwnerReference{
 					{
@@ -658,7 +659,7 @@ var _ = Describe("Eventhandler", func() {
 	})
 
 	Describe("Funcs", func() {
-		failingFuncs := handler.Funcs{
+		failingFuncs := handler.TypedFuncs[client.Object, reconcile.Request]{
 			CreateFunc: func(context.Context, event.CreateEvent, workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 				defer GinkgoRecover()
 				Fail("Did not expect CreateEvent to be called.")
@@ -677,7 +678,7 @@ var _ = Describe("Eventhandler", func() {
 			},
 		}
 
-		It("should call CreateFunc for a CreateEvent if provided.", func() {
+		It("should call CreateFunc for a CreateEvent if provided.", func(ctx SpecContext) {
 			instance := failingFuncs
 			evt := event.CreateEvent{
 				Object: pod,
@@ -690,7 +691,7 @@ var _ = Describe("Eventhandler", func() {
 			instance.Create(ctx, evt, q)
 		})
 
-		It("should NOT call CreateFunc for a CreateEvent if NOT provided.", func() {
+		It("should NOT call CreateFunc for a CreateEvent if NOT provided.", func(ctx SpecContext) {
 			instance := failingFuncs
 			instance.CreateFunc = nil
 			evt := event.CreateEvent{
@@ -699,7 +700,7 @@ var _ = Describe("Eventhandler", func() {
 			instance.Create(ctx, evt, q)
 		})
 
-		It("should call UpdateFunc for an UpdateEvent if provided.", func() {
+		It("should call UpdateFunc for an UpdateEvent if provided.", func(ctx SpecContext) {
 			newPod := pod.DeepCopy()
 			newPod.Name = pod.Name + "2"
 			newPod.Namespace = pod.Namespace + "2"
@@ -718,7 +719,7 @@ var _ = Describe("Eventhandler", func() {
 			instance.Update(ctx, evt, q)
 		})
 
-		It("should NOT call UpdateFunc for an UpdateEvent if NOT provided.", func() {
+		It("should NOT call UpdateFunc for an UpdateEvent if NOT provided.", func(ctx SpecContext) {
 			newPod := pod.DeepCopy()
 			newPod.Name = pod.Name + "2"
 			newPod.Namespace = pod.Namespace + "2"
@@ -729,7 +730,7 @@ var _ = Describe("Eventhandler", func() {
 			instance.Update(ctx, evt, q)
 		})
 
-		It("should call DeleteFunc for a DeleteEvent if provided.", func() {
+		It("should call DeleteFunc for a DeleteEvent if provided.", func(ctx SpecContext) {
 			instance := failingFuncs
 			evt := event.DeleteEvent{
 				Object: pod,
@@ -742,7 +743,7 @@ var _ = Describe("Eventhandler", func() {
 			instance.Delete(ctx, evt, q)
 		})
 
-		It("should NOT call DeleteFunc for a DeleteEvent if NOT provided.", func() {
+		It("should NOT call DeleteFunc for a DeleteEvent if NOT provided.", func(ctx SpecContext) {
 			instance := failingFuncs
 			instance.DeleteFunc = nil
 			evt := event.DeleteEvent{
@@ -751,7 +752,7 @@ var _ = Describe("Eventhandler", func() {
 			instance.Delete(ctx, evt, q)
 		})
 
-		It("should call GenericFunc for a GenericEvent if provided.", func() {
+		It("should call GenericFunc for a GenericEvent if provided.", func(ctx SpecContext) {
 			instance := failingFuncs
 			evt := event.GenericEvent{
 				Object: pod,
@@ -764,7 +765,7 @@ var _ = Describe("Eventhandler", func() {
 			instance.Generic(ctx, evt, q)
 		})
 
-		It("should NOT call GenericFunc for a GenericEvent if NOT provided.", func() {
+		It("should NOT call GenericFunc for a GenericEvent if NOT provided.", func(ctx SpecContext) {
 			instance := failingFuncs
 			instance.GenericFunc = nil
 			evt := event.GenericEvent{
@@ -773,4 +774,395 @@ var _ = Describe("Eventhandler", func() {
 			instance.Generic(ctx, evt, q)
 		})
 	})
+
+	Describe("WithLowPriorityWhenUnchanged", func() {
+		handlerPriorityTests := []struct {
+			name             string
+			handler          func() handler.EventHandler
+			after            time.Duration
+			ratelimited      bool
+			overridePriority int
+		}{
+			{
+				name:    "WithLowPriorityWhenUnchanged wrapper",
+				handler: func() handler.EventHandler { return handler.WithLowPriorityWhenUnchanged(customHandler{}) },
+			},
+			{
+				name:    "EnqueueRequestForObject",
+				handler: func() handler.EventHandler { return &handler.EnqueueRequestForObject{} },
+			},
+			{
+				name: "EnqueueRequestForOwner",
+				handler: func() handler.EventHandler {
+					return handler.EnqueueRequestForOwner(
+						scheme.Scheme,
+						mapper,
+						&corev1.Pod{},
+					)
+				},
+			},
+			{
+				name: "TypedEnqueueRequestForOwner",
+				handler: func() handler.EventHandler {
+					return handler.TypedEnqueueRequestForOwner[client.Object](
+						scheme.Scheme,
+						mapper,
+						&corev1.Pod{},
+					)
+				},
+			},
+			{
+				name: "Funcs",
+				handler: func() handler.EventHandler {
+					return handler.TypedFuncs[client.Object, reconcile.Request]{
+						CreateFunc: func(ctx context.Context, tce event.TypedCreateEvent[client.Object], wq workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+							wq.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+								Namespace: tce.Object.GetNamespace(),
+								Name:      tce.Object.GetName(),
+							}})
+						},
+						UpdateFunc: func(ctx context.Context, tue event.TypedUpdateEvent[client.Object], wq workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+							wq.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+								Namespace: tue.ObjectNew.GetNamespace(),
+								Name:      tue.ObjectNew.GetName(),
+							}})
+						},
+					}
+				},
+			},
+			{
+				name: "EnqueueRequestsFromMapFunc",
+				handler: func() handler.EventHandler {
+					return handler.EnqueueRequestsFromMapFunc(func(ctx context.Context, obj client.Object) []reconcile.Request {
+						return []reconcile.Request{{NamespacedName: types.NamespacedName{
+							Name:      obj.GetName(),
+							Namespace: obj.GetNamespace(),
+						}}}
+					})
+				},
+			},
+			{
+				name: "WithLowPriorityWhenUnchanged - Add",
+				handler: func() handler.EventHandler {
+					return handler.WithLowPriorityWhenUnchanged(
+						handler.TypedFuncs[client.Object, reconcile.Request]{
+							CreateFunc: func(ctx context.Context, tce event.TypedCreateEvent[client.Object], wq workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+								wq.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+									Namespace: tce.Object.GetNamespace(),
+									Name:      tce.Object.GetName(),
+								}})
+							},
+							UpdateFunc: func(ctx context.Context, tue event.TypedUpdateEvent[client.Object], wq workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+								wq.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+									Namespace: tue.ObjectNew.GetNamespace(),
+									Name:      tue.ObjectNew.GetName(),
+								}})
+							},
+						})
+				},
+			},
+			{
+				name: "WithLowPriorityWhenUnchanged - AddAfter",
+				handler: func() handler.EventHandler {
+					return handler.WithLowPriorityWhenUnchanged(
+						handler.TypedFuncs[client.Object, reconcile.Request]{
+							CreateFunc: func(ctx context.Context, tce event.TypedCreateEvent[client.Object], wq workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+								wq.AddAfter(reconcile.Request{NamespacedName: types.NamespacedName{
+									Namespace: tce.Object.GetNamespace(),
+									Name:      tce.Object.GetName(),
+								}}, time.Second)
+							},
+							UpdateFunc: func(ctx context.Context, tue event.TypedUpdateEvent[client.Object], wq workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+								wq.AddAfter(reconcile.Request{NamespacedName: types.NamespacedName{
+									Namespace: tue.ObjectNew.GetNamespace(),
+									Name:      tue.ObjectNew.GetName(),
+								}}, time.Second)
+							},
+						})
+				},
+				after: time.Second,
+			},
+			{
+				name: "WithLowPriorityWhenUnchanged - AddRateLimited",
+				handler: func() handler.EventHandler {
+					return handler.WithLowPriorityWhenUnchanged(
+						handler.TypedFuncs[client.Object, reconcile.Request]{
+							CreateFunc: func(ctx context.Context, tce event.TypedCreateEvent[client.Object], wq workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+								wq.AddRateLimited(reconcile.Request{NamespacedName: types.NamespacedName{
+									Namespace: tce.Object.GetNamespace(),
+									Name:      tce.Object.GetName(),
+								}})
+							},
+							UpdateFunc: func(ctx context.Context, tue event.TypedUpdateEvent[client.Object], wq workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+								wq.AddRateLimited(reconcile.Request{NamespacedName: types.NamespacedName{
+									Namespace: tue.ObjectNew.GetNamespace(),
+									Name:      tue.ObjectNew.GetName(),
+								}})
+							},
+						})
+				},
+				ratelimited: true,
+			},
+			{
+				name: "WithLowPriorityWhenUnchanged - AddWithOpts priority is retained",
+				handler: func() handler.EventHandler {
+					return handler.WithLowPriorityWhenUnchanged(
+						handler.TypedFuncs[client.Object, reconcile.Request]{
+							CreateFunc: func(ctx context.Context, tce event.TypedCreateEvent[client.Object], wq workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+								if pq, isPQ := wq.(priorityqueue.PriorityQueue[reconcile.Request]); isPQ {
+									pq.AddWithOpts(priorityqueue.AddOpts{Priority: ptr.To(100)}, reconcile.Request{NamespacedName: types.NamespacedName{
+										Namespace: tce.Object.GetNamespace(),
+										Name:      tce.Object.GetName(),
+									}})
+									return
+								}
+								wq.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+									Namespace: tce.Object.GetNamespace(),
+									Name:      tce.Object.GetName(),
+								}})
+							},
+							UpdateFunc: func(ctx context.Context, tue event.TypedUpdateEvent[client.Object], wq workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+								if pq, isPQ := wq.(priorityqueue.PriorityQueue[reconcile.Request]); isPQ {
+									pq.AddWithOpts(priorityqueue.AddOpts{Priority: ptr.To(100)}, reconcile.Request{NamespacedName: types.NamespacedName{
+										Namespace: tue.ObjectNew.GetNamespace(),
+										Name:      tue.ObjectNew.GetName(),
+									}})
+									return
+								}
+								wq.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+									Namespace: tue.ObjectNew.GetNamespace(),
+									Name:      tue.ObjectNew.GetName(),
+								}})
+							},
+						})
+				},
+				overridePriority: 100,
+			},
+		}
+		for _, test := range handlerPriorityTests {
+			When("handler is "+test.name, func() {
+				It("should lower the priority of a create request for an object that was part of the initial list", func(ctx SpecContext) {
+					actualOpts := priorityqueue.AddOpts{}
+					var actualRequests []reconcile.Request
+					wq := &fakePriorityQueue{
+						addWithOpts: func(o priorityqueue.AddOpts, items ...reconcile.Request) {
+							actualOpts = o
+							actualRequests = items
+						},
+					}
+
+					test.handler().Create(ctx, event.CreateEvent{
+						Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{
+							Name:              "my-pod",
+							CreationTimestamp: metav1.Now(),
+							OwnerReferences: []metav1.OwnerReference{{
+								Kind: "Pod",
+								Name: "my-pod",
+							}},
+						}},
+						IsInInitialList: true,
+					}, wq)
+
+					expected := handler.LowPriority
+					if test.overridePriority != 0 {
+						expected = test.overridePriority
+					}
+
+					Expect(actualOpts).To(Equal(priorityqueue.AddOpts{
+						Priority:    ptr.To(expected),
+						After:       test.after,
+						RateLimited: test.ratelimited,
+					}))
+					Expect(actualRequests).To(Equal([]reconcile.Request{{NamespacedName: types.NamespacedName{Name: "my-pod"}}}))
+				})
+
+				It("should not lower the priority of a create request for an object that was not part of the initial list", func(ctx SpecContext) {
+					actualOpts := priorityqueue.AddOpts{}
+					var actualRequests []reconcile.Request
+					wq := &fakePriorityQueue{
+						addWithOpts: func(o priorityqueue.AddOpts, items ...reconcile.Request) {
+							actualOpts = o
+							actualRequests = items
+						},
+					}
+
+					test.handler().Create(ctx, event.CreateEvent{
+						Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{
+							Name:              "my-pod",
+							CreationTimestamp: metav1.Now(),
+							OwnerReferences: []metav1.OwnerReference{{
+								Kind: "Pod",
+								Name: "my-pod",
+							}},
+						}},
+						IsInInitialList: false,
+					}, wq)
+
+					var expectedPriority *int
+					if test.overridePriority != 0 {
+						expectedPriority = &test.overridePriority
+					}
+
+					Expect(actualOpts).To(Equal(priorityqueue.AddOpts{After: test.after, RateLimited: test.ratelimited, Priority: expectedPriority}))
+					Expect(actualRequests).To(Equal([]reconcile.Request{{NamespacedName: types.NamespacedName{Name: "my-pod"}}}))
+				})
+
+				It("should lower the priority of an update request with unchanged RV", func(ctx SpecContext) {
+					actualOpts := priorityqueue.AddOpts{}
+					var actualRequests []reconcile.Request
+					wq := &fakePriorityQueue{
+						addWithOpts: func(o priorityqueue.AddOpts, items ...reconcile.Request) {
+							actualOpts = o
+							actualRequests = items
+						},
+					}
+
+					test.handler().Update(ctx, event.UpdateEvent{
+						ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{
+							Name: "my-pod",
+							OwnerReferences: []metav1.OwnerReference{{
+								Kind: "Pod",
+								Name: "my-pod",
+							}},
+						}},
+						ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{
+							Name: "my-pod",
+							OwnerReferences: []metav1.OwnerReference{{
+								Kind: "Pod",
+								Name: "my-pod",
+							}},
+						}},
+					}, wq)
+
+					expectedPriority := handler.LowPriority
+					if test.overridePriority != 0 {
+						expectedPriority = test.overridePriority
+					}
+
+					Expect(actualOpts).To(Equal(priorityqueue.AddOpts{After: test.after, RateLimited: test.ratelimited, Priority: ptr.To(expectedPriority)}))
+					Expect(actualRequests).To(Equal([]reconcile.Request{{NamespacedName: types.NamespacedName{Name: "my-pod"}}}))
+				})
+
+				It("should not lower the priority of an update request with changed RV", func(ctx SpecContext) {
+					actualOpts := priorityqueue.AddOpts{}
+					var actualRequests []reconcile.Request
+					wq := &fakePriorityQueue{
+						addWithOpts: func(o priorityqueue.AddOpts, items ...reconcile.Request) {
+							actualOpts = o
+							actualRequests = items
+						},
+					}
+
+					test.handler().Update(ctx, event.UpdateEvent{
+						ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{
+							Name: "my-pod",
+							OwnerReferences: []metav1.OwnerReference{{
+								Kind: "Pod",
+								Name: "my-pod",
+							}},
+						}},
+						ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{
+							Name:            "my-pod",
+							ResourceVersion: "1",
+							OwnerReferences: []metav1.OwnerReference{{
+								Kind: "Pod",
+								Name: "my-pod",
+							}},
+						}},
+					}, wq)
+
+					var expectedPriority *int
+					if test.overridePriority != 0 {
+						expectedPriority = &test.overridePriority
+					}
+					Expect(actualOpts).To(Equal(priorityqueue.AddOpts{After: test.after, RateLimited: test.ratelimited, Priority: expectedPriority}))
+					Expect(actualRequests).To(Equal([]reconcile.Request{{NamespacedName: types.NamespacedName{Name: "my-pod"}}}))
+				})
+
+				It("should have no effect on create if the workqueue is not a priorityqueue", func(ctx SpecContext) {
+					test.handler().Create(ctx, event.CreateEvent{
+						Object: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{
+							Name: "my-pod",
+							OwnerReferences: []metav1.OwnerReference{{
+								Kind: "Pod",
+								Name: "my-pod",
+							}},
+						}},
+					}, q)
+
+					Expect(q.Len()).To(Equal(1))
+					item, _ := q.Get()
+					Expect(item).To(Equal(reconcile.Request{NamespacedName: types.NamespacedName{Name: "my-pod"}}))
+				})
+
+				It("should have no effect on Update if the workqueue is not a priorityqueue", func(ctx SpecContext) {
+					test.handler().Update(ctx, event.UpdateEvent{
+						ObjectOld: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{
+							Name: "my-pod",
+							OwnerReferences: []metav1.OwnerReference{{
+								Kind: "Pod",
+								Name: "my-pod",
+							}},
+						}},
+						ObjectNew: &corev1.Pod{ObjectMeta: metav1.ObjectMeta{
+							Name: "my-pod",
+							OwnerReferences: []metav1.OwnerReference{{
+								Kind: "Pod",
+								Name: "my-pod",
+							}},
+						}},
+					}, q)
+
+					Expect(q.Len()).To(Equal(1))
+					item, _ := q.Get()
+					Expect(item).To(Equal(reconcile.Request{NamespacedName: types.NamespacedName{Name: "my-pod"}}))
+				})
+			})
+		}
+	})
 })
+
+type fakePriorityQueue struct {
+	workqueue.TypedRateLimitingInterface[reconcile.Request]
+	addWithOpts func(o priorityqueue.AddOpts, items ...reconcile.Request)
+}
+
+func (f *fakePriorityQueue) Add(item reconcile.Request) {
+	f.AddWithOpts(priorityqueue.AddOpts{}, item)
+}
+
+func (f *fakePriorityQueue) AddWithOpts(o priorityqueue.AddOpts, items ...reconcile.Request) {
+	f.addWithOpts(o, items...)
+}
+func (f *fakePriorityQueue) GetWithPriority() (item reconcile.Request, priority int, shutdown bool) {
+	panic("GetWithPriority is not expected to be called")
+}
+
+// customHandler re-implements the basic enqueueRequestForObject logic
+// to be able to test the WithLowPriorityWhenUnchanged wrapper
+type customHandler struct{}
+
+func (ch customHandler) Create(ctx context.Context, evt event.CreateEvent, q workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+	q.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+		Namespace: evt.Object.GetNamespace(),
+		Name:      evt.Object.GetName(),
+	}})
+}
+func (ch customHandler) Update(ctx context.Context, evt event.UpdateEvent, q workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+	q.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+		Namespace: evt.ObjectNew.GetNamespace(),
+		Name:      evt.ObjectNew.GetName(),
+	}})
+}
+func (ch customHandler) Delete(ctx context.Context, evt event.DeleteEvent, q workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+	q.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+		Namespace: evt.Object.GetNamespace(),
+		Name:      evt.Object.GetName(),
+	}})
+}
+func (ch customHandler) Generic(ctx context.Context, evt event.GenericEvent, q workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+	q.Add(reconcile.Request{NamespacedName: types.NamespacedName{
+		Namespace: evt.Object.GetNamespace(),
+		Name:      evt.Object.GetName(),
+	}})
+}
diff --git a/pkg/internal/controller/controller.go b/pkg/internal/controller/controller.go
index dfe407f3b8..ea79681862 100644
--- a/pkg/internal/controller/controller.go
+++ b/pkg/internal/controller/controller.go
@@ -21,20 +21,73 @@ import (
 	"errors"
 	"fmt"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/go-logr/logr"
+	"golang.org/x/sync/errgroup"
 	"k8s.io/apimachinery/pkg/types"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"k8s.io/apimachinery/pkg/util/uuid"
 	"k8s.io/client-go/util/workqueue"
+	"k8s.io/utils/ptr"
 
+	"sigs.k8s.io/controller-runtime/pkg/controller/priorityqueue"
 	ctrlmetrics "sigs.k8s.io/controller-runtime/pkg/internal/controller/metrics"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 )
 
+// Options are the arguments for creating a new Controller.
+type Options[request comparable] struct {
+	// Reconciler is a function that can be called at any time with the Name / Namespace of an object and
+	// ensures that the state of the system matches the state specified in the object.
+	// Defaults to the DefaultReconcileFunc.
+	Do reconcile.TypedReconciler[request]
+
+	// RateLimiter is used to limit how frequently requests may be queued into the work queue.
+	RateLimiter workqueue.TypedRateLimiter[request]
+
+	// NewQueue constructs the queue for this controller once the controller is ready to start.
+	// This is a func because the standard Kubernetes work queues start themselves immediately, which
+	// leads to goroutine leaks if something calls controller.New repeatedly.
+	NewQueue func(controllerName string, rateLimiter workqueue.TypedRateLimiter[request]) workqueue.TypedRateLimitingInterface[request]
+
+	// MaxConcurrentReconciles is the maximum number of concurrent Reconciles which can be run. Defaults to 1.
+	MaxConcurrentReconciles int
+
+	// CacheSyncTimeout refers to the time limit set on waiting for cache to sync
+	// Defaults to 2 minutes if not set.
+	CacheSyncTimeout time.Duration
+
+	// Name is used to uniquely identify a Controller in tracing, logging and monitoring.  Name is required.
+	Name string
+
+	// LogConstructor is used to construct a logger to then log messages to users during reconciliation,
+	// or for example when a watch is started.
+	// Note: LogConstructor has to be able to handle nil requests as we are also using it
+	// outside the context of a reconciliation.
+	LogConstructor func(request *request) logr.Logger
+
+	// RecoverPanic indicates whether the panic caused by reconcile should be recovered.
+	// Defaults to true.
+	RecoverPanic *bool
+
+	// LeaderElected indicates whether the controller is leader elected or always running.
+	LeaderElected *bool
+
+	// EnableWarmup specifies whether the controller should start its sources
+	// when the manager is not the leader.
+	// Defaults to false, which means that the controller will wait for leader election to start
+	// before starting sources.
+	EnableWarmup *bool
+
+	// ReconciliationTimeout is used as the timeout passed to the context of each Reconcile call.
+	// By default, there is no timeout.
+	ReconciliationTimeout time.Duration
+}
+
 // Controller implements controller.Controller.
 type Controller[request comparable] struct {
 	// Name is used to uniquely identify a Controller in tracing, logging and monitoring.  Name is required.
@@ -58,7 +111,7 @@ type Controller[request comparable] struct {
 
 	// Queue is an listeningQueue that listens for events from Informers and adds object keys to
 	// the Queue for processing
-	Queue workqueue.TypedRateLimitingInterface[request]
+	Queue priorityqueue.PriorityQueue[request]
 
 	// mu is used to synchronize Controller setup
 	mu sync.Mutex
@@ -80,6 +133,14 @@ type Controller[request comparable] struct {
 	// startWatches maintains a list of sources, handlers, and predicates to start when the controller is started.
 	startWatches []source.TypedSource[request]
 
+	// startedEventSourcesAndQueue is used to track if the event sources have been started.
+	// It ensures that we append sources to c.startWatches only until we call Start() / Warmup()
+	// It is true if startEventSourcesAndQueueLocked has been called at least once.
+	startedEventSourcesAndQueue bool
+
+	// didStartEventSourcesOnce is used to ensure that the event sources are only started once.
+	didStartEventSourcesOnce sync.Once
+
 	// LogConstructor is used to construct a logger to then log messages to users during reconciliation,
 	// or for example when a watch is started.
 	// Note: LogConstructor has to be able to handle nil requests as we are also using it
@@ -92,6 +153,38 @@ type Controller[request comparable] struct {
 
 	// LeaderElected indicates whether the controller is leader elected or always running.
 	LeaderElected *bool
+
+	// EnableWarmup specifies whether the controller should start its sources when the manager is not
+	// the leader. This is useful for cases where sources take a long time to start, as it allows
+	// for the controller to warm up its caches even before it is elected as the leader. This
+	// improves leadership failover time, as the caches will be prepopulated before the controller
+	// transitions to be leader.
+	//
+	// Setting EnableWarmup to true and NeedLeaderElection to true means the controller will start its
+	// sources without waiting to become leader.
+	// Setting EnableWarmup to true and NeedLeaderElection to false is a no-op as controllers without
+	// leader election do not wait on leader election to start their sources.
+	// Defaults to false.
+	EnableWarmup *bool
+
+	ReconciliationTimeout time.Duration
+}
+
+// New returns a new Controller configured with the given options.
+func New[request comparable](options Options[request]) *Controller[request] {
+	return &Controller[request]{
+		Do:                      options.Do,
+		RateLimiter:             options.RateLimiter,
+		NewQueue:                options.NewQueue,
+		MaxConcurrentReconciles: options.MaxConcurrentReconciles,
+		CacheSyncTimeout:        options.CacheSyncTimeout,
+		Name:                    options.Name,
+		LogConstructor:          options.LogConstructor,
+		RecoverPanic:            options.RecoverPanic,
+		LeaderElected:           options.LeaderElected,
+		EnableWarmup:            options.EnableWarmup,
+		ReconciliationTimeout:   options.ReconciliationTimeout,
+	}
 }
 
 // Reconcile implements reconcile.Reconciler.
@@ -113,6 +206,13 @@ func (c *Controller[request]) Reconcile(ctx context.Context, req request) (_ rec
 			panic(r)
 		}
 	}()
+
+	if c.ReconciliationTimeout > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, c.ReconciliationTimeout)
+		defer cancel()
+	}
+
 	return c.Do.Reconcile(ctx, req)
 }
 
@@ -121,10 +221,9 @@ func (c *Controller[request]) Watch(src source.TypedSource[request]) error {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
-	// Controller hasn't started yet, store the watches locally and return.
-	//
-	// These watches are going to be held on the controller struct until the manager or user calls Start(...).
-	if !c.Started {
+	// Sources weren't started yet, store the watches locally and return.
+	// These sources are going to be held until either Warmup() or Start(...) is called.
+	if !c.startedEventSourcesAndQueue {
 		c.startWatches = append(c.startWatches, src)
 		return nil
 	}
@@ -141,6 +240,21 @@ func (c *Controller[request]) NeedLeaderElection() bool {
 	return *c.LeaderElected
 }
 
+// Warmup implements the manager.WarmupRunnable interface.
+func (c *Controller[request]) Warmup(ctx context.Context) error {
+	if c.EnableWarmup == nil || !*c.EnableWarmup {
+		return nil
+	}
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	// Set the ctx so later calls to watch use this internal context
+	c.ctx = ctx
+
+	return c.startEventSourcesAndQueueLocked(ctx)
+}
+
 // Start implements controller.Controller.
 func (c *Controller[request]) Start(ctx context.Context) error {
 	// use an IIFE to get proper lock handling
@@ -155,64 +269,22 @@ func (c *Controller[request]) Start(ctx context.Context) error {
 	// Set the internal context.
 	c.ctx = ctx
 
-	c.Queue = c.NewQueue(c.Name, c.RateLimiter)
-	go func() {
-		<-ctx.Done()
-		c.Queue.ShutDown()
-	}()
-
 	wg := &sync.WaitGroup{}
 	err := func() error {
 		defer c.mu.Unlock()
 
 		// TODO(pwittrock): Reconsider HandleCrash
-		defer utilruntime.HandleCrash()
+		defer utilruntime.HandleCrashWithLogger(c.LogConstructor(nil))
 
 		// NB(directxman12): launch the sources *before* trying to wait for the
-		// caches to sync so that they have a chance to register their intendeded
+		// caches to sync so that they have a chance to register their intended
 		// caches.
-		for _, watch := range c.startWatches {
-			c.LogConstructor(nil).Info("Starting EventSource", "source", fmt.Sprintf("%s", watch))
-
-			if err := watch.Start(ctx, c.Queue); err != nil {
-				return err
-			}
+		if err := c.startEventSourcesAndQueueLocked(ctx); err != nil {
+			return err
 		}
 
-		// Start the SharedIndexInformer factories to begin populating the SharedIndexInformer caches
 		c.LogConstructor(nil).Info("Starting Controller")
 
-		for _, watch := range c.startWatches {
-			syncingSource, ok := watch.(source.SyncingSource)
-			if !ok {
-				continue
-			}
-
-			if err := func() error {
-				// use a context with timeout for launching sources and syncing caches.
-				sourceStartCtx, cancel := context.WithTimeout(ctx, c.CacheSyncTimeout)
-				defer cancel()
-
-				// WaitForSync waits for a definitive timeout, and returns if there
-				// is an error or a timeout
-				if err := syncingSource.WaitForSync(sourceStartCtx); err != nil {
-					err := fmt.Errorf("failed to wait for %s caches to sync: %w", c.Name, err)
-					c.LogConstructor(nil).Error(err, "Could not wait for Cache to sync")
-					return err
-				}
-
-				return nil
-			}(); err != nil {
-				return err
-			}
-		}
-
-		// All the watches have been started, we can reset the local slice.
-		//
-		// We should never hold watches more than necessary, each watch source can hold a backing cache,
-		// which won't be garbage collected if we hold a reference to it.
-		c.startWatches = nil
-
 		// Launch workers to process resources
 		c.LogConstructor(nil).Info("Starting workers", "worker count", c.MaxConcurrentReconciles)
 		wg.Add(c.MaxConcurrentReconciles)
@@ -240,10 +312,96 @@ func (c *Controller[request]) Start(ctx context.Context) error {
 	return nil
 }
 
+// startEventSourcesAndQueueLocked launches all the sources registered with this controller and waits
+// for them to sync. It returns an error if any of the sources fail to start or sync.
+func (c *Controller[request]) startEventSourcesAndQueueLocked(ctx context.Context) error {
+	var retErr error
+
+	c.didStartEventSourcesOnce.Do(func() {
+		queue := c.NewQueue(c.Name, c.RateLimiter)
+		if priorityQueue, isPriorityQueue := queue.(priorityqueue.PriorityQueue[request]); isPriorityQueue {
+			c.Queue = priorityQueue
+		} else {
+			c.Queue = &priorityQueueWrapper[request]{TypedRateLimitingInterface: queue}
+		}
+		go func() {
+			<-ctx.Done()
+			c.Queue.ShutDown()
+		}()
+
+		errGroup := &errgroup.Group{}
+		for _, watch := range c.startWatches {
+			log := c.LogConstructor(nil)
+			_, ok := watch.(interface {
+				String() string
+			})
+			if !ok {
+				log = log.WithValues("source", fmt.Sprintf("%T", watch))
+			} else {
+				log = log.WithValues("source", fmt.Sprintf("%s", watch))
+			}
+			didStartSyncingSource := &atomic.Bool{}
+			errGroup.Go(func() error {
+				// Use a timeout for starting and syncing the source to avoid silently
+				// blocking startup indefinitely if it doesn't come up.
+				sourceStartCtx, cancel := context.WithTimeout(ctx, c.CacheSyncTimeout)
+				defer cancel()
+
+				sourceStartErrChan := make(chan error, 1) // Buffer chan to not leak goroutine if we time out
+				go func() {
+					defer close(sourceStartErrChan)
+					log.Info("Starting EventSource")
+
+					if err := watch.Start(ctx, c.Queue); err != nil {
+						sourceStartErrChan <- err
+						return
+					}
+					syncingSource, ok := watch.(source.TypedSyncingSource[request])
+					if !ok {
+						return
+					}
+					didStartSyncingSource.Store(true)
+					if err := syncingSource.WaitForSync(sourceStartCtx); err != nil {
+						err := fmt.Errorf("failed to wait for %s caches to sync %v: %w", c.Name, syncingSource, err)
+						log.Error(err, "Could not wait for Cache to sync")
+						sourceStartErrChan <- err
+					}
+				}()
+
+				select {
+				case err := <-sourceStartErrChan:
+					return err
+				case <-sourceStartCtx.Done():
+					if didStartSyncingSource.Load() { // We are racing with WaitForSync, wait for it to let it tell us what happened
+						return <-sourceStartErrChan
+					}
+					if ctx.Err() != nil { // Don't return an error if the root context got cancelled
+						return nil
+					}
+					return fmt.Errorf("timed out waiting for source %s to Start. Please ensure that its Start() method is non-blocking", watch)
+				}
+			})
+		}
+		retErr = errGroup.Wait()
+
+		// All the watches have been started, we can reset the local slice.
+		//
+		// We should never hold watches more than necessary, each watch source can hold a backing cache,
+		// which won't be garbage collected if we hold a reference to it.
+		c.startWatches = nil
+
+		// Mark event sources as started after resetting the startWatches slice so that watches from
+		// a new Watch() call are immediately started.
+		c.startedEventSourcesAndQueue = true
+	})
+
+	return retErr
+}
+
 // processNextWorkItem will read a single work item off the workqueue and
 // attempt to process it, by calling the reconcileHandler.
 func (c *Controller[request]) processNextWorkItem(ctx context.Context) bool {
-	obj, shutdown := c.Queue.Get()
+	obj, priority, shutdown := c.Queue.GetWithPriority()
 	if shutdown {
 		// Stop working
 		return false
@@ -260,7 +418,7 @@ func (c *Controller[request]) processNextWorkItem(ctx context.Context) bool {
 	ctrlmetrics.ActiveWorkers.WithLabelValues(c.Name).Add(1)
 	defer ctrlmetrics.ActiveWorkers.WithLabelValues(c.Name).Add(-1)
 
-	c.reconcileHandler(ctx, obj)
+	c.reconcileHandler(ctx, obj, priority)
 	return true
 }
 
@@ -283,7 +441,7 @@ func (c *Controller[request]) initMetrics() {
 	ctrlmetrics.ActiveWorkers.WithLabelValues(c.Name).Set(0)
 }
 
-func (c *Controller[request]) reconcileHandler(ctx context.Context, req request) {
+func (c *Controller[request]) reconcileHandler(ctx context.Context, req request, priority int) {
 	// Update metrics after processing each item
 	reconcileStartTS := time.Now()
 	defer func() {
@@ -306,12 +464,12 @@ func (c *Controller[request]) reconcileHandler(ctx context.Context, req request)
 		if errors.Is(err, reconcile.TerminalError(nil)) {
 			ctrlmetrics.TerminalReconcileErrors.WithLabelValues(c.Name).Inc()
 		} else {
-			c.Queue.AddRateLimited(req)
+			c.Queue.AddWithOpts(priorityqueue.AddOpts{RateLimited: true, Priority: ptr.To(priority)}, req)
 		}
 		ctrlmetrics.ReconcileErrors.WithLabelValues(c.Name).Inc()
 		ctrlmetrics.ReconcileTotal.WithLabelValues(c.Name, labelError).Inc()
 		if !result.IsZero() {
-			log.Info("Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes reqeueuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler")
+			log.Info("Warning: Reconciler returned both a non-zero result and a non-nil error. The result will always be ignored if the error is non-nil and the non-nil error causes requeuing with exponential backoff. For more details, see: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/reconcile#Reconciler")
 		}
 		log.Error(err, "Reconciler error")
 	case result.RequeueAfter > 0:
@@ -321,11 +479,11 @@ func (c *Controller[request]) reconcileHandler(ctx context.Context, req request)
 		// We need to drive to stable reconcile loops before queuing due
 		// to result.RequestAfter
 		c.Queue.Forget(req)
-		c.Queue.AddAfter(req, result.RequeueAfter)
+		c.Queue.AddWithOpts(priorityqueue.AddOpts{After: result.RequeueAfter, Priority: ptr.To(priority)}, req)
 		ctrlmetrics.ReconcileTotal.WithLabelValues(c.Name, labelRequeueAfter).Inc()
-	case result.Requeue:
+	case result.Requeue: //nolint: staticcheck // We have to handle it until it is removed
 		log.V(5).Info("Reconcile done, requeueing")
-		c.Queue.AddRateLimited(req)
+		c.Queue.AddWithOpts(priorityqueue.AddOpts{RateLimited: true, Priority: ptr.To(priority)}, req)
 		ctrlmetrics.ReconcileTotal.WithLabelValues(c.Name, labelRequeue).Inc()
 	default:
 		log.V(5).Info("Reconcile successful")
@@ -363,3 +521,25 @@ type reconcileIDKey struct{}
 func addReconcileID(ctx context.Context, reconcileID types.UID) context.Context {
 	return context.WithValue(ctx, reconcileIDKey{}, reconcileID)
 }
+
+type priorityQueueWrapper[request comparable] struct {
+	workqueue.TypedRateLimitingInterface[request]
+}
+
+func (p *priorityQueueWrapper[request]) AddWithOpts(opts priorityqueue.AddOpts, items ...request) {
+	for _, item := range items {
+		switch {
+		case opts.RateLimited:
+			p.TypedRateLimitingInterface.AddRateLimited(item)
+		case opts.After > 0:
+			p.TypedRateLimitingInterface.AddAfter(item, opts.After)
+		default:
+			p.TypedRateLimitingInterface.Add(item)
+		}
+	}
+}
+
+func (p *priorityQueueWrapper[request]) GetWithPriority() (request, int, bool) {
+	item, shutdown := p.TypedRateLimitingInterface.Get()
+	return item, 0, shutdown
+}
diff --git a/pkg/internal/controller/controller_test.go b/pkg/internal/controller/controller_test.go
index 638d21810e..306e0b0126 100644
--- a/pkg/internal/controller/controller_test.go
+++ b/pkg/internal/controller/controller_test.go
@@ -21,6 +21,7 @@ import (
 	"errors"
 	"fmt"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/go-logr/logr"
@@ -28,6 +29,7 @@ import (
 	. "github.com/onsi/gomega"
 	"github.com/prometheus/client_golang/prometheus"
 	dto "github.com/prometheus/client_model/go"
+	"go.uber.org/goleak"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -38,14 +40,25 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/cache/informertest"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllertest"
+	"sigs.k8s.io/controller-runtime/pkg/controller/priorityqueue"
+	"sigs.k8s.io/controller-runtime/pkg/envtest"
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	ctrlmetrics "sigs.k8s.io/controller-runtime/pkg/internal/controller/metrics"
 	"sigs.k8s.io/controller-runtime/pkg/internal/log"
+	"sigs.k8s.io/controller-runtime/pkg/leaderelection"
+	fakeleaderelection "sigs.k8s.io/controller-runtime/pkg/leaderelection/fake"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/controller-runtime/pkg/source"
 )
 
+type TestRequest struct {
+	Key string
+}
+
+const testControllerName = "testcontroller"
+
 var _ = Describe("controller", func() {
 	var fakeReconcile *fakeReconciler
 	var ctrl *Controller[reconcile.Request]
@@ -64,7 +77,7 @@ var _ = Describe("controller", func() {
 		queue = &controllertest.Queue{
 			TypedInterface: workqueue.NewTyped[reconcile.Request](),
 		}
-		ctrl = &Controller[reconcile.Request]{
+		ctrl = New[reconcile.Request](Options[reconcile.Request]{
 			MaxConcurrentReconciles: 1,
 			Do:                      fakeReconcile,
 			NewQueue: func(string, workqueue.TypedRateLimiter[reconcile.Request]) workqueue.TypedRateLimitingInterface[reconcile.Request] {
@@ -73,14 +86,11 @@ var _ = Describe("controller", func() {
 			LogConstructor: func(_ *reconcile.Request) logr.Logger {
 				return log.RuntimeLog.WithName("controller").WithName("test")
 			},
-		}
+		})
 	})
 
 	Describe("Reconciler", func() {
-		It("should call the Reconciler function", func() {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
+		It("should call the Reconciler function", func(ctx SpecContext) {
 			ctrl.Do = reconcile.Func(func(context.Context, reconcile.Request) (reconcile.Result, error) {
 				return reconcile.Result{Requeue: true}, nil
 			})
@@ -90,10 +100,7 @@ var _ = Describe("controller", func() {
 			Expect(result).To(Equal(reconcile.Result{Requeue: true}))
 		})
 
-		It("should not recover panic if RecoverPanic is false", func() {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
+		It("should not recover panic if RecoverPanic is false", func(ctx SpecContext) {
 			defer func() {
 				Expect(recover()).ShouldNot(BeNil())
 			}()
@@ -106,10 +113,7 @@ var _ = Describe("controller", func() {
 				reconcile.Request{NamespacedName: types.NamespacedName{Namespace: "foo", Name: "bar"}})
 		})
 
-		It("should recover panic if RecoverPanic is true by default", func() {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
+		It("should recover panic if RecoverPanic is true by default", func(ctx SpecContext) {
 			defer func() {
 				Expect(recover()).To(BeNil())
 			}()
@@ -124,10 +128,7 @@ var _ = Describe("controller", func() {
 			Expect(err.Error()).To(ContainSubstring("[recovered]"))
 		})
 
-		It("should recover panic if RecoverPanic is true", func() {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
+		It("should recover panic if RecoverPanic is true", func(ctx SpecContext) {
 			defer func() {
 				Expect(recover()).To(BeNil())
 			}()
@@ -141,40 +142,63 @@ var _ = Describe("controller", func() {
 			Expect(err).To(HaveOccurred())
 			Expect(err.Error()).To(ContainSubstring("[recovered]"))
 		})
+
+		It("should time out if ReconciliationTimeout is set", func(ctx SpecContext) {
+			ctrl.ReconciliationTimeout = time.Duration(1) // One nanosecond
+			ctrl.Do = reconcile.Func(func(ctx context.Context, _ reconcile.Request) (reconcile.Result, error) {
+				<-ctx.Done()
+				return reconcile.Result{}, ctx.Err()
+			})
+			_, err := ctrl.Reconcile(ctx,
+				reconcile.Request{NamespacedName: types.NamespacedName{Namespace: "foo", Name: "bar"}})
+			Expect(err).To(HaveOccurred())
+			Expect(err).To(Equal(context.DeadlineExceeded))
+		})
+
+		It("should not configure a timeout if ReconciliationTimeout is zero", func(ctx SpecContext) {
+			ctrl.Do = reconcile.Func(func(ctx context.Context, _ reconcile.Request) (reconcile.Result, error) {
+				defer GinkgoRecover()
+
+				_, ok := ctx.Deadline()
+				Expect(ok).To(BeFalse())
+				return reconcile.Result{}, nil
+			})
+			_, err := ctrl.Reconcile(ctx,
+				reconcile.Request{NamespacedName: types.NamespacedName{Namespace: "foo", Name: "bar"}})
+			Expect(err).NotTo(HaveOccurred())
+		})
 	})
 
 	Describe("Start", func() {
-		It("should return an error if there is an error waiting for the informers", func() {
+		It("should return an error if there is an error waiting for the informers", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = time.Second
 			f := false
 			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
 				source.Kind(&informertest.FakeInformers{Synced: &f}, &corev1.Pod{}, &handler.TypedEnqueueRequestForObject[*corev1.Pod]{}),
 			}
 			ctrl.Name = "foo"
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			err := ctrl.Start(ctx)
 			Expect(err).To(HaveOccurred())
 			Expect(err.Error()).To(ContainSubstring("failed to wait for foo caches to sync"))
 		})
 
-		It("should error when cache sync timeout occurs", func() {
-			ctrl.CacheSyncTimeout = 10 * time.Nanosecond
-
+		It("should error when cache sync timeout occurs", func(ctx SpecContext) {
 			c, err := cache.New(cfg, cache.Options{})
 			Expect(err).NotTo(HaveOccurred())
 			c = &cacheWithIndefinitelyBlockingGetInformer{c}
 
+			ctrl.CacheSyncTimeout = time.Second
 			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
 				source.Kind(c, &appsv1.Deployment{}, &handler.TypedEnqueueRequestForObject[*appsv1.Deployment]{}),
 			}
-			ctrl.Name = "testcontroller"
+			ctrl.Name = testControllerName
 
-			err = ctrl.Start(context.TODO())
+			err = ctrl.Start(ctx)
 			Expect(err).To(HaveOccurred())
-			Expect(err.Error()).To(ContainSubstring("failed to wait for testcontroller caches to sync: timed out waiting for cache to be synced"))
+			Expect(err.Error()).To(ContainSubstring("failed to wait for testcontroller caches to sync kind source: *v1.Deployment: timed out waiting for cache to be synced"))
 		})
 
-		It("should not error when context cancelled", func() {
+		It("should not error when controller Start context is cancelled during Sources WaitForSync", func(specCtx SpecContext) {
 			ctrl.CacheSyncTimeout = 1 * time.Second
 
 			sourceSynced := make(chan struct{})
@@ -187,9 +211,9 @@ var _ = Describe("controller", func() {
 					cacheSyncDone: sourceSynced,
 				},
 			}
-			ctrl.Name = "testcontroller"
+			ctrl.Name = testControllerName
 
-			ctx, cancel := context.WithCancel(context.TODO())
+			ctx, cancel := context.WithCancel(specCtx)
 			go func() {
 				defer GinkgoRecover()
 				err = ctrl.Start(ctx)
@@ -200,15 +224,31 @@ var _ = Describe("controller", func() {
 			<-sourceSynced
 		})
 
-		It("should not error when cache sync timeout is of sufficiently high", func() {
-			ctrl.CacheSyncTimeout = 1 * time.Second
+		It("should error when Start() is blocking forever", func(specCtx SpecContext) {
+			ctrl.CacheSyncTimeout = time.Second
+
+			controllerDone := make(chan struct{})
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+					<-controllerDone
+					return ctx.Err()
+				})}
 
-			ctx, cancel := context.WithCancel(context.Background())
+			ctx, cancel := context.WithTimeout(specCtx, 10*time.Second)
 			defer cancel()
 
+			err := ctrl.Start(ctx)
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("Please ensure that its Start() method is non-blocking"))
+
+			close(controllerDone)
+		})
+
+		It("should not error when cache sync timeout is of sufficiently high", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = 10 * time.Second
+
 			sourceSynced := make(chan struct{})
-			c, err := cache.New(cfg, cache.Options{})
-			Expect(err).NotTo(HaveOccurred())
+			c := &informertest.FakeInformers{}
 			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
 				&singnallingSourceWrapper{
 					SyncingSource: source.Kind[client.Object](c, &appsv1.Deployment{}, &handler.EnqueueRequestForObject{}),
@@ -216,11 +256,6 @@ var _ = Describe("controller", func() {
 				},
 			}
 
-			go func() {
-				defer GinkgoRecover()
-				Expect(c.Start(ctx)).To(Succeed())
-			}()
-
 			go func() {
 				defer GinkgoRecover()
 				Expect(ctrl.Start(ctx)).To(Succeed())
@@ -229,15 +264,13 @@ var _ = Describe("controller", func() {
 			<-sourceSynced
 		})
 
-		It("should process events from source.Channel", func() {
+		It("should process events from source.Channel", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = 10 * time.Second
 			// channel to be closed when event is processed
 			processed := make(chan struct{})
 			// source channel
 			ch := make(chan event.GenericEvent, 1)
 
-			ctx, cancel := context.WithCancel(context.TODO())
-			defer cancel()
-
 			// event to be sent to the channel
 			p := &corev1.Pod{
 				ObjectMeta: metav1.ObjectMeta{Name: "foo", Namespace: "bar"},
@@ -268,9 +301,8 @@ var _ = Describe("controller", func() {
 			<-processed
 		})
 
-		It("should error when channel source is not specified", func() {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
+		It("should error when channel source is not specified", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = 10 * time.Second
 
 			ins := source.Channel[string](nil, nil)
 			ctrl.startWatches = []source.TypedSource[reconcile.Request]{ins}
@@ -280,25 +312,27 @@ var _ = Describe("controller", func() {
 			Expect(e.Error()).To(ContainSubstring("must specify Channel.Source"))
 		})
 
-		It("should call Start on sources with the appropriate EventHandler, Queue, and Predicates", func() {
+		It("should call Start on sources with the appropriate EventHandler, Queue, and Predicates", func(specCtx SpecContext) {
+			ctrl.CacheSyncTimeout = 10 * time.Second
 			started := false
+			ctx, cancel := context.WithCancel(specCtx)
 			src := source.Func(func(ctx context.Context, q workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
 				defer GinkgoRecover()
 				Expect(q).To(Equal(ctrl.Queue))
 
 				started = true
+				cancel() // Cancel the context so ctrl.Start() doesn't block forever
 				return nil
 			})
 			Expect(ctrl.Watch(src)).NotTo(HaveOccurred())
 
-			// Use a cancelled context so Start doesn't block
-			ctx, cancel := context.WithCancel(context.Background())
-			cancel()
-			Expect(ctrl.Start(ctx)).To(Succeed())
+			err := ctrl.Start(ctx)
+			Expect(err).To(Succeed())
 			Expect(started).To(BeTrue())
 		})
 
-		It("should return an error if there is an error starting sources", func() {
+		It("should return an error if there is an error starting sources", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = 10 * time.Second
 			err := fmt.Errorf("Expected Error: could not start source")
 			src := source.Func(func(context.Context,
 				workqueue.TypedRateLimitingInterface[reconcile.Request],
@@ -307,15 +341,12 @@ var _ = Describe("controller", func() {
 				return err
 			})
 			Expect(ctrl.Watch(src)).To(Succeed())
-
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			Expect(ctrl.Start(ctx)).To(Equal(err))
 		})
 
-		It("should return an error if it gets started more than once", func() {
+		It("should return an error if it gets started more than once", func(specCtx SpecContext) {
 			// Use a cancelled context so Start doesn't block
-			ctx, cancel := context.WithCancel(context.Background())
+			ctx, cancel := context.WithCancel(specCtx)
 			cancel()
 			Expect(ctrl.Start(ctx)).To(Succeed())
 			err := ctrl.Start(ctx)
@@ -323,12 +354,242 @@ var _ = Describe("controller", func() {
 			Expect(err.Error()).To(Equal("controller was started more than once. This is likely to be caused by being added to a manager multiple times"))
 		})
 
+		It("should check for correct TypedSyncingSource if custom types are used", func(specCtx SpecContext) {
+			queue := &priorityQueueWrapper[TestRequest]{
+				TypedRateLimitingInterface: &controllertest.TypedQueue[TestRequest]{
+					TypedInterface: workqueue.NewTyped[TestRequest](),
+				}}
+			ctrl := New[TestRequest](Options[TestRequest]{
+				NewQueue: func(string, workqueue.TypedRateLimiter[TestRequest]) workqueue.TypedRateLimitingInterface[TestRequest] {
+					return queue
+				},
+				LogConstructor: func(*TestRequest) logr.Logger {
+					return log.RuntimeLog.WithName("controller").WithName("test")
+				},
+			})
+			ctrl.CacheSyncTimeout = time.Second
+			src := &bisignallingSource[TestRequest]{
+				startCall: make(chan workqueue.TypedRateLimitingInterface[TestRequest]),
+				startDone: make(chan error, 1),
+				waitCall:  make(chan struct{}),
+				waitDone:  make(chan error, 1),
+			}
+			ctrl.startWatches = []source.TypedSource[TestRequest]{src}
+			ctrl.Name = "foo"
+			ctx, cancel := context.WithCancel(specCtx)
+			defer cancel()
+			startCh := make(chan error)
+			go func() {
+				defer GinkgoRecover()
+				startCh <- ctrl.Start(ctx)
+			}()
+			Eventually(src.startCall).Should(Receive(Equal(queue)))
+			src.startDone <- nil
+			Eventually(src.waitCall).Should(BeClosed())
+			src.waitDone <- nil
+			cancel()
+			Eventually(startCh).Should(Receive(Succeed()))
+		})
+	})
+
+	Describe("startEventSourcesAndQueueLocked", func() {
+		It("should return nil when no sources are provided", func(ctx SpecContext) {
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{}
+			err := ctrl.startEventSourcesAndQueueLocked(ctx)
+			Expect(err).NotTo(HaveOccurred())
+		})
+
+		It("should initialize controller queue when called", func(ctx SpecContext) {
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{}
+			err := ctrl.startEventSourcesAndQueueLocked(ctx)
+			Expect(err).NotTo(HaveOccurred())
+			Expect(ctrl.Queue).NotTo(BeNil())
+		})
+
+		It("should return an error if a source fails to start", func(ctx SpecContext) {
+			expectedErr := fmt.Errorf("failed to start source")
+			src := source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+				// Return the error immediately so we don't get a timeout
+				return expectedErr
+			})
+
+			// Set a sufficiently long timeout to avoid timeouts interfering with the error being returned
+			ctrl.CacheSyncTimeout = 5 * time.Second
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{src}
+			err := ctrl.startEventSourcesAndQueueLocked(ctx)
+			Expect(err).To(Equal(expectedErr))
+		})
+
+		It("should return an error if a source fails to sync", func(ctx SpecContext) {
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Kind(&informertest.FakeInformers{Synced: ptr.To(false)}, &corev1.Pod{}, &handler.TypedEnqueueRequestForObject[*corev1.Pod]{}),
+			}
+			ctrl.Name = "test-controller"
+			ctrl.CacheSyncTimeout = 5 * time.Second
+
+			err := ctrl.startEventSourcesAndQueueLocked(ctx)
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("failed to wait for test-controller caches to sync"))
+		})
+
+		It("should not return an error when sources start and sync successfully", func(ctx SpecContext) {
+			// Create a source that starts and syncs successfully
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Kind(&informertest.FakeInformers{Synced: ptr.To(true)}, &corev1.Pod{}, &handler.TypedEnqueueRequestForObject[*corev1.Pod]{}),
+			}
+			ctrl.Name = "test-controller"
+			ctrl.CacheSyncTimeout = 5 * time.Second
+
+			err := ctrl.startEventSourcesAndQueueLocked(ctx)
+			Expect(err).NotTo(HaveOccurred())
+		})
+
+		It("should not return an error when context is cancelled during source sync", func(ctx SpecContext) {
+			sourceCtx, sourceCancel := context.WithCancel(ctx)
+			defer sourceCancel()
+
+			ctrl.CacheSyncTimeout = 5 * time.Second
+
+			// Create a bisignallingSource to control the test flow
+			src := &bisignallingSource[reconcile.Request]{
+				startCall: make(chan workqueue.TypedRateLimitingInterface[reconcile.Request]),
+				startDone: make(chan error, 1),
+				waitCall:  make(chan struct{}),
+				waitDone:  make(chan error, 1),
+			}
+
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{src}
+
+			// Start the sources in a goroutine
+			startErrCh := make(chan error)
+			go func() {
+				defer GinkgoRecover()
+				startErrCh <- ctrl.startEventSourcesAndQueueLocked(sourceCtx)
+			}()
+
+			// Allow source to start successfully
+			Eventually(src.startCall).Should(Receive())
+			src.startDone <- nil
+
+			// Wait for WaitForSync to be called
+			Eventually(src.waitCall).Should(BeClosed())
+
+			// Return context.Canceled from WaitForSync
+			src.waitDone <- context.Canceled
+
+			// Also cancel the context
+			sourceCancel()
+
+			// We expect to receive the context.Canceled error
+			err := <-startErrCh
+			Expect(err).To(MatchError(context.Canceled))
+		})
+
+		It("should timeout if source Start blocks for too long", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = 1 * time.Millisecond
+
+			// Create a source that blocks forever in Start
+			blockingSrc := source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+				<-ctx.Done()
+				return ctx.Err()
+			})
+
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{blockingSrc}
+
+			err := ctrl.startEventSourcesAndQueueLocked(ctx)
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("timed out waiting for source"))
+		})
+
+		It("should only start sources once when called multiple times concurrently", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = 1 * time.Millisecond
+
+			var startCount atomic.Int32
+			src := source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+				startCount.Add(1)
+				return nil
+			})
+
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{src}
+
+			By("Calling startEventSourcesAndQueueLocked multiple times in parallel")
+			var wg sync.WaitGroup
+			for i := 1; i <= 5; i++ {
+				wg.Add(1)
+				go func() {
+					defer wg.Done()
+					err := ctrl.startEventSourcesAndQueueLocked(ctx)
+					// All calls should return the same nil error
+					Expect(err).NotTo(HaveOccurred())
+				}()
+			}
+
+			wg.Wait()
+			Expect(startCount.Load()).To(Equal(int32(1)), "Source should only be started once even when called multiple times")
+		})
+
+		It("should block subsequent calls from returning until the first call to startEventSourcesAndQueueLocked has returned", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = 5 * time.Second
+
+			// finishSourceChan is closed to unblock startEventSourcesAndQueueLocked from returning
+			finishSourceChan := make(chan struct{})
+
+			src := source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+				<-finishSourceChan
+				return nil
+			})
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{src}
+
+			By("Calling startEventSourcesAndQueueLocked asynchronously")
+			wg := sync.WaitGroup{}
+			go func() {
+				defer GinkgoRecover()
+				defer wg.Done()
+
+				wg.Add(1)
+				Expect(ctrl.startEventSourcesAndQueueLocked(ctx)).To(Succeed())
+			}()
+
+			By("Calling startEventSourcesAndQueueLocked again")
+			var didSubsequentCallComplete atomic.Bool
+			go func() {
+				defer GinkgoRecover()
+				defer wg.Done()
+
+				wg.Add(1)
+				Expect(ctrl.startEventSourcesAndQueueLocked(ctx)).To(Succeed())
+				didSubsequentCallComplete.Store(true)
+			}()
+
+			// Assert that second call to startEventSourcesAndQueueLocked is blocked while source has not finished
+			Consistently(didSubsequentCallComplete.Load).Should(BeFalse())
+
+			By("Finishing source start + sync")
+			finishSourceChan <- struct{}{}
+
+			// Assert that second call to startEventSourcesAndQueueLocked is now complete
+			Eventually(didSubsequentCallComplete.Load).Should(BeTrue(), "startEventSourcesAndQueueLocked should complete after source is started and synced")
+			wg.Wait()
+		})
+
+		It("should reset c.startWatches to nil after returning and startedEventSourcesAndQueue", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = 1 * time.Millisecond
+
+			src := source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+				return nil
+			})
+
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{src}
+
+			err := ctrl.startEventSourcesAndQueueLocked(ctx)
+			Expect(err).NotTo(HaveOccurred())
+			Expect(ctrl.startWatches).To(BeNil(), "startWatches should be reset to nil after returning")
+			Expect(ctrl.startedEventSourcesAndQueue).To(BeTrue(), "startedEventSourcesAndQueue should be set to true after startEventSourcesAndQueueLocked returns without error")
+		})
 	})
 
 	Describe("Processing queue items from a Controller", func() {
-		It("should call Reconciler if an item is enqueued", func() {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
+		It("should call Reconciler if an item is enqueued", func(ctx SpecContext) {
 			go func() {
 				defer GinkgoRecover()
 				Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -344,13 +605,7 @@ var _ = Describe("controller", func() {
 			Eventually(func() int { return queue.NumRequeues(request) }).Should(Equal(0))
 		})
 
-		PIt("should forget an item if it is not a Request and continue processing items", func() {
-			// TODO(community): write this test
-		})
-
-		It("should requeue a Request if there is an error and continue processing items", func() {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
+		It("should requeue a Request if there is an error and continue processing items", func(ctx SpecContext) {
 			go func() {
 				defer GinkgoRecover()
 				Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -374,9 +629,7 @@ var _ = Describe("controller", func() {
 			Eventually(func() int { return queue.NumRequeues(request) }, 1.0).Should(Equal(0))
 		})
 
-		It("should not requeue a Request if there is a terminal error", func() {
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
+		It("should not requeue a Request if there is a terminal error", func(ctx SpecContext) {
 			go func() {
 				defer GinkgoRecover()
 				Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -397,14 +650,12 @@ var _ = Describe("controller", func() {
 
 		// TODO(directxman12): we should ensure that backoff occurrs with error requeue
 
-		It("should not reset backoff until there's a non-error result", func() {
+		It("should not reset backoff until there's a non-error result", func(ctx SpecContext) {
 			dq := &DelegatingQueue{TypedRateLimitingInterface: ctrl.NewQueue("controller1", nil)}
 			ctrl.NewQueue = func(string, workqueue.TypedRateLimiter[reconcile.Request]) workqueue.TypedRateLimitingInterface[reconcile.Request] {
 				return dq
 			}
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			go func() {
 				defer GinkgoRecover()
 				Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -435,14 +686,12 @@ var _ = Describe("controller", func() {
 			Eventually(func() int { return dq.NumRequeues(request) }).Should(Equal(0))
 		})
 
-		It("should requeue a Request with rate limiting if the Result sets Requeue:true and continue processing items", func() {
+		It("should requeue a Request with rate limiting if the Result sets Requeue:true and continue processing items", func(ctx SpecContext) {
 			dq := &DelegatingQueue{TypedRateLimitingInterface: ctrl.NewQueue("controller1", nil)}
 			ctrl.NewQueue = func(string, workqueue.TypedRateLimiter[reconcile.Request]) workqueue.TypedRateLimitingInterface[reconcile.Request] {
 				return dq
 			}
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			go func() {
 				defer GinkgoRecover()
 				Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -467,14 +716,41 @@ var _ = Describe("controller", func() {
 			Eventually(func() int { return dq.NumRequeues(request) }).Should(Equal(0))
 		})
 
-		It("should requeue a Request after a duration (but not rate-limitted) if the Result sets RequeueAfter (regardless of Requeue)", func() {
+		It("should retain the priority when the reconciler requests a requeue", func(ctx SpecContext) {
+			q := &fakePriorityQueue{PriorityQueue: priorityqueue.New[reconcile.Request]("controller1")}
+			ctrl.NewQueue = func(string, workqueue.TypedRateLimiter[reconcile.Request]) workqueue.TypedRateLimitingInterface[reconcile.Request] {
+				return q
+			}
+
+			go func() {
+				defer GinkgoRecover()
+				Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
+			}()
+
+			q.PriorityQueue.AddWithOpts(priorityqueue.AddOpts{Priority: ptr.To(10)}, request)
+
+			By("Invoking Reconciler which will request a requeue")
+			fakeReconcile.AddResult(reconcile.Result{Requeue: true}, nil)
+			Expect(<-reconciled).To(Equal(request))
+			Eventually(func() []priorityQueueAddition {
+				q.lock.Lock()
+				defer q.lock.Unlock()
+				return q.added
+			}).Should(Equal([]priorityQueueAddition{{
+				AddOpts: priorityqueue.AddOpts{
+					RateLimited: true,
+					Priority:    ptr.To(10),
+				},
+				items: []reconcile.Request{request},
+			}}))
+		})
+
+		It("should requeue a Request after a duration (but not rate-limitted) if the Result sets RequeueAfter (regardless of Requeue)", func(ctx SpecContext) {
 			dq := &DelegatingQueue{TypedRateLimitingInterface: ctrl.NewQueue("controller1", nil)}
 			ctrl.NewQueue = func(string, workqueue.TypedRateLimiter[reconcile.Request]) workqueue.TypedRateLimitingInterface[reconcile.Request] {
 				return dq
 			}
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			go func() {
 				defer GinkgoRecover()
 				Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -499,14 +775,41 @@ var _ = Describe("controller", func() {
 			Eventually(func() int { return dq.NumRequeues(request) }).Should(Equal(0))
 		})
 
-		It("should perform error behavior if error is not nil, regardless of RequeueAfter", func() {
+		It("should retain the priority with RequeAfter", func(ctx SpecContext) {
+			q := &fakePriorityQueue{PriorityQueue: priorityqueue.New[reconcile.Request]("controller1")}
+			ctrl.NewQueue = func(string, workqueue.TypedRateLimiter[reconcile.Request]) workqueue.TypedRateLimitingInterface[reconcile.Request] {
+				return q
+			}
+
+			go func() {
+				defer GinkgoRecover()
+				Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
+			}()
+
+			q.PriorityQueue.AddWithOpts(priorityqueue.AddOpts{Priority: ptr.To(10)}, request)
+
+			By("Invoking Reconciler which will ask for RequeueAfter")
+			fakeReconcile.AddResult(reconcile.Result{RequeueAfter: time.Millisecond * 100}, nil)
+			Expect(<-reconciled).To(Equal(request))
+			Eventually(func() []priorityQueueAddition {
+				q.lock.Lock()
+				defer q.lock.Unlock()
+				return q.added
+			}).Should(Equal([]priorityQueueAddition{{
+				AddOpts: priorityqueue.AddOpts{
+					After:    time.Millisecond * 100,
+					Priority: ptr.To(10),
+				},
+				items: []reconcile.Request{request},
+			}}))
+		})
+
+		It("should perform error behavior if error is not nil, regardless of RequeueAfter", func(ctx SpecContext) {
 			dq := &DelegatingQueue{TypedRateLimitingInterface: ctrl.NewQueue("controller1", nil)}
 			ctrl.NewQueue = func(string, workqueue.TypedRateLimiter[reconcile.Request]) workqueue.TypedRateLimitingInterface[reconcile.Request] {
 				return dq
 			}
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			go func() {
 				defer GinkgoRecover()
 				Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -530,6 +833,35 @@ var _ = Describe("controller", func() {
 			Eventually(func() int { return dq.NumRequeues(request) }).Should(Equal(0))
 		})
 
+		It("should retain the priority when there was an error", func(ctx SpecContext) {
+			q := &fakePriorityQueue{PriorityQueue: priorityqueue.New[reconcile.Request]("controller1")}
+			ctrl.NewQueue = func(string, workqueue.TypedRateLimiter[reconcile.Request]) workqueue.TypedRateLimitingInterface[reconcile.Request] {
+				return q
+			}
+
+			go func() {
+				defer GinkgoRecover()
+				Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
+			}()
+
+			q.PriorityQueue.AddWithOpts(priorityqueue.AddOpts{Priority: ptr.To(10)}, request)
+
+			By("Invoking Reconciler which will return an error")
+			fakeReconcile.AddResult(reconcile.Result{}, errors.New("oups, I did it again"))
+			Expect(<-reconciled).To(Equal(request))
+			Eventually(func() []priorityQueueAddition {
+				q.lock.Lock()
+				defer q.lock.Unlock()
+				return q.added
+			}).Should(Equal([]priorityQueueAddition{{
+				AddOpts: priorityqueue.AddOpts{
+					RateLimited: true,
+					Priority:    ptr.To(10),
+				},
+				items: []reconcile.Request{request},
+			}}))
+		})
+
 		PIt("should return if the queue is shutdown", func() {
 			// TODO(community): write this test
 		})
@@ -550,7 +882,7 @@ var _ = Describe("controller", func() {
 				reconcileTotal.Reset()
 			})
 
-			It("should get updated on successful reconciliation", func() {
+			It("should get updated on successful reconciliation", func(ctx SpecContext) {
 				Expect(func() error {
 					Expect(ctrlmetrics.ReconcileTotal.WithLabelValues(ctrl.Name, "success").Write(&reconcileTotal)).To(Succeed())
 					if reconcileTotal.GetCounter().GetValue() != 0.0 {
@@ -559,8 +891,6 @@ var _ = Describe("controller", func() {
 					return nil
 				}()).Should(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -579,7 +909,7 @@ var _ = Describe("controller", func() {
 				}, 2.0).Should(Succeed())
 			})
 
-			It("should get updated on reconcile errors", func() {
+			It("should get updated on reconcile errors", func(ctx SpecContext) {
 				Expect(func() error {
 					Expect(ctrlmetrics.ReconcileTotal.WithLabelValues(ctrl.Name, "error").Write(&reconcileTotal)).To(Succeed())
 					if reconcileTotal.GetCounter().GetValue() != 0.0 {
@@ -588,8 +918,6 @@ var _ = Describe("controller", func() {
 					return nil
 				}()).Should(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -608,7 +936,7 @@ var _ = Describe("controller", func() {
 				}, 2.0).Should(Succeed())
 			})
 
-			It("should get updated when reconcile returns with retry enabled", func() {
+			It("should get updated when reconcile returns with retry enabled", func(ctx SpecContext) {
 				Expect(func() error {
 					Expect(ctrlmetrics.ReconcileTotal.WithLabelValues(ctrl.Name, "retry").Write(&reconcileTotal)).To(Succeed())
 					if reconcileTotal.GetCounter().GetValue() != 0.0 {
@@ -617,8 +945,6 @@ var _ = Describe("controller", func() {
 					return nil
 				}()).Should(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -638,7 +964,7 @@ var _ = Describe("controller", func() {
 				}, 2.0).Should(Succeed())
 			})
 
-			It("should get updated when reconcile returns with retryAfter enabled", func() {
+			It("should get updated when reconcile returns with retryAfter enabled", func(ctx SpecContext) {
 				Expect(func() error {
 					Expect(ctrlmetrics.ReconcileTotal.WithLabelValues(ctrl.Name, "retry_after").Write(&reconcileTotal)).To(Succeed())
 					if reconcileTotal.GetCounter().GetValue() != 0.0 {
@@ -647,8 +973,6 @@ var _ = Describe("controller", func() {
 					return nil
 				}()).Should(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -669,7 +993,7 @@ var _ = Describe("controller", func() {
 		})
 
 		Context("should update prometheus metrics", func() {
-			It("should requeue a Request if there is an error and continue processing items", func() {
+			It("should requeue a Request if there is an error and continue processing items", func(ctx SpecContext) {
 				var reconcileErrs dto.Metric
 				ctrlmetrics.ReconcileErrors.Reset()
 				Expect(func() error {
@@ -680,8 +1004,6 @@ var _ = Describe("controller", func() {
 					return nil
 				}()).Should(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -708,7 +1030,7 @@ var _ = Describe("controller", func() {
 				Eventually(func() int { return queue.NumRequeues(request) }).Should(Equal(0))
 			})
 
-			It("should add a reconcile time to the reconcile time histogram", func() {
+			It("should add a reconcile time to the reconcile time histogram", func(ctx SpecContext) {
 				var reconcileTime dto.Metric
 				ctrlmetrics.ReconcileTime.Reset()
 
@@ -722,8 +1044,6 @@ var _ = Describe("controller", func() {
 					return nil
 				}()).Should(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(ctrl.Start(ctx)).NotTo(HaveOccurred())
@@ -750,19 +1070,527 @@ var _ = Describe("controller", func() {
 			})
 		})
 	})
+
+	Describe("Warmup", func() {
+		JustBeforeEach(func() {
+			ctrl.EnableWarmup = ptr.To(true)
+		})
+
+		It("should track warmup status correctly with successful sync", func(ctx SpecContext) {
+			// Setup controller with sources that complete successfully
+			ctrl.CacheSyncTimeout = time.Second
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+					return nil
+				}),
+			}
+
+			Expect(ctrl.Warmup(ctx)).To(Succeed())
+		})
+
+		It("should return an error if there is an error waiting for the informers", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = time.Second
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Kind(&informertest.FakeInformers{Synced: ptr.To(false)}, &corev1.Pod{}, &handler.TypedEnqueueRequestForObject[*corev1.Pod]{}),
+			}
+			ctrl.Name = testControllerName
+			err := ctrl.Warmup(ctx)
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("failed to wait for testcontroller caches to sync"))
+		})
+
+		It("should error when cache sync timeout occurs", func(ctx SpecContext) {
+			c, err := cache.New(cfg, cache.Options{})
+			Expect(err).NotTo(HaveOccurred())
+			c = &cacheWithIndefinitelyBlockingGetInformer{c}
+
+			ctrl.CacheSyncTimeout = time.Second
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Kind(c, &appsv1.Deployment{}, &handler.TypedEnqueueRequestForObject[*appsv1.Deployment]{}),
+			}
+			ctrl.Name = testControllerName
+
+			err = ctrl.Warmup(ctx)
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("failed to wait for testcontroller caches to sync kind source: *v1.Deployment: timed out waiting for cache to be synced"))
+		})
+
+		It("should not error when controller Warmup context is cancelled during Sources WaitForSync", func(specCtx SpecContext) {
+			ctrl.CacheSyncTimeout = 1 * time.Second
+
+			sourceSynced := make(chan struct{})
+			c, err := cache.New(cfg, cache.Options{})
+			Expect(err).NotTo(HaveOccurred())
+			c = &cacheWithIndefinitelyBlockingGetInformer{c}
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				&singnallingSourceWrapper{
+					SyncingSource: source.Kind[client.Object](c, &appsv1.Deployment{}, &handler.EnqueueRequestForObject{}),
+					cacheSyncDone: sourceSynced,
+				},
+			}
+			ctrl.Name = testControllerName
+
+			ctx, cancel := context.WithCancel(specCtx)
+			go func() {
+				defer GinkgoRecover()
+				err = ctrl.Warmup(ctx)
+				Expect(err).To(Succeed())
+			}()
+
+			cancel()
+			<-sourceSynced
+		})
+
+		It("should error when Warmup() is blocking forever", func(specCtx SpecContext) {
+			ctrl.CacheSyncTimeout = time.Second
+
+			controllerDone := make(chan struct{})
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+					<-controllerDone
+					return ctx.Err()
+				})}
+
+			ctx, cancel := context.WithTimeout(specCtx, 10*time.Second)
+			defer cancel()
+
+			err := ctrl.Warmup(ctx)
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("Please ensure that its Start() method is non-blocking"))
+
+			close(controllerDone)
+		})
+
+		It("should not error when cache sync timeout is of sufficiently high", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = 10 * time.Second
+
+			sourceSynced := make(chan struct{})
+			c := &informertest.FakeInformers{}
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				&singnallingSourceWrapper{
+					SyncingSource: source.Kind[client.Object](c, &appsv1.Deployment{}, &handler.EnqueueRequestForObject{}),
+					cacheSyncDone: sourceSynced,
+				},
+			}
+
+			go func() {
+				defer GinkgoRecover()
+				Expect(ctrl.Warmup(ctx)).To(Succeed())
+			}()
+
+			<-sourceSynced
+		})
+
+		It("should process events from source.Channel", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = 10 * time.Second
+			// channel to be closed when event is processed
+			processed := make(chan struct{})
+			// source channel
+			ch := make(chan event.GenericEvent, 1)
+
+			// event to be sent to the channel
+			p := &corev1.Pod{
+				ObjectMeta: metav1.ObjectMeta{Name: "foo", Namespace: "bar"},
+			}
+			evt := event.GenericEvent{
+				Object: p,
+			}
+
+			ins := source.Channel(
+				ch,
+				handler.Funcs{
+					GenericFunc: func(ctx context.Context, evt event.GenericEvent, q workqueue.TypedRateLimitingInterface[reconcile.Request]) {
+						defer GinkgoRecover()
+						close(processed)
+					},
+				},
+			)
+
+			// send the event to the channel
+			ch <- evt
+
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{ins}
+
+			go func() {
+				defer GinkgoRecover()
+				Expect(ctrl.Warmup(ctx)).To(Succeed())
+			}()
+			<-processed
+		})
+
+		It("should error when channel source is not specified", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = 10 * time.Second
+
+			ins := source.Channel[string](nil, nil)
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{ins}
+
+			e := ctrl.Warmup(ctx)
+			Expect(e).To(HaveOccurred())
+			Expect(e.Error()).To(ContainSubstring("must specify Channel.Source"))
+		})
+
+		It("should call Start on sources with the appropriate EventHandler, Queue, and Predicates", func(specCtx SpecContext) {
+			ctrl.CacheSyncTimeout = 10 * time.Second
+			started := false
+			ctx, cancel := context.WithCancel(specCtx)
+			src := source.Func(func(ctx context.Context, q workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+				defer GinkgoRecover()
+				Expect(q).To(Equal(ctrl.Queue))
+
+				started = true
+				cancel() // Cancel the context so ctrl.Warmup() doesn't block forever
+				return nil
+			})
+			Expect(ctrl.Watch(src)).NotTo(HaveOccurred())
+
+			err := ctrl.Warmup(ctx)
+			Expect(err).To(Succeed())
+			Expect(started).To(BeTrue())
+		})
+
+		It("should return an error if there is an error starting sources", func(ctx SpecContext) {
+			ctrl.CacheSyncTimeout = 10 * time.Second
+			err := fmt.Errorf("Expected Error: could not start source")
+			src := source.Func(func(context.Context,
+				workqueue.TypedRateLimitingInterface[reconcile.Request],
+			) error {
+				defer GinkgoRecover()
+				return err
+			})
+			Expect(ctrl.Watch(src)).To(Succeed())
+
+			Expect(ctrl.Warmup(ctx)).To(Equal(err))
+		})
+
+		It("should track warmup status correctly with unsuccessful sync", func(ctx SpecContext) {
+			// Setup controller with sources that complete with error
+			ctrl.CacheSyncTimeout = time.Second
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+					return errors.New("sync error")
+				}),
+			}
+
+			err := ctrl.Warmup(ctx)
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("sync error"))
+		})
+
+		It("should call Start on sources with the appropriate non-nil queue", func(specCtx SpecContext) {
+			ctrl.CacheSyncTimeout = 10 * time.Second
+			started := false
+			ctx, cancel := context.WithCancel(specCtx)
+			src := source.Func(func(ctx context.Context, q workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+				defer GinkgoRecover()
+				Expect(q).ToNot(BeNil())
+				Expect(q).To(Equal(ctrl.Queue))
+
+				started = true
+				cancel() // Cancel the context so ctrl.Start() doesn't block forever
+				return nil
+			})
+			Expect(ctrl.Watch(src)).To(Succeed())
+			Expect(ctrl.Warmup(ctx)).To(Succeed())
+			Expect(ctrl.Queue).ToNot(BeNil())
+			Expect(started).To(BeTrue())
+		})
+
+		It("should return true if context is cancelled while waiting for source to start", func(specCtx SpecContext) {
+			// Setup controller with sources that complete with error
+			ctx, cancel := context.WithCancel(specCtx)
+			defer cancel()
+
+			ctrl.CacheSyncTimeout = time.Second
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+					<-ctx.Done()
+					return nil
+				}),
+			}
+
+			// channel to prevent the goroutine from outliving the It test
+			waitChan := make(chan struct{})
+
+			// Invoked in a goroutine because Warmup will block
+			go func() {
+				defer GinkgoRecover()
+				defer close(waitChan)
+				Expect(ctrl.Warmup(ctx)).To(Succeed())
+			}()
+
+			cancel()
+			<-waitChan
+		})
+
+		It("should be called before leader election runnables if warmup is enabled", func(specCtx SpecContext) {
+			// This unit test exists to ensure that a warmup enabled controller will actually be
+			// called in the warmup phase before the leader election runnables are started. It
+			// catches regressions in the controller that would not implement warmupRunnable from
+			// pkg/manager.
+			ctx, cancel := context.WithCancel(specCtx)
+
+			By("Creating a channel to track execution order")
+			runnableExecutionOrderChan := make(chan string, 2)
+			const nonWarmupRunnableName = "nonWarmupRunnable"
+			const warmupRunnableName = "warmupRunnable"
+
+			ctrl.CacheSyncTimeout = time.Second
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+					runnableExecutionOrderChan <- warmupRunnableName
+					return nil
+				}),
+			}
+
+			nonWarmupCtrl := New[reconcile.Request](Options[reconcile.Request]{
+				MaxConcurrentReconciles: 1,
+				Do:                      fakeReconcile,
+				NewQueue: func(string, workqueue.TypedRateLimiter[reconcile.Request]) workqueue.TypedRateLimitingInterface[reconcile.Request] {
+					return queue
+				},
+				LogConstructor: func(_ *reconcile.Request) logr.Logger {
+					return log.RuntimeLog.WithName("controller").WithName("test")
+				},
+				CacheSyncTimeout: time.Second,
+				EnableWarmup:     ptr.To(false),
+				LeaderElected:    ptr.To(true),
+			})
+			nonWarmupCtrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+					runnableExecutionOrderChan <- nonWarmupRunnableName
+					return nil
+				}),
+			}
+
+			By("Creating a test resource lock with hooks")
+			resourceLock, err := fakeleaderelection.NewResourceLock(nil, nil, leaderelection.Options{})
+			Expect(err).ToNot(HaveOccurred())
+
+			By("Creating a manager")
+			testenv = &envtest.Environment{}
+			cfg, err := testenv.Start()
+			Expect(err).NotTo(HaveOccurred())
+			m, err := manager.New(cfg, manager.Options{
+				LeaderElection:                      true,
+				LeaderElectionID:                    "some-leader-election-id",
+				LeaderElectionNamespace:             "default",
+				LeaderElectionResourceLockInterface: resourceLock,
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			By("Adding warmup and non-warmup controllers to the manager")
+			Expect(m.Add(ctrl)).To(Succeed())
+			Expect(m.Add(nonWarmupCtrl)).To(Succeed())
+
+			By("Blocking leader election")
+			resourceLockWithHooks, ok := resourceLock.(fakeleaderelection.ControllableResourceLockInterface)
+			Expect(ok).To(BeTrue(), "resource lock should implement ResourceLockInterfaceWithHooks")
+			resourceLockWithHooks.BlockLeaderElection()
+
+			By("Starting the manager")
+			waitChan := make(chan struct{})
+			go func() {
+				defer GinkgoRecover()
+				defer close(waitChan)
+				Expect(m.Start(ctx)).To(Succeed())
+			}()
+			Expect(<-runnableExecutionOrderChan).To(Equal(warmupRunnableName))
+
+			By("Unblocking leader election")
+			resourceLockWithHooks.UnblockLeaderElection()
+			<-m.Elected()
+			Expect(<-runnableExecutionOrderChan).To(Equal(nonWarmupRunnableName))
+
+			cancel()
+			<-waitChan
+		})
+
+		It("should not cause a data race when called concurrently", func(ctx SpecContext) {
+
+			ctrl.CacheSyncTimeout = time.Second
+
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+					return nil
+				}),
+			}
+
+			var wg sync.WaitGroup
+			for i := 0; i < 5; i++ {
+				wg.Add(1)
+				go func() {
+					defer GinkgoRecover()
+					defer wg.Done()
+					Expect(ctrl.Warmup(ctx)).To(Succeed())
+				}()
+			}
+
+			wg.Wait()
+		})
+
+		It("should not cause a data race when called concurrently with Start and only start sources once", func(specCtx SpecContext) {
+			ctx, cancel := context.WithCancel(specCtx)
+
+			ctrl.CacheSyncTimeout = time.Second
+			numWatches := 10
+
+			var watchStartedCount atomic.Int32
+			for range numWatches {
+				ctrl.startWatches = append(ctrl.startWatches, source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+					watchStartedCount.Add(1)
+					return nil
+				}))
+			}
+
+			By("calling Warmup and Start concurrently")
+			blockOnStartChan := make(chan struct{})
+			go func() {
+				defer GinkgoRecover()
+				Expect(ctrl.Start(ctx)).To(Succeed())
+				close(blockOnStartChan)
+			}()
+
+			blockOnWarmupChan := make(chan struct{})
+			go func() {
+				defer GinkgoRecover()
+				Expect(ctrl.Warmup(ctx)).To(Succeed())
+				close(blockOnWarmupChan)
+			}()
+
+			<-blockOnWarmupChan
+
+			cancel()
+
+			<-blockOnStartChan
+
+			Expect(watchStartedCount.Load()).To(Equal(int32(numWatches)), "source should only be started once")
+			Expect(ctrl.startWatches).To(BeNil(), "startWatches should be reset to nil after they are started")
+		})
+
+		It("should start sources added after Warmup is called", func(specCtx SpecContext) {
+			ctx, cancel := context.WithCancel(specCtx)
+
+			ctrl.CacheSyncTimeout = time.Second
+
+			Expect(ctrl.Warmup(ctx)).To(Succeed())
+
+			By("starting a watch after warmup is added")
+			var didWatchStart atomic.Bool
+			Expect(ctrl.Watch(source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+				didWatchStart.Store(true)
+				return nil
+			}))).To(Succeed())
+
+			waitChan := make(chan struct{})
+			go func() {
+				defer GinkgoRecover()
+				Expect(ctrl.Start(ctx)).To(Succeed())
+				close(waitChan)
+			}()
+
+			Eventually(didWatchStart.Load).Should(BeTrue(), "watch should be started if it is added after Warmup")
+
+			cancel()
+			<-waitChan
+		})
+
+		DescribeTable("should not leak goroutines when manager is stopped with warmup runnable",
+			func(specContext SpecContext, leaderElection bool) {
+				ctx, cancel := context.WithCancel(specContext)
+				defer cancel()
+
+				ctrl.CacheSyncTimeout = time.Second
+
+				By("Creating a manager")
+				testenv = &envtest.Environment{}
+				cfg, err := testenv.Start()
+				Expect(err).NotTo(HaveOccurred())
+				m, err := manager.New(cfg, manager.Options{
+					LeaderElection:          leaderElection,
+					LeaderElectionID:        "some-leader-election-id",
+					LeaderElectionNamespace: "default",
+				})
+				Expect(err).NotTo(HaveOccurred())
+
+				ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+					source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+						<-ctx.Done()
+						return nil
+					}),
+				}
+				Expect(m.Add(ctrl)).To(Succeed())
+
+				// ignore needs to go after the testenv.Start() call to ignore the apiserver
+				// process
+				currentGRs := goleak.IgnoreCurrent()
+				waitChan := make(chan struct{})
+				go func() {
+					defer GinkgoRecover()
+					Expect(m.Start(ctx)).To(Succeed())
+					close(waitChan)
+				}()
+
+				<-m.Elected()
+				By("stopping the manager via context")
+				cancel()
+
+				Eventually(func() error { return goleak.Find(currentGRs) }).Should(Succeed())
+				<-waitChan
+			},
+			Entry("and with leader election enabled", true),
+			Entry("and without leader election enabled", false),
+		)
+	})
+
+	Describe("Warmup with warmup disabled", func() {
+		JustBeforeEach(func() {
+			ctrl.EnableWarmup = ptr.To(false)
+		})
+
+		It("should not start sources when Warmup is called if warmup is disabled but start it when Start is called.", func(specCtx SpecContext) {
+			// Setup controller with sources that complete successfully
+			ctx, cancel := context.WithCancel(specCtx)
+
+			ctrl.CacheSyncTimeout = time.Second
+			var isSourceStarted atomic.Bool
+			isSourceStarted.Store(false)
+			ctrl.startWatches = []source.TypedSource[reconcile.Request]{
+				source.Func(func(ctx context.Context, _ workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+					isSourceStarted.Store(true)
+					return nil
+				}),
+			}
+
+			By("Calling Warmup when EnableWarmup is false")
+			err := ctrl.Warmup(ctx)
+			Expect(err).NotTo(HaveOccurred())
+			Expect(isSourceStarted.Load()).To(BeFalse())
+
+			By("Calling Start when EnableWarmup is false")
+			waitChan := make(chan struct{})
+
+			go func() {
+				defer GinkgoRecover()
+				Expect(ctrl.Start(ctx)).To(Succeed())
+				close(waitChan)
+			}()
+			Eventually(isSourceStarted.Load).Should(BeTrue())
+			cancel()
+			<-waitChan
+		})
+	})
 })
 
 var _ = Describe("ReconcileIDFromContext function", func() {
-	It("should return an empty string if there is nothing in the context", func() {
-		ctx := context.Background()
+	It("should return an empty string if there is nothing in the context", func(ctx SpecContext) {
 		reconcileID := ReconcileIDFromContext(ctx)
 
 		Expect(reconcileID).To(Equal(types.UID("")))
 	})
 
-	It("should return the correct reconcileID from context", func() {
+	It("should return the correct reconcileID from context", func(specContext SpecContext) {
 		const expectedReconcileID = types.UID("uuid")
-		ctx := addReconcileID(context.Background(), expectedReconcileID)
+		ctx := addReconcileID(specContext, expectedReconcileID)
 		reconcileID := ReconcileIDFromContext(ctx)
 
 		Expect(reconcileID).To(Equal(expectedReconcileID))
@@ -852,6 +1680,15 @@ type singnallingSourceWrapper struct {
 	source.SyncingSource
 }
 
+func (s *singnallingSourceWrapper) Start(ctx context.Context, q workqueue.TypedRateLimitingInterface[reconcile.Request]) error {
+	err := s.SyncingSource.Start(ctx, q)
+	if err != nil {
+		// WaitForSync will never be called if this errors, so close the channel to prevent deadlocks in tests
+		close(s.cacheSyncDone)
+	}
+	return err
+}
+
 func (s *singnallingSourceWrapper) WaitForSync(ctx context.Context) error {
 	defer func() {
 		close(s.cacheSyncDone)
@@ -875,3 +1712,58 @@ func (c *cacheWithIndefinitelyBlockingGetInformer) GetInformer(ctx context.Conte
 	<-ctx.Done()
 	return nil, errors.New("GetInformer timed out")
 }
+
+type bisignallingSource[T comparable] struct {
+	// receives the queue that is passed to Start
+	startCall chan workqueue.TypedRateLimitingInterface[T]
+	// passes an error to return from Start
+	startDone chan error
+	// closed when WaitForSync is called
+	waitCall chan struct{}
+	// passes an error to return from WaitForSync
+	waitDone chan error
+}
+
+var _ source.TypedSyncingSource[int] = (*bisignallingSource[int])(nil)
+
+func (t *bisignallingSource[T]) Start(ctx context.Context, q workqueue.TypedRateLimitingInterface[T]) error {
+	select {
+	case t.startCall <- q:
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+	select {
+	case err := <-t.startDone:
+		return err
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+func (t *bisignallingSource[T]) WaitForSync(ctx context.Context) error {
+	close(t.waitCall)
+	select {
+	case err := <-t.waitDone:
+		return err
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+type priorityQueueAddition struct {
+	priorityqueue.AddOpts
+	items []reconcile.Request
+}
+
+type fakePriorityQueue struct {
+	priorityqueue.PriorityQueue[reconcile.Request]
+
+	lock  sync.Mutex
+	added []priorityQueueAddition
+}
+
+func (f *fakePriorityQueue) AddWithOpts(o priorityqueue.AddOpts, items ...reconcile.Request) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+	f.added = append(f.added, priorityQueueAddition{AddOpts: o, items: items})
+}
diff --git a/pkg/internal/controller/metrics/metrics.go b/pkg/internal/controller/metrics/metrics.go
index fbf15669d5..450e9ae25b 100644
--- a/pkg/internal/controller/metrics/metrics.go
+++ b/pkg/internal/controller/metrics/metrics.go
@@ -17,6 +17,8 @@ limitations under the License.
 package metrics
 
 import (
+	"time"
+
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/collectors"
 	"sigs.k8s.io/controller-runtime/pkg/metrics"
@@ -60,6 +62,9 @@ var (
 		Help: "Length of time per reconciliation per controller",
 		Buckets: []float64{0.005, 0.01, 0.025, 0.05, 0.1, 0.15, 0.2, 0.25, 0.3, 0.35, 0.4, 0.45, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0,
 			1.25, 1.5, 1.75, 2.0, 2.5, 3.0, 3.5, 4.0, 4.5, 5, 6, 7, 8, 9, 10, 15, 20, 25, 30, 40, 50, 60},
+		NativeHistogramBucketFactor:     1.1,
+		NativeHistogramMaxBucketNumber:  100,
+		NativeHistogramMinResetDuration: 1 * time.Hour,
 	}, []string{"controller"})
 
 	// WorkerCount is a prometheus metric which holds the number of
@@ -88,7 +93,7 @@ func init() {
 		ActiveWorkers,
 		// expose process metrics like CPU, Memory, file descriptor usage etc.
 		collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}),
-		// expose Go runtime metrics like GC stats, memory stats etc.
-		collectors.NewGoCollector(),
+		// expose all Go runtime metrics like GC stats, memory stats etc.
+		collectors.NewGoCollector(collectors.WithGoCollectorRuntimeMetrics(collectors.MetricsAll)),
 	)
 }
diff --git a/pkg/internal/metrics/workqueue.go b/pkg/internal/metrics/workqueue.go
new file mode 100644
index 0000000000..402319817b
--- /dev/null
+++ b/pkg/internal/metrics/workqueue.go
@@ -0,0 +1,170 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package metrics
+
+import (
+	"strconv"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"k8s.io/client-go/util/workqueue"
+	"sigs.k8s.io/controller-runtime/pkg/metrics"
+)
+
+// This file is copied and adapted from k8s.io/component-base/metrics/prometheus/workqueue
+// which registers metrics to the k8s legacy Registry. We require very
+// similar functionality, but must register metrics to a different Registry.
+
+// Metrics subsystem and all keys used by the workqueue.
+const (
+	WorkQueueSubsystem         = metrics.WorkQueueSubsystem
+	DepthKey                   = metrics.DepthKey
+	AddsKey                    = metrics.AddsKey
+	QueueLatencyKey            = metrics.QueueLatencyKey
+	WorkDurationKey            = metrics.WorkDurationKey
+	UnfinishedWorkKey          = metrics.UnfinishedWorkKey
+	LongestRunningProcessorKey = metrics.LongestRunningProcessorKey
+	RetriesKey                 = metrics.RetriesKey
+)
+
+var (
+	depth = prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Subsystem: WorkQueueSubsystem,
+		Name:      DepthKey,
+		Help:      "Current depth of workqueue by workqueue and priority",
+	}, []string{"name", "controller", "priority"})
+
+	adds = prometheus.NewCounterVec(prometheus.CounterOpts{
+		Subsystem: WorkQueueSubsystem,
+		Name:      AddsKey,
+		Help:      "Total number of adds handled by workqueue",
+	}, []string{"name", "controller"})
+
+	latency = prometheus.NewHistogramVec(prometheus.HistogramOpts{
+		Subsystem:                       WorkQueueSubsystem,
+		Name:                            QueueLatencyKey,
+		Help:                            "How long in seconds an item stays in workqueue before being requested",
+		Buckets:                         prometheus.ExponentialBuckets(10e-9, 10, 12),
+		NativeHistogramBucketFactor:     1.1,
+		NativeHistogramMaxBucketNumber:  100,
+		NativeHistogramMinResetDuration: 1 * time.Hour,
+	}, []string{"name", "controller"})
+
+	workDuration = prometheus.NewHistogramVec(prometheus.HistogramOpts{
+		Subsystem:                       WorkQueueSubsystem,
+		Name:                            WorkDurationKey,
+		Help:                            "How long in seconds processing an item from workqueue takes.",
+		Buckets:                         prometheus.ExponentialBuckets(10e-9, 10, 12),
+		NativeHistogramBucketFactor:     1.1,
+		NativeHistogramMaxBucketNumber:  100,
+		NativeHistogramMinResetDuration: 1 * time.Hour,
+	}, []string{"name", "controller"})
+
+	unfinished = prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Subsystem: WorkQueueSubsystem,
+		Name:      UnfinishedWorkKey,
+		Help: "How many seconds of work has been done that " +
+			"is in progress and hasn't been observed by work_duration. Large " +
+			"values indicate stuck threads. One can deduce the number of stuck " +
+			"threads by observing the rate at which this increases.",
+	}, []string{"name", "controller"})
+
+	longestRunningProcessor = prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Subsystem: WorkQueueSubsystem,
+		Name:      LongestRunningProcessorKey,
+		Help: "How many seconds has the longest running " +
+			"processor for workqueue been running.",
+	}, []string{"name", "controller"})
+
+	retries = prometheus.NewCounterVec(prometheus.CounterOpts{
+		Subsystem: WorkQueueSubsystem,
+		Name:      RetriesKey,
+		Help:      "Total number of retries handled by workqueue",
+	}, []string{"name", "controller"})
+)
+
+func init() {
+	metrics.Registry.MustRegister(depth)
+	metrics.Registry.MustRegister(adds)
+	metrics.Registry.MustRegister(latency)
+	metrics.Registry.MustRegister(workDuration)
+	metrics.Registry.MustRegister(unfinished)
+	metrics.Registry.MustRegister(longestRunningProcessor)
+	metrics.Registry.MustRegister(retries)
+
+	workqueue.SetProvider(WorkqueueMetricsProvider{})
+}
+
+type WorkqueueMetricsProvider struct{}
+
+func (WorkqueueMetricsProvider) NewDepthMetric(name string) workqueue.GaugeMetric {
+	return depth.WithLabelValues(name, name, "") // no priority
+}
+
+func (WorkqueueMetricsProvider) NewAddsMetric(name string) workqueue.CounterMetric {
+	return adds.WithLabelValues(name, name)
+}
+
+func (WorkqueueMetricsProvider) NewLatencyMetric(name string) workqueue.HistogramMetric {
+	return latency.WithLabelValues(name, name)
+}
+
+func (WorkqueueMetricsProvider) NewWorkDurationMetric(name string) workqueue.HistogramMetric {
+	return workDuration.WithLabelValues(name, name)
+}
+
+func (WorkqueueMetricsProvider) NewUnfinishedWorkSecondsMetric(name string) workqueue.SettableGaugeMetric {
+	return unfinished.WithLabelValues(name, name)
+}
+
+func (WorkqueueMetricsProvider) NewLongestRunningProcessorSecondsMetric(name string) workqueue.SettableGaugeMetric {
+	return longestRunningProcessor.WithLabelValues(name, name)
+}
+
+func (WorkqueueMetricsProvider) NewRetriesMetric(name string) workqueue.CounterMetric {
+	return retries.WithLabelValues(name, name)
+}
+
+type MetricsProviderWithPriority interface {
+	workqueue.MetricsProvider
+
+	NewDepthMetricWithPriority(name string) DepthMetricWithPriority
+}
+
+// DepthMetricWithPriority represents a depth metric with priority.
+type DepthMetricWithPriority interface {
+	Inc(priority int)
+	Dec(priority int)
+}
+
+var _ MetricsProviderWithPriority = WorkqueueMetricsProvider{}
+
+func (WorkqueueMetricsProvider) NewDepthMetricWithPriority(name string) DepthMetricWithPriority {
+	return &depthWithPriorityMetric{lvs: []string{name, name}}
+}
+
+type depthWithPriorityMetric struct {
+	lvs []string
+}
+
+func (g *depthWithPriorityMetric) Inc(priority int) {
+	depth.WithLabelValues(append(g.lvs, strconv.Itoa(priority))...).Inc()
+}
+
+func (g *depthWithPriorityMetric) Dec(priority int) {
+	depth.WithLabelValues(append(g.lvs, strconv.Itoa(priority))...).Dec()
+}
diff --git a/pkg/internal/recorder/recorder_integration_test.go b/pkg/internal/recorder/recorder_integration_test.go
index 48097872c5..c278fbde79 100644
--- a/pkg/internal/recorder/recorder_integration_test.go
+++ b/pkg/internal/recorder/recorder_integration_test.go
@@ -37,7 +37,7 @@ import (
 
 var _ = Describe("recorder", func() {
 	Describe("recorder", func() {
-		It("should publish events", func() {
+		It("should publish events", func(ctx SpecContext) {
 			By("Creating the Manager")
 			cm, err := manager.New(cfg, manager.Options{})
 			Expect(err).NotTo(HaveOccurred())
@@ -60,8 +60,6 @@ var _ = Describe("recorder", func() {
 			Expect(err).NotTo(HaveOccurred())
 
 			By("Starting the Manager")
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			go func() {
 				defer GinkgoRecover()
 				Expect(cm.Start(ctx)).NotTo(HaveOccurred())
diff --git a/pkg/internal/source/event_handler.go b/pkg/internal/source/event_handler.go
index 38432a1a79..7cc8c51555 100644
--- a/pkg/internal/source/event_handler.go
+++ b/pkg/internal/source/event_handler.go
@@ -32,6 +32,8 @@ import (
 
 var log = logf.RuntimeLog.WithName("source").WithName("EventHandler")
 
+var _ cache.ResourceEventHandler = &EventHandler[client.Object, any]{}
+
 // NewEventHandler creates a new EventHandler.
 func NewEventHandler[object client.Object, request comparable](
 	ctx context.Context,
@@ -57,19 +59,11 @@ type EventHandler[object client.Object, request comparable] struct {
 	predicates []predicate.TypedPredicate[object]
 }
 
-// HandlerFuncs converts EventHandler to a ResourceEventHandlerFuncs
-// TODO: switch to ResourceEventHandlerDetailedFuncs with client-go 1.27
-func (e *EventHandler[object, request]) HandlerFuncs() cache.ResourceEventHandlerFuncs {
-	return cache.ResourceEventHandlerFuncs{
-		AddFunc:    e.OnAdd,
-		UpdateFunc: e.OnUpdate,
-		DeleteFunc: e.OnDelete,
-	}
-}
-
 // OnAdd creates CreateEvent and calls Create on EventHandler.
-func (e *EventHandler[object, request]) OnAdd(obj interface{}) {
-	c := event.TypedCreateEvent[object]{}
+func (e *EventHandler[object, request]) OnAdd(obj interface{}, isInInitialList bool) {
+	c := event.TypedCreateEvent[object]{
+		IsInInitialList: isInInitialList,
+	}
 
 	// Pull Object out of the object
 	if o, ok := obj.(object); ok {
diff --git a/pkg/internal/source/internal_test.go b/pkg/internal/source/internal_test.go
index 4de8628ebf..73eb1a1d28 100644
--- a/pkg/internal/source/internal_test.go
+++ b/pkg/internal/source/internal_test.go
@@ -38,11 +38,10 @@ import (
 )
 
 var _ = Describe("Internal", func() {
-	var ctx = context.Background()
 	var instance *internal.EventHandler[client.Object, reconcile.Request]
 	var funcs, setfuncs *handler.Funcs
 	var set bool
-	BeforeEach(func() {
+	BeforeEach(func(ctx SpecContext) {
 		funcs = &handler.Funcs{
 			CreateFunc: func(context.Context, event.CreateEvent, workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 				defer GinkgoRecover()
@@ -92,27 +91,27 @@ var _ = Describe("Internal", func() {
 			newPod.Labels = map[string]string{"foo": "bar"}
 		})
 
-		It("should create a CreateEvent", func() {
+		It("should create a CreateEvent", func(ctx SpecContext) {
 			funcs.CreateFunc = func(ctx context.Context, evt event.CreateEvent, q workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 				defer GinkgoRecover()
 				Expect(evt.Object).To(Equal(pod))
 			}
-			instance.OnAdd(pod)
+			instance.OnAdd(pod, false)
 		})
 
-		It("should used Predicates to filter CreateEvents", func() {
+		It("should used Predicates to filter CreateEvents", func(ctx SpecContext) {
 			instance = internal.NewEventHandler(ctx, &controllertest.Queue{}, setfuncs, []predicate.Predicate{
 				predicate.Funcs{CreateFunc: func(event.CreateEvent) bool { return false }},
 			})
 			set = false
-			instance.OnAdd(pod)
+			instance.OnAdd(pod, false)
 			Expect(set).To(BeFalse())
 
 			set = false
 			instance = internal.NewEventHandler(ctx, &controllertest.Queue{}, setfuncs, []predicate.Predicate{
 				predicate.Funcs{CreateFunc: func(event.CreateEvent) bool { return true }},
 			})
-			instance.OnAdd(pod)
+			instance.OnAdd(pod, false)
 			Expect(set).To(BeTrue())
 
 			set = false
@@ -120,7 +119,7 @@ var _ = Describe("Internal", func() {
 				predicate.Funcs{CreateFunc: func(event.CreateEvent) bool { return true }},
 				predicate.Funcs{CreateFunc: func(event.CreateEvent) bool { return false }},
 			})
-			instance.OnAdd(pod)
+			instance.OnAdd(pod, false)
 			Expect(set).To(BeFalse())
 
 			set = false
@@ -128,7 +127,7 @@ var _ = Describe("Internal", func() {
 				predicate.Funcs{CreateFunc: func(event.CreateEvent) bool { return false }},
 				predicate.Funcs{CreateFunc: func(event.CreateEvent) bool { return true }},
 			})
-			instance.OnAdd(pod)
+			instance.OnAdd(pod, false)
 			Expect(set).To(BeFalse())
 
 			set = false
@@ -136,19 +135,19 @@ var _ = Describe("Internal", func() {
 				predicate.Funcs{CreateFunc: func(event.CreateEvent) bool { return true }},
 				predicate.Funcs{CreateFunc: func(event.CreateEvent) bool { return true }},
 			})
-			instance.OnAdd(pod)
+			instance.OnAdd(pod, false)
 			Expect(set).To(BeTrue())
 		})
 
 		It("should not call Create EventHandler if the object is not a runtime.Object", func() {
-			instance.OnAdd(&metav1.ObjectMeta{})
+			instance.OnAdd(&metav1.ObjectMeta{}, false)
 		})
 
 		It("should not call Create EventHandler if the object does not have metadata", func() {
-			instance.OnAdd(FooRuntimeObject{})
+			instance.OnAdd(FooRuntimeObject{}, false)
 		})
 
-		It("should create an UpdateEvent", func() {
+		It("should create an UpdateEvent", func(ctx SpecContext) {
 			funcs.UpdateFunc = func(ctx context.Context, evt event.UpdateEvent, q workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 				defer GinkgoRecover()
 				Expect(evt.ObjectOld).To(Equal(pod))
@@ -157,7 +156,7 @@ var _ = Describe("Internal", func() {
 			instance.OnUpdate(pod, newPod)
 		})
 
-		It("should used Predicates to filter UpdateEvents", func() {
+		It("should used Predicates to filter UpdateEvents", func(ctx SpecContext) {
 			set = false
 			instance = internal.NewEventHandler(ctx, &controllertest.Queue{}, setfuncs, []predicate.Predicate{
 				predicate.Funcs{UpdateFunc: func(updateEvent event.UpdateEvent) bool { return false }},
@@ -215,7 +214,7 @@ var _ = Describe("Internal", func() {
 			instance.OnDelete(pod)
 		})
 
-		It("should used Predicates to filter DeleteEvents", func() {
+		It("should used Predicates to filter DeleteEvents", func(ctx SpecContext) {
 			set = false
 			instance = internal.NewEventHandler(ctx, &controllertest.Queue{}, setfuncs, []predicate.Predicate{
 				predicate.Funcs{DeleteFunc: func(event.DeleteEvent) bool { return false }},
@@ -281,7 +280,7 @@ var _ = Describe("Internal", func() {
 			instance.OnDelete(tombstone)
 		})
 		It("should ignore objects without meta", func() {
-			instance.OnAdd(Foo{})
+			instance.OnAdd(Foo{}, false)
 			instance.OnUpdate(Foo{}, Foo{})
 			instance.OnDelete(Foo{})
 		})
diff --git a/pkg/internal/source/kind.go b/pkg/internal/source/kind.go
index 4999edc432..2854244523 100644
--- a/pkg/internal/source/kind.go
+++ b/pkg/internal/source/kind.go
@@ -10,7 +10,9 @@ import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/wait"
+	toolscache "k8s.io/client-go/tools/cache"
 	"k8s.io/client-go/util/workqueue"
+	logf "sigs.k8s.io/controller-runtime/pkg/internal/log"
 
 	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -18,6 +20,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 )
 
+var logKind = logf.RuntimeLog.WithName("source").WithName("Kind")
+
 // Kind is used to provide a source of events originating inside the cluster from Watches (e.g. Pod Create).
 type Kind[object client.Object, request comparable] struct {
 	// Type is the type of object to watch.  e.g. &v1.Pod{}
@@ -52,7 +56,7 @@ func (ks *Kind[object, request]) Start(ctx context.Context, queue workqueue.Type
 	// cache.GetInformer will block until its context is cancelled if the cache was already started and it can not
 	// sync that informer (most commonly due to RBAC issues).
 	ctx, ks.startCancel = context.WithCancel(ctx)
-	ks.startedErr = make(chan error)
+	ks.startedErr = make(chan error, 1) // Buffer chan to not leak goroutines if WaitForSync isn't called
 	go func() {
 		var (
 			i       cache.Informer
@@ -68,12 +72,12 @@ func (ks *Kind[object, request]) Start(ctx context.Context, queue workqueue.Type
 				kindMatchErr := &meta.NoKindMatchError{}
 				switch {
 				case errors.As(lastErr, &kindMatchErr):
-					log.Error(lastErr, "if kind is a CRD, it should be installed before calling Start",
+					logKind.Error(lastErr, "if kind is a CRD, it should be installed before calling Start",
 						"kind", kindMatchErr.GroupKind)
 				case runtime.IsNotRegisteredError(lastErr):
-					log.Error(lastErr, "kind must be registered to the Scheme")
+					logKind.Error(lastErr, "kind must be registered to the Scheme")
 				default:
-					log.Error(lastErr, "failed to get informer from cache")
+					logKind.Error(lastErr, "failed to get informer from cache")
 				}
 				return false, nil // Retry.
 			}
@@ -87,7 +91,9 @@ func (ks *Kind[object, request]) Start(ctx context.Context, queue workqueue.Type
 			return
 		}
 
-		_, err := i.AddEventHandler(NewEventHandler(ctx, queue, ks.Handler, ks.Predicates).HandlerFuncs())
+		_, err := i.AddEventHandlerWithOptions(NewEventHandler(ctx, queue, ks.Handler, ks.Predicates), toolscache.HandlerOptions{
+			Logger: &logKind,
+		})
 		if err != nil {
 			ks.startedErr <- err
 			return
diff --git a/pkg/internal/testing/controlplane/apiserver.go b/pkg/internal/testing/controlplane/apiserver.go
index c9a1a232ea..aadb69e84f 100644
--- a/pkg/internal/testing/controlplane/apiserver.go
+++ b/pkg/internal/testing/controlplane/apiserver.go
@@ -374,7 +374,12 @@ func (s *APIServer) populateAPIServerCerts() error {
 		return err
 	}
 
-	servingCerts, err := ca.NewServingCert()
+	servingAddresses := []string{"localhost"}
+	if s.SecureServing.ListenAddr.Address != "" {
+		servingAddresses = append(servingAddresses, s.SecureServing.ListenAddr.Address)
+	}
+
+	servingCerts, err := ca.NewServingCert(servingAddresses...)
 	if err != nil {
 		return err
 	}
@@ -384,10 +389,10 @@ func (s *APIServer) populateAPIServerCerts() error {
 		return err
 	}
 
-	if err := os.WriteFile(filepath.Join(s.CertDir, "apiserver.crt"), certData, 0640); err != nil { //nolint:gosec
+	if err := os.WriteFile(filepath.Join(s.CertDir, "apiserver.crt"), certData, 0o640); err != nil {
 		return err
 	}
-	if err := os.WriteFile(filepath.Join(s.CertDir, "apiserver.key"), keyData, 0640); err != nil { //nolint:gosec
+	if err := os.WriteFile(filepath.Join(s.CertDir, "apiserver.key"), keyData, 0o640); err != nil {
 		return err
 	}
 
@@ -404,10 +409,10 @@ func (s *APIServer) populateAPIServerCerts() error {
 		return err
 	}
 
-	if err := os.WriteFile(filepath.Join(s.CertDir, saCertFile), saCert, 0640); err != nil { //nolint:gosec
+	if err := os.WriteFile(filepath.Join(s.CertDir, saCertFile), saCert, 0o640); err != nil {
 		return err
 	}
-	return os.WriteFile(filepath.Join(s.CertDir, saKeyFile), saKey, 0640) //nolint:gosec
+	return os.WriteFile(filepath.Join(s.CertDir, saKeyFile), saKey, 0o640)
 }
 
 // Stop stops this process gracefully, waits for its termination, and cleans up
@@ -421,6 +426,9 @@ func (s *APIServer) Stop() error {
 			return err
 		}
 	}
+	if s.Authn == nil {
+		return nil
+	}
 	return s.Authn.Stop()
 }
 
diff --git a/pkg/internal/testing/controlplane/apiserver_test.go b/pkg/internal/testing/controlplane/apiserver_test.go
index 051eeb6ca1..0811e9fb59 100644
--- a/pkg/internal/testing/controlplane/apiserver_test.go
+++ b/pkg/internal/testing/controlplane/apiserver_test.go
@@ -17,8 +17,13 @@ limitations under the License.
 package controlplane_test
 
 import (
+	"crypto/x509"
+	"encoding/pem"
 	"errors"
+	"net"
 	"net/url"
+	"os"
+	"path"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -191,6 +196,66 @@ var _ = Describe("APIServer", func() {
 		})
 	})
 
+	// These tests assume that 'localhost' resolves to 127.0.0.1. It can resolve
+	// to other addresses as well (e.g. ::1 on IPv6), but it must always resolve
+	// to 127.0.0.1.
+	Describe(("generated certificates"), func() {
+		getCertificate := func() *x509.Certificate {
+			// Read the cert file
+			certFile := path.Join(server.CertDir, "apiserver.crt")
+			certBytes, err := os.ReadFile(certFile)
+			Expect(err).NotTo(HaveOccurred(), "should be able to read the cert file")
+
+			// Decode and parse it
+			block, remainder := pem.Decode(certBytes)
+			Expect(block).NotTo(BeNil(), "should be able to decode the cert file")
+			Expect(remainder).To(BeEmpty(), "should not have any extra data in the cert file")
+			Expect(block.Type).To(Equal("CERTIFICATE"), "should be a certificate block")
+
+			cert, err := x509.ParseCertificate(block.Bytes)
+			Expect(err).NotTo(HaveOccurred(), "should be able to parse the cert file")
+
+			return cert
+		}
+
+		Context("when SecureServing are not set", func() {
+			It("should have localhost/127.0.0.1 in the certificate altnames", func() {
+				cert := getCertificate()
+
+				Expect(cert.Subject.CommonName).To(Equal("localhost"))
+				Expect(cert.DNSNames).To(ConsistOf("localhost"))
+				expectedIPAddresses := []net.IP{
+					net.ParseIP("127.0.0.1").To4(),
+					net.ParseIP(server.SecureServing.ListenAddr.Address).To4(),
+				}
+				Expect(cert.IPAddresses).To(ContainElements(expectedIPAddresses))
+			})
+		})
+
+		Context("when SecureServing host & port are set", func() {
+			BeforeEach(func() {
+				server.SecureServing = SecureServing{
+					ListenAddr: process.ListenAddr{
+						Address: "1.2.3.4",
+						Port:    "5678",
+					},
+				}
+			})
+
+			It("should have the host in the certificate altnames", func() {
+				cert := getCertificate()
+
+				Expect(cert.Subject.CommonName).To(Equal("localhost"))
+				Expect(cert.DNSNames).To(ConsistOf("localhost"))
+				expectedIPAddresses := []net.IP{
+					net.ParseIP("127.0.0.1").To4(),
+					net.ParseIP(server.SecureServing.ListenAddr.Address).To4(),
+				}
+				Expect(cert.IPAddresses).To(ContainElements(expectedIPAddresses))
+			})
+		})
+	})
+
 	Describe("setting up auth", func() {
 		var auth *fakeAuthn
 		BeforeEach(func() {
diff --git a/pkg/internal/testing/controlplane/auth.go b/pkg/internal/testing/controlplane/auth.go
index 16c86a712c..b44035ebf2 100644
--- a/pkg/internal/testing/controlplane/auth.go
+++ b/pkg/internal/testing/controlplane/auth.go
@@ -128,7 +128,7 @@ func (c *CertAuthn) Start() error {
 		return fmt.Errorf("start called before configure")
 	}
 	caCrt := c.ca.CA.CertBytes()
-	if err := os.WriteFile(c.caCrtPath(), caCrt, 0640); err != nil { //nolint:gosec
+	if err := os.WriteFile(c.caCrtPath(), caCrt, 0640); err != nil {
 		return fmt.Errorf("unable to save the client certificate CA to %s: %w", c.caCrtPath(), err)
 	}
 
diff --git a/pkg/internal/testing/controlplane/etcd.go b/pkg/internal/testing/controlplane/etcd.go
index c30d213295..98ffe3ac5e 100644
--- a/pkg/internal/testing/controlplane/etcd.go
+++ b/pkg/internal/testing/controlplane/etcd.go
@@ -159,6 +159,10 @@ func (e *Etcd) setProcessState() error {
 // Stop stops this process gracefully, waits for its termination, and cleans up
 // the DataDir if necessary.
 func (e *Etcd) Stop() error {
+	if e.processState == nil {
+		return nil
+	}
+
 	if e.processState.DirNeedsCleaning {
 		e.DataDir = "" // reset the directory if it was randomly allocated, so that we can safely restart
 	}
diff --git a/pkg/internal/testing/controlplane/plane_test.go b/pkg/internal/testing/controlplane/plane_test.go
index cd0359dbca..a228e5a51c 100644
--- a/pkg/internal/testing/controlplane/plane_test.go
+++ b/pkg/internal/testing/controlplane/plane_test.go
@@ -17,8 +17,6 @@ limitations under the License.
 package controlplane_test
 
 import (
-	"context"
-
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	kauthn "k8s.io/api/authorization/v1"
@@ -69,7 +67,7 @@ var _ = Describe("Control Plane", func() {
 			Expect(plane.Stop()).To(Succeed())
 		})
 
-		It("should provision a working legacy user and legacy kubectl", func() {
+		It("should provision a working legacy user and legacy kubectl", func(ctx SpecContext) {
 			By("grabbing the legacy kubectl")
 			Expect(plane.KubeCtl()).NotTo(BeNil())
 
@@ -89,7 +87,7 @@ var _ = Describe("Control Plane", func() {
 					},
 				},
 			}
-			Expect(cl.Create(context.Background(), sar)).To(Succeed(), "should be able to make a Self-SAR")
+			Expect(cl.Create(ctx, sar)).To(Succeed(), "should be able to make a Self-SAR")
 			Expect(sar.Status.Allowed).To(BeTrue(), "admin user should be able to do everything")
 		})
 
diff --git a/pkg/internal/testing/process/process.go b/pkg/internal/testing/process/process.go
index 03f252524a..0d541921e2 100644
--- a/pkg/internal/testing/process/process.go
+++ b/pkg/internal/testing/process/process.go
@@ -215,7 +215,7 @@ func pollURLUntilOK(url url.URL, interval time.Duration, ready chan bool, stopCh
 				// there's probably certs *somewhere*,
 				// but it's fine to just skip validating
 				// them for health checks during testing
-				InsecureSkipVerify: true, //nolint:gosec
+				InsecureSkipVerify: true,
 			},
 		},
 	}
diff --git a/pkg/leaderelection/fake/leader_election.go b/pkg/leaderelection/fake/leader_election.go
index 5a82cf43b8..ab816a19a7 100644
--- a/pkg/leaderelection/fake/leader_election.go
+++ b/pkg/leaderelection/fake/leader_election.go
@@ -19,7 +19,9 @@ package fake
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"os"
+	"sync/atomic"
 	"time"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -30,6 +32,19 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/recorder"
 )
 
+// ControllableResourceLockInterface is an interface that extends resourcelock.Interface to be
+// controllable.
+type ControllableResourceLockInterface interface {
+	resourcelock.Interface
+
+	// BlockLeaderElection blocks the leader election process when called. It will not be unblocked
+	// until UnblockLeaderElection is called.
+	BlockLeaderElection()
+
+	// UnblockLeaderElection unblocks the leader election.
+	UnblockLeaderElection()
+}
+
 // NewResourceLock creates a new ResourceLock for use in testing
 // leader election.
 func NewResourceLock(config *rest.Config, recorderProvider recorder.Provider, options leaderelection.Options) (resourcelock.Interface, error) {
@@ -40,27 +55,31 @@ func NewResourceLock(config *rest.Config, recorderProvider recorder.Provider, op
 	}
 	id = id + "_" + string(uuid.NewUUID())
 
-	return &ResourceLock{
+	return &resourceLock{
 		id: id,
 		record: resourcelock.LeaderElectionRecord{
 			HolderIdentity:       id,
-			LeaseDurationSeconds: 15,
+			LeaseDurationSeconds: 1,
 			AcquireTime:          metav1.NewTime(time.Now()),
-			RenewTime:            metav1.NewTime(time.Now().Add(15 * time.Second)),
+			RenewTime:            metav1.NewTime(time.Now().Add(1 * time.Second)),
 			LeaderTransitions:    1,
 		},
 	}, nil
 }
 
-// ResourceLock implements the ResourceLockInterface.
+var _ ControllableResourceLockInterface = &resourceLock{}
+
+// resourceLock implements the ResourceLockInterface.
 // By default returns that the current identity holds the lock.
-type ResourceLock struct {
+type resourceLock struct {
 	id     string
 	record resourcelock.LeaderElectionRecord
+
+	blockedLeaderElection atomic.Bool
 }
 
 // Get implements the ResourceLockInterface.
-func (f *ResourceLock) Get(ctx context.Context) (*resourcelock.LeaderElectionRecord, []byte, error) {
+func (f *resourceLock) Get(ctx context.Context) (*resourcelock.LeaderElectionRecord, []byte, error) {
 	recordBytes, err := json.Marshal(f.record)
 	if err != nil {
 		return nil, nil, err
@@ -69,28 +88,49 @@ func (f *ResourceLock) Get(ctx context.Context) (*resourcelock.LeaderElectionRec
 }
 
 // Create implements the ResourceLockInterface.
-func (f *ResourceLock) Create(ctx context.Context, ler resourcelock.LeaderElectionRecord) error {
+func (f *resourceLock) Create(ctx context.Context, ler resourcelock.LeaderElectionRecord) error {
+	if f.blockedLeaderElection.Load() {
+		// If leader election is blocked, we do not allow creating a new record.
+		return errors.New("leader election is blocked, cannot create new record")
+	}
+
 	f.record = ler
 	return nil
 }
 
 // Update implements the ResourceLockInterface.
-func (f *ResourceLock) Update(ctx context.Context, ler resourcelock.LeaderElectionRecord) error {
+func (f *resourceLock) Update(ctx context.Context, ler resourcelock.LeaderElectionRecord) error {
+	if f.blockedLeaderElection.Load() {
+		// If leader election is blocked, we do not allow updating records
+		return errors.New("leader election is blocked, cannot update record")
+	}
+
 	f.record = ler
+
 	return nil
 }
 
 // RecordEvent implements the ResourceLockInterface.
-func (f *ResourceLock) RecordEvent(s string) {
+func (f *resourceLock) RecordEvent(s string) {
 
 }
 
 // Identity implements the ResourceLockInterface.
-func (f *ResourceLock) Identity() string {
+func (f *resourceLock) Identity() string {
 	return f.id
 }
 
 // Describe implements the ResourceLockInterface.
-func (f *ResourceLock) Describe() string {
+func (f *resourceLock) Describe() string {
 	return f.id
 }
+
+// BlockLeaderElection blocks the leader election process when called.
+func (f *resourceLock) BlockLeaderElection() {
+	f.blockedLeaderElection.Store(true)
+}
+
+// UnblockLeaderElection blocks the leader election process when called.
+func (f *resourceLock) UnblockLeaderElection() {
+	f.blockedLeaderElection.Store(false)
+}
diff --git a/pkg/leaderelection/leader_election.go b/pkg/leaderelection/leader_election.go
index ee4fcf4cbe..6c013e7992 100644
--- a/pkg/leaderelection/leader_election.go
+++ b/pkg/leaderelection/leader_election.go
@@ -20,6 +20,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"time"
 
 	"k8s.io/apimachinery/pkg/util/uuid"
 	coordinationv1client "k8s.io/client-go/kubernetes/typed/coordination/v1"
@@ -49,6 +50,16 @@ type Options struct {
 	// LeaderElectionID determines the name of the resource that leader election
 	// will use for holding the leader lock.
 	LeaderElectionID string
+
+	// RenewDeadline is the renew deadline for this leader election client.
+	// Must be set to ensure the resource lock has an appropriate client timeout.
+	// Without that, a single slow response from the API server can result
+	// in losing leadership.
+	RenewDeadline time.Duration
+
+	// LeaderLabels are an optional set of labels that will be set on the lease object
+	// when this replica becomes leader
+	LeaderLabels map[string]string
 }
 
 // NewResourceLock creates a new resource lock for use in a leader election loop.
@@ -56,7 +67,6 @@ func NewResourceLock(config *rest.Config, recorderProvider recorder.Provider, op
 	if !options.LeaderElection {
 		return nil, nil
 	}
-
 	// Default resource lock to "leases". The previous default (from v0.7.0 to v0.11.x) was configmapsleases, which was
 	// used to migrate from configmaps to leases. Since the default was "configmapsleases" for over a year, spanning
 	// five minor releases, any actively maintained operators are very likely to have a released version that uses
@@ -86,8 +96,21 @@ func NewResourceLock(config *rest.Config, recorderProvider recorder.Provider, op
 	}
 	id = id + "_" + string(uuid.NewUUID())
 
+	// Construct config for leader election
+	config = rest.AddUserAgent(config, "leader-election")
+
+	// Timeout set for a client used to contact to Kubernetes should be lower than
+	// RenewDeadline to keep a single hung request from forcing a leader loss.
+	// Setting it to max(time.Second, RenewDeadline/2) as a reasonable heuristic.
+	if options.RenewDeadline != 0 {
+		timeout := options.RenewDeadline / 2
+		if timeout < time.Second {
+			timeout = time.Second
+		}
+		config.Timeout = timeout
+	}
+
 	// Construct clients for leader election
-	rest.AddUserAgent(config, "leader-election")
 	corev1Client, err := corev1client.NewForConfig(config)
 	if err != nil {
 		return nil, err
@@ -98,7 +121,7 @@ func NewResourceLock(config *rest.Config, recorderProvider recorder.Provider, op
 		return nil, err
 	}
 
-	return resourcelock.New(options.LeaderElectionResourceLock,
+	return resourcelock.NewWithLabels(options.LeaderElectionResourceLock,
 		options.LeaderElectionNamespace,
 		options.LeaderElectionID,
 		corev1Client,
@@ -106,7 +129,9 @@ func NewResourceLock(config *rest.Config, recorderProvider recorder.Provider, op
 		resourcelock.ResourceLockConfig{
 			Identity:      id,
 			EventRecorder: recorderProvider.GetEventRecorderFor(id),
-		})
+		},
+		options.LeaderLabels,
+	)
 }
 
 func getInClusterNamespace() (string, error) {
diff --git a/pkg/log/log_test.go b/pkg/log/log_test.go
index b75604b6be..404a859e4d 100644
--- a/pkg/log/log_test.go
+++ b/pkg/log/log_test.go
@@ -17,7 +17,6 @@ limitations under the License.
 package log
 
 import (
-	"context"
 	"errors"
 
 	"github.com/go-logr/logr"
@@ -194,12 +193,12 @@ var _ = Describe("logging", func() {
 			}()
 			go func() {
 				defer GinkgoRecover()
-				delegLog.WithValues("with-value")
+				delegLog.WithValues("key", "with-value")
 				close(withValuesDone)
 			}()
 			go func() {
 				defer GinkgoRecover()
-				child.WithValues("grandchild")
+				child.WithValues("key", "grandchild")
 				close(grandChildDone)
 			}()
 			go func() {
@@ -297,17 +296,17 @@ var _ = Describe("logging", func() {
 	})
 
 	Describe("logger from context", func() {
-		It("should return default logger when context is empty", func() {
-			gotLog := FromContext(context.Background())
+		It("should return default logger when context is empty", func(ctx SpecContext) {
+			gotLog := FromContext(ctx)
 			Expect(gotLog).To(Not(BeNil()))
 		})
 
-		It("should return existing logger", func() {
+		It("should return existing logger", func(specCtx SpecContext) {
 			root := &fakeLoggerRoot{}
 			baseLog := &fakeLogger{root: root}
 
 			wantLog := logr.New(baseLog).WithName("my-logger")
-			ctx := IntoContext(context.Background(), wantLog)
+			ctx := IntoContext(specCtx, wantLog)
 
 			gotLog := FromContext(ctx)
 			Expect(gotLog).To(Not(BeNil()))
@@ -318,12 +317,12 @@ var _ = Describe("logging", func() {
 			))
 		})
 
-		It("should have added key-values", func() {
+		It("should have added key-values", func(specCtx SpecContext) {
 			root := &fakeLoggerRoot{}
 			baseLog := &fakeLogger{root: root}
 
 			wantLog := logr.New(baseLog).WithName("my-logger")
-			ctx := IntoContext(context.Background(), wantLog)
+			ctx := IntoContext(specCtx, wantLog)
 
 			gotLog := FromContext(ctx, "tag1", "value1")
 			Expect(gotLog).To(Not(BeNil()))
diff --git a/pkg/log/warning_handler.go b/pkg/log/warning_handler.go
index e9522632d3..413b56d2e4 100644
--- a/pkg/log/warning_handler.go
+++ b/pkg/log/warning_handler.go
@@ -17,13 +17,12 @@ limitations under the License.
 package log
 
 import (
+	"context"
 	"sync"
-
-	"github.com/go-logr/logr"
 )
 
 // KubeAPIWarningLoggerOptions controls the behavior
-// of a rest.WarningHandler constructed using NewKubeAPIWarningLogger().
+// of a rest.WarningHandlerWithContext constructed using NewKubeAPIWarningLogger().
 type KubeAPIWarningLoggerOptions struct {
 	// Deduplicate indicates a given warning message should only be written once.
 	// Setting this to true in a long-running process handling many warnings can
@@ -33,10 +32,8 @@ type KubeAPIWarningLoggerOptions struct {
 
 // KubeAPIWarningLogger is a wrapper around
 // a provided logr.Logger that implements the
-// rest.WarningHandler interface.
+// rest.WarningHandlerWithContext interface.
 type KubeAPIWarningLogger struct {
-	// logger is used to log responses with the warning header
-	logger logr.Logger
 	// opts contain options controlling warning output
 	opts KubeAPIWarningLoggerOptions
 	// writtenLock gurads written
@@ -46,9 +43,11 @@ type KubeAPIWarningLogger struct {
 	written map[string]struct{}
 }
 
-// HandleWarningHeader handles logging for responses from API server that are
-// warnings with code being 299 and uses a logr.Logger for its logging purposes.
-func (l *KubeAPIWarningLogger) HandleWarningHeader(code int, agent string, message string) {
+// HandleWarningHeaderWithContext handles logging for responses from API server that are
+// warnings with code being 299 and uses a logr.Logger from context for its logging purposes.
+func (l *KubeAPIWarningLogger) HandleWarningHeaderWithContext(ctx context.Context, code int, _ string, message string) {
+	log := FromContext(ctx)
+
 	if code != 299 || len(message) == 0 {
 		return
 	}
@@ -62,13 +61,13 @@ func (l *KubeAPIWarningLogger) HandleWarningHeader(code int, agent string, messa
 		}
 		l.written[message] = struct{}{}
 	}
-	l.logger.Info(message)
+	log.Info(message)
 }
 
-// NewKubeAPIWarningLogger returns an implementation of rest.WarningHandler that logs warnings
-// with code = 299 to the provided logr.Logger.
-func NewKubeAPIWarningLogger(l logr.Logger, opts KubeAPIWarningLoggerOptions) *KubeAPIWarningLogger {
-	h := &KubeAPIWarningLogger{logger: l, opts: opts}
+// NewKubeAPIWarningLogger returns an implementation of rest.WarningHandlerWithContext that logs warnings
+// with code = 299 to the logger passed into HandleWarningHeaderWithContext via the context.
+func NewKubeAPIWarningLogger(opts KubeAPIWarningLoggerOptions) *KubeAPIWarningLogger {
+	h := &KubeAPIWarningLogger{opts: opts}
 	if opts.Deduplicate {
 		h.written = map[string]struct{}{}
 	}
diff --git a/pkg/log/zap/flags.go b/pkg/log/zap/flags.go
index fb492b14da..2c88ad42ab 100644
--- a/pkg/log/zap/flags.go
+++ b/pkg/log/zap/flags.go
@@ -32,6 +32,7 @@ var levelStrings = map[string]zapcore.Level{
 	"debug": zap.DebugLevel,
 	"info":  zap.InfoLevel,
 	"error": zap.ErrorLevel,
+	"panic": zap.PanicLevel,
 }
 
 var stackLevelStrings = map[string]zapcore.Level{
diff --git a/pkg/log/zap/kube_helpers.go b/pkg/log/zap/kube_helpers.go
index 3b4ebfdaa0..c47fe6646f 100644
--- a/pkg/log/zap/kube_helpers.go
+++ b/pkg/log/zap/kube_helpers.go
@@ -78,6 +78,7 @@ func (w kubeObjectWrapper) MarshalLogObject(enc zapcore.ObjectEncoder) error {
 func (k *KubeAwareEncoder) Clone() zapcore.Encoder {
 	return &KubeAwareEncoder{
 		Encoder: k.Encoder.Clone(),
+		Verbose: k.Verbose,
 	}
 }
 
diff --git a/pkg/log/zap/zap.go b/pkg/log/zap/zap.go
index 3a114667bd..607b6680d5 100644
--- a/pkg/log/zap/zap.go
+++ b/pkg/log/zap/zap.go
@@ -247,7 +247,7 @@ func NewRaw(opts ...Opts) *zap.Logger {
 //     Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn)
 //     Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error)
 //   - zap-encoder: Zap log encoding (one of 'json' or 'console')
-//   - zap-log-level: Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error',
+//   - zap-log-level: Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error', 'panic'
 //     or any integer value > 0 which corresponds to custom debug levels of increasing verbosity").
 //   - zap-stacktrace-level: Zap Level at and above which stacktraces are captured (one of 'info', 'error' or 'panic')
 //   - zap-time-encoding: Zap time encoding (one of 'epoch', 'millis', 'nano', 'iso8601', 'rfc3339' or 'rfc3339nano'),
@@ -271,7 +271,7 @@ func (o *Options) BindFlags(fs *flag.FlagSet) {
 		o.Level = fromFlag
 	}
 	fs.Var(&levelVal, "zap-log-level",
-		"Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error', "+
+		"Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error', 'panic'"+
 			"or any integer value > 0 which corresponds to custom debug levels of increasing verbosity")
 
 	// Set the StrackTrace Level
diff --git a/pkg/log/zap/zap_test.go b/pkg/log/zap/zap_test.go
index f7fad41f06..3e80113a65 100644
--- a/pkg/log/zap/zap_test.go
+++ b/pkg/log/zap/zap_test.go
@@ -327,6 +327,24 @@ var _ = Describe("Zap log level flag options setup", func() {
 
 			Expect(outRaw).To(BeEmpty())
 		})
+
+		It("Should output only panic logs, otherwise empty logs", func() {
+			args := []string{"--zap-log-level=panic"}
+			fromFlags.BindFlags(&fs)
+			err := fs.Parse(args)
+			Expect(err).ToNot(HaveOccurred())
+
+			logOut := new(bytes.Buffer)
+
+			logger := New(UseFlagOptions(&fromFlags), WriteTo(logOut))
+			logger.V(0).Info(logInfoLevel0)
+			logger.V(1).Info(logDebugLevel1)
+			logger.V(2).Info(logDebugLevel2)
+
+			outRaw := logOut.Bytes()
+
+			Expect(outRaw).To(BeEmpty())
+		})
 	})
 
 	Context("with  zap-log-level  with increased verbosity.", func() {
diff --git a/pkg/manager/internal.go b/pkg/manager/internal.go
index e5204a7506..a9f91cbdd5 100644
--- a/pkg/manager/internal.go
+++ b/pkg/manager/internal.go
@@ -439,6 +439,11 @@ func (cm *controllerManager) Start(ctx context.Context) (err error) {
 		return fmt.Errorf("failed to start other runnables: %w", err)
 	}
 
+	// Start WarmupRunnables and wait for warmup to complete.
+	if err := cm.runnables.Warmup.Start(cm.internalCtx); err != nil {
+		return fmt.Errorf("failed to start warmup runnables: %w", err)
+	}
+
 	// Start the leader election and all required runnables.
 	{
 		ctx, cancel := context.WithCancel(context.Background())
@@ -534,6 +539,18 @@ func (cm *controllerManager) engageStopProcedure(stopComplete <-chan struct{}) e
 	}()
 
 	go func() {
+		go func() {
+			// Stop the warmup runnables in a separate goroutine to avoid blocking.
+			// It is important to stop the warmup runnables in parallel with the other runnables
+			// since we cannot assume ordering of whether or not one of the warmup runnables or one
+			// of the other runnables is holding a lock.
+			// Cancelling the wrong runnable (one that is not holding the lock) will cause the
+			// shutdown sequence to block indefinitely as it will wait for the runnable that is
+			// holding the lock to finish.
+			cm.logger.Info("Stopping and waiting for warmup runnables")
+			cm.runnables.Warmup.StopAndWait(cm.shutdownCtx)
+		}()
+
 		// First stop the non-leader election runnables.
 		cm.logger.Info("Stopping and waiting for non leader election runnables")
 		cm.runnables.Others.StopAndWait(cm.shutdownCtx)
diff --git a/pkg/manager/internal/integration/manager_test.go b/pkg/manager/internal/integration/manager_test.go
index 624aa69339..c83eead3c1 100644
--- a/pkg/manager/internal/integration/manager_test.go
+++ b/pkg/manager/internal/integration/manager_test.go
@@ -34,10 +34,12 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/utils/ptr"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
 	"sigs.k8s.io/controller-runtime/pkg/envtest"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
@@ -90,6 +92,8 @@ var (
 			},
 		},
 	}
+
+	ctx = ctrl.SetupSignalHandler()
 )
 
 var _ = Describe("manger.Manager Start", func() {
@@ -107,9 +111,7 @@ var _ = Describe("manger.Manager Start", func() {
 	//   * Add an index on v2 Driver to ensure we start and wait for an informer during cache.Start (as part of manager.Start)
 	//     * Note: cache.Start would fail if the conversion webhook doesn't work (which in turn depends on the readiness probe)
 	//     * Note: Adding the index for v2 ensures the Driver list call during Informer sync goes through conversion.
-	It("should start all components without deadlock", func() {
-		ctx := ctrl.SetupSignalHandler()
-
+	DescribeTable("should start all components without deadlock", func(warmupEnabled bool) {
 		// Set up schema.
 		Expect(clientgoscheme.AddToScheme(scheme)).To(Succeed())
 		Expect(apiextensionsv1.AddToScheme(scheme)).To(Succeed())
@@ -163,7 +165,13 @@ var _ = Describe("manger.Manager Start", func() {
 		driverReconciler := &DriverReconciler{
 			Client: mgr.GetClient(),
 		}
-		Expect(ctrl.NewControllerManagedBy(mgr).For(&crewv2.Driver{}).Complete(driverReconciler)).To(Succeed())
+		Expect(
+			ctrl.NewControllerManagedBy(mgr).
+				For(&crewv2.Driver{}).
+				Named(fmt.Sprintf("driver_warmup_%t", warmupEnabled)).
+				WithOptions(controller.Options{EnableWarmup: ptr.To(warmupEnabled)}).
+				Complete(driverReconciler),
+		).To(Succeed())
 
 		// Set up a conversion webhook.
 		conversionWebhook := createConversionWebhook(mgr)
@@ -211,7 +219,10 @@ var _ = Describe("manger.Manager Start", func() {
 
 		// Shutdown the server
 		cancel()
-	})
+	},
+		Entry("controller warmup enabled", true),
+		Entry("controller warmup not enabled", false),
+	)
 })
 
 type DriverReconciler struct {
@@ -261,7 +272,7 @@ func createConversionWebhook(mgr manager.Manager) *ConversionWebhook {
 	// This is a hack but it's better than using a hard-coded port.
 	v := reflect.ValueOf(mgr).Elem()
 	field := v.FieldByName("healthProbeListener")
-	healthProbeListener := *(*net.Listener)(unsafe.Pointer(field.UnsafeAddr())) //nolint:gosec
+	healthProbeListener := *(*net.Listener)(unsafe.Pointer(field.UnsafeAddr()))
 	readinessEndpoint := fmt.Sprint("http://", healthProbeListener.Addr().String(), "/readyz")
 
 	return &ConversionWebhook{
diff --git a/pkg/manager/manager.go b/pkg/manager/manager.go
index 3166f4818f..e0e94245e7 100644
--- a/pkg/manager/manager.go
+++ b/pkg/manager/manager.go
@@ -201,10 +201,15 @@ type Options struct {
 	// LeaseDuration time first.
 	LeaderElectionReleaseOnCancel bool
 
+	// LeaderElectionLabels allows a controller to supplement all leader election api calls with a set of custom labels based on
+	// the replica attempting to acquire leader status.
+	LeaderElectionLabels map[string]string
+
 	// LeaderElectionResourceLockInterface allows to provide a custom resourcelock.Interface that was created outside
 	// of the controller-runtime. If this value is set the options LeaderElectionID, LeaderElectionNamespace,
-	// LeaderElectionResourceLock, LeaseDuration, RenewDeadline and RetryPeriod will be ignored. This can be useful if you
-	// want to use a locking mechanism that is currently not supported, like a MultiLock across two Kubernetes clusters.
+	//  LeaderElectionResourceLock, LeaseDuration, RenewDeadline, RetryPeriod and LeaderElectionLeases will be ignored.
+	// This can be useful if you want to use a locking mechanism that is currently not supported, like a MultiLock across
+	// two Kubernetes clusters.
 	LeaderElectionResourceLockInterface resourcelock.Interface
 
 	// LeaseDuration is the duration that non-leader candidates will
@@ -314,6 +319,15 @@ type LeaderElectionRunnable interface {
 	NeedLeaderElection() bool
 }
 
+// warmupRunnable knows if a Runnable requires warmup. A warmup runnable is a runnable
+// that should be run when the manager is started but before it becomes leader.
+// Note: Implementing this interface is only useful when LeaderElection can be enabled, as the
+// behavior when leaderelection is not enabled is to run LeaderElectionRunnables immediately.
+type warmupRunnable interface {
+	// Warmup will be called when the manager is started but before it becomes leader.
+	Warmup(context.Context) error
+}
+
 // New returns a new Manager for creating Controllers.
 // Note that if ContentType in the given config is not set, "application/vnd.kubernetes.protobuf"
 // will be used for all built-in resources of Kubernetes, and "application/json" is for other types
@@ -389,6 +403,8 @@ func New(config *rest.Config, options Options) (Manager, error) {
 			LeaderElectionResourceLock: options.LeaderElectionResourceLock,
 			LeaderElectionID:           options.LeaderElectionID,
 			LeaderElectionNamespace:    options.LeaderElectionNamespace,
+			RenewDeadline:              *options.RenewDeadline,
+			LeaderLabels:               options.LeaderElectionLabels,
 		})
 		if err != nil {
 			return nil, err
@@ -416,7 +432,7 @@ func New(config *rest.Config, options Options) (Manager, error) {
 	}
 
 	errChan := make(chan error, 1)
-	runnables := newRunnables(options.BaseContext, errChan)
+	runnables := newRunnables(options.BaseContext, errChan).withLogger(options.Logger)
 	return &controllerManager{
 		stopProcedureEngaged:          ptr.To(int64(0)),
 		cluster:                       cluster,
@@ -543,6 +559,10 @@ func setOptionsDefaults(options Options) Options {
 		options.Logger = log.Log
 	}
 
+	if options.Controller.Logger.GetSink() == nil {
+		options.Controller.Logger = options.Logger
+	}
+
 	if options.BaseContext == nil {
 		options.BaseContext = defaultBaseContext
 	}
diff --git a/pkg/manager/manager_test.go b/pkg/manager/manager_test.go
index c42d2f2ae7..4363d62f59 100644
--- a/pkg/manager/manager_test.go
+++ b/pkg/manager/manager_test.go
@@ -160,7 +160,7 @@ var _ = Describe("manger.Manager", func() {
 		})
 
 		Context("with leader election enabled", func() {
-			It("should only cancel the leader election after all runnables are done", func() {
+			It("should only cancel the leader election after all runnables are done", func(specCtx SpecContext) {
 				m, err := New(cfg, Options{
 					LeaderElection:          true,
 					LeaderElectionNamespace: "default",
@@ -190,7 +190,7 @@ var _ = Describe("manger.Manager", func() {
 					close(leaderElectionDone)
 				}
 
-				ctx, cancel := context.WithCancel(context.Background())
+				ctx, cancel := context.WithCancel(specCtx)
 				mgrDone := make(chan struct{})
 				go func() {
 					defer GinkgoRecover()
@@ -209,7 +209,7 @@ var _ = Describe("manger.Manager", func() {
 				<-mgrDone
 
 			})
-			It("should disable gracefulShutdown when stopping to lead", func() {
+			It("should disable gracefulShutdown when stopping to lead", func(ctx SpecContext) {
 				m, err := New(cfg, Options{
 					LeaderElection:          true,
 					LeaderElectionNamespace: "default",
@@ -220,8 +220,6 @@ var _ = Describe("manger.Manager", func() {
 				})
 				Expect(err).ToNot(HaveOccurred())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				mgrDone := make(chan struct{})
 				go func() {
 					defer GinkgoRecover()
@@ -239,7 +237,7 @@ var _ = Describe("manger.Manager", func() {
 				Expect(cm.gracefulShutdownTimeout.Nanoseconds()).To(Equal(int64(0)))
 			})
 
-			It("should prevent leader election when shutting down a non-elected manager", func() {
+			It("should prevent leader election when shutting down a non-elected manager", func(specCtx SpecContext) {
 				var rl resourcelock.Interface
 				m1, err := New(cfg, Options{
 					LeaderElection:          true,
@@ -286,12 +284,10 @@ var _ = Describe("manger.Manager", func() {
 					return nil
 				}))).To(Succeed())
 
-				ctx1, cancel1 := context.WithCancel(context.Background())
-				defer cancel1()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m1.Elected()).ShouldNot(BeClosed())
-					Expect(m1.Start(ctx1)).NotTo(HaveOccurred())
+					Expect(m1.Start(specCtx)).NotTo(HaveOccurred())
 				}()
 				<-m1.Elected()
 				<-m1done
@@ -300,7 +296,7 @@ var _ = Describe("manger.Manager", func() {
 
 				Expect(m2.Add(electionRunnable)).To(Succeed())
 
-				ctx2, cancel2 := context.WithCancel(context.Background())
+				ctx2, cancel2 := context.WithCancel(specCtx)
 				m2done := make(chan struct{})
 				go func() {
 					defer GinkgoRecover()
@@ -317,7 +313,29 @@ var _ = Describe("manger.Manager", func() {
 				<-m2done
 			})
 
-			It("should default ID to controller-runtime if ID is not set", func() {
+			It("should default RenewDeadline for leader election config", func() {
+				var rl resourcelock.Interface
+				m1, err := New(cfg, Options{
+					LeaderElection:          true,
+					LeaderElectionNamespace: "default",
+					LeaderElectionID:        "test-leader-election-id",
+					newResourceLock: func(config *rest.Config, recorderProvider recorder.Provider, options leaderelection.Options) (resourcelock.Interface, error) {
+						if options.RenewDeadline != 10*time.Second {
+							return nil, fmt.Errorf("expected RenewDeadline to be 10s, got %v", options.RenewDeadline)
+						}
+						var err error
+						rl, err = leaderelection.NewResourceLock(config, recorderProvider, options)
+						return rl, err
+					},
+					HealthProbeBindAddress: "0",
+					Metrics:                metricsserver.Options{BindAddress: "0"},
+					PprofBindAddress:       "0",
+				})
+				Expect(err).ToNot(HaveOccurred())
+				Expect(m1).ToNot(BeNil())
+			})
+
+			It("should default ID to controller-runtime if ID is not set", func(specCtx SpecContext) {
 				var rl resourcelock.Interface
 				m1, err := New(cfg, Options{
 					LeaderElection:          true,
@@ -368,12 +386,10 @@ var _ = Describe("manger.Manager", func() {
 					return nil
 				}))).To(Succeed())
 
-				ctx1, cancel1 := context.WithCancel(context.Background())
-				defer cancel1()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m1.Elected()).ShouldNot(BeClosed())
-					Expect(m1.Start(ctx1)).NotTo(HaveOccurred())
+					Expect(m1.Start(specCtx)).NotTo(HaveOccurred())
 				}()
 				<-m1.Elected()
 				<-c1
@@ -385,7 +401,7 @@ var _ = Describe("manger.Manager", func() {
 					return nil
 				}))).To(Succeed())
 
-				ctx2, cancel := context.WithCancel(context.Background())
+				ctx2, cancel := context.WithCancel(specCtx)
 				m2done := make(chan struct{})
 				go func() {
 					defer GinkgoRecover()
@@ -443,7 +459,7 @@ var _ = Describe("manger.Manager", func() {
 				_, isLeaseLock := cm.resourceLock.(*resourcelock.LeaseLock)
 				Expect(isLeaseLock).To(BeTrue())
 			})
-			It("should release lease if ElectionReleaseOnCancel is true", func() {
+			It("should release lease if ElectionReleaseOnCancel is true", func(specCtx SpecContext) {
 				var rl resourcelock.Interface
 				m, err := New(cfg, Options{
 					LeaderElection:                true,
@@ -459,7 +475,7 @@ var _ = Describe("manger.Manager", func() {
 				})
 				Expect(err).ToNot(HaveOccurred())
 
-				ctx, cancel := context.WithCancel(context.Background())
+				ctx, cancel := context.WithCancel(specCtx)
 				doneCh := make(chan struct{})
 				go func() {
 					defer GinkgoRecover()
@@ -470,12 +486,29 @@ var _ = Describe("manger.Manager", func() {
 				cancel()
 				<-doneCh
 
-				ctx, cancel = context.WithCancel(context.Background())
-				defer cancel()
-				record, _, err := rl.Get(ctx)
+				record, _, err := rl.Get(specCtx)
 				Expect(err).ToNot(HaveOccurred())
 				Expect(record.HolderIdentity).To(BeEmpty())
 			})
+			It("should set the leaselocks's label field when LeaderElectionLabels is set", func() {
+				labels := map[string]string{"my-key": "my-val"}
+				m, err := New(cfg, Options{
+					LeaderElection:             true,
+					LeaderElectionResourceLock: resourcelock.LeasesResourceLock,
+					LeaderElectionID:           "controller-runtime",
+					LeaderElectionNamespace:    "default",
+					LeaderElectionLabels:       labels,
+				})
+				Expect(err).ToNot(HaveOccurred())
+				Expect(m).ToNot(BeNil())
+				cm, ok := m.(*controllerManager)
+				Expect(ok).To(BeTrue())
+				ll, isLeaseLock := cm.resourceLock.(*resourcelock.LeaseLock)
+				Expect(isLeaseLock).To(BeTrue())
+				val, exists := ll.Labels["my-key"]
+				Expect(exists).To(BeTrue())
+				Expect(val).To(Equal("my-val"))
+			})
 			When("using a custom LeaderElectionResourceLockInterface", func() {
 				It("should use the custom LeaderElectionResourceLockInterface", func() {
 					rl, err := fakeleaderelection.NewResourceLock(nil, nil, leaderelection.Options{})
@@ -497,7 +530,7 @@ var _ = Describe("manger.Manager", func() {
 			})
 		})
 
-		It("should create a metrics server if a valid address is provided", func() {
+		It("should create a metrics server if a valid address is provided", func(specCtx SpecContext) {
 			var srv metricsserver.Server
 			m, err := New(cfg, Options{
 				Metrics: metricsserver.Options{BindAddress: ":0"},
@@ -513,12 +546,12 @@ var _ = Describe("manger.Manager", func() {
 
 			// Triggering the metric server start here manually to test if it works.
 			// Usually this happens later during manager.Start().
-			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			ctx, cancel := context.WithTimeout(specCtx, 5*time.Second)
 			Expect(srv.Start(ctx)).To(Succeed())
 			cancel()
 		})
 
-		It("should create a metrics server if a valid address is provided and secure serving is enabled", func() {
+		It("should create a metrics server if a valid address is provided and secure serving is enabled", func(specCtx SpecContext) {
 			var srv metricsserver.Server
 			m, err := New(cfg, Options{
 				Metrics: metricsserver.Options{BindAddress: ":0", SecureServing: true},
@@ -534,7 +567,7 @@ var _ = Describe("manger.Manager", func() {
 
 			// Triggering the metric server start here manually to test if it works.
 			// Usually this happens later during manager.Start().
-			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			ctx, cancel := context.WithTimeout(specCtx, 5*time.Second)
 			Expect(srv.Start(ctx)).To(Succeed())
 			cancel()
 		})
@@ -549,8 +582,8 @@ var _ = Describe("manger.Manager", func() {
 			Expect(err).ToNot(HaveOccurred())
 		})
 
-		It("should return an error if the metrics bind address is already in use", func() {
-			ln, err := net.Listen("tcp", ":0") //nolint:gosec
+		It("should return an error if the metrics bind address is already in use", func(ctx SpecContext) {
+			ln, err := net.Listen("tcp", ":0")
 			Expect(err).ShouldNot(HaveOccurred())
 
 			var srv metricsserver.Server
@@ -569,13 +602,13 @@ var _ = Describe("manger.Manager", func() {
 
 			// Triggering the metric server start here manually to test if it works.
 			// Usually this happens later during manager.Start().
-			Expect(srv.Start(context.Background())).ToNot(Succeed())
+			Expect(srv.Start(ctx)).ToNot(Succeed())
 
 			Expect(ln.Close()).To(Succeed())
 		})
 
-		It("should return an error if the metrics bind address is already in use and secure serving enabled", func() {
-			ln, err := net.Listen("tcp", ":0") //nolint:gosec
+		It("should return an error if the metrics bind address is already in use and secure serving enabled", func(ctx SpecContext) {
+			ln, err := net.Listen("tcp", ":0")
 			Expect(err).ShouldNot(HaveOccurred())
 
 			var srv metricsserver.Server
@@ -595,7 +628,7 @@ var _ = Describe("manger.Manager", func() {
 
 			// Triggering the metric server start here manually to test if it works.
 			// Usually this happens later during manager.Start().
-			Expect(srv.Start(context.Background())).ToNot(Succeed())
+			Expect(srv.Start(ctx)).ToNot(Succeed())
 
 			Expect(ln.Close()).To(Succeed())
 		})
@@ -639,7 +672,7 @@ var _ = Describe("manger.Manager", func() {
 
 	Describe("Start", func() {
 		var startSuite = func(options Options, callbacks ...func(Manager)) {
-			It("should Start each Component", func() {
+			It("should Start each Component", func(ctx SpecContext) {
 				m, err := New(cfg, options)
 				Expect(err).NotTo(HaveOccurred())
 				for _, cb := range callbacks {
@@ -659,8 +692,6 @@ var _ = Describe("manger.Manager", func() {
 					return nil
 				}))).To(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m.Elected()).ShouldNot(BeClosed())
@@ -690,18 +721,18 @@ var _ = Describe("manger.Manager", func() {
 				Expect(m.GetConfig()).To(Equal(originalCfg))
 			})
 
-			It("should stop when context is cancelled", func() {
+			It("should stop when context is cancelled", func(specCtx SpecContext) {
 				m, err := New(cfg, options)
 				Expect(err).NotTo(HaveOccurred())
 				for _, cb := range callbacks {
 					cb(m)
 				}
-				ctx, cancel := context.WithCancel(context.Background())
+				ctx, cancel := context.WithCancel(specCtx)
 				cancel()
 				Expect(m.Start(ctx)).NotTo(HaveOccurred())
 			})
 
-			It("should return an error if it can't start the cache", func() {
+			It("should return an error if it can't start the cache", func(ctx SpecContext) {
 				m, err := New(cfg, options)
 				Expect(err).NotTo(HaveOccurred())
 				for _, cb := range callbacks {
@@ -713,12 +744,10 @@ var _ = Describe("manger.Manager", func() {
 					&cacheProvider{cache: &informertest.FakeInformers{Error: fmt.Errorf("expected error")}},
 				)).To(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				Expect(m.Start(ctx)).To(MatchError(ContainSubstring("expected error")))
 			})
 
-			It("should start the cache before starting anything else", func() {
+			It("should start the cache before starting anything else", func(ctx SpecContext) {
 				fakeCache := &startSignalingInformer{Cache: &informertest.FakeInformers{}}
 				options.NewCache = func(_ *rest.Config, _ cache.Options) (cache.Cache, error) {
 					return fakeCache, nil
@@ -740,8 +769,6 @@ var _ = Describe("manger.Manager", func() {
 				})
 				Expect(m.Add(runnable)).To(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m.Start(ctx)).ToNot(HaveOccurred())
@@ -750,7 +777,7 @@ var _ = Describe("manger.Manager", func() {
 				<-runnableWasStarted
 			})
 
-			It("should start additional clusters before anything else", func() {
+			It("should start additional clusters before anything else", func(ctx SpecContext) {
 				fakeCache := &startSignalingInformer{Cache: &informertest.FakeInformers{}}
 				options.NewCache = func(_ *rest.Config, _ cache.Options) (cache.Cache, error) {
 					return fakeCache, nil
@@ -783,8 +810,6 @@ var _ = Describe("manger.Manager", func() {
 					return nil
 				}))).To(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m.Start(ctx)).ToNot(HaveOccurred())
@@ -793,7 +818,7 @@ var _ = Describe("manger.Manager", func() {
 				<-runnableWasStarted
 			})
 
-			It("should return an error if any Components fail to Start", func() {
+			It("should return an error if any Components fail to Start", func(ctx SpecContext) {
 				m, err := New(cfg, options)
 				Expect(err).NotTo(HaveOccurred())
 				for _, cb := range callbacks {
@@ -816,15 +841,12 @@ var _ = Describe("manger.Manager", func() {
 					return nil
 				}))).To(Succeed())
 
-				defer GinkgoRecover()
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				err = m.Start(ctx)
 				Expect(err).To(HaveOccurred())
 				Expect(err.Error()).To(Equal("expected error"))
 			})
 
-			It("should start caches added after Manager has started", func() {
+			It("should start caches added after Manager has started", func(ctx SpecContext) {
 				fakeCache := &startSignalingInformer{Cache: &informertest.FakeInformers{}}
 				options.NewCache = func(_ *rest.Config, _ cache.Options) (cache.Cache, error) {
 					return fakeCache, nil
@@ -845,8 +867,6 @@ var _ = Describe("manger.Manager", func() {
 					return nil
 				}))).To(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m.Start(ctx)).ToNot(HaveOccurred())
@@ -867,7 +887,7 @@ var _ = Describe("manger.Manager", func() {
 				}).Should(BeTrue())
 			})
 
-			It("should wait for runnables to stop", func() {
+			It("should wait for runnables to stop", func(specCtx SpecContext) {
 				m, err := New(cfg, options)
 				Expect(err).NotTo(HaveOccurred())
 				for _, cb := range callbacks {
@@ -901,7 +921,7 @@ var _ = Describe("manger.Manager", func() {
 				}))).To(Succeed())
 
 				defer GinkgoRecover()
-				ctx, cancel := context.WithCancel(context.Background())
+				ctx, cancel := context.WithCancel(specCtx)
 
 				var wgManagerRunning sync.WaitGroup
 				wgManagerRunning.Add(1)
@@ -919,7 +939,7 @@ var _ = Describe("manger.Manager", func() {
 				wgManagerRunning.Wait()
 			})
 
-			It("should return an error if any Components fail to Start and wait for runnables to stop", func() {
+			It("should return an error if any Components fail to Start and wait for runnables to stop", func(ctx SpecContext) {
 				m, err := New(cfg, options)
 				Expect(err).NotTo(HaveOccurred())
 				for _, cb := range callbacks {
@@ -947,13 +967,11 @@ var _ = Describe("manger.Manager", func() {
 					return nil
 				}))).To(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				Expect(m.Start(ctx)).To(HaveOccurred())
 				Expect(runnableDoneCount).To(Equal(2))
 			})
 
-			It("should refuse to add runnable if stop procedure is already engaged", func() {
+			It("should refuse to add runnable if stop procedure is already engaged", func(specCtx SpecContext) {
 				m, err := New(cfg, options)
 				Expect(err).NotTo(HaveOccurred())
 				for _, cb := range callbacks {
@@ -970,7 +988,7 @@ var _ = Describe("manger.Manager", func() {
 					return nil
 				}))).To(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
+				ctx, cancel := context.WithCancel(specCtx)
 				go func() {
 					Expect(m.Start(ctx)).NotTo(HaveOccurred())
 				}()
@@ -983,7 +1001,7 @@ var _ = Describe("manger.Manager", func() {
 				}))).NotTo(Succeed())
 			})
 
-			It("should not return runnables context.Canceled errors", func() {
+			It("should not return runnables context.Canceled errors", func(specCtx SpecContext) {
 				Expect(options.Logger).To(BeZero(), "this test overrides Logger")
 
 				var log struct {
@@ -1011,7 +1029,7 @@ var _ = Describe("manger.Manager", func() {
 				}))).To(Succeed())
 
 				stopped := make(chan error)
-				ctx, cancel := context.WithCancel(context.Background())
+				ctx, cancel := context.WithCancel(specCtx)
 				go func() {
 					stopped <- m.Start(ctx)
 				}()
@@ -1034,7 +1052,53 @@ var _ = Describe("manger.Manager", func() {
 				)))
 			})
 
-			It("should return both runnables and stop errors when both error", func() {
+			It("should default controller logger from manager logger", func(specCtx SpecContext) {
+				var lock sync.Mutex
+				var messages []string
+				options.Logger = funcr.NewJSON(func(object string) {
+					lock.Lock()
+					messages = append(messages, object)
+					lock.Unlock()
+				}, funcr.Options{})
+				options.LeaderElection = false
+
+				m, err := New(cfg, options)
+				Expect(err).NotTo(HaveOccurred())
+				for _, cb := range callbacks {
+					cb(m)
+				}
+
+				started := make(chan struct{})
+				Expect(m.Add(RunnableFunc(func(ctx context.Context) error {
+					close(started)
+					return nil
+				}))).To(Succeed())
+
+				stopped := make(chan error)
+				ctx, cancel := context.WithCancel(specCtx)
+				go func() {
+					stopped <- m.Start(ctx)
+				}()
+
+				// Wait for runnables to start as a proxy for the manager being fully started.
+				<-started
+				cancel()
+				Expect(<-stopped).To(Succeed())
+
+				msg := "controller log message"
+				m.GetControllerOptions().Logger.Info(msg)
+
+				Eventually(func(g Gomega) {
+					lock.Lock()
+					defer lock.Unlock()
+
+					g.Expect(messages).To(ContainElement(
+						ContainSubstring(msg),
+					))
+				}).Should(Succeed())
+			})
+
+			It("should return both runnables and stop errors when both error", func(ctx SpecContext) {
 				m, err := New(cfg, options)
 				Expect(err).NotTo(HaveOccurred())
 				for _, cb := range callbacks {
@@ -1057,8 +1121,6 @@ var _ = Describe("manger.Manager", func() {
 						return nil
 					}
 				}))).To(Succeed())
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				err = m.Start(ctx)
 				Expect(err).To(HaveOccurred())
 				eMsg := "[not feeling like that, failed waiting for all runnables to end within grace period of 1ns: context deadline exceeded]"
@@ -1067,7 +1129,7 @@ var _ = Describe("manger.Manager", func() {
 				Expect(errors.Is(err, runnableError{})).To(BeTrue())
 			})
 
-			It("should return only stop errors if runnables dont error", func() {
+			It("should return only stop errors if runnables dont error", func(specCtx SpecContext) {
 				m, err := New(cfg, options)
 				Expect(err).NotTo(HaveOccurred())
 				for _, cb := range callbacks {
@@ -1091,7 +1153,7 @@ var _ = Describe("manger.Manager", func() {
 						return nil
 					}
 				}))).To(Succeed())
-				ctx, cancel := context.WithCancel(context.Background())
+				ctx, cancel := context.WithCancel(specCtx)
 				managerStopDone := make(chan struct{})
 				go func() { err = m.Start(ctx); close(managerStopDone) }()
 				// Use the 'elected' channel to find out if startup was done, otherwise we stop
@@ -1105,7 +1167,7 @@ var _ = Describe("manger.Manager", func() {
 				Expect(errors.Is(err, runnableError{})).ToNot(BeTrue())
 			})
 
-			It("should return only runnables error if stop doesn't error", func() {
+			It("should return only runnables error if stop doesn't error", func(ctx SpecContext) {
 				m, err := New(cfg, options)
 				Expect(err).NotTo(HaveOccurred())
 				for _, cb := range callbacks {
@@ -1114,8 +1176,6 @@ var _ = Describe("manger.Manager", func() {
 				Expect(m.Add(RunnableFunc(func(context.Context) error {
 					return runnableError{}
 				}))).To(Succeed())
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				err = m.Start(ctx)
 				Expect(err).To(HaveOccurred())
 				Expect(err.Error()).To(Equal("not feeling like that"))
@@ -1123,7 +1183,7 @@ var _ = Describe("manger.Manager", func() {
 				Expect(errors.Is(err, runnableError{})).To(BeTrue())
 			})
 
-			It("should not wait for runnables if gracefulShutdownTimeout is 0", func() {
+			It("should not wait for runnables if gracefulShutdownTimeout is 0", func(specCtx SpecContext) {
 				m, err := New(cfg, options)
 				Expect(err).NotTo(HaveOccurred())
 				for _, cb := range callbacks {
@@ -1139,7 +1199,7 @@ var _ = Describe("manger.Manager", func() {
 					return nil
 				}))).ToNot(HaveOccurred())
 
-				ctx, cancel := context.WithCancel(context.Background())
+				ctx, cancel := context.WithCancel(specCtx)
 				managerStopDone := make(chan struct{})
 				go func() {
 					defer GinkgoRecover()
@@ -1153,7 +1213,7 @@ var _ = Describe("manger.Manager", func() {
 				<-runnableStopped
 			})
 
-			It("should wait forever for runnables if gracefulShutdownTimeout is <0 (-1)", func() {
+			It("should wait forever for runnables if gracefulShutdownTimeout is <0 (-1)", func(specCtx SpecContext) {
 				m, err := New(cfg, options)
 				Expect(err).NotTo(HaveOccurred())
 				for _, cb := range callbacks {
@@ -1182,7 +1242,7 @@ var _ = Describe("manger.Manager", func() {
 					return nil
 				}))).ToNot(HaveOccurred())
 
-				ctx, cancel := context.WithCancel(context.Background())
+				ctx, cancel := context.WithCancel(specCtx)
 				managerStopDone := make(chan struct{})
 				go func() {
 					defer GinkgoRecover()
@@ -1218,7 +1278,7 @@ var _ = Describe("manger.Manager", func() {
 				},
 			)
 
-			It("should return an error if leader election param incorrect", func() {
+			It("should return an error if leader election param incorrect", func(specCtx SpecContext) {
 				renewDeadline := time.Second * 20
 				m, err := New(cfg, Options{
 					LeaderElection:          true,
@@ -1228,7 +1288,7 @@ var _ = Describe("manger.Manager", func() {
 					RenewDeadline:           &renewDeadline,
 				})
 				Expect(err).NotTo(HaveOccurred())
-				ctx, cancel := context.WithTimeout(context.Background(), time.Second*10)
+				ctx, cancel := context.WithTimeout(specCtx, time.Second*10)
 				defer cancel()
 				err = m.Start(ctx)
 				Expect(err).To(HaveOccurred())
@@ -1258,11 +1318,11 @@ var _ = Describe("manger.Manager", func() {
 				}
 			})
 
-			It("should stop serving metrics when stop is called", func() {
+			It("should stop serving metrics when stop is called", func(specCtx SpecContext) {
 				m, err := New(cfg, opts)
 				Expect(err).NotTo(HaveOccurred())
 
-				ctx, cancel := context.WithCancel(context.Background())
+				ctx, cancel := context.WithCancel(specCtx)
 				go func() {
 					defer GinkgoRecover()
 					Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1287,12 +1347,10 @@ var _ = Describe("manger.Manager", func() {
 				}, 10*time.Second).ShouldNot(Succeed())
 			})
 
-			It("should serve metrics endpoint", func() {
+			It("should serve metrics endpoint", func(ctx SpecContext) {
 				m, err := New(cfg, opts)
 				Expect(err).NotTo(HaveOccurred())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1308,12 +1366,10 @@ var _ = Describe("manger.Manager", func() {
 				Expect(resp.StatusCode).To(Equal(200))
 			})
 
-			It("should not serve anything other than metrics endpoint by default", func() {
+			It("should not serve anything other than metrics endpoint by default", func(ctx SpecContext) {
 				m, err := New(cfg, opts)
 				Expect(err).NotTo(HaveOccurred())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1330,7 +1386,7 @@ var _ = Describe("manger.Manager", func() {
 				Expect(resp.StatusCode).To(Equal(404))
 			})
 
-			It("should serve metrics in its registry", func() {
+			It("should serve metrics in its registry", func(ctx SpecContext) {
 				one := prometheus.NewCounter(prometheus.CounterOpts{
 					Name: "test_one",
 					Help: "test metric for testing",
@@ -1342,8 +1398,6 @@ var _ = Describe("manger.Manager", func() {
 				m, err := New(cfg, opts)
 				Expect(err).NotTo(HaveOccurred())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1372,7 +1426,7 @@ var _ = Describe("manger.Manager", func() {
 				Expect(ok).To(BeTrue())
 			})
 
-			It("should serve extra endpoints", func() {
+			It("should serve extra endpoints", func(ctx SpecContext) {
 				opts.Metrics.ExtraHandlers = map[string]http.Handler{
 					"/debug": http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 						_, _ = w.Write([]byte("Some debug info"))
@@ -1387,8 +1441,6 @@ var _ = Describe("manger.Manager", func() {
 				}))
 				Expect(err).To(HaveOccurred())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1432,12 +1484,12 @@ var _ = Describe("manger.Manager", func() {
 			}
 		})
 
-		It("should stop serving health probes when stop is called", func() {
+		It("should stop serving health probes when stop is called", func(specCtx SpecContext) {
 			opts.HealthProbeBindAddress = ":0"
 			m, err := New(cfg, opts)
 			Expect(err).NotTo(HaveOccurred())
 
-			ctx, cancel := context.WithCancel(context.Background())
+			ctx, cancel := context.WithCancel(specCtx)
 			go func() {
 				defer GinkgoRecover()
 				Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1459,7 +1511,7 @@ var _ = Describe("manger.Manager", func() {
 			}, 10*time.Second).ShouldNot(Succeed())
 		})
 
-		It("should serve readiness endpoint", func() {
+		It("should serve readiness endpoint", func(ctx SpecContext) {
 			opts.HealthProbeBindAddress = ":0"
 			m, err := New(cfg, opts)
 			Expect(err).NotTo(HaveOccurred())
@@ -1469,8 +1521,6 @@ var _ = Describe("manger.Manager", func() {
 			err = m.AddReadyzCheck(namedCheck, func(_ *http.Request) error { return res })
 			Expect(err).NotTo(HaveOccurred())
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			go func() {
 				defer GinkgoRecover()
 				Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1514,7 +1564,7 @@ var _ = Describe("manger.Manager", func() {
 			Expect(resp.StatusCode).To(Equal(http.StatusOK))
 		})
 
-		It("should serve liveness endpoint", func() {
+		It("should serve liveness endpoint", func(ctx SpecContext) {
 			opts.HealthProbeBindAddress = ":0"
 			m, err := New(cfg, opts)
 			Expect(err).NotTo(HaveOccurred())
@@ -1524,8 +1574,6 @@ var _ = Describe("manger.Manager", func() {
 			err = m.AddHealthzCheck(namedCheck, func(_ *http.Request) error { return res })
 			Expect(err).NotTo(HaveOccurred())
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			go func() {
 				defer GinkgoRecover()
 				Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1591,12 +1639,12 @@ var _ = Describe("manger.Manager", func() {
 			}
 		})
 
-		It("should stop serving pprof when stop is called", func() {
+		It("should stop serving pprof when stop is called", func(specCtx SpecContext) {
 			opts.PprofBindAddress = ":0"
 			m, err := New(cfg, opts)
 			Expect(err).NotTo(HaveOccurred())
 
-			ctx, cancel := context.WithCancel(context.Background())
+			ctx, cancel := context.WithCancel(specCtx)
 			go func() {
 				defer GinkgoRecover()
 				Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1618,13 +1666,11 @@ var _ = Describe("manger.Manager", func() {
 			}, 10*time.Second).ShouldNot(Succeed())
 		})
 
-		It("should serve pprof endpoints", func() {
+		It("should serve pprof endpoints", func(ctx SpecContext) {
 			opts.PprofBindAddress = ":0"
 			m, err := New(cfg, opts)
 			Expect(err).NotTo(HaveOccurred())
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			go func() {
 				defer GinkgoRecover()
 				Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1665,7 +1711,7 @@ var _ = Describe("manger.Manager", func() {
 
 	Describe("Add", func() {
 		It("should immediately start the Component if the Manager has already Started another Component",
-			func() {
+			func(ctx SpecContext) {
 				m, err := New(cfg, Options{})
 				Expect(err).NotTo(HaveOccurred())
 				mgr, ok := m.(*controllerManager)
@@ -1679,8 +1725,6 @@ var _ = Describe("manger.Manager", func() {
 					return nil
 				}))).To(Succeed())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1703,14 +1747,12 @@ var _ = Describe("manger.Manager", func() {
 				<-c2
 			})
 
-		It("should immediately start the Component if the Manager has already Started", func() {
+		It("should immediately start the Component if the Manager has already Started", func(ctx SpecContext) {
 			m, err := New(cfg, Options{})
 			Expect(err).NotTo(HaveOccurred())
 			mgr, ok := m.(*controllerManager)
 			Expect(ok).To(BeTrue())
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			go func() {
 				defer GinkgoRecover()
 				Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1730,12 +1772,10 @@ var _ = Describe("manger.Manager", func() {
 			<-c1
 		})
 
-		It("should fail if attempted to start a second time", func() {
+		It("should fail if attempted to start a second time", func(ctx SpecContext) {
 			m, err := New(cfg, Options{})
 			Expect(err).NotTo(HaveOccurred())
 
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
 			go func() {
 				defer GinkgoRecover()
 				Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -1754,13 +1794,13 @@ var _ = Describe("manger.Manager", func() {
 		})
 	})
 
-	It("should not leak goroutines when stopped", func() {
+	It("should not leak goroutines when stopped", func(specCtx SpecContext) {
 		currentGRs := goleak.IgnoreCurrent()
 
 		m, err := New(cfg, Options{})
 		Expect(err).NotTo(HaveOccurred())
 
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(specCtx)
 		cancel()
 		Expect(m.Start(ctx)).NotTo(HaveOccurred())
 
@@ -1770,7 +1810,7 @@ var _ = Describe("manger.Manager", func() {
 		Eventually(func() error { return goleak.Find(currentGRs) }).Should(Succeed())
 	})
 
-	It("should not leak goroutines if the default event broadcaster is used & events are emitted", func() {
+	It("should not leak goroutines if the default event broadcaster is used & events are emitted", func(specCtx SpecContext) {
 		currentGRs := goleak.IgnoreCurrent()
 
 		m, err := New(cfg, Options{ /* implicit: default setting for EventBroadcaster */ })
@@ -1787,7 +1827,7 @@ var _ = Describe("manger.Manager", func() {
 		}))).To(Succeed())
 
 		By("starting the manager & waiting till we've sent our event")
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(specCtx)
 		doneCh := make(chan struct{})
 		go func() {
 			defer GinkgoRecover()
@@ -1797,7 +1837,7 @@ var _ = Describe("manger.Manager", func() {
 		<-m.Elected()
 
 		Eventually(func() *corev1.Event {
-			evts, err := clientset.CoreV1().Events("").Search(m.GetScheme(), &ns)
+			evts, err := clientset.CoreV1().Events("").SearchWithContext(ctx, m.GetScheme(), &ns)
 			Expect(err).NotTo(HaveOccurred())
 
 			for i, evt := range evts.Items {
@@ -1818,6 +1858,54 @@ var _ = Describe("manger.Manager", func() {
 		Eventually(func() error { return goleak.Find(currentGRs) }).Should(Succeed())
 	})
 
+	It("should not leak goroutines when a runnable returns error slowly after being signaled to stop", func(specCtx SpecContext) {
+		// This test reproduces the race condition where the manager's Start method
+		// exits due to context cancellation, leaving no one to drain errChan
+
+		currentGRs := goleak.IgnoreCurrent()
+
+		// Create manager with a very short graceful shutdown timeout to reliablytrigger the race condition
+		shortGracefulShutdownTimeout := 10 * time.Millisecond
+		m, err := New(cfg, Options{
+			GracefulShutdownTimeout: &shortGracefulShutdownTimeout,
+		})
+		Expect(err).NotTo(HaveOccurred())
+
+		// Add the slow runnable that will return an error after some delay
+		for i := 0; i < 3; i++ {
+			slowRunnable := RunnableFunc(func(c context.Context) error {
+				<-c.Done()
+
+				// Simulate some work that delays the error from being returned
+				// Choosing a large delay to reliably trigger the race condition
+				time.Sleep(100 * time.Millisecond)
+
+				// This simulates the race condition where runnables try to send
+				// errors after the manager has stopped reading from errChan
+				return errors.New("slow runnable error")
+			})
+
+			Expect(m.Add(slowRunnable)).To(Succeed())
+		}
+
+		ctx, cancel := context.WithTimeout(specCtx, 50*time.Millisecond)
+		defer cancel()
+		go func() {
+			defer GinkgoRecover()
+			Expect(m.Start(ctx)).To(HaveOccurred()) // We expect error here because the slow runnables will return errors
+		}()
+
+		// Wait for context to be cancelled
+		<-ctx.Done()
+
+		// Give time for any leaks to become apparent. This makes sure that we don't false alarm on go routine leaks because runnables are still running.
+		time.Sleep(300 * time.Millisecond)
+
+		// force-close keep-alive connections
+		clientTransport.CloseIdleConnections()
+		Eventually(func() error { return goleak.Find(currentGRs) }).Should(Succeed())
+	})
+
 	It("should provide a function to get the Config", func() {
 		m, err := New(cfg, Options{})
 		Expect(err).NotTo(HaveOccurred())
@@ -1860,6 +1948,76 @@ var _ = Describe("manger.Manager", func() {
 		Expect(err).NotTo(HaveOccurred())
 		Expect(m.GetAPIReader()).NotTo(BeNil())
 	})
+
+	It("should run warmup runnables before leader election is won", func(ctx SpecContext) {
+		By("Creating a channel to track execution order")
+		runnableExecutionOrderChan := make(chan string, 2)
+		const leaderElectionRunnableName = "leaderElectionRunnable"
+		const warmupRunnableName = "warmupRunnable"
+
+		By("Creating a manager with leader election enabled")
+		m, err := New(cfg, Options{
+			LeaderElection:          true,
+			LeaderElectionNamespace: "default",
+			LeaderElectionID:        "test-leader-election-warmup",
+			newResourceLock:         fakeleaderelection.NewResourceLock,
+			HealthProbeBindAddress:  "0",
+			Metrics:                 metricsserver.Options{BindAddress: "0"},
+			PprofBindAddress:        "0",
+		})
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Creating a runnable that implements WarmupRunnable interface")
+		// Create a warmup runnable
+		warmupRunnable := newWarmupRunnableFunc(
+			func(ctx context.Context) error {
+				// This is the leader election runnable that will be executed after leader election
+				// It will block until context is done/cancelled
+				<-ctx.Done()
+				return nil
+			},
+			func(ctx context.Context) error {
+				// This should be called during startup before leader election
+				runnableExecutionOrderChan <- warmupRunnableName
+				return nil
+			},
+		)
+		Expect(m.Add(warmupRunnable)).To(Succeed())
+
+		By("Creating a runnable that requires leader election")
+		leaderElectionRunnable := RunnableFunc(
+			func(ctx context.Context) error {
+				runnableExecutionOrderChan <- leaderElectionRunnableName
+				<-ctx.Done()
+				return nil
+			},
+		)
+		Expect(m.Add(leaderElectionRunnable)).To(Succeed())
+
+		cm, ok := m.(*controllerManager)
+		Expect(ok).To(BeTrue())
+		resourceLockWithHooks, ok := cm.resourceLock.(fakeleaderelection.ControllableResourceLockInterface)
+		Expect(ok).To(BeTrue())
+
+		By("Blocking leader election")
+		resourceLockWithHooks.BlockLeaderElection()
+
+		By("Starting the manager")
+		go func() {
+			defer GinkgoRecover()
+			Expect(m.Start(ctx)).To(Succeed())
+		}()
+
+		By("Waiting for the warmup runnable to be executed without leader election being won")
+		Expect(<-runnableExecutionOrderChan).To(Equal(warmupRunnableName))
+
+		By("Unblocking leader election")
+		resourceLockWithHooks.UnblockLeaderElection()
+
+		By("Waiting for the leader election runnable to be executed after leader election was won")
+		<-m.Elected()
+		Expect(<-runnableExecutionOrderChan).To(Equal(leaderElectionRunnableName))
+	})
 })
 
 type runnableError struct {
diff --git a/pkg/manager/runnable_group.go b/pkg/manager/runnable_group.go
index db5cda7c88..53e29fc56f 100644
--- a/pkg/manager/runnable_group.go
+++ b/pkg/manager/runnable_group.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"sync"
 
+	"github.com/go-logr/logr"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 )
 
@@ -32,6 +33,7 @@ type runnables struct {
 	Webhooks       *runnableGroup
 	Caches         *runnableGroup
 	LeaderElection *runnableGroup
+	Warmup         *runnableGroup
 	Others         *runnableGroup
 }
 
@@ -42,10 +44,21 @@ func newRunnables(baseContext BaseContextFunc, errChan chan error) *runnables {
 		Webhooks:       newRunnableGroup(baseContext, errChan),
 		Caches:         newRunnableGroup(baseContext, errChan),
 		LeaderElection: newRunnableGroup(baseContext, errChan),
+		Warmup:         newRunnableGroup(baseContext, errChan),
 		Others:         newRunnableGroup(baseContext, errChan),
 	}
 }
 
+// withLogger returns the runnables with the logger set for all runnable groups.
+func (r *runnables) withLogger(logger logr.Logger) *runnables {
+	r.HTTPServers.withLogger(logger)
+	r.Webhooks.withLogger(logger)
+	r.Caches.withLogger(logger)
+	r.LeaderElection.withLogger(logger)
+	r.Others.withLogger(logger)
+	return r
+}
+
 // Add adds a runnable to closest group of runnable that they belong to.
 //
 // Add should be able to be called before and after Start, but not after StopAndWait.
@@ -65,8 +78,20 @@ func (r *runnables) Add(fn Runnable) error {
 		})
 	case webhook.Server:
 		return r.Webhooks.Add(fn, nil)
-	case LeaderElectionRunnable:
-		if !runnable.NeedLeaderElection() {
+	case warmupRunnable, LeaderElectionRunnable:
+		if warmupRunnable, ok := fn.(warmupRunnable); ok {
+			if err := r.Warmup.Add(RunnableFunc(warmupRunnable.Warmup), nil); err != nil {
+				return err
+			}
+		}
+
+		leaderElectionRunnable, ok := fn.(LeaderElectionRunnable)
+		if !ok {
+			// If the runnable is not a LeaderElectionRunnable, add it to the leader election group for backwards compatibility
+			return r.LeaderElection.Add(fn, nil)
+		}
+
+		if !leaderElectionRunnable.NeedLeaderElection() {
 			return r.Others.Add(fn, nil)
 		}
 		return r.LeaderElection.Add(fn, nil)
@@ -105,6 +130,9 @@ type runnableGroup struct {
 	// wg is an internal sync.WaitGroup that allows us to properly stop
 	// and wait for all the runnables to finish before returning.
 	wg *sync.WaitGroup
+
+	// logger is used for logging when errors are dropped during shutdown
+	logger logr.Logger
 }
 
 func newRunnableGroup(baseContext BaseContextFunc, errChan chan error) *runnableGroup {
@@ -113,12 +141,18 @@ func newRunnableGroup(baseContext BaseContextFunc, errChan chan error) *runnable
 		errChan:      errChan,
 		ch:           make(chan *readyRunnable),
 		wg:           new(sync.WaitGroup),
+		logger:       logr.Discard(), // Default to no-op logger
 	}
 
 	r.ctx, r.cancel = context.WithCancel(baseContext())
 	return r
 }
 
+// withLogger sets the logger for this runnable group.
+func (r *runnableGroup) withLogger(logger logr.Logger) {
+	r.logger = logger
+}
+
 // Started returns true if the group has started.
 func (r *runnableGroup) Started() bool {
 	r.start.Lock()
@@ -224,7 +258,27 @@ func (r *runnableGroup) reconcile() {
 
 			// Start the runnable.
 			if err := rn.Start(r.ctx); err != nil {
-				r.errChan <- err
+				// Check if we're during the shutdown process.
+				r.stop.RLock()
+				isStopped := r.stopped
+				r.stop.RUnlock()
+
+				if isStopped {
+					// During shutdown, try to send error first (error drain goroutine might still be running)
+					// but drop if it would block to prevent goroutine leaks
+					select {
+					case r.errChan <- err:
+						// Error sent successfully (error drain goroutine is still running)
+					default:
+						// Error drain goroutine has exited, drop error to prevent goroutine leak
+						if !errors.Is(err, context.Canceled) { // don't log context.Canceled errors as they are expected during shutdown
+							r.logger.Info("error dropped during shutdown to prevent goroutine leak", "error", err)
+						}
+					}
+				} else {
+					// During normal operation, always try to send errors (may block briefly)
+					r.errChan <- err
+				}
 			}
 		}(runnable)
 	}
diff --git a/pkg/manager/runnable_group_test.go b/pkg/manager/runnable_group_test.go
index f2f4119ba6..6f9b879e0e 100644
--- a/pkg/manager/runnable_group_test.go
+++ b/pkg/manager/runnable_group_test.go
@@ -27,6 +27,7 @@ var _ = Describe("runnables", func() {
 		r := newRunnables(defaultBaseContext, errCh)
 		Expect(r.Add(server)).To(Succeed())
 		Expect(r.HTTPServers.startQueue).To(HaveLen(1))
+		Expect(r.Others.startQueue).To(BeEmpty())
 	})
 
 	It("should add caches to the appropriate group", func() {
@@ -34,6 +35,7 @@ var _ = Describe("runnables", func() {
 		r := newRunnables(defaultBaseContext, errCh)
 		Expect(r.Add(cache)).To(Succeed())
 		Expect(r.Caches.startQueue).To(HaveLen(1))
+		Expect(r.Others.startQueue).To(BeEmpty())
 	})
 
 	It("should add webhooks to the appropriate group", func() {
@@ -41,6 +43,7 @@ var _ = Describe("runnables", func() {
 		r := newRunnables(defaultBaseContext, errCh)
 		Expect(r.Add(webhook)).To(Succeed())
 		Expect(r.Webhooks.startQueue).To(HaveLen(1))
+		Expect(r.Others.startQueue).To(BeEmpty())
 	})
 
 	It("should add any runnable to the leader election group", func() {
@@ -52,15 +55,122 @@ var _ = Describe("runnables", func() {
 		r := newRunnables(defaultBaseContext, errCh)
 		Expect(r.Add(runnable)).To(Succeed())
 		Expect(r.LeaderElection.startQueue).To(HaveLen(1))
+		Expect(r.Others.startQueue).To(BeEmpty())
+	})
+
+	It("should add WarmupRunnable to the Warmup and LeaderElection group", func() {
+		warmupRunnable := newWarmupRunnableFunc(
+			func(c context.Context) error {
+				<-c.Done()
+				return nil
+			},
+			func(c context.Context) error { return nil },
+		)
+
+		r := newRunnables(defaultBaseContext, errCh)
+		Expect(r.Add(warmupRunnable)).To(Succeed())
+		Expect(r.Warmup.startQueue).To(HaveLen(1))
+		Expect(r.LeaderElection.startQueue).To(HaveLen(1))
+		Expect(r.Others.startQueue).To(BeEmpty())
+	})
+
+	It("should add WarmupRunnable that doesn't needs leader election to warmup group only", func() {
+		warmupRunnable := newLeaderElectionAndWarmupRunnable(
+			func(c context.Context) error {
+				<-c.Done()
+				return nil
+			},
+			func(c context.Context) error { return nil },
+			false,
+		)
+
+		r := newRunnables(defaultBaseContext, errCh)
+		Expect(r.Add(warmupRunnable)).To(Succeed())
+
+		Expect(r.Warmup.startQueue).To(HaveLen(1))
+		Expect(r.LeaderElection.startQueue).To(BeEmpty())
+		Expect(r.Others.startQueue).To(HaveLen(1))
+	})
+
+	It("should add WarmupRunnable that needs leader election to Warmup and LeaderElection group, not Others", func() {
+		warmupRunnable := newLeaderElectionAndWarmupRunnable(
+			func(c context.Context) error {
+				<-c.Done()
+				return nil
+			},
+			func(c context.Context) error { return nil },
+			true,
+		)
+
+		r := newRunnables(defaultBaseContext, errCh)
+		Expect(r.Add(warmupRunnable)).To(Succeed())
+
+		Expect(r.Warmup.startQueue).To(HaveLen(1))
+		Expect(r.LeaderElection.startQueue).To(HaveLen(1))
+		Expect(r.Others.startQueue).To(BeEmpty())
+	})
+
+	It("should execute the Warmup function when Warmup group is started", func(ctx SpecContext) {
+		var warmupExecuted atomic.Bool
+
+		warmupRunnable := newWarmupRunnableFunc(
+			func(c context.Context) error {
+				<-c.Done()
+				return nil
+			},
+			func(c context.Context) error {
+				warmupExecuted.Store(true)
+				return nil
+			},
+		)
+
+		r := newRunnables(defaultBaseContext, errCh)
+		Expect(r.Add(warmupRunnable)).To(Succeed())
+
+		// Start the Warmup group
+		Expect(r.Warmup.Start(ctx)).To(Succeed())
+
+		// Verify warmup function was called
+		Expect(warmupExecuted.Load()).To(BeTrue())
+	})
+
+	It("should propagate errors from Warmup function to error channel", func(ctx SpecContext) {
+		expectedErr := fmt.Errorf("expected warmup error")
+
+		warmupRunnable := newWarmupRunnableFunc(
+			func(c context.Context) error {
+				<-c.Done()
+				return nil
+			},
+			func(c context.Context) error { return expectedErr },
+		)
+
+		testErrChan := make(chan error, 1)
+		r := newRunnables(defaultBaseContext, testErrChan)
+		Expect(r.Add(warmupRunnable)).To(Succeed())
+
+		// Start the Warmup group in a goroutine
+		go func() {
+			Expect(r.Warmup.Start(ctx)).To(Succeed())
+		}()
+
+		// Error from Warmup should be sent to error channel
+		var receivedErr error
+		Eventually(func() error {
+			select {
+			case receivedErr = <-testErrChan:
+				return receivedErr
+			default:
+				return nil
+			}
+		}).Should(Equal(expectedErr))
 	})
 })
 
 var _ = Describe("runnableGroup", func() {
 	errCh := make(chan error)
 
-	It("should be able to add new runnables before it starts", func() {
-		ctx, cancel := context.WithCancel(context.Background())
-		defer cancel()
+	It("should be able to add new runnables before it starts", func(ctx SpecContext) {
 		rg := newRunnableGroup(defaultBaseContext, errCh)
 		Expect(rg.Add(RunnableFunc(func(c context.Context) error {
 			<-ctx.Done()
@@ -70,9 +180,7 @@ var _ = Describe("runnableGroup", func() {
 		Expect(rg.Started()).To(BeFalse())
 	})
 
-	It("should be able to add new runnables before and after start", func() {
-		ctx, cancel := context.WithCancel(context.Background())
-		defer cancel()
+	It("should be able to add new runnables before and after start", func(ctx SpecContext) {
 		rg := newRunnableGroup(defaultBaseContext, errCh)
 		Expect(rg.Add(RunnableFunc(func(c context.Context) error {
 			<-ctx.Done()
@@ -86,9 +194,7 @@ var _ = Describe("runnableGroup", func() {
 		}), nil)).To(Succeed())
 	})
 
-	It("should be able to add new runnables before and after start concurrently", func() {
-		ctx, cancel := context.WithCancel(context.Background())
-		defer cancel()
+	It("should be able to add new runnables before and after start concurrently", func(ctx SpecContext) {
 		rg := newRunnableGroup(defaultBaseContext, errCh)
 
 		go func() {
@@ -110,8 +216,8 @@ var _ = Describe("runnableGroup", func() {
 		}
 	})
 
-	It("should be able to close the group and wait for all runnables to finish", func() {
-		ctx, cancel := context.WithCancel(context.Background())
+	It("should be able to close the group and wait for all runnables to finish", func(specCtx SpecContext) {
+		ctx, cancel := context.WithCancel(specCtx)
 
 		exited := ptr.To(int64(0))
 		rg := newRunnableGroup(defaultBaseContext, errCh)
@@ -127,7 +233,7 @@ var _ = Describe("runnableGroup", func() {
 
 		// Cancel the context, asking the runnables to exit.
 		cancel()
-		rg.StopAndWait(context.Background())
+		rg.StopAndWait(specCtx)
 
 		Expect(rg.Add(RunnableFunc(func(c context.Context) error {
 			return nil
@@ -136,8 +242,8 @@ var _ = Describe("runnableGroup", func() {
 		Expect(atomic.LoadInt64(exited)).To(BeNumerically("==", 10))
 	})
 
-	It("should be able to wait for all runnables to be ready at different intervals", func() {
-		ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+	It("should be able to wait for all runnables to be ready at different intervals", func(specCtx SpecContext) {
+		ctx, cancel := context.WithTimeout(specCtx, 1*time.Second)
 		defer cancel()
 		rg := newRunnableGroup(defaultBaseContext, errCh)
 
@@ -162,8 +268,8 @@ var _ = Describe("runnableGroup", func() {
 		}
 	})
 
-	It("should be able to handle adding runnables while stopping", func() {
-		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	It("should be able to handle adding runnables while stopping", func(specCtx SpecContext) {
+		ctx, cancel := context.WithTimeout(specCtx, 10*time.Second)
 		defer cancel()
 		rg := newRunnableGroup(defaultBaseContext, errCh)
 
@@ -175,7 +281,7 @@ var _ = Describe("runnableGroup", func() {
 		go func() {
 			defer GinkgoRecover()
 			<-time.After(1 * time.Millisecond)
-			ctx, cancel := context.WithCancel(context.Background())
+			ctx, cancel := context.WithCancel(ctx)
 			cancel()
 			rg.StopAndWait(ctx)
 		}()
@@ -198,8 +304,8 @@ var _ = Describe("runnableGroup", func() {
 		}
 	})
 
-	It("should not turn ready if some readiness check fail", func() {
-		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	It("should not turn ready if some readiness check fail", func(specCtx SpecContext) {
+		ctx, cancel := context.WithTimeout(specCtx, 2*time.Second)
 		defer cancel()
 		rg := newRunnableGroup(defaultBaseContext, errCh)
 
@@ -224,3 +330,57 @@ var _ = Describe("runnableGroup", func() {
 		}
 	})
 })
+
+var _ warmupRunnable = &warmupRunnableFunc{}
+
+func newWarmupRunnableFunc(
+	startFunc func(context.Context) error,
+	warmupFunc func(context.Context) error,
+) *warmupRunnableFunc {
+	return &warmupRunnableFunc{
+		startFunc:  startFunc,
+		warmupFunc: warmupFunc,
+	}
+}
+
+// warmupRunnableFunc is a helper struct that implements WarmupRunnable
+// for testing purposes.
+type warmupRunnableFunc struct {
+	startFunc  func(context.Context) error
+	warmupFunc func(context.Context) error
+}
+
+func (r *warmupRunnableFunc) Start(ctx context.Context) error {
+	return r.startFunc(ctx)
+}
+
+func (r *warmupRunnableFunc) Warmup(ctx context.Context) error {
+	return r.warmupFunc(ctx)
+}
+
+var _ LeaderElectionRunnable = &leaderElectionAndWarmupRunnable{}
+var _ warmupRunnable = &leaderElectionAndWarmupRunnable{}
+
+// leaderElectionAndWarmupRunnable implements both WarmupRunnable and LeaderElectionRunnable
+type leaderElectionAndWarmupRunnable struct {
+	*warmupRunnableFunc
+	needLeaderElection bool
+}
+
+func newLeaderElectionAndWarmupRunnable(
+	startFunc func(context.Context) error,
+	warmupFunc func(context.Context) error,
+	needLeaderElection bool,
+) *leaderElectionAndWarmupRunnable {
+	return &leaderElectionAndWarmupRunnable{
+		warmupRunnableFunc: &warmupRunnableFunc{
+			startFunc:  startFunc,
+			warmupFunc: warmupFunc,
+		},
+		needLeaderElection: needLeaderElection,
+	}
+}
+
+func (r leaderElectionAndWarmupRunnable) NeedLeaderElection() bool {
+	return r.needLeaderElection
+}
diff --git a/pkg/manager/server.go b/pkg/manager/server.go
index 76f6165b53..1983165da8 100644
--- a/pkg/manager/server.go
+++ b/pkg/manager/server.go
@@ -70,7 +70,7 @@ func (s *Server) Start(ctx context.Context) error {
 		shutdownCtx := context.Background()
 		if s.ShutdownTimeout != nil {
 			var shutdownCancel context.CancelFunc
-			shutdownCtx, shutdownCancel = context.WithTimeout(context.Background(), *s.ShutdownTimeout)
+			shutdownCtx, shutdownCancel = context.WithTimeout(shutdownCtx, *s.ShutdownTimeout)
 			defer shutdownCancel()
 		}
 
diff --git a/pkg/metrics/filters/filters_test.go b/pkg/metrics/filters/filters_test.go
index e47d79d621..bd107fc56d 100644
--- a/pkg/metrics/filters/filters_test.go
+++ b/pkg/metrics/filters/filters_test.go
@@ -72,11 +72,11 @@ var _ = Describe("manger.Manager", func() {
 					Elem().
 					Set(reflect.ValueOf(newMetricsServer))
 				httpClient = &http.Client{Transport: &http.Transport{
-					TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec
+					TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 				}}
 			})
 
-			It("should serve metrics in its registry", func() {
+			It("should serve metrics in its registry", func(ctx SpecContext) {
 				one := prometheus.NewCounter(prometheus.CounterOpts{
 					Name: "test_one",
 					Help: "test metric for testing",
@@ -88,8 +88,6 @@ var _ = Describe("manger.Manager", func() {
 				m, err := manager.New(cfg, opts)
 				Expect(err).NotTo(HaveOccurred())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m.Start(ctx)).NotTo(HaveOccurred())
@@ -128,7 +126,7 @@ var _ = Describe("manger.Manager", func() {
 				Expect(ok).To(BeTrue())
 			})
 
-			It("should serve extra endpoints", func() {
+			It("should serve extra endpoints", func(ctx SpecContext) {
 				opts.Metrics.ExtraHandlers = map[string]http.Handler{
 					"/debug": http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 						_, _ = w.Write([]byte("Some debug info"))
@@ -137,8 +135,6 @@ var _ = Describe("manger.Manager", func() {
 				m, err := manager.New(cfg, opts)
 				Expect(err).NotTo(HaveOccurred())
 
-				ctx, cancel := context.WithCancel(context.Background())
-				defer cancel()
 				go func() {
 					defer GinkgoRecover()
 					Expect(m.Start(ctx)).NotTo(HaveOccurred())
diff --git a/pkg/metrics/server/server.go b/pkg/metrics/server/server.go
index 5eb0c62a72..939c333f7a 100644
--- a/pkg/metrics/server/server.go
+++ b/pkg/metrics/server/server.go
@@ -275,7 +275,7 @@ func (s *defaultServer) createListener(ctx context.Context, log logr.Logger) (ne
 		return s.options.ListenConfig.Listen(ctx, "tcp", s.options.BindAddress)
 	}
 
-	cfg := &tls.Config{ //nolint:gosec
+	cfg := &tls.Config{
 		NextProtos: []string{"h2"},
 	}
 	// fallback TLS config ready, will now mutate if passer wants full control over it
diff --git a/pkg/metrics/workqueue.go b/pkg/metrics/workqueue.go
index 590653e70f..cd7ccc773e 100644
--- a/pkg/metrics/workqueue.go
+++ b/pkg/metrics/workqueue.go
@@ -16,15 +16,6 @@ limitations under the License.
 
 package metrics
 
-import (
-	"github.com/prometheus/client_golang/prometheus"
-	"k8s.io/client-go/util/workqueue"
-)
-
-// This file is copied and adapted from k8s.io/component-base/metrics/prometheus/workqueue
-// which registers metrics to the k8s legacy Registry. We require very
-// similar functionality, but must register metrics to a different Registry.
-
 // Metrics subsystem and all keys used by the workqueue.
 const (
 	WorkQueueSubsystem         = "workqueue"
@@ -36,95 +27,3 @@ const (
 	LongestRunningProcessorKey = "longest_running_processor_seconds"
 	RetriesKey                 = "retries_total"
 )
-
-var (
-	depth = prometheus.NewGaugeVec(prometheus.GaugeOpts{
-		Subsystem: WorkQueueSubsystem,
-		Name:      DepthKey,
-		Help:      "Current depth of workqueue",
-	}, []string{"name", "controller"})
-
-	adds = prometheus.NewCounterVec(prometheus.CounterOpts{
-		Subsystem: WorkQueueSubsystem,
-		Name:      AddsKey,
-		Help:      "Total number of adds handled by workqueue",
-	}, []string{"name", "controller"})
-
-	latency = prometheus.NewHistogramVec(prometheus.HistogramOpts{
-		Subsystem: WorkQueueSubsystem,
-		Name:      QueueLatencyKey,
-		Help:      "How long in seconds an item stays in workqueue before being requested",
-		Buckets:   prometheus.ExponentialBuckets(10e-9, 10, 12),
-	}, []string{"name", "controller"})
-
-	workDuration = prometheus.NewHistogramVec(prometheus.HistogramOpts{
-		Subsystem: WorkQueueSubsystem,
-		Name:      WorkDurationKey,
-		Help:      "How long in seconds processing an item from workqueue takes.",
-		Buckets:   prometheus.ExponentialBuckets(10e-9, 10, 12),
-	}, []string{"name", "controller"})
-
-	unfinished = prometheus.NewGaugeVec(prometheus.GaugeOpts{
-		Subsystem: WorkQueueSubsystem,
-		Name:      UnfinishedWorkKey,
-		Help: "How many seconds of work has been done that " +
-			"is in progress and hasn't been observed by work_duration. Large " +
-			"values indicate stuck threads. One can deduce the number of stuck " +
-			"threads by observing the rate at which this increases.",
-	}, []string{"name", "controller"})
-
-	longestRunningProcessor = prometheus.NewGaugeVec(prometheus.GaugeOpts{
-		Subsystem: WorkQueueSubsystem,
-		Name:      LongestRunningProcessorKey,
-		Help: "How many seconds has the longest running " +
-			"processor for workqueue been running.",
-	}, []string{"name", "controller"})
-
-	retries = prometheus.NewCounterVec(prometheus.CounterOpts{
-		Subsystem: WorkQueueSubsystem,
-		Name:      RetriesKey,
-		Help:      "Total number of retries handled by workqueue",
-	}, []string{"name", "controller"})
-)
-
-func init() {
-	Registry.MustRegister(depth)
-	Registry.MustRegister(adds)
-	Registry.MustRegister(latency)
-	Registry.MustRegister(workDuration)
-	Registry.MustRegister(unfinished)
-	Registry.MustRegister(longestRunningProcessor)
-	Registry.MustRegister(retries)
-
-	workqueue.SetProvider(workqueueMetricsProvider{})
-}
-
-type workqueueMetricsProvider struct{}
-
-func (workqueueMetricsProvider) NewDepthMetric(name string) workqueue.GaugeMetric {
-	return depth.WithLabelValues(name, name)
-}
-
-func (workqueueMetricsProvider) NewAddsMetric(name string) workqueue.CounterMetric {
-	return adds.WithLabelValues(name, name)
-}
-
-func (workqueueMetricsProvider) NewLatencyMetric(name string) workqueue.HistogramMetric {
-	return latency.WithLabelValues(name, name)
-}
-
-func (workqueueMetricsProvider) NewWorkDurationMetric(name string) workqueue.HistogramMetric {
-	return workDuration.WithLabelValues(name, name)
-}
-
-func (workqueueMetricsProvider) NewUnfinishedWorkSecondsMetric(name string) workqueue.SettableGaugeMetric {
-	return unfinished.WithLabelValues(name, name)
-}
-
-func (workqueueMetricsProvider) NewLongestRunningProcessorSecondsMetric(name string) workqueue.SettableGaugeMetric {
-	return longestRunningProcessor.WithLabelValues(name, name)
-}
-
-func (workqueueMetricsProvider) NewRetriesMetric(name string) workqueue.CounterMetric {
-	return retries.WithLabelValues(name, name)
-}
diff --git a/pkg/predicate/predicate.go b/pkg/predicate/predicate.go
index 90918db57a..9f24cb178c 100644
--- a/pkg/predicate/predicate.go
+++ b/pkg/predicate/predicate.go
@@ -47,13 +47,15 @@ type TypedPredicate[object any] interface {
 	Generic(event.TypedGenericEvent[object]) bool
 }
 
-var _ Predicate = Funcs{}
-var _ Predicate = ResourceVersionChangedPredicate{}
-var _ Predicate = GenerationChangedPredicate{}
-var _ Predicate = AnnotationChangedPredicate{}
-var _ Predicate = or[client.Object]{}
-var _ Predicate = and[client.Object]{}
-var _ Predicate = not[client.Object]{}
+var (
+	_ Predicate = Funcs{}
+	_ Predicate = ResourceVersionChangedPredicate{}
+	_ Predicate = GenerationChangedPredicate{}
+	_ Predicate = AnnotationChangedPredicate{}
+	_ Predicate = or[client.Object]{}
+	_ Predicate = and[client.Object]{}
+	_ Predicate = not[client.Object]{}
+)
 
 // Funcs is a function that implements Predicate.
 type Funcs = TypedFuncs[client.Object]
@@ -173,7 +175,8 @@ func (TypedResourceVersionChangedPredicate[T]) Update(e event.TypedUpdateEvent[T
 // The metadata.generation field of an object is incremented by the API server when writes are made to the spec field of an object.
 // This allows a controller to ignore update events where the spec is unchanged, and only the metadata and/or status fields are changed.
 //
-// For CustomResource objects the Generation is only incremented when the status subresource is enabled.
+// For CustomResource objects the Generation is incremented when spec is changed, or status changed and status not modeled as subresource.
+// subresource status update will not increase Generation.
 //
 // Caveats:
 //
@@ -191,7 +194,8 @@ type GenerationChangedPredicate = TypedGenerationChangedPredicate[client.Object]
 // The metadata.generation field of an object is incremented by the API server when writes are made to the spec field of an object.
 // This allows a controller to ignore update events where the spec is unchanged, and only the metadata and/or status fields are changed.
 //
-// For CustomResource objects the Generation is only incremented when the status subresource is enabled.
+// For CustomResource objects the Generation is incremented when spec is changed, or status changed and status not modeled as subresource.
+// subresource status update will not increase Generation.
 //
 // Caveats:
 //
@@ -257,11 +261,10 @@ func (TypedAnnotationChangedPredicate[object]) Update(e event.TypedUpdateEvent[o
 // This predicate will skip update events that have no change in the object's label.
 // It is intended to be used in conjunction with the GenerationChangedPredicate, as in the following example:
 //
-// Controller.Watch(
-//
-//	&source.Kind{Type: v1.MyCustomKind},
-//	&handler.EnqueueRequestForObject{},
-//	predicate.Or(predicate.GenerationChangedPredicate{}, predicate.LabelChangedPredicate{}))
+//	Controller.Watch(
+//		&source.Kind{Type: v1.MyCustomKind},
+//		&handler.EnqueueRequestForObject{},
+//		predicate.Or(predicate.GenerationChangedPredicate{}, predicate.LabelChangedPredicate{}))
 //
 // This will be helpful when object's labels is carrying some extra specification information beyond object's spec,
 // and the controller will be triggered if any valid spec change (not only in spec, but also in labels) happens.
diff --git a/pkg/reconcile/reconcile.go b/pkg/reconcile/reconcile.go
index ee63f681cc..c98b1864ef 100644
--- a/pkg/reconcile/reconcile.go
+++ b/pkg/reconcile/reconcile.go
@@ -28,7 +28,17 @@ import (
 
 // Result contains the result of a Reconciler invocation.
 type Result struct {
-	// Requeue tells the Controller to requeue the reconcile key.  Defaults to false.
+	// Requeue tells the Controller to perform a ratelimited requeue
+	// using the workqueues ratelimiter. Defaults to false.
+	//
+	// This setting is deprecated as it causes confusion and there is
+	// no good reason to use it. When waiting for an external event to
+	// happen, either the duration until it is supposed to happen or an
+	// appropriate poll interval should be used, rather than an
+	// interval emitted by a ratelimiter whose purpose it is to control
+	// retry on error.
+	//
+	// Deprecated: Use `RequeueAfter` instead.
 	Requeue bool
 
 	// RequeueAfter if greater than 0, tells the Controller to requeue the reconcile key after the Duration.
diff --git a/pkg/reconcile/reconcile_test.go b/pkg/reconcile/reconcile_test.go
index fb6a88220a..bb5644b87c 100644
--- a/pkg/reconcile/reconcile_test.go
+++ b/pkg/reconcile/reconcile_test.go
@@ -63,7 +63,7 @@ var _ = Describe("reconcile", func() {
 	})
 
 	Describe("Func", func() {
-		It("should call the function with the request and return a nil error.", func() {
+		It("should call the function with the request and return a nil error.", func(ctx SpecContext) {
 			request := reconcile.Request{
 				NamespacedName: types.NamespacedName{Name: "foo", Namespace: "bar"},
 			}
@@ -77,12 +77,12 @@ var _ = Describe("reconcile", func() {
 
 				return result, nil
 			})
-			actualResult, actualErr := instance.Reconcile(context.Background(), request)
+			actualResult, actualErr := instance.Reconcile(ctx, request)
 			Expect(actualResult).To(Equal(result))
 			Expect(actualErr).NotTo(HaveOccurred())
 		})
 
-		It("should call the function with the request and return an error.", func() {
+		It("should call the function with the request and return an error.", func(ctx SpecContext) {
 			request := reconcile.Request{
 				NamespacedName: types.NamespacedName{Name: "foo", Namespace: "bar"},
 			}
@@ -97,7 +97,7 @@ var _ = Describe("reconcile", func() {
 
 				return result, err
 			})
-			actualResult, actualErr := instance.Reconcile(context.Background(), request)
+			actualResult, actualErr := instance.Reconcile(ctx, request)
 			Expect(actualResult).To(Equal(result))
 			Expect(actualErr).To(Equal(err))
 		})
@@ -136,7 +136,7 @@ var _ = Describe("reconcile", func() {
 		Context("with an existing object", func() {
 			var key client.ObjectKey
 
-			BeforeEach(func() {
+			BeforeEach(func(ctx SpecContext) {
 				cm := &corev1.ConfigMap{
 					ObjectMeta: metav1.ObjectMeta{
 						Namespace: "default",
@@ -145,11 +145,11 @@ var _ = Describe("reconcile", func() {
 				}
 				key = client.ObjectKeyFromObject(cm)
 
-				err := testClient.Create(context.Background(), cm)
+				err := testClient.Create(ctx, cm)
 				Expect(err).NotTo(HaveOccurred())
 			})
 
-			It("should Get the object and call the ObjectReconciler", func() {
+			It("should Get the object and call the ObjectReconciler", func(ctx SpecContext) {
 				var actual *corev1.ConfigMap
 				reconciler := reconcile.AsReconciler(testClient, &mockObjectReconciler{
 					reconcileFunc: func(ctx context.Context, cm *corev1.ConfigMap) (reconcile.Result, error) {
@@ -158,7 +158,7 @@ var _ = Describe("reconcile", func() {
 					},
 				})
 
-				res, err := reconciler.Reconcile(context.Background(), reconcile.Request{NamespacedName: key})
+				res, err := reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: key})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(res).To(BeZero())
 				Expect(actual).NotTo(BeNil())
@@ -168,7 +168,7 @@ var _ = Describe("reconcile", func() {
 		})
 
 		Context("with an object that doesn't exist", func() {
-			It("should not call the ObjectReconciler", func() {
+			It("should not call the ObjectReconciler", func(ctx SpecContext) {
 				called := false
 				reconciler := reconcile.AsReconciler(testClient, &mockObjectReconciler{
 					reconcileFunc: func(ctx context.Context, cm *corev1.ConfigMap) (reconcile.Result, error) {
@@ -178,7 +178,7 @@ var _ = Describe("reconcile", func() {
 				})
 
 				key := types.NamespacedName{Namespace: "default", Name: "fake-obj"}
-				res, err := reconciler.Reconcile(context.Background(), reconcile.Request{NamespacedName: key})
+				res, err := reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: key})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(res).To(BeZero())
 				Expect(called).To(BeFalse())
diff --git a/pkg/source/source.go b/pkg/source/source.go
index 267a6470b8..c2c2dc4e07 100644
--- a/pkg/source/source.go
+++ b/pkg/source/source.go
@@ -22,11 +22,13 @@ import (
 	"fmt"
 	"sync"
 
+	toolscache "k8s.io/client-go/tools/cache"
 	"k8s.io/client-go/util/workqueue"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
+	logf "sigs.k8s.io/controller-runtime/pkg/internal/log"
 	internal "sigs.k8s.io/controller-runtime/pkg/internal/source"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
@@ -34,6 +36,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 )
 
+var logInformer = logf.RuntimeLog.WithName("source").WithName("Informer")
+
 // Source is a source of events (e.g. Create, Update, Delete operations on Kubernetes Objects, Webhook callbacks, etc)
 // which should be processed by event.EventHandlers to enqueue reconcile.Requests.
 //
@@ -282,7 +286,9 @@ func (is *Informer) Start(ctx context.Context, queue workqueue.TypedRateLimiting
 		return errors.New("must specify Informer.Handler")
 	}
 
-	_, err := is.Informer.AddEventHandler(internal.NewEventHandler(ctx, queue, is.Handler, is.Predicates).HandlerFuncs())
+	_, err := is.Informer.AddEventHandlerWithOptions(internal.NewEventHandler(ctx, queue, is.Handler, is.Predicates), toolscache.HandlerOptions{
+		Logger: &logInformer,
+	})
 	if err != nil {
 		return err
 	}
diff --git a/pkg/source/source_integration_test.go b/pkg/source/source_integration_test.go
index 504a671c8a..cc0ba530ec 100644
--- a/pkg/source/source_integration_test.go
+++ b/pkg/source/source_integration_test.go
@@ -45,7 +45,7 @@ var _ = Describe("Source", func() {
 	var ns string
 	count := 0
 
-	BeforeEach(func() {
+	BeforeEach(func(ctx SpecContext) {
 		// Create the namespace for the test
 		ns = fmt.Sprintf("controller-source-kindsource-%v", count)
 		count++
@@ -63,7 +63,7 @@ var _ = Describe("Source", func() {
 		c2 = make(chan interface{})
 	})
 
-	AfterEach(func() {
+	AfterEach(func(ctx SpecContext) {
 		err := clientset.CoreV1().Namespaces().Delete(ctx, ns, metav1.DeleteOptions{})
 		Expect(err).NotTo(HaveOccurred())
 		close(c1)
@@ -74,7 +74,7 @@ var _ = Describe("Source", func() {
 		Context("for a Deployment resource", func() {
 			obj = &appsv1.Deployment{}
 
-			It("should provide Deployment Events", func() {
+			It("should provide Deployment Events", func(ctx SpecContext) {
 				var created, updated, deleted *appsv1.Deployment
 				var err error
 
@@ -239,7 +239,7 @@ var _ = Describe("Source", func() {
 		})
 
 		Context("for a ReplicaSet resource", func() {
-			It("should provide a ReplicaSet CreateEvent", func() {
+			It("should provide a ReplicaSet CreateEvent", func(ctx SpecContext) {
 				c := make(chan struct{})
 
 				q := workqueue.NewTypedRateLimitingQueueWithConfig(
@@ -282,7 +282,7 @@ var _ = Describe("Source", func() {
 				<-c
 			})
 
-			It("should provide a ReplicaSet UpdateEvent", func() {
+			It("should provide a ReplicaSet UpdateEvent", func(ctx SpecContext) {
 				var err error
 				rs, err = clientset.AppsV1().ReplicaSets("default").Get(ctx, rs.Name, metav1.GetOptions{})
 				Expect(err).NotTo(HaveOccurred())
@@ -331,7 +331,7 @@ var _ = Describe("Source", func() {
 				<-c
 			})
 
-			It("should provide a ReplicaSet DeletedEvent", func() {
+			It("should provide a ReplicaSet DeletedEvent", func(ctx SpecContext) {
 				c := make(chan struct{})
 
 				q := workqueue.NewTypedRateLimitingQueueWithConfig(
diff --git a/pkg/source/source_suite_test.go b/pkg/source/source_suite_test.go
index 131099f0b9..774d978ca3 100644
--- a/pkg/source/source_suite_test.go
+++ b/pkg/source/source_suite_test.go
@@ -39,11 +39,12 @@ var testenv *envtest.Environment
 var config *rest.Config
 var clientset *kubernetes.Clientset
 var icache cache.Cache
-var ctx context.Context
 var cancel context.CancelFunc
 
 var _ = BeforeSuite(func() {
-	ctx, cancel = context.WithCancel(context.Background())
+	var ctx context.Context
+	// Has to be derived from context.Background, as it stays valid past the BeforeSuite
+	ctx, cancel = context.WithCancel(context.Background()) //nolint:forbidigo
 	logf.SetLogger(zap.New(zap.WriteTo(GinkgoWriter), zap.UseDevMode(true)))
 
 	testenv = &envtest.Environment{}
diff --git a/pkg/source/source_test.go b/pkg/source/source_test.go
index eec3179c7d..ad311d73b2 100644
--- a/pkg/source/source_test.go
+++ b/pkg/source/source_test.go
@@ -56,7 +56,7 @@ var _ = Describe("Source", func() {
 		})
 
 		Context("for a Pod resource", func() {
-			It("should provide a Pod CreateEvent", func() {
+			It("should provide a Pod CreateEvent", func(ctx SpecContext) {
 				c := make(chan struct{})
 				p := &corev1.Pod{
 					Spec: corev1.PodSpec{
@@ -93,7 +93,7 @@ var _ = Describe("Source", func() {
 				})
 				err := instance.Start(ctx, q)
 				Expect(err).NotTo(HaveOccurred())
-				Expect(instance.WaitForSync(context.Background())).NotTo(HaveOccurred())
+				Expect(instance.WaitForSync(ctx)).NotTo(HaveOccurred())
 
 				i, err := ic.FakeInformerFor(ctx, &corev1.Pod{})
 				Expect(err).NotTo(HaveOccurred())
@@ -102,7 +102,7 @@ var _ = Describe("Source", func() {
 				<-c
 			})
 
-			It("should provide a Pod UpdateEvent", func() {
+			It("should provide a Pod UpdateEvent", func(ctx SpecContext) {
 				p2 := p.DeepCopy()
 				p2.SetLabels(map[string]string{"biz": "baz"})
 
@@ -137,7 +137,7 @@ var _ = Describe("Source", func() {
 				})
 				err := instance.Start(ctx, q)
 				Expect(err).NotTo(HaveOccurred())
-				Expect(instance.WaitForSync(context.Background())).NotTo(HaveOccurred())
+				Expect(instance.WaitForSync(ctx)).NotTo(HaveOccurred())
 
 				i, err := ic.FakeInformerFor(ctx, &corev1.Pod{})
 				Expect(err).NotTo(HaveOccurred())
@@ -146,7 +146,7 @@ var _ = Describe("Source", func() {
 				<-c
 			})
 
-			It("should provide a Pod DeletedEvent", func() {
+			It("should provide a Pod DeletedEvent", func(ctx SpecContext) {
 				c := make(chan struct{})
 				p := &corev1.Pod{
 					Spec: corev1.PodSpec{
@@ -183,7 +183,7 @@ var _ = Describe("Source", func() {
 				})
 				err := instance.Start(ctx, q)
 				Expect(err).NotTo(HaveOccurred())
-				Expect(instance.WaitForSync(context.Background())).NotTo(HaveOccurred())
+				Expect(instance.WaitForSync(ctx)).NotTo(HaveOccurred())
 
 				i, err := ic.FakeInformerFor(ctx, &corev1.Pod{})
 				Expect(err).NotTo(HaveOccurred())
@@ -193,38 +193,38 @@ var _ = Describe("Source", func() {
 			})
 		})
 
-		It("should return an error from Start cache was not provided", func() {
+		It("should return an error from Start cache was not provided", func(ctx SpecContext) {
 			instance := source.Kind(nil, &corev1.Pod{}, nil)
 			err := instance.Start(ctx, nil)
 			Expect(err).To(HaveOccurred())
 			Expect(err.Error()).To(ContainSubstring("must create Kind with a non-nil cache"))
 		})
 
-		It("should return an error from Start if a type was not provided", func() {
+		It("should return an error from Start if a type was not provided", func(ctx SpecContext) {
 			instance := source.Kind[client.Object](ic, nil, nil)
 			err := instance.Start(ctx, nil)
 			Expect(err).To(HaveOccurred())
 			Expect(err.Error()).To(ContainSubstring("must create Kind with a non-nil object"))
 		})
-		It("should return an error from Start if a handler was not provided", func() {
+		It("should return an error from Start if a handler was not provided", func(ctx SpecContext) {
 			instance := source.Kind(ic, &corev1.Pod{}, nil)
 			err := instance.Start(ctx, nil)
 			Expect(err).To(HaveOccurred())
 			Expect(err.Error()).To(ContainSubstring("must create Kind with non-nil handler"))
 		})
 
-		It("should return an error if syncing fails", func() {
+		It("should return an error if syncing fails", func(ctx SpecContext) {
 			f := false
 			instance := source.Kind[client.Object](&informertest.FakeInformers{Synced: &f}, &corev1.Pod{}, &handler.EnqueueRequestForObject{})
-			Expect(instance.Start(context.Background(), nil)).NotTo(HaveOccurred())
-			err := instance.WaitForSync(context.Background())
+			Expect(instance.Start(ctx, nil)).NotTo(HaveOccurred())
+			err := instance.WaitForSync(ctx)
 			Expect(err).To(HaveOccurred())
 			Expect(err.Error()).To(Equal("cache did not sync"))
 
 		})
 
 		Context("for a Kind not in the cache", func() {
-			It("should return an error when WaitForSync is called", func() {
+			It("should return an error when WaitForSync is called", func(specContext SpecContext) {
 				ic.Error = fmt.Errorf("test error")
 				q := workqueue.NewTypedRateLimitingQueueWithConfig(
 					workqueue.DefaultTypedControllerRateLimiter[reconcile.Request](),
@@ -232,21 +232,21 @@ var _ = Describe("Source", func() {
 						Name: "test",
 					})
 
-				ctx, cancel := context.WithTimeout(ctx, 2*time.Second)
+				ctx, cancel := context.WithTimeout(specContext, 2*time.Second)
 				defer cancel()
 
 				instance := source.Kind(ic, &corev1.Pod{}, handler.TypedFuncs[*corev1.Pod, reconcile.Request]{})
 				err := instance.Start(ctx, q)
 				Expect(err).NotTo(HaveOccurred())
-				Eventually(instance.WaitForSync).WithArguments(context.Background()).Should(HaveOccurred())
+				Eventually(instance.WaitForSync).WithArguments(ctx).Should(HaveOccurred())
 			})
 		})
 
-		It("should return an error if syncing fails", func() {
+		It("should return an error if syncing fails", func(ctx SpecContext) {
 			f := false
 			instance := source.Kind[client.Object](&informertest.FakeInformers{Synced: &f}, &corev1.Pod{}, &handler.EnqueueRequestForObject{})
-			Expect(instance.Start(context.Background(), nil)).NotTo(HaveOccurred())
-			err := instance.WaitForSync(context.Background())
+			Expect(instance.Start(ctx, nil)).NotTo(HaveOccurred())
+			err := instance.WaitForSync(ctx)
 			Expect(err).To(HaveOccurred())
 			Expect(err.Error()).To(Equal("cache did not sync"))
 
@@ -254,7 +254,7 @@ var _ = Describe("Source", func() {
 	})
 
 	Describe("Func", func() {
-		It("should be called from Start", func() {
+		It("should be called from Start", func(ctx SpecContext) {
 			run := false
 			instance := source.Func(func(
 				context.Context,
@@ -276,22 +276,18 @@ var _ = Describe("Source", func() {
 	})
 
 	Describe("Channel", func() {
-		var ctx context.Context
-		var cancel context.CancelFunc
 		var ch chan event.GenericEvent
 
 		BeforeEach(func() {
-			ctx, cancel = context.WithCancel(context.Background())
 			ch = make(chan event.GenericEvent)
 		})
 
 		AfterEach(func() {
-			cancel()
 			close(ch)
 		})
 
 		Context("for a source", func() {
-			It("should provide a GenericEvent", func() {
+			It("should provide a GenericEvent", func(ctx SpecContext) {
 				ch := make(chan event.GenericEvent)
 				c := make(chan struct{})
 				p := &corev1.Pod{
@@ -348,7 +344,7 @@ var _ = Describe("Source", func() {
 				ch <- evt
 				<-c
 			})
-			It("should get pending events processed once channel unblocked", func() {
+			It("should get pending events processed once channel unblocked", func(ctx SpecContext) {
 				ch := make(chan event.GenericEvent)
 				unblock := make(chan struct{})
 				processed := make(chan struct{})
@@ -411,7 +407,7 @@ var _ = Describe("Source", func() {
 				// Validate all of the events have been processed.
 				Expect(eventCount).To(Equal(3))
 			})
-			It("should be able to cope with events in the channel before the source is started", func() {
+			It("should be able to cope with events in the channel before the source is started", func(ctx SpecContext) {
 				ch := make(chan event.GenericEvent, 1)
 				processed := make(chan struct{})
 				evt := event.GenericEvent{}
@@ -451,7 +447,7 @@ var _ = Describe("Source", func() {
 
 				<-processed
 			})
-			It("should stop when the source channel is closed", func() {
+			It("should stop when the source channel is closed", func(ctx SpecContext) {
 				q := workqueue.NewTypedRateLimitingQueueWithConfig(
 					workqueue.DefaultTypedControllerRateLimiter[reconcile.Request](),
 					workqueue.TypedRateLimitingQueueConfig[reconcile.Request]{
@@ -500,7 +496,7 @@ var _ = Describe("Source", func() {
 				Eventually(processed).Should(Receive())
 				Consistently(processed).ShouldNot(Receive())
 			})
-			It("should get error if no source specified", func() {
+			It("should get error if no source specified", func(ctx SpecContext) {
 				q := workqueue.NewTypedRateLimitingQueueWithConfig(
 					workqueue.DefaultTypedControllerRateLimiter[reconcile.Request](),
 					workqueue.TypedRateLimitingQueueConfig[reconcile.Request]{
diff --git a/pkg/webhook/admission/defaulter.go b/pkg/webhook/admission/defaulter.go
deleted file mode 100644
index efbbf60282..0000000000
--- a/pkg/webhook/admission/defaulter.go
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package admission
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-
-	admissionv1 "k8s.io/api/admission/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-// Defaulter defines functions for setting defaults on resources.
-// Deprecated: Ue CustomDefaulter instead.
-type Defaulter interface {
-	runtime.Object
-	Default()
-}
-
-// DefaultingWebhookFor creates a new Webhook for Defaulting the provided type.
-// Deprecated: Use WithCustomDefaulter instead.
-func DefaultingWebhookFor(scheme *runtime.Scheme, defaulter Defaulter) *Webhook {
-	return &Webhook{
-		Handler: &mutatingHandler{defaulter: defaulter, decoder: NewDecoder(scheme)},
-	}
-}
-
-type mutatingHandler struct {
-	defaulter Defaulter
-	decoder   Decoder
-}
-
-// Handle handles admission requests.
-func (h *mutatingHandler) Handle(ctx context.Context, req Request) Response {
-	if h.decoder == nil {
-		panic("decoder should never be nil")
-	}
-	if h.defaulter == nil {
-		panic("defaulter should never be nil")
-	}
-
-	// always skip when a DELETE operation received in mutation handler
-	// describe in https://github.com/kubernetes-sigs/controller-runtime/issues/1762
-	if req.Operation == admissionv1.Delete {
-		return Response{AdmissionResponse: admissionv1.AdmissionResponse{
-			Allowed: true,
-			Result: &metav1.Status{
-				Code: http.StatusOK,
-			},
-		}}
-	}
-
-	// Get the object in the request
-	obj := h.defaulter.DeepCopyObject().(Defaulter)
-	if err := h.decoder.Decode(req, obj); err != nil {
-		return Errored(http.StatusBadRequest, err)
-	}
-
-	// Default the object
-	obj.Default()
-	marshalled, err := json.Marshal(obj)
-	if err != nil {
-		return Errored(http.StatusInternalServerError, err)
-	}
-
-	// Create the patch
-	return PatchResponseFromRaw(req.Object.Raw, marshalled)
-}
diff --git a/pkg/webhook/admission/defaulter_custom.go b/pkg/webhook/admission/defaulter_custom.go
index d15dec7a05..a703cbd2c5 100644
--- a/pkg/webhook/admission/defaulter_custom.go
+++ b/pkg/webhook/admission/defaulter_custom.go
@@ -21,11 +21,14 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
+	"slices"
 
+	"gomodules.xyz/jsonpatch/v2"
 	admissionv1 "k8s.io/api/admission/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
 )
 
 // CustomDefaulter defines functions for setting defaults on resources.
@@ -33,17 +36,41 @@ type CustomDefaulter interface {
 	Default(ctx context.Context, obj runtime.Object) error
 }
 
+type defaulterOptions struct {
+	removeUnknownOrOmitableFields bool
+}
+
+// DefaulterOption defines the type of a CustomDefaulter's option
+type DefaulterOption func(*defaulterOptions)
+
+// DefaulterRemoveUnknownOrOmitableFields makes the defaulter prune fields that are in the json object retrieved by the
+// webhook but not in the local go type json representation. This happens for example when the CRD in the apiserver has
+// fields that our go type doesn't know about, because it's outdated, or the field has a zero value and is `omitempty`.
+func DefaulterRemoveUnknownOrOmitableFields(o *defaulterOptions) {
+	o.removeUnknownOrOmitableFields = true
+}
+
 // WithCustomDefaulter creates a new Webhook for a CustomDefaulter interface.
-func WithCustomDefaulter(scheme *runtime.Scheme, obj runtime.Object, defaulter CustomDefaulter) *Webhook {
+func WithCustomDefaulter(scheme *runtime.Scheme, obj runtime.Object, defaulter CustomDefaulter, opts ...DefaulterOption) *Webhook {
+	options := &defaulterOptions{}
+	for _, o := range opts {
+		o(options)
+	}
 	return &Webhook{
-		Handler: &defaulterForType{object: obj, defaulter: defaulter, decoder: NewDecoder(scheme)},
+		Handler: &defaulterForType{
+			object:                        obj,
+			defaulter:                     defaulter,
+			decoder:                       NewDecoder(scheme),
+			removeUnknownOrOmitableFields: options.removeUnknownOrOmitableFields,
+		},
 	}
 }
 
 type defaulterForType struct {
-	defaulter CustomDefaulter
-	object    runtime.Object
-	decoder   Decoder
+	defaulter                     CustomDefaulter
+	object                        runtime.Object
+	decoder                       Decoder
+	removeUnknownOrOmitableFields bool
 }
 
 // Handle handles admission requests.
@@ -76,6 +103,12 @@ func (h *defaulterForType) Handle(ctx context.Context, req Request) Response {
 		return Errored(http.StatusBadRequest, err)
 	}
 
+	// Keep a copy of the object if needed
+	var originalObj runtime.Object
+	if !h.removeUnknownOrOmitableFields {
+		originalObj = obj.DeepCopyObject()
+	}
+
 	// Default the object
 	if err := h.defaulter.Default(ctx, obj); err != nil {
 		var apiStatus apierrors.APIStatus
@@ -90,5 +123,43 @@ func (h *defaulterForType) Handle(ctx context.Context, req Request) Response {
 	if err != nil {
 		return Errored(http.StatusInternalServerError, err)
 	}
-	return PatchResponseFromRaw(req.Object.Raw, marshalled)
+
+	handlerResponse := PatchResponseFromRaw(req.Object.Raw, marshalled)
+	if !h.removeUnknownOrOmitableFields {
+		handlerResponse = h.dropSchemeRemovals(handlerResponse, originalObj, req.Object.Raw)
+	}
+	return handlerResponse
+}
+
+func (h *defaulterForType) dropSchemeRemovals(r Response, original runtime.Object, raw []byte) Response {
+	const opRemove = "remove"
+	if !r.Allowed || r.PatchType == nil {
+		return r
+	}
+
+	// If we don't have removals in the patch.
+	if !slices.ContainsFunc(r.Patches, func(o jsonpatch.JsonPatchOperation) bool { return o.Operation == opRemove }) {
+		return r
+	}
+
+	// Get the raw to original patch
+	marshalledOriginal, err := json.Marshal(original)
+	if err != nil {
+		return Errored(http.StatusInternalServerError, err)
+	}
+
+	patchOriginal, err := jsonpatch.CreatePatch(raw, marshalledOriginal)
+	if err != nil {
+		return Errored(http.StatusInternalServerError, err)
+	}
+	removedByScheme := sets.New(slices.DeleteFunc(patchOriginal, func(p jsonpatch.JsonPatchOperation) bool { return p.Operation != opRemove })...)
+
+	r.Patches = slices.DeleteFunc(r.Patches, func(p jsonpatch.JsonPatchOperation) bool {
+		return p.Operation == opRemove && removedByScheme.Has(p)
+	})
+
+	if len(r.Patches) == 0 {
+		r.PatchType = nil
+	}
+	return r
 }
diff --git a/pkg/webhook/admission/defaulter_custom_test.go b/pkg/webhook/admission/defaulter_custom_test.go
new file mode 100644
index 0000000000..1bc26e59f4
--- /dev/null
+++ b/pkg/webhook/admission/defaulter_custom_test.go
@@ -0,0 +1,169 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package admission
+
+import (
+	"context"
+	"maps"
+	"net/http"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"gomodules.xyz/jsonpatch/v2"
+
+	admissionv1 "k8s.io/api/admission/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var _ = Describe("Defaulter Handler", func() {
+
+	It("should remove unknown fields when DefaulterRemoveUnknownFields is passed", func(ctx SpecContext) {
+		obj := &TestDefaulter{}
+		handler := WithCustomDefaulter(admissionScheme, obj, &TestCustomDefaulter{}, DefaulterRemoveUnknownOrOmitableFields)
+
+		resp := handler.Handle(ctx, Request{
+			AdmissionRequest: admissionv1.AdmissionRequest{
+				Operation: admissionv1.Create,
+				Object: runtime.RawExtension{
+					Raw: []byte(`{"newField":"foo", "totalReplicas":5}`),
+				},
+			},
+		})
+		Expect(resp.Allowed).Should(BeTrue())
+		Expect(resp.Patches).To(HaveLen(4))
+		Expect(resp.Patches).To(ContainElements(
+			jsonpatch.JsonPatchOperation{
+				Operation: "add",
+				Path:      "/labels",
+				Value:     map[string]any{"foo": "bar"},
+			},
+			jsonpatch.JsonPatchOperation{
+				Operation: "add",
+				Path:      "/replica",
+				Value:     2.0,
+			},
+			jsonpatch.JsonPatchOperation{
+				Operation: "remove",
+				Path:      "/newField",
+			},
+			jsonpatch.JsonPatchOperation{
+				Operation: "remove",
+				Path:      "/totalReplicas",
+			},
+		))
+		Expect(resp.Result.Code).Should(Equal(int32(http.StatusOK)))
+	})
+
+	It("should preserve unknown fields by default", func(ctx SpecContext) {
+		obj := &TestDefaulter{}
+		handler := WithCustomDefaulter(admissionScheme, obj, &TestCustomDefaulter{})
+
+		resp := handler.Handle(ctx, Request{
+			AdmissionRequest: admissionv1.AdmissionRequest{
+				Operation: admissionv1.Create,
+				Object: runtime.RawExtension{
+					Raw: []byte(`{"newField":"foo", "totalReplicas":5}`),
+				},
+			},
+		})
+		Expect(resp.Allowed).Should(BeTrue())
+		Expect(resp.Patches).To(HaveLen(3))
+		Expect(resp.Patches).To(ContainElements(
+			jsonpatch.JsonPatchOperation{
+				Operation: "add",
+				Path:      "/labels",
+				Value:     map[string]any{"foo": "bar"},
+			},
+			jsonpatch.JsonPatchOperation{
+				Operation: "add",
+				Path:      "/replica",
+				Value:     2.0,
+			},
+			jsonpatch.JsonPatchOperation{
+				Operation: "remove",
+				Path:      "/totalReplicas",
+			},
+		))
+		Expect(resp.Result.Code).Should(Equal(int32(http.StatusOK)))
+	})
+
+	It("should return ok if received delete verb in defaulter handler", func(ctx SpecContext) {
+		obj := &TestDefaulter{}
+		handler := WithCustomDefaulter(admissionScheme, obj, &TestCustomDefaulter{})
+		resp := handler.Handle(ctx, Request{
+			AdmissionRequest: admissionv1.AdmissionRequest{
+				Operation: admissionv1.Delete,
+				OldObject: runtime.RawExtension{
+					Raw: []byte("{}"),
+				},
+			},
+		})
+		Expect(resp.Allowed).Should(BeTrue())
+		Expect(resp.Result.Code).Should(Equal(int32(http.StatusOK)))
+	})
+})
+
+// TestDefaulter.
+var _ runtime.Object = &TestDefaulter{}
+
+type TestDefaulter struct {
+	Labels map[string]string `json:"labels,omitempty"`
+
+	Replica       int `json:"replica,omitempty"`
+	TotalReplicas int `json:"totalReplicas,omitempty"`
+}
+
+var testDefaulterGVK = schema.GroupVersionKind{Group: "foo.test.org", Version: "v1", Kind: "TestDefaulter"}
+
+func (d *TestDefaulter) GetObjectKind() schema.ObjectKind { return d }
+func (d *TestDefaulter) DeepCopyObject() runtime.Object {
+	return &TestDefaulter{
+		Labels:        maps.Clone(d.Labels),
+		Replica:       d.Replica,
+		TotalReplicas: d.TotalReplicas,
+	}
+}
+
+func (d *TestDefaulter) GroupVersionKind() schema.GroupVersionKind {
+	return testDefaulterGVK
+}
+
+func (d *TestDefaulter) SetGroupVersionKind(gvk schema.GroupVersionKind) {}
+
+var _ runtime.Object = &TestDefaulterList{}
+
+type TestDefaulterList struct{}
+
+func (*TestDefaulterList) GetObjectKind() schema.ObjectKind { return nil }
+func (*TestDefaulterList) DeepCopyObject() runtime.Object   { return nil }
+
+// TestCustomDefaulter
+type TestCustomDefaulter struct{}
+
+func (d *TestCustomDefaulter) Default(ctx context.Context, obj runtime.Object) error {
+	o := obj.(*TestDefaulter)
+
+	if o.Labels == nil {
+		o.Labels = map[string]string{}
+	}
+	o.Labels["foo"] = "bar"
+
+	if o.Replica < 2 {
+		o.Replica = 2
+	}
+	o.TotalReplicas = 0
+	return nil
+}
diff --git a/pkg/webhook/admission/defaulter_test.go b/pkg/webhook/admission/defaulter_test.go
deleted file mode 100644
index cf7571663c..0000000000
--- a/pkg/webhook/admission/defaulter_test.go
+++ /dev/null
@@ -1,68 +0,0 @@
-package admission
-
-import (
-	"context"
-	"net/http"
-
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-
-	admissionv1 "k8s.io/api/admission/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-)
-
-var _ = Describe("Defaulter Handler", func() {
-
-	It("should return ok if received delete verb in defaulter handler", func() {
-		obj := &TestDefaulter{}
-		handler := DefaultingWebhookFor(admissionScheme, obj)
-
-		resp := handler.Handle(context.TODO(), Request{
-			AdmissionRequest: admissionv1.AdmissionRequest{
-				Operation: admissionv1.Delete,
-				OldObject: runtime.RawExtension{
-					Raw: []byte("{}"),
-				},
-			},
-		})
-		Expect(resp.Allowed).Should(BeTrue())
-		Expect(resp.Result.Code).Should(Equal(int32(http.StatusOK)))
-	})
-
-})
-
-// TestDefaulter.
-var _ runtime.Object = &TestDefaulter{}
-
-type TestDefaulter struct {
-	Replica int `json:"replica,omitempty"`
-}
-
-var testDefaulterGVK = schema.GroupVersionKind{Group: "foo.test.org", Version: "v1", Kind: "TestDefaulter"}
-
-func (d *TestDefaulter) GetObjectKind() schema.ObjectKind { return d }
-func (d *TestDefaulter) DeepCopyObject() runtime.Object {
-	return &TestDefaulter{
-		Replica: d.Replica,
-	}
-}
-
-func (d *TestDefaulter) GroupVersionKind() schema.GroupVersionKind {
-	return testDefaulterGVK
-}
-
-func (d *TestDefaulter) SetGroupVersionKind(gvk schema.GroupVersionKind) {}
-
-var _ runtime.Object = &TestDefaulterList{}
-
-type TestDefaulterList struct{}
-
-func (*TestDefaulterList) GetObjectKind() schema.ObjectKind { return nil }
-func (*TestDefaulterList) DeepCopyObject() runtime.Object   { return nil }
-
-func (d *TestDefaulter) Default() {
-	if d.Replica < 2 {
-		d.Replica = 2
-	}
-}
diff --git a/pkg/webhook/admission/http_test.go b/pkg/webhook/admission/http_test.go
index 86f35ac882..9cea9dd9e7 100644
--- a/pkg/webhook/admission/http_test.go
+++ b/pkg/webhook/admission/http_test.go
@@ -156,7 +156,7 @@ var _ = Describe("Admission Webhooks", func() {
 			Expect(respRecorder.Body.String()).To(Equal(expected))
 		})
 
-		It("should present the Context from the HTTP request, if any", func() {
+		It("should present the Context from the HTTP request, if any", func(specCtx SpecContext) {
 			req := &http.Request{
 				Header: http.Header{"Content-Type": []string{"application/json"}},
 				Body:   nopCloser{Reader: bytes.NewBufferString(`{"request":{}}`)},
@@ -176,13 +176,13 @@ var _ = Describe("Admission Webhooks", func() {
 			expected := fmt.Sprintf(`{%s,"response":{"uid":"","allowed":true,"status":{"metadata":{},"message":%q,"code":200}}}
 `, gvkJSONv1, value)
 
-			ctx, cancel := context.WithCancel(context.WithValue(context.Background(), key, value))
+			ctx, cancel := context.WithCancel(context.WithValue(specCtx, key, value))
 			cancel()
 			webhook.ServeHTTP(respRecorder, req.WithContext(ctx))
 			Expect(respRecorder.Body.String()).To(Equal(expected))
 		})
 
-		It("should mutate the Context from the HTTP request, if func supplied", func() {
+		It("should mutate the Context from the HTTP request, if func supplied", func(specCtx SpecContext) {
 			req := &http.Request{
 				Header: http.Header{"Content-Type": []string{"application/json"}},
 				Body:   nopCloser{Reader: bytes.NewBufferString(`{"request":{}}`)},
@@ -203,7 +203,7 @@ var _ = Describe("Admission Webhooks", func() {
 			expected := fmt.Sprintf(`{%s,"response":{"uid":"","allowed":true,"status":{"metadata":{},"message":%q,"code":200}}}
 `, gvkJSONv1, "application/json")
 
-			ctx, cancel := context.WithCancel(context.Background())
+			ctx, cancel := context.WithCancel(specCtx)
 			cancel()
 			webhook.ServeHTTP(respRecorder, req.WithContext(ctx))
 			Expect(respRecorder.Body.String()).To(Equal(expected))
diff --git a/pkg/webhook/admission/multi.go b/pkg/webhook/admission/multi.go
index 2f7820d04b..ef9c456248 100644
--- a/pkg/webhook/admission/multi.go
+++ b/pkg/webhook/admission/multi.go
@@ -31,6 +31,7 @@ type multiMutating []Handler
 
 func (hs multiMutating) Handle(ctx context.Context, req Request) Response {
 	patches := []jsonpatch.JsonPatchOperation{}
+	warnings := []string{}
 	for _, handler := range hs {
 		resp := handler.Handle(ctx, req)
 		if !resp.Allowed {
@@ -42,6 +43,7 @@ func (hs multiMutating) Handle(ctx context.Context, req Request) Response {
 					resp.PatchType, admissionv1.PatchTypeJSONPatch))
 		}
 		patches = append(patches, resp.Patches...)
+		warnings = append(warnings, resp.Warnings...)
 	}
 	var err error
 	marshaledPatch, err := json.Marshal(patches)
@@ -55,6 +57,7 @@ func (hs multiMutating) Handle(ctx context.Context, req Request) Response {
 				Code: http.StatusOK,
 			},
 			Patch:     marshaledPatch,
+			Warnings:  warnings,
 			PatchType: func() *admissionv1.PatchType { pt := admissionv1.PatchTypeJSONPatch; return &pt }(),
 		},
 	}
@@ -71,11 +74,13 @@ func MultiMutatingHandler(handlers ...Handler) Handler {
 type multiValidating []Handler
 
 func (hs multiValidating) Handle(ctx context.Context, req Request) Response {
+	warnings := []string{}
 	for _, handler := range hs {
 		resp := handler.Handle(ctx, req)
 		if !resp.Allowed {
 			return resp
 		}
+		warnings = append(warnings, resp.Warnings...)
 	}
 	return Response{
 		AdmissionResponse: admissionv1.AdmissionResponse{
@@ -83,6 +88,7 @@ func (hs multiValidating) Handle(ctx context.Context, req Request) Response {
 			Result: &metav1.Status{
 				Code: http.StatusOK,
 			},
+			Warnings: warnings,
 		},
 	}
 }
diff --git a/pkg/webhook/admission/multi_test.go b/pkg/webhook/admission/multi_test.go
index da85a52e42..888836ed67 100644
--- a/pkg/webhook/admission/multi_test.go
+++ b/pkg/webhook/admission/multi_test.go
@@ -46,23 +46,46 @@ var _ = Describe("Multi-Handler Admission Webhooks", func() {
 		},
 	}
 
+	withWarnings := &fakeHandler{
+		fn: func(ctx context.Context, req Request) Response {
+			return Response{
+				AdmissionResponse: admissionv1.AdmissionResponse{
+					Allowed:  true,
+					Warnings: []string{"handler-warning"},
+				},
+			}
+		},
+	}
+
 	Context("with validating handlers", func() {
-		It("should deny the request if any handler denies the request", func() {
+		It("should deny the request if any handler denies the request", func(ctx SpecContext) {
 			By("setting up a handler with accept and deny")
 			handler := MultiValidatingHandler(alwaysAllow, alwaysDeny)
 
 			By("checking that the handler denies the request")
-			resp := handler.Handle(context.Background(), Request{})
+			resp := handler.Handle(ctx, Request{})
 			Expect(resp.Allowed).To(BeFalse())
+			Expect(resp.Warnings).To(BeEmpty())
 		})
 
-		It("should allow the request if all handlers allow the request", func() {
+		It("should allow the request if all handlers allow the request", func(ctx SpecContext) {
 			By("setting up a handler with only accept")
 			handler := MultiValidatingHandler(alwaysAllow, alwaysAllow)
 
 			By("checking that the handler allows the request")
-			resp := handler.Handle(context.Background(), Request{})
+			resp := handler.Handle(ctx, Request{})
 			Expect(resp.Allowed).To(BeTrue())
+			Expect(resp.Warnings).To(BeEmpty())
+		})
+
+		It("should show the warnings if all handlers allow the request", func(ctx SpecContext) {
+			By("setting up a handler with only accept")
+			handler := MultiValidatingHandler(alwaysAllow, withWarnings)
+
+			By("checking that the handler allows the request")
+			resp := handler.Handle(ctx, Request{})
+			Expect(resp.Allowed).To(BeTrue())
+			Expect(resp.Warnings).To(HaveLen(1))
 		})
 	})
 
@@ -107,26 +130,60 @@ var _ = Describe("Multi-Handler Admission Webhooks", func() {
 			},
 		}
 
-		It("should not return any patches if the request is denied", func() {
+		patcher3 := &fakeHandler{
+			fn: func(ctx context.Context, req Request) Response {
+				return Response{
+					Patches: []jsonpatch.JsonPatchOperation{
+						{
+							Operation: "add",
+							Path:      "/metadata/annotation/newest-key",
+							Value:     "value",
+						},
+					},
+					AdmissionResponse: admissionv1.AdmissionResponse{
+						Allowed:   true,
+						Warnings:  []string{"annotation-warning"},
+						PatchType: func() *admissionv1.PatchType { pt := admissionv1.PatchTypeJSONPatch; return &pt }(),
+					},
+				}
+			},
+		}
+
+		It("should not return any patches if the request is denied", func(ctx SpecContext) {
 			By("setting up a webhook with some patches and a deny")
 			handler := MultiMutatingHandler(patcher1, patcher2, alwaysDeny)
 
 			By("checking that the handler denies the request and produces no patches")
-			resp := handler.Handle(context.Background(), Request{})
+			resp := handler.Handle(ctx, Request{})
 			Expect(resp.Allowed).To(BeFalse())
 			Expect(resp.Patches).To(BeEmpty())
 		})
 
-		It("should produce all patches if the requests are all allowed", func() {
+		It("should produce all patches if the requests are all allowed", func(ctx SpecContext) {
 			By("setting up a webhook with some patches")
 			handler := MultiMutatingHandler(patcher1, patcher2, alwaysAllow)
 
 			By("checking that the handler accepts the request and returns all patches")
-			resp := handler.Handle(context.Background(), Request{})
+			resp := handler.Handle(ctx, Request{})
 			Expect(resp.Allowed).To(BeTrue())
 			Expect(resp.Patch).To(Equal([]byte(
 				`[{"op":"add","path":"/metadata/annotation/new-key","value":"new-value"},` +
 					`{"op":"replace","path":"/spec/replicas","value":"2"},{"op":"add","path":"/metadata/annotation/hello","value":"world"}]`)))
 		})
+
+		It("should produce all patches if the requests are all allowed and show warnings", func(ctx SpecContext) {
+			By("setting up a webhook with some patches")
+			handler := MultiMutatingHandler(patcher1, patcher2, alwaysAllow, patcher3)
+
+			By("checking that the handler accepts the request and returns all patches")
+			resp := handler.Handle(ctx, Request{})
+			Expect(resp.Allowed).To(BeTrue())
+			Expect(resp.Patch).To(Equal([]byte(
+				`[{"op":"add","path":"/metadata/annotation/new-key","value":"new-value"},` +
+					`{"op":"replace","path":"/spec/replicas","value":"2"},{"op":"add","path":"/metadata/annotation/hello","value":"world"},` +
+					`{"op":"add","path":"/metadata/annotation/newest-key","value":"value"}]`)))
+			Expect(resp.Warnings).To(HaveLen(1))
+		})
+
 	})
 })
diff --git a/pkg/webhook/admission/validator.go b/pkg/webhook/admission/validator.go
deleted file mode 100644
index b28a56eef8..0000000000
--- a/pkg/webhook/admission/validator.go
+++ /dev/null
@@ -1,127 +0,0 @@
-/*
-Copyright 2018 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package admission
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/http"
-
-	v1 "k8s.io/api/admission/v1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-// Warnings represents warning messages.
-type Warnings []string
-
-// Validator defines functions for validating an operation.
-// The custom resource kind which implements this interface can validate itself.
-// To validate the custom resource with another specific struct, use CustomValidator instead.
-// Deprecated: Use CustomValidator instead.
-type Validator interface {
-	runtime.Object
-
-	// ValidateCreate validates the object on creation.
-	// The optional warnings will be added to the response as warning messages.
-	// Return an error if the object is invalid.
-	ValidateCreate() (warnings Warnings, err error)
-
-	// ValidateUpdate validates the object on update. The oldObj is the object before the update.
-	// The optional warnings will be added to the response as warning messages.
-	// Return an error if the object is invalid.
-	ValidateUpdate(old runtime.Object) (warnings Warnings, err error)
-
-	// ValidateDelete validates the object on deletion.
-	// The optional warnings will be added to the response as warning messages.
-	// Return an error if the object is invalid.
-	ValidateDelete() (warnings Warnings, err error)
-}
-
-// ValidatingWebhookFor creates a new Webhook for validating the provided type.
-// Deprecated: Use WithCustomValidator instead.
-func ValidatingWebhookFor(scheme *runtime.Scheme, validator Validator) *Webhook {
-	return &Webhook{
-		Handler: &validatingHandler{validator: validator, decoder: NewDecoder(scheme)},
-	}
-}
-
-type validatingHandler struct {
-	validator Validator
-	decoder   Decoder
-}
-
-// Handle handles admission requests.
-func (h *validatingHandler) Handle(ctx context.Context, req Request) Response {
-	if h.decoder == nil {
-		panic("decoder should never be nil")
-	}
-	if h.validator == nil {
-		panic("validator should never be nil")
-	}
-	// Get the object in the request
-	obj := h.validator.DeepCopyObject().(Validator)
-
-	var err error
-	var warnings []string
-
-	switch req.Operation {
-	case v1.Connect:
-		// No validation for connect requests.
-		// TODO(vincepri): Should we validate CONNECT requests? In what cases?
-	case v1.Create:
-		if err = h.decoder.Decode(req, obj); err != nil {
-			return Errored(http.StatusBadRequest, err)
-		}
-
-		warnings, err = obj.ValidateCreate()
-	case v1.Update:
-		oldObj := obj.DeepCopyObject()
-
-		err = h.decoder.DecodeRaw(req.Object, obj)
-		if err != nil {
-			return Errored(http.StatusBadRequest, err)
-		}
-		err = h.decoder.DecodeRaw(req.OldObject, oldObj)
-		if err != nil {
-			return Errored(http.StatusBadRequest, err)
-		}
-
-		warnings, err = obj.ValidateUpdate(oldObj)
-	case v1.Delete:
-		// In reference to PR: https://github.com/kubernetes/kubernetes/pull/76346
-		// OldObject contains the object being deleted
-		err = h.decoder.DecodeRaw(req.OldObject, obj)
-		if err != nil {
-			return Errored(http.StatusBadRequest, err)
-		}
-
-		warnings, err = obj.ValidateDelete()
-	default:
-		return Errored(http.StatusBadRequest, fmt.Errorf("unknown operation %q", req.Operation))
-	}
-
-	if err != nil {
-		var apiStatus apierrors.APIStatus
-		if errors.As(err, &apiStatus) {
-			return validationResponseFromStatus(false, apiStatus.Status()).WithWarnings(warnings...)
-		}
-		return Denied(err.Error()).WithWarnings(warnings...)
-	}
-	return Allowed("").WithWarnings(warnings...)
-}
diff --git a/pkg/webhook/admission/validator_custom.go b/pkg/webhook/admission/validator_custom.go
index b8f194401e..ef1be52a8f 100644
--- a/pkg/webhook/admission/validator_custom.go
+++ b/pkg/webhook/admission/validator_custom.go
@@ -27,6 +27,9 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
+// Warnings represents warning messages.
+type Warnings []string
+
 // CustomValidator defines functions for validating an operation.
 // The object to be validated is passed into methods as a parameter.
 type CustomValidator interface {
diff --git a/pkg/webhook/admission/validator_test.go b/pkg/webhook/admission/validator_custom_test.go
similarity index 77%
rename from pkg/webhook/admission/validator_test.go
rename to pkg/webhook/admission/validator_custom_test.go
index 404fad9016..7c9615df71 100644
--- a/pkg/webhook/admission/validator_test.go
+++ b/pkg/webhook/admission/validator_custom_test.go
@@ -1,10 +1,8 @@
 /*
 Copyright 2021 The Kubernetes Authors.
-
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
-
     http://www.apache.org/licenses/LICENSE-2.0
 
 Unless required by applicable law or agreed to in writing, software
@@ -28,27 +26,25 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/client-go/kubernetes/scheme"
 )
 
 var fakeValidatorVK = schema.GroupVersionKind{Group: "foo.test.org", Version: "v1", Kind: "fakeValidator"}
 
-var _ = Describe("validatingHandler", func() {
-
-	decoder := NewDecoder(scheme.Scheme)
+var _ = Describe("customValidatingHandler", func() {
 
 	Context("when dealing with successful results without warning", func() {
-		f := &fakeValidator{ErrorToReturn: nil, GVKToReturn: fakeValidatorVK, WarningsToReturn: nil}
-		handler := validatingHandler{validator: f, decoder: decoder}
+		val := &fakeCustomValidator{ErrorToReturn: nil, GVKToReturn: fakeValidatorVK, WarningsToReturn: nil}
+		f := &fakeValidator{}
+		handler := WithCustomValidator(admissionScheme, f, val)
 
-		It("should return 200 in response when create succeeds", func() {
+		It("should return 200 in response when create succeeds", func(ctx SpecContext) {
 
-			response := handler.Handle(context.TODO(), Request{
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Create,
 					Object: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -57,18 +53,18 @@ var _ = Describe("validatingHandler", func() {
 			Expect(response.Result.Code).Should(Equal(int32(http.StatusOK)))
 		})
 
-		It("should return 200 in response when update succeeds", func() {
+		It("should return 200 in response when update succeeds", func(ctx SpecContext) {
 
-			response := handler.Handle(context.TODO(), Request{
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Update,
 					Object: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 					OldObject: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -76,14 +72,14 @@ var _ = Describe("validatingHandler", func() {
 			Expect(response.Result.Code).Should(Equal(int32(http.StatusOK)))
 		})
 
-		It("should return 200 in response when delete succeeds", func() {
+		It("should return 200 in response when delete succeeds", func(ctx SpecContext) {
 
-			response := handler.Handle(context.TODO(), Request{
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Delete,
 					OldObject: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -95,19 +91,19 @@ var _ = Describe("validatingHandler", func() {
 	const warningMessage = "warning message"
 	const anotherWarningMessage = "another warning message"
 	Context("when dealing with successful results with warning", func() {
-		f := &fakeValidator{ErrorToReturn: nil, GVKToReturn: fakeValidatorVK, WarningsToReturn: []string{
+		f := &fakeValidator{}
+		val := &fakeCustomValidator{ErrorToReturn: nil, GVKToReturn: fakeValidatorVK, WarningsToReturn: []string{
 			warningMessage,
 			anotherWarningMessage,
 		}}
-		handler := validatingHandler{validator: f, decoder: decoder}
-
-		It("should return 200 in response when create succeeds, with warning messages", func() {
-			response := handler.Handle(context.TODO(), Request{
+		handler := WithCustomValidator(admissionScheme, f, val)
+		It("should return 200 in response when create succeeds, with warning messages", func(ctx SpecContext) {
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Create,
 					Object: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -118,18 +114,18 @@ var _ = Describe("validatingHandler", func() {
 			Expect(response.AdmissionResponse.Warnings).Should(ContainElement(anotherWarningMessage))
 		})
 
-		It("should return 200 in response when update succeeds, with warning messages", func() {
+		It("should return 200 in response when update succeeds, with warning messages", func(ctx SpecContext) {
 
-			response := handler.Handle(context.TODO(), Request{
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Update,
 					Object: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 					OldObject: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -139,14 +135,15 @@ var _ = Describe("validatingHandler", func() {
 			Expect(response.AdmissionResponse.Warnings).Should(ContainElement(anotherWarningMessage))
 		})
 
-		It("should return 200 in response when delete succeeds, with warning messages", func() {
+		It("should return 200 in response when delete succeeds, with warning messages", func(ctx SpecContext) {
 
-			response := handler.Handle(context.TODO(), Request{
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Delete,
 					OldObject: runtime.RawExtension{
-						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Raw: []byte("{}"),
+
+						Object: f,
 					},
 				},
 			})
@@ -165,17 +162,18 @@ var _ = Describe("validatingHandler", func() {
 				Code:    http.StatusUnprocessableEntity,
 			},
 		}
-		f := &fakeValidator{ErrorToReturn: expectedError, GVKToReturn: fakeValidatorVK, WarningsToReturn: []string{warningMessage, anotherWarningMessage}}
-		handler := validatingHandler{validator: f, decoder: decoder}
+		f := &fakeValidator{}
+		val := &fakeCustomValidator{ErrorToReturn: expectedError, GVKToReturn: fakeValidatorVK, WarningsToReturn: []string{warningMessage, anotherWarningMessage}}
+		handler := WithCustomValidator(admissionScheme, f, val)
 
-		It("should propagate the Status from ValidateCreate's return value to the HTTP response", func() {
+		It("should propagate the Status from ValidateCreate's return value to the HTTP response", func(ctx SpecContext) {
 
-			response := handler.Handle(context.TODO(), Request{
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Create,
 					Object: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -188,18 +186,19 @@ var _ = Describe("validatingHandler", func() {
 
 		})
 
-		It("should propagate the Status from ValidateUpdate's return value to the HTTP response", func() {
+		It("should propagate the Status from ValidateUpdate's return value to the HTTP response", func(ctx SpecContext) {
 
-			response := handler.Handle(context.TODO(), Request{
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Update,
 					Object: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 					OldObject: runtime.RawExtension{
-						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Raw: []byte("{}"),
+
+						Object: f,
 					},
 				},
 			})
@@ -212,14 +211,15 @@ var _ = Describe("validatingHandler", func() {
 
 		})
 
-		It("should propagate the Status from ValidateDelete's return value to the HTTP response", func() {
+		It("should propagate the Status from ValidateDelete's return value to the HTTP response", func(ctx SpecContext) {
 
-			response := handler.Handle(context.TODO(), Request{
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Delete,
+
 					OldObject: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -242,17 +242,19 @@ var _ = Describe("validatingHandler", func() {
 				Code:    http.StatusUnprocessableEntity,
 			},
 		}
-		f := &fakeValidator{ErrorToReturn: expectedError, GVKToReturn: fakeValidatorVK, WarningsToReturn: nil}
-		handler := validatingHandler{validator: f, decoder: decoder}
+		f := &fakeValidator{}
+		val := &fakeCustomValidator{ErrorToReturn: expectedError, GVKToReturn: fakeValidatorVK, WarningsToReturn: nil}
+		handler := WithCustomValidator(admissionScheme, f, val)
 
-		It("should propagate the Status from ValidateCreate's return value to the HTTP response", func() {
+		It("should propagate the Status from ValidateCreate's return value to the HTTP response", func(ctx SpecContext) {
+
+			response := handler.Handle(ctx, Request{
 
-			response := handler.Handle(context.TODO(), Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Create,
 					Object: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -263,18 +265,18 @@ var _ = Describe("validatingHandler", func() {
 
 		})
 
-		It("should propagate the Status from ValidateUpdate's return value to the HTTP response", func() {
+		It("should propagate the Status from ValidateUpdate's return value to the HTTP response", func(ctx SpecContext) {
 
-			response := handler.Handle(context.TODO(), Request{
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Update,
 					Object: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 					OldObject: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -285,20 +287,21 @@ var _ = Describe("validatingHandler", func() {
 
 		})
 
-		It("should propagate the Status from ValidateDelete's return value to the HTTP response", func() {
+		It("should propagate the Status from ValidateDelete's return value to the HTTP response", func(ctx SpecContext) {
 
-			response := handler.Handle(context.TODO(), Request{
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Delete,
 					OldObject: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
 
 			Expect(response.Allowed).Should(BeFalse())
 			Expect(response.Result.Code).Should(Equal(expectedError.Status().Code))
+
 			Expect(*response.Result).Should(Equal(expectedError.Status()))
 
 		})
@@ -308,17 +311,19 @@ var _ = Describe("validatingHandler", func() {
 	Context("when dealing with non-status errors, without warning messages", func() {
 
 		expectedError := errors.New("some error")
-		f := &fakeValidator{ErrorToReturn: expectedError, GVKToReturn: fakeValidatorVK}
-		handler := validatingHandler{validator: f, decoder: decoder}
+		f := &fakeValidator{}
+		val := &fakeCustomValidator{ErrorToReturn: expectedError, GVKToReturn: fakeValidatorVK}
+		handler := WithCustomValidator(admissionScheme, f, val)
+
+		It("should return 403 response when ValidateCreate with error message embedded", func(ctx SpecContext) {
 
-		It("should return 403 response when ValidateCreate with error message embedded", func() {
+			response := handler.Handle(ctx, Request{
 
-			response := handler.Handle(context.TODO(), Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Create,
 					Object: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -329,18 +334,19 @@ var _ = Describe("validatingHandler", func() {
 
 		})
 
-		It("should return 403 response when ValidateUpdate returns non-APIStatus error", func() {
+		It("should return 403 response when ValidateUpdate returns non-APIStatus error", func(ctx SpecContext) {
+
+			response := handler.Handle(ctx, Request{
 
-			response := handler.Handle(context.TODO(), Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Update,
 					Object: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 					OldObject: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -351,13 +357,13 @@ var _ = Describe("validatingHandler", func() {
 
 		})
 
-		It("should return 403 response when ValidateDelete returns non-APIStatus error", func() {
-			response := handler.Handle(context.TODO(), Request{
+		It("should return 403 response when ValidateDelete returns non-APIStatus error", func(ctx SpecContext) {
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Delete,
 					OldObject: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -371,21 +377,24 @@ var _ = Describe("validatingHandler", func() {
 	Context("when dealing with non-status errors, with warning messages", func() {
 
 		expectedError := errors.New("some error")
-		f := &fakeValidator{ErrorToReturn: expectedError, GVKToReturn: fakeValidatorVK, WarningsToReturn: []string{warningMessage, anotherWarningMessage}}
-		handler := validatingHandler{validator: f, decoder: decoder}
+		f := &fakeValidator{}
+		val := &fakeCustomValidator{ErrorToReturn: expectedError, GVKToReturn: fakeValidatorVK, WarningsToReturn: []string{warningMessage, anotherWarningMessage}}
+		handler := WithCustomValidator(admissionScheme, f, val)
 
-		It("should return 403 response when ValidateCreate with error message embedded", func() {
+		It("should return 403 response when ValidateCreate with error message embedded", func(ctx SpecContext) {
 
-			response := handler.Handle(context.TODO(), Request{
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
+
 					Operation: admissionv1.Create,
 					Object: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
 			Expect(response.Allowed).Should(BeFalse())
+
 			Expect(response.Result.Code).Should(Equal(int32(http.StatusForbidden)))
 			Expect(response.Result.Reason).Should(Equal(metav1.StatusReasonForbidden))
 			Expect(response.Result.Message).Should(Equal(expectedError.Error()))
@@ -393,18 +402,19 @@ var _ = Describe("validatingHandler", func() {
 			Expect(response.AdmissionResponse.Warnings).Should(ContainElement(anotherWarningMessage))
 		})
 
-		It("should return 403 response when ValidateUpdate returns non-APIStatus error", func() {
+		It("should return 403 response when ValidateUpdate returns non-APIStatus error", func(ctx SpecContext) {
 
-			response := handler.Handle(context.TODO(), Request{
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Update,
 					Object: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 					OldObject: runtime.RawExtension{
+
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -412,18 +422,19 @@ var _ = Describe("validatingHandler", func() {
 			Expect(response.Result.Code).Should(Equal(int32(http.StatusForbidden)))
 			Expect(response.Result.Reason).Should(Equal(metav1.StatusReasonForbidden))
 			Expect(response.Result.Message).Should(Equal(expectedError.Error()))
+
 			Expect(response.AdmissionResponse.Warnings).Should(ContainElement(warningMessage))
 			Expect(response.AdmissionResponse.Warnings).Should(ContainElement(anotherWarningMessage))
 
 		})
 
-		It("should return 403 response when ValidateDelete returns non-APIStatus error", func() {
-			response := handler.Handle(context.TODO(), Request{
+		It("should return 403 response when ValidateDelete returns non-APIStatus error", func(ctx SpecContext) {
+			response := handler.Handle(ctx, Request{
 				AdmissionRequest: admissionv1.AdmissionRequest{
 					Operation: admissionv1.Delete,
 					OldObject: runtime.RawExtension{
 						Raw:    []byte("{}"),
-						Object: handler.validator,
+						Object: f,
 					},
 				},
 			})
@@ -447,12 +458,12 @@ var _ = Describe("validatingHandler", func() {
 
 })
 
-// fakeValidator provides fake validating webhook functionality for testing
-// It implements the admission.Validator interface and
+// fakeCustomValidator provides fake validating webhook functionality for testing
+// It implements the admission.CustomValidator interface and
 // rejects all requests with the same configured error
 // or passes if ErrorToReturn is nil.
 // And it would always return configured warning messages WarningsToReturn.
-type fakeValidator struct {
+type fakeCustomValidator struct {
 	// ErrorToReturn is the error for which the fakeValidator rejects all requests
 	ErrorToReturn error `json:"errorToReturn,omitempty"`
 	// GVKToReturn is the GroupVersionKind that the webhook operates on
@@ -461,18 +472,23 @@ type fakeValidator struct {
 	WarningsToReturn []string
 }
 
-func (v *fakeValidator) ValidateCreate() (warnings Warnings, err error) {
+func (v *fakeCustomValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (warnings Warnings, err error) {
 	return v.WarningsToReturn, v.ErrorToReturn
 }
 
-func (v *fakeValidator) ValidateUpdate(old runtime.Object) (warnings Warnings, err error) {
+func (v *fakeCustomValidator) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (warnings Warnings, err error) {
 	return v.WarningsToReturn, v.ErrorToReturn
 }
 
-func (v *fakeValidator) ValidateDelete() (warnings Warnings, err error) {
+func (v *fakeCustomValidator) ValidateDelete(ctx context.Context, obj runtime.Object) (warnings Warnings, err error) {
 	return v.WarningsToReturn, v.ErrorToReturn
 }
 
+type fakeValidator struct {
+	// GVKToReturn is the GroupVersionKind that the webhook operates on
+	GVKToReturn schema.GroupVersionKind
+}
+
 func (v *fakeValidator) SetGroupVersionKind(gvk schema.GroupVersionKind) {
 	v.GVKToReturn = gvk
 }
@@ -487,8 +503,6 @@ func (v *fakeValidator) GetObjectKind() schema.ObjectKind {
 
 func (v *fakeValidator) DeepCopyObject() runtime.Object {
 	return &fakeValidator{
-		ErrorToReturn:    v.ErrorToReturn,
-		GVKToReturn:      v.GVKToReturn,
-		WarningsToReturn: v.WarningsToReturn,
+		GVKToReturn: v.GVKToReturn,
 	}
 }
diff --git a/pkg/webhook/admission/webhook_test.go b/pkg/webhook/admission/webhook_test.go
index 102988bc6e..5176077368 100644
--- a/pkg/webhook/admission/webhook_test.go
+++ b/pkg/webhook/admission/webhook_test.go
@@ -64,40 +64,40 @@ var _ = Describe("Admission Webhooks", func() {
 		return webhook
 	}
 
-	It("should invoke the handler to get a response", func() {
+	It("should invoke the handler to get a response", func(ctx SpecContext) {
 		By("setting up a webhook with an allow handler")
 		webhook := allowHandler()
 
 		By("invoking the webhook")
-		resp := webhook.Handle(context.Background(), Request{})
+		resp := webhook.Handle(ctx, Request{})
 
 		By("checking that it allowed the request")
 		Expect(resp.Allowed).To(BeTrue())
 	})
 
-	It("should ensure that the response's UID is set to the request's UID", func() {
+	It("should ensure that the response's UID is set to the request's UID", func(ctx SpecContext) {
 		By("setting up a webhook")
 		webhook := allowHandler()
 
 		By("invoking the webhook")
-		resp := webhook.Handle(context.Background(), Request{AdmissionRequest: admissionv1.AdmissionRequest{UID: "foobar"}})
+		resp := webhook.Handle(ctx, Request{AdmissionRequest: admissionv1.AdmissionRequest{UID: "foobar"}})
 
 		By("checking that the response share's the request's UID")
 		Expect(resp.UID).To(Equal(machinerytypes.UID("foobar")))
 	})
 
-	It("should populate the status on a response if one is not provided", func() {
+	It("should populate the status on a response if one is not provided", func(ctx SpecContext) {
 		By("setting up a webhook")
 		webhook := allowHandler()
 
 		By("invoking the webhook")
-		resp := webhook.Handle(context.Background(), Request{})
+		resp := webhook.Handle(ctx, Request{})
 
 		By("checking that the response share's the request's UID")
 		Expect(resp.Result).To(Equal(&metav1.Status{Code: http.StatusOK}))
 	})
 
-	It("shouldn't overwrite the status on a response", func() {
+	It("shouldn't overwrite the status on a response", func(ctx SpecContext) {
 		By("setting up a webhook that sets a status")
 		webhook := &Webhook{
 			Handler: HandlerFunc(func(ctx context.Context, req Request) Response {
@@ -111,14 +111,14 @@ var _ = Describe("Admission Webhooks", func() {
 		}
 
 		By("invoking the webhook")
-		resp := webhook.Handle(context.Background(), Request{})
+		resp := webhook.Handle(ctx, Request{})
 
 		By("checking that the message is intact")
 		Expect(resp.Result).NotTo(BeNil())
 		Expect(resp.Result.Message).To(Equal("Ground Control to Major Tom"))
 	})
 
-	It("should serialize patch operations into a single jsonpatch blob", func() {
+	It("should serialize patch operations into a single jsonpatch blob", func(ctx SpecContext) {
 		By("setting up a webhook with a patching handler")
 		webhook := &Webhook{
 			Handler: HandlerFunc(func(ctx context.Context, req Request) Response {
@@ -127,7 +127,7 @@ var _ = Describe("Admission Webhooks", func() {
 		}
 
 		By("invoking the webhook")
-		resp := webhook.Handle(context.Background(), Request{})
+		resp := webhook.Handle(ctx, Request{})
 
 		By("checking that a JSON patch is populated on the response")
 		patchType := admissionv1.PatchTypeJSONPatch
@@ -135,7 +135,7 @@ var _ = Describe("Admission Webhooks", func() {
 		Expect(resp.Patch).To(Equal([]byte(`[{"op":"add","path":"/a","value":2},{"op":"replace","path":"/b","value":4}]`)))
 	})
 
-	It("should pass a request logger via the context", func() {
+	It("should pass a request logger via the context", func(ctx SpecContext) {
 		By("setting up a webhook that uses the request logger")
 		webhook := &Webhook{
 			Handler: HandlerFunc(func(ctx context.Context, req Request) Response {
@@ -151,7 +151,7 @@ var _ = Describe("Admission Webhooks", func() {
 		}
 
 		By("invoking the webhook")
-		resp := webhook.Handle(context.Background(), Request{AdmissionRequest: admissionv1.AdmissionRequest{
+		resp := webhook.Handle(ctx, Request{AdmissionRequest: admissionv1.AdmissionRequest{
 			UID:       "test123",
 			Name:      "foo",
 			Namespace: "bar",
@@ -170,7 +170,7 @@ var _ = Describe("Admission Webhooks", func() {
 		Eventually(logBuffer).Should(gbytes.Say(`"msg":"Received request","object":{"name":"foo","namespace":"bar"},"namespace":"bar","name":"foo","resource":{"group":"apps","version":"v1","resource":"deployments"},"user":"tim","requestID":"test123"}`))
 	})
 
-	It("should pass a request logger created by LogConstructor via the context", func() {
+	It("should pass a request logger created by LogConstructor via the context", func(ctx SpecContext) {
 		By("setting up a webhook that uses the request logger")
 		webhook := &Webhook{
 			Handler: HandlerFunc(func(ctx context.Context, req Request) Response {
@@ -189,7 +189,7 @@ var _ = Describe("Admission Webhooks", func() {
 		}
 
 		By("invoking the webhook")
-		resp := webhook.Handle(context.Background(), Request{AdmissionRequest: admissionv1.AdmissionRequest{
+		resp := webhook.Handle(ctx, Request{AdmissionRequest: admissionv1.AdmissionRequest{
 			UID:       "test123",
 			Operation: admissionv1.Create,
 		}})
@@ -200,7 +200,7 @@ var _ = Describe("Admission Webhooks", func() {
 	})
 
 	Describe("panic recovery", func() {
-		It("should recover panic if RecoverPanic is true by default", func() {
+		It("should recover panic if RecoverPanic is true by default", func(ctx SpecContext) {
 			panicHandler := func() *Webhook {
 				handler := &fakeHandler{
 					fn: func(ctx context.Context, req Request) Response {
@@ -219,7 +219,7 @@ var _ = Describe("Admission Webhooks", func() {
 			webhook := panicHandler()
 
 			By("invoking the webhook")
-			resp := webhook.Handle(context.Background(), Request{})
+			resp := webhook.Handle(ctx, Request{})
 
 			By("checking that it errored the request")
 			Expect(resp.Allowed).To(BeFalse())
@@ -227,7 +227,7 @@ var _ = Describe("Admission Webhooks", func() {
 			Expect(resp.Result.Message).To(Equal("panic: fake panic test [recovered]"))
 		})
 
-		It("should recover panic if RecoverPanic is true", func() {
+		It("should recover panic if RecoverPanic is true", func(ctx SpecContext) {
 			panicHandler := func() *Webhook {
 				handler := &fakeHandler{
 					fn: func(ctx context.Context, req Request) Response {
@@ -246,7 +246,7 @@ var _ = Describe("Admission Webhooks", func() {
 			webhook := panicHandler()
 
 			By("invoking the webhook")
-			resp := webhook.Handle(context.Background(), Request{})
+			resp := webhook.Handle(ctx, Request{})
 
 			By("checking that it errored the request")
 			Expect(resp.Allowed).To(BeFalse())
@@ -254,7 +254,7 @@ var _ = Describe("Admission Webhooks", func() {
 			Expect(resp.Result.Message).To(Equal("panic: fake panic test [recovered]"))
 		})
 
-		It("should not recover panic if RecoverPanic is false", func() {
+		It("should not recover panic if RecoverPanic is false", func(ctx SpecContext) {
 			panicHandler := func() *Webhook {
 				handler := &fakeHandler{
 					fn: func(ctx context.Context, req Request) Response {
@@ -276,20 +276,19 @@ var _ = Describe("Admission Webhooks", func() {
 			webhook := panicHandler()
 
 			By("invoking the webhook")
-			webhook.Handle(context.Background(), Request{})
+			webhook.Handle(ctx, Request{})
 		})
 	})
 })
 
-var _ = Describe("Should be able to write/read admission.Request to/from context", func() {
-	ctx := context.Background()
+var _ = It("Should be able to write/read admission.Request to/from context", func(specContext SpecContext) {
 	testRequest := Request{
 		admissionv1.AdmissionRequest{
 			UID: "test-uid",
 		},
 	}
 
-	ctx = NewContextWithRequest(ctx, testRequest)
+	ctx := NewContextWithRequest(specContext, testRequest)
 
 	gotRequest, err := RequestFromContext(ctx)
 	Expect(err).To(Not(HaveOccurred()))
diff --git a/pkg/webhook/alias.go b/pkg/webhook/alias.go
index e8439e2ea2..2882e7bab3 100644
--- a/pkg/webhook/alias.go
+++ b/pkg/webhook/alias.go
@@ -23,14 +23,6 @@ import (
 
 // define some aliases for common bits of the webhook functionality
 
-// Defaulter defines functions for setting defaults on resources.
-// Deprecated: Use CustomDefaulter instead.
-type Defaulter = admission.Defaulter
-
-// Validator defines functions for validating an operation.
-// Deprecated: Use CustomValidator instead.
-type Validator = admission.Validator
-
 // CustomDefaulter defines functions for setting defaults on resources.
 type CustomDefaulter = admission.CustomDefaulter
 
diff --git a/pkg/webhook/authentication/http_test.go b/pkg/webhook/authentication/http_test.go
index 101b0c702d..e51b2af7e6 100644
--- a/pkg/webhook/authentication/http_test.go
+++ b/pkg/webhook/authentication/http_test.go
@@ -50,10 +50,10 @@ var _ = Describe("Authentication Webhooks", func() {
 		It("should return bad-request when given an empty body", func() {
 			req := &http.Request{Body: nil}
 
-			expected := `{"metadata":{"creationTimestamp":null},"spec":{},"status":{"user":{},"error":"request body is empty"}}
+			expected := `{"metadata":{},"spec":{},"status":{"user":{},"error":"request body is empty"}}
 `
 			webhook.ServeHTTP(respRecorder, req)
-			Expect(respRecorder.Body.String()).To(Equal(expected))
+			Expect(respRecorder.Body.String()).To(BeComparableTo(expected))
 		})
 
 		It("should return bad-request when given the wrong content-type", func() {
@@ -63,7 +63,7 @@ var _ = Describe("Authentication Webhooks", func() {
 				Body:   nopCloser{Reader: bytes.NewBuffer(nil)},
 			}
 
-			expected := `{"metadata":{"creationTimestamp":null},"spec":{},"status":{"user":{},"error":"contentType=application/foo, expected application/json"}}
+			expected := `{"metadata":{},"spec":{},"status":{"user":{},"error":"contentType=application/foo, expected application/json"}}
 `
 			webhook.ServeHTTP(respRecorder, req)
 			Expect(respRecorder.Body.String()).To(Equal(expected))
@@ -76,7 +76,7 @@ var _ = Describe("Authentication Webhooks", func() {
 				Body:   nopCloser{Reader: bytes.NewBufferString("{")},
 			}
 
-			expected := `{"metadata":{"creationTimestamp":null},"spec":{},"status":{"user":{},"error":"couldn't get version/kind; json parse error: unexpected end of JSON input"}}
+			expected := `{"metadata":{},"spec":{},"status":{"user":{},"error":"couldn't get version/kind; json parse error: unexpected end of JSON input"}}
 `
 			webhook.ServeHTTP(respRecorder, req)
 			Expect(respRecorder.Body.String()).To(Equal(expected))
@@ -89,7 +89,7 @@ var _ = Describe("Authentication Webhooks", func() {
 				Body:   nopCloser{Reader: bytes.NewBufferString(`{"spec":{"token":""}}`)},
 			}
 
-			expected := `{"metadata":{"creationTimestamp":null},"spec":{},"status":{"user":{},"error":"token is empty"}}
+			expected := `{"metadata":{},"spec":{},"status":{"user":{},"error":"token is empty"}}
 `
 			webhook.ServeHTTP(respRecorder, req)
 			Expect(respRecorder.Body.String()).To(Equal(expected))
@@ -102,7 +102,7 @@ var _ = Describe("Authentication Webhooks", func() {
 				Body:   http.NoBody,
 			}
 
-			expected := `{"metadata":{"creationTimestamp":null},"spec":{},"status":{"user":{},"error":"request body is empty"}}
+			expected := `{"metadata":{},"spec":{},"status":{"user":{},"error":"request body is empty"}}
 `
 			webhook.ServeHTTP(respRecorder, req)
 			Expect(respRecorder.Body.String()).To(Equal(expected))
@@ -115,7 +115,7 @@ var _ = Describe("Authentication Webhooks", func() {
 				Body:   nopCloser{Reader: rand.Reader},
 			}
 
-			expected := `{"metadata":{"creationTimestamp":null},"spec":{},"status":{"user":{},"error":"request entity is too large; limit is 1048576 bytes"}}
+			expected := `{"metadata":{},"spec":{},"status":{"user":{},"error":"request entity is too large; limit is 1048576 bytes"}}
 `
 			webhook.ServeHTTP(respRecorder, req)
 			Expect(respRecorder.Body.String()).To(Equal(expected))
@@ -131,7 +131,7 @@ var _ = Describe("Authentication Webhooks", func() {
 				Handler: &fakeHandler{},
 			}
 
-			expected := fmt.Sprintf(`{%s,"metadata":{"creationTimestamp":null},"spec":{},"status":{"authenticated":true,"user":{}}}
+			expected := fmt.Sprintf(`{%s,"metadata":{},"spec":{},"status":{"authenticated":true,"user":{}}}
 `, gvkJSONv1)
 
 			webhook.ServeHTTP(respRecorder, req)
@@ -148,13 +148,13 @@ var _ = Describe("Authentication Webhooks", func() {
 				Handler: &fakeHandler{},
 			}
 
-			expected := fmt.Sprintf(`{%s,"metadata":{"creationTimestamp":null},"spec":{},"status":{"authenticated":true,"user":{}}}
+			expected := fmt.Sprintf(`{%s,"metadata":{},"spec":{},"status":{"authenticated":true,"user":{}}}
 `, gvkJSONv1)
 			webhook.ServeHTTP(respRecorder, req)
 			Expect(respRecorder.Body.String()).To(Equal(expected))
 		})
 
-		It("should present the Context from the HTTP request, if any", func() {
+		It("should present the Context from the HTTP request, if any", func(specContext SpecContext) {
 			req := &http.Request{
 				Header: http.Header{"Content-Type": []string{"application/json"}},
 				Method: http.MethodPost,
@@ -172,16 +172,16 @@ var _ = Describe("Authentication Webhooks", func() {
 				},
 			}
 
-			expected := fmt.Sprintf(`{%s,"metadata":{"creationTimestamp":null},"spec":{},"status":{"authenticated":true,"user":{},"error":%q}}
+			expected := fmt.Sprintf(`{%s,"metadata":{},"spec":{},"status":{"authenticated":true,"user":{},"error":%q}}
 `, gvkJSONv1, value)
 
-			ctx, cancel := context.WithCancel(context.WithValue(context.Background(), key, value))
+			ctx, cancel := context.WithCancel(context.WithValue(specContext, key, value))
 			cancel()
 			webhook.ServeHTTP(respRecorder, req.WithContext(ctx))
 			Expect(respRecorder.Body.String()).To(Equal(expected))
 		})
 
-		It("should mutate the Context from the HTTP request, if func supplied", func() {
+		It("should mutate the Context from the HTTP request, if func supplied", func(specContext SpecContext) {
 			req := &http.Request{
 				Header: http.Header{"Content-Type": []string{"application/json"}},
 				Method: http.MethodPost,
@@ -200,10 +200,10 @@ var _ = Describe("Authentication Webhooks", func() {
 				},
 			}
 
-			expected := fmt.Sprintf(`{%s,"metadata":{"creationTimestamp":null},"spec":{},"status":{"authenticated":true,"user":{},"error":%q}}
+			expected := fmt.Sprintf(`{%s,"metadata":{},"spec":{},"status":{"authenticated":true,"user":{},"error":%q}}
 `, gvkJSONv1, "application/json")
 
-			ctx, cancel := context.WithCancel(context.Background())
+			ctx, cancel := context.WithCancel(specContext)
 			cancel()
 			webhook.ServeHTTP(respRecorder, req.WithContext(ctx))
 			Expect(respRecorder.Body.String()).To(Equal(expected))
diff --git a/pkg/webhook/authentication/webhook_test.go b/pkg/webhook/authentication/webhook_test.go
index 3df446d898..22c4e284cd 100644
--- a/pkg/webhook/authentication/webhook_test.go
+++ b/pkg/webhook/authentication/webhook_test.go
@@ -47,40 +47,40 @@ var _ = Describe("Authentication Webhooks", func() {
 		return webhook
 	}
 
-	It("should invoke the handler to get a response", func() {
+	It("should invoke the handler to get a response", func(ctx SpecContext) {
 		By("setting up a webhook with an allow handler")
 		webhook := allowHandler()
 
 		By("invoking the webhook")
-		resp := webhook.Handle(context.Background(), Request{})
+		resp := webhook.Handle(ctx, Request{})
 
 		By("checking that it allowed the request")
 		Expect(resp.Status.Authenticated).To(BeTrue())
 	})
 
-	It("should ensure that the response's UID is set to the request's UID", func() {
+	It("should ensure that the response's UID is set to the request's UID", func(ctx SpecContext) {
 		By("setting up a webhook")
 		webhook := allowHandler()
 
 		By("invoking the webhook")
-		resp := webhook.Handle(context.Background(), Request{TokenReview: authenticationv1.TokenReview{ObjectMeta: metav1.ObjectMeta{UID: "foobar"}}})
+		resp := webhook.Handle(ctx, Request{TokenReview: authenticationv1.TokenReview{ObjectMeta: metav1.ObjectMeta{UID: "foobar"}}})
 
 		By("checking that the response share's the request's UID")
 		Expect(resp.UID).To(Equal(machinerytypes.UID("foobar")))
 	})
 
-	It("should populate the status on a response if one is not provided", func() {
+	It("should populate the status on a response if one is not provided", func(ctx SpecContext) {
 		By("setting up a webhook")
 		webhook := allowHandler()
 
 		By("invoking the webhook")
-		resp := webhook.Handle(context.Background(), Request{})
+		resp := webhook.Handle(ctx, Request{})
 
 		By("checking that the response share's the request's UID")
 		Expect(resp.Status).To(Equal(authenticationv1.TokenReviewStatus{Authenticated: true}))
 	})
 
-	It("shouldn't overwrite the status on a response", func() {
+	It("shouldn't overwrite the status on a response", func(ctx SpecContext) {
 		By("setting up a webhook that sets a status")
 		webhook := &Webhook{
 			Handler: HandlerFunc(func(ctx context.Context, req Request) Response {
@@ -96,7 +96,7 @@ var _ = Describe("Authentication Webhooks", func() {
 		}
 
 		By("invoking the webhook")
-		resp := webhook.Handle(context.Background(), Request{})
+		resp := webhook.Handle(ctx, Request{})
 
 		By("checking that the message is intact")
 		Expect(resp.Status).NotTo(BeNil())
diff --git a/pkg/webhook/conversion/conversion.go b/pkg/webhook/conversion/conversion.go
index 249a364b38..a26fa348bb 100644
--- a/pkg/webhook/conversion/conversion.go
+++ b/pkg/webhook/conversion/conversion.go
@@ -22,7 +22,9 @@ See pkg/conversion for interface definitions required to ensure an API Type is c
 package conversion
 
 import (
+	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 
@@ -31,8 +33,10 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/conversion"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
+	conversionmetrics "sigs.k8s.io/controller-runtime/pkg/webhook/conversion/metrics"
 )
 
 var (
@@ -53,6 +57,8 @@ type webhook struct {
 var _ http.Handler = &webhook{}
 
 func (wh *webhook) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
 	convertReview := &apix.ConversionReview{}
 	err := json.NewDecoder(r.Body).Decode(convertReview)
 	if err != nil {
@@ -69,7 +75,7 @@ func (wh *webhook) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	// TODO(droot): may be move the conversion logic to a separate module to
 	// decouple it from the http layer ?
-	resp, err := wh.handleConvertRequest(convertReview.Request)
+	resp, err := wh.handleConvertRequest(ctx, convertReview.Request)
 	if err != nil {
 		log.Error(err, "failed to convert", "request", convertReview.Request.UID)
 		convertReview.Response = errored(err)
@@ -87,7 +93,18 @@ func (wh *webhook) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 // handles a version conversion request.
-func (wh *webhook) handleConvertRequest(req *apix.ConversionRequest) (*apix.ConversionResponse, error) {
+func (wh *webhook) handleConvertRequest(ctx context.Context, req *apix.ConversionRequest) (_ *apix.ConversionResponse, retErr error) {
+	defer func() {
+		if r := recover(); r != nil {
+			conversionmetrics.WebhookPanics.WithLabelValues().Inc()
+
+			for _, fn := range utilruntime.PanicHandlers {
+				fn(ctx, r)
+			}
+			retErr = errors.New("internal error occurred during conversion")
+			return
+		}
+	}()
 	if req == nil {
 		return nil, fmt.Errorf("conversion request is nil")
 	}
diff --git a/pkg/webhook/conversion/conversion_test.go b/pkg/webhook/conversion/conversion_test.go
index be984e232b..489689bccb 100644
--- a/pkg/webhook/conversion/conversion_test.go
+++ b/pkg/webhook/conversion/conversion_test.go
@@ -296,6 +296,29 @@ var _ = Describe("Conversion Webhook", func() {
 		Expect(convReview.Response.ConvertedObjects).To(BeEmpty())
 	})
 
+	It("should return error on panic in conversion", func() {
+
+		v1Obj := makeV1Obj()
+		v1Obj.Spec.PanicInConversion = true
+
+		convReq := &apix.ConversionReview{
+			TypeMeta: metav1.TypeMeta{},
+			Request: &apix.ConversionRequest{
+				DesiredAPIVersion: "jobs.testprojects.kb.io/v3",
+				Objects: []runtime.RawExtension{
+					{
+						Object: v1Obj,
+					},
+				},
+			},
+		}
+
+		convReview := doRequest(convReq)
+
+		Expect(convReview.Response.ConvertedObjects).To(HaveLen(0))
+		Expect(convReview.Response.Result.Status).To(Equal(metav1.StatusFailure))
+		Expect(convReview.Response.Result.Message).To(Equal("internal error occurred during conversion"))
+	})
 })
 
 var _ = Describe("IsConvertible", func() {
diff --git a/pkg/webhook/conversion/metrics/metrics.go b/pkg/webhook/conversion/metrics/metrics.go
new file mode 100644
index 0000000000..c825f17f0b
--- /dev/null
+++ b/pkg/webhook/conversion/metrics/metrics.go
@@ -0,0 +1,39 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package metrics
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+	"sigs.k8s.io/controller-runtime/pkg/metrics"
+)
+
+var (
+	// WebhookPanics is a prometheus counter metrics which holds the total
+	// number of panics from conversion webhooks.
+	WebhookPanics = prometheus.NewCounterVec(prometheus.CounterOpts{
+		Name: "controller_runtime_conversion_webhook_panics_total",
+		Help: "Total number of conversion webhook panics",
+	}, []string{})
+)
+
+func init() {
+	metrics.Registry.MustRegister(
+		WebhookPanics,
+	)
+	// Init metric.
+	WebhookPanics.WithLabelValues().Add(0)
+}
diff --git a/pkg/webhook/conversion/testdata/api/v1/externaljob_types.go b/pkg/webhook/conversion/testdata/api/v1/externaljob_types.go
index bf99e2a204..c6065e1fb4 100644
--- a/pkg/webhook/conversion/testdata/api/v1/externaljob_types.go
+++ b/pkg/webhook/conversion/testdata/api/v1/externaljob_types.go
@@ -17,6 +17,7 @@ package v1
 
 import (
 	"fmt"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/conversion"
 
@@ -31,6 +32,9 @@ type ExternalJobSpec struct {
 	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
 	// Important: Run "make" to regenerate code after modifying this file
 	RunAt string `json:"runAt"`
+
+	// PanicInConversion triggers a panic during conversion when set to true.
+	PanicInConversion bool `json:"panicInConversion"`
 }
 
 // ExternalJobStatus defines the observed state of ExternalJob
@@ -66,6 +70,9 @@ func init() {
 // ConvertTo implements conversion logic to convert to Hub type (v2.ExternalJob
 // in this case)
 func (ej *ExternalJob) ConvertTo(dst conversion.Hub) error {
+	if ej.Spec.PanicInConversion {
+		panic("PanicInConversion field set to true")
+	}
 	switch t := dst.(type) {
 	case *v2.ExternalJob:
 		jobv2 := dst.(*v2.ExternalJob)
@@ -80,6 +87,9 @@ func (ej *ExternalJob) ConvertTo(dst conversion.Hub) error {
 // ConvertFrom implements conversion logic to convert from Hub type (v2.ExternalJob
 // in this case)
 func (ej *ExternalJob) ConvertFrom(src conversion.Hub) error {
+	if ej.Spec.PanicInConversion {
+		panic("PanicInConversion field set to true")
+	}
 	switch t := src.(type) {
 	case *v2.ExternalJob:
 		jobv2 := src.(*v2.ExternalJob)
diff --git a/pkg/webhook/conversion/testdata/api/v1/zz_generated.deepcopy.go b/pkg/webhook/conversion/testdata/api/v1/zz_generated.deepcopy.go
index 7208ba8c69..af7396abf1 100644
--- a/pkg/webhook/conversion/testdata/api/v1/zz_generated.deepcopy.go
+++ b/pkg/webhook/conversion/testdata/api/v1/zz_generated.deepcopy.go
@@ -1,4 +1,4 @@
-// +build !ignore_autogenerated
+//go:build !ignore_autogenerated
 
 /*
 
@@ -15,7 +15,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// autogenerated by controller-gen object, do not modify manually
+// Code generated by controller-gen. DO NOT EDIT.
 
 package v1
 
@@ -54,7 +54,7 @@ func (in *ExternalJob) DeepCopyObject() runtime.Object {
 func (in *ExternalJobList) DeepCopyInto(out *ExternalJobList) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
-	out.ListMeta = in.ListMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
 		*out = make([]ExternalJob, len(*in))
diff --git a/pkg/webhook/conversion/testdata/api/v2/externaljob_types.go b/pkg/webhook/conversion/testdata/api/v2/externaljob_types.go
index de5a03a212..1f87e8a017 100644
--- a/pkg/webhook/conversion/testdata/api/v2/externaljob_types.go
+++ b/pkg/webhook/conversion/testdata/api/v2/externaljob_types.go
@@ -27,6 +27,9 @@ type ExternalJobSpec struct {
 	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
 	// Important: Run "make" to regenerate code after modifying this file
 	ScheduleAt string `json:"scheduleAt"`
+
+	// PanicInConversion triggers a panic during conversion when set to true.
+	PanicInConversion bool `json:"panicInConversion"`
 }
 
 // ExternalJobStatus defines the observed state of ExternalJob
diff --git a/pkg/webhook/conversion/testdata/api/v2/zz_generated.deepcopy.go b/pkg/webhook/conversion/testdata/api/v2/zz_generated.deepcopy.go
index 53c9f758b1..d5efd6150e 100644
--- a/pkg/webhook/conversion/testdata/api/v2/zz_generated.deepcopy.go
+++ b/pkg/webhook/conversion/testdata/api/v2/zz_generated.deepcopy.go
@@ -1,4 +1,4 @@
-// +build !ignore_autogenerated
+//go:build !ignore_autogenerated
 
 /*
 
@@ -15,7 +15,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// autogenerated by controller-gen object, do not modify manually
+// Code generated by controller-gen. DO NOT EDIT.
 
 package v2
 
@@ -54,7 +54,7 @@ func (in *ExternalJob) DeepCopyObject() runtime.Object {
 func (in *ExternalJobList) DeepCopyInto(out *ExternalJobList) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
-	out.ListMeta = in.ListMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
 		*out = make([]ExternalJob, len(*in))
diff --git a/pkg/webhook/conversion/testdata/api/v3/externaljob_types.go b/pkg/webhook/conversion/testdata/api/v3/externaljob_types.go
index 15c438f68a..85a166b7cf 100644
--- a/pkg/webhook/conversion/testdata/api/v3/externaljob_types.go
+++ b/pkg/webhook/conversion/testdata/api/v3/externaljob_types.go
@@ -17,6 +17,7 @@ package v3
 
 import (
 	"fmt"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/conversion"
 
@@ -31,6 +32,9 @@ type ExternalJobSpec struct {
 	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
 	// Important: Run "make" to regenerate code after modifying this file
 	DeferredAt string `json:"deferredAt"`
+
+	// PanicInConversion triggers a panic during conversion when set to true.
+	PanicInConversion bool `json:"panicInConversion"`
 }
 
 // ExternalJobStatus defines the observed state of ExternalJob
@@ -66,6 +70,9 @@ func init() {
 // ConvertTo implements conversion logic to convert to Hub type (v2.ExternalJob
 // in this case)
 func (ej *ExternalJob) ConvertTo(dst conversion.Hub) error {
+	if ej.Spec.PanicInConversion {
+		panic("PanicInConversion field set to true")
+	}
 	switch t := dst.(type) {
 	case *v2.ExternalJob:
 		jobv2 := dst.(*v2.ExternalJob)
@@ -80,6 +87,9 @@ func (ej *ExternalJob) ConvertTo(dst conversion.Hub) error {
 // ConvertFrom implements conversion logic to convert from Hub type (v2.ExternalJob
 // in this case)
 func (ej *ExternalJob) ConvertFrom(src conversion.Hub) error {
+	if ej.Spec.PanicInConversion {
+		panic("PanicInConversion field set to true")
+	}
 	switch t := src.(type) {
 	case *v2.ExternalJob:
 		jobv2 := src.(*v2.ExternalJob)
diff --git a/pkg/webhook/conversion/testdata/api/v3/zz_generated.deepcopy.go b/pkg/webhook/conversion/testdata/api/v3/zz_generated.deepcopy.go
index a90942b427..d12b6910dc 100644
--- a/pkg/webhook/conversion/testdata/api/v3/zz_generated.deepcopy.go
+++ b/pkg/webhook/conversion/testdata/api/v3/zz_generated.deepcopy.go
@@ -1,4 +1,4 @@
-// +build !ignore_autogenerated
+//go:build !ignore_autogenerated
 
 /*
 
@@ -15,7 +15,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// autogenerated by controller-gen object, do not modify manually
+// Code generated by controller-gen. DO NOT EDIT.
 
 package v3
 
@@ -54,7 +54,7 @@ func (in *ExternalJob) DeepCopyObject() runtime.Object {
 func (in *ExternalJobList) DeepCopyInto(out *ExternalJobList) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
-	out.ListMeta = in.ListMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
 		*out = make([]ExternalJob, len(*in))
diff --git a/pkg/webhook/example_test.go b/pkg/webhook/example_test.go
index f68008755d..7c4f718f4c 100644
--- a/pkg/webhook/example_test.go
+++ b/pkg/webhook/example_test.go
@@ -145,7 +145,7 @@ func ExampleStandaloneWebhook() {
 	mux.Handle("/validating", validatingHookHandler)
 
 	// Run your handler
-	if err := http.ListenAndServe(port, mux); err != nil { //nolint:gosec // it's fine to not set timeouts here
+	if err := http.ListenAndServe(port, mux); err != nil {
 		panic(err)
 	}
 }
diff --git a/pkg/webhook/internal/metrics/metrics.go b/pkg/webhook/internal/metrics/metrics.go
index 557004908b..f1e6ce68f5 100644
--- a/pkg/webhook/internal/metrics/metrics.go
+++ b/pkg/webhook/internal/metrics/metrics.go
@@ -18,6 +18,7 @@ package metrics
 
 import (
 	"net/http"
+	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
@@ -30,8 +31,11 @@ var (
 	// of processing admission requests.
 	RequestLatency = prometheus.NewHistogramVec(
 		prometheus.HistogramOpts{
-			Name: "controller_runtime_webhook_latency_seconds",
-			Help: "Histogram of the latency of processing admission requests",
+			Name:                            "controller_runtime_webhook_latency_seconds",
+			Help:                            "Histogram of the latency of processing admission requests",
+			NativeHistogramBucketFactor:     1.1,
+			NativeHistogramMaxBucketNumber:  100,
+			NativeHistogramMinResetDuration: 1 * time.Hour,
 		},
 		[]string{"webhook"},
 	)
diff --git a/pkg/webhook/server.go b/pkg/webhook/server.go
index f8820e8b7c..4d8ae9ec7a 100644
--- a/pkg/webhook/server.go
+++ b/pkg/webhook/server.go
@@ -190,7 +190,7 @@ func (s *DefaultServer) Start(ctx context.Context) error {
 
 	log.Info("Starting webhook server")
 
-	cfg := &tls.Config{ //nolint:gosec
+	cfg := &tls.Config{
 		NextProtos: []string{"h2"},
 	}
 	// fallback TLS config ready, will now mutate if passer wants full control over it
@@ -272,7 +272,7 @@ func (s *DefaultServer) Start(ctx context.Context) error {
 // server has been started.
 func (s *DefaultServer) StartedChecker() healthz.Checker {
 	config := &tls.Config{
-		InsecureSkipVerify: true, //nolint:gosec // config is used to connect to our own webhook port.
+		InsecureSkipVerify: true,
 	}
 	return func(req *http.Request) error {
 		s.mu.Lock()
diff --git a/pkg/webhook/server_test.go b/pkg/webhook/server_test.go
index 04d4ac7f86..6542222585 100644
--- a/pkg/webhook/server_test.go
+++ b/pkg/webhook/server_test.go
@@ -36,17 +36,19 @@ import (
 
 var _ = Describe("Webhook Server", func() {
 	var (
-		ctx          context.Context
-		ctxCancel    context.CancelFunc
-		testHostPort string
-		client       *http.Client
-		server       webhook.Server
-		servingOpts  envtest.WebhookInstallOptions
+		ctxCancel          context.CancelFunc
+		testHostPort       string
+		client             *http.Client
+		server             webhook.Server
+		servingOpts        envtest.WebhookInstallOptions
+		genericStartServer func(f func(ctx context.Context)) (done <-chan struct{})
 	)
 
 	BeforeEach(func() {
-		ctx, ctxCancel = context.WithCancel(context.Background())
-		// closed in individual tests differently
+		var ctx context.Context
+		// Has to be derived from context.Background() as it needs to be
+		// valid past the BeforeEach
+		ctx, ctxCancel = context.WithCancel(context.Background()) //nolint:forbidigo
 
 		servingOpts = envtest.WebhookInstallOptions{}
 		Expect(servingOpts.PrepWithoutInstalling()).To(Succeed())
@@ -67,27 +69,27 @@ var _ = Describe("Webhook Server", func() {
 			Port:    servingOpts.LocalServingPort,
 			CertDir: servingOpts.LocalServingCertDir,
 		})
+
+		genericStartServer = func(f func(ctx context.Context)) (done <-chan struct{}) {
+			doneCh := make(chan struct{})
+			go func() {
+				defer GinkgoRecover()
+				defer close(doneCh)
+				f(ctx)
+			}()
+			// wait till we can ping the server to start the test
+			Eventually(func() error {
+				_, err := client.Get(fmt.Sprintf("https://%s/unservedpath", testHostPort))
+				return err
+			}).Should(Succeed())
+
+			return doneCh
+		}
 	})
 	AfterEach(func() {
 		Expect(servingOpts.Cleanup()).To(Succeed())
 	})
 
-	genericStartServer := func(f func(ctx context.Context)) (done <-chan struct{}) {
-		doneCh := make(chan struct{})
-		go func() {
-			defer GinkgoRecover()
-			defer close(doneCh)
-			f(ctx)
-		}()
-		// wait till we can ping the server to start the test
-		Eventually(func() error {
-			_, err := client.Get(fmt.Sprintf("https://%s/unservedpath", testHostPort))
-			return err
-		}).Should(Succeed())
-
-		return doneCh
-	}
-
 	startServer := func() (done <-chan struct{}) {
 		return genericStartServer(func(ctx context.Context) {
 			Expect(server.Start(ctx)).To(Succeed())
diff --git a/pkg/webhook/webhook_integration_test.go b/pkg/webhook/webhook_integration_test.go
index 752a1fe6f5..cbb5b711f7 100644
--- a/pkg/webhook/webhook_integration_test.go
+++ b/pkg/webhook/webhook_integration_test.go
@@ -73,7 +73,7 @@ var _ = Describe("Webhook", func() {
 		}
 	})
 	Context("when running a webhook server with a manager", func() {
-		It("should reject create request for webhook that rejects all requests", func() {
+		It("should reject create request for webhook that rejects all requests", func(ctx SpecContext) {
 			m, err := manager.New(cfg, manager.Options{
 				WebhookServer: webhook.NewServer(webhook.Options{
 					Port:    testenv.WebhookInstallOptions.LocalServingPort,
@@ -86,20 +86,17 @@ var _ = Describe("Webhook", func() {
 			server := m.GetWebhookServer()
 			server.Register("/failing", &webhook.Admission{Handler: &rejectingValidator{d: admission.NewDecoder(testenv.Scheme)}})
 
-			ctx, cancel := context.WithCancel(context.Background())
 			go func() {
 				err := server.Start(ctx)
 				Expect(err).NotTo(HaveOccurred())
 			}()
 
 			Eventually(func() bool {
-				err := c.Create(context.TODO(), obj)
+				err := c.Create(ctx, obj)
 				return err != nil && strings.HasSuffix(err.Error(), "Always denied") && apierrors.ReasonForError(err) == metav1.StatusReasonForbidden
 			}, 1*time.Second).Should(BeTrue())
-
-			cancel()
 		})
-		It("should reject create request for multi-webhook that rejects all requests", func() {
+		It("should reject create request for multi-webhook that rejects all requests", func(ctx SpecContext) {
 			m, err := manager.New(cfg, manager.Options{
 				Metrics: metricsserver.Options{BindAddress: "0"},
 				WebhookServer: webhook.NewServer(webhook.Options{
@@ -113,22 +110,20 @@ var _ = Describe("Webhook", func() {
 			server := m.GetWebhookServer()
 			server.Register("/failing", &webhook.Admission{Handler: admission.MultiValidatingHandler(&rejectingValidator{d: admission.NewDecoder(testenv.Scheme)})})
 
-			ctx, cancel := context.WithCancel(context.Background())
 			go func() {
+				defer GinkgoRecover()
 				err = server.Start(ctx)
 				Expect(err).NotTo(HaveOccurred())
 			}()
 
 			Eventually(func() bool {
-				err = c.Create(context.TODO(), obj)
+				err = c.Create(ctx, obj)
 				return err != nil && strings.HasSuffix(err.Error(), "Always denied") && apierrors.ReasonForError(err) == metav1.StatusReasonForbidden
 			}, 1*time.Second).Should(BeTrue())
-
-			cancel()
 		})
 	})
 	Context("when running a webhook server without a manager", func() {
-		It("should reject create request for webhook that rejects all requests", func() {
+		It("should reject create request for webhook that rejects all requests", func(ctx SpecContext) {
 			server := webhook.NewServer(webhook.Options{
 				Port:    testenv.WebhookInstallOptions.LocalServingPort,
 				Host:    testenv.WebhookInstallOptions.LocalServingHost,
@@ -136,18 +131,15 @@ var _ = Describe("Webhook", func() {
 			})
 			server.Register("/failing", &webhook.Admission{Handler: &rejectingValidator{d: admission.NewDecoder(testenv.Scheme)}})
 
-			ctx, cancel := context.WithCancel(context.Background())
 			go func() {
 				err := server.Start(ctx)
 				Expect(err).NotTo(HaveOccurred())
 			}()
 
 			Eventually(func() bool {
-				err := c.Create(context.TODO(), obj)
+				err := c.Create(ctx, obj)
 				return err != nil && strings.HasSuffix(err.Error(), "Always denied") && apierrors.ReasonForError(err) == metav1.StatusReasonForbidden
 			}, 1*time.Second).Should(BeTrue())
-
-			cancel()
 		})
 	})
 })
diff --git a/tools/setup-envtest/README.md b/tools/setup-envtest/README.md
index 0482dd3162..a4de6f3eae 100644
--- a/tools/setup-envtest/README.md
+++ b/tools/setup-envtest/README.md
@@ -4,17 +4,17 @@ This is a small tool that manages binaries for envtest. It can be used to
 download new binaries, list currently installed and available ones, and
 clean up versions.
 
-To use it, just go-install it with Golang 1.22+ (it's a separate, self-contained
+To use it, just go-install it with Golang 1.24+ (it's a separate, self-contained
 module):
 
 ```shell
 go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
 ```
 
-If you are using Golang 1.20 or 1.21, use the `release-0.17` branch instead:
+If you are using Golang 1.23, use the `release-0.20` branch instead:
 
 ```shell
-go install sigs.k8s.io/controller-runtime/tools/setup-envtest@release-0.17
+go install sigs.k8s.io/controller-runtime/tools/setup-envtest@release-0.20
 ```
 
 For full documentation, run it with the `--help` flag, but here are some
@@ -47,16 +47,11 @@ setup-envtest use -i --use-env
 # sideload a pre-downloaded tarball as Kubernetes 1.16.2 into our store
 setup-envtest sideload 1.16.2 < downloaded-envtest.tar.gz
 
-# Per default envtest binaries are downloaded from: 
+# Per default envtest binaries are downloaded from:
 # https://raw.githubusercontent.com/kubernetes-sigs/controller-tools/master/envtest-releases.yaml
 # To download from a custom index use the following:
 setup-envtest use --index https://custom.com/envtest-releases.yaml
 
-# To download from the kubebuilder-tools GCS bucket: (default behavior before v0.18)
-# Note: This is a Google-owned bucket and it might be shutdown at any time
-# see: https://github.com/kubernetes/k8s.io/issues/2647#event-12439345373
-# Note: This flag will also be removed soon.
-setup-envtest use --use-deprecated-gcs
 ```
 
 ## Where does it put all those binaries?
@@ -107,8 +102,7 @@ Then, you have a few options for managing your binaries:
 
   `--use-env` makes the command unconditionally use the value of
   KUBEBUILDER_ASSETS as long as it contains the required binaries, and
-  `-i` indicates that we only ever want to work with installed binaries
-  (no reaching out the remote GCS storage).
+  `-i` indicates that we only ever want to work with installed binaries.
 
   As noted about, you can use `ENVTEST_INSTALLED_ONLY=true` to switch `-i`
   on by default, and you can use `ENVTEST_USE_ENV=true` to switch
@@ -123,25 +117,3 @@ Then, you have a few options for managing your binaries:
 - If you want to talk to some internal source via HTTP, you can simply set `--index`
   The index must contain references to envtest binary archives in the same format as:
   https://raw.githubusercontent.com/kubernetes-sigs/controller-tools/master/envtest-releases.yaml
-
-- If you want to talk to some internal source in a GCS "style", you can use the
-  `--remote-bucket` and `--remote-server` options together with `--use-deprecated-gcs`.
-  Note: This is deprecated and will be removed soon. The former sets which
-  GCS bucket to download from, and the latter sets the host to talk to as
-  if it were a GCS endpoint. Theoretically, you could use the latter
-  version to run an internal "mirror" -- the tool expects
-
-  - `HOST/storage/v1/b/BUCKET/o` to return JSON like
-
-    ```json
-    {"items": [
-        {"name": "kubebuilder-tools-X.Y.Z-os-arch.tar.gz", "md5Hash": "<base-64-encoded-md5-hash>"},
-        {"name": "kubebuilder-tools-X.Y.Z-os-arch.tar.gz", "md5Hash": "<base-64-encoded-md5-hash>"}
-    ]}
-    ```
-
-  - `HOST/storage/v1/b/BUCKET/o/TARBALL_NAME` to return JSON like
-    `{"name": "kubebuilder-tools-X.Y.Z-os-arch.tar.gz", "md5Hash": "<base-64-encoded-md5-hash>"}`
-
-  - `HOST/storage/v1/b/BUCKET/o/TARBALL_NAME?alt=media` to return the
-    actual file contents
diff --git a/tools/setup-envtest/env/env.go b/tools/setup-envtest/env/env.go
index 24857916d7..6168739eb6 100644
--- a/tools/setup-envtest/env/env.go
+++ b/tools/setup-envtest/env/env.go
@@ -42,10 +42,6 @@ type Env struct {
 	// contact remote services & re-download.
 	ForceDownload bool
 
-	// UseDeprecatedGCS signals if the GCS client is used.
-	// Note: This will be removed together with remote.GCSClient.
-	UseDeprecatedGCS bool
-
 	// Client is our remote client for contacting remote services.
 	Client remote.Client
 
@@ -291,7 +287,7 @@ func (e *Env) Fetch(ctx context.Context) {
 		}
 	})
 
-	archiveOut, err := e.FS.TempFile("", "*-"+e.Platform.ArchiveName(e.UseDeprecatedGCS, *e.Version.AsConcrete()))
+	archiveOut, err := e.FS.TempFile("", "*-"+e.Platform.ArchiveName(*e.Version.AsConcrete()))
 	if err != nil {
 		ExitCause(2, err, "unable to open file to write downloaded archive to")
 	}
diff --git a/tools/setup-envtest/go.mod b/tools/setup-envtest/go.mod
index 7fb3060f8f..15c64f8b57 100644
--- a/tools/setup-envtest/go.mod
+++ b/tools/setup-envtest/go.mod
@@ -1,28 +1,29 @@
 module sigs.k8s.io/controller-runtime/tools/setup-envtest
 
-go 1.22.0
+go 1.24.0
 
 require (
 	github.com/go-logr/logr v1.4.2
 	github.com/go-logr/zapr v1.3.0
-	github.com/onsi/ginkgo/v2 v2.19.0
-	github.com/onsi/gomega v1.33.1
-	github.com/spf13/afero v1.6.0
-	github.com/spf13/pflag v1.0.5
-	go.uber.org/zap v1.26.0
-	k8s.io/apimachinery v0.31.0
-	sigs.k8s.io/yaml v1.4.0
+	github.com/onsi/ginkgo/v2 v2.22.2
+	github.com/onsi/gomega v1.36.2
+	github.com/spf13/afero v1.12.0
+	github.com/spf13/pflag v1.0.6
+	go.uber.org/zap v1.27.0
+	k8s.io/apimachinery v0.34.1
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
-	github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect
 	go.uber.org/multierr v1.10.0 // indirect
-	golang.org/x/net v0.26.0 // indirect
-	golang.org/x/sys v0.21.0 // indirect
-	golang.org/x/text v0.16.0 // indirect
-	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
-	google.golang.org/protobuf v1.34.2 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	golang.org/x/net v0.38.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/tools v0.28.0 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/tools/setup-envtest/go.sum b/tools/setup-envtest/go.sum
index 4ab5d6d16e..dfc8e7cce2 100644
--- a/tools/setup-envtest/go.sum
+++ b/tools/setup-envtest/go.sum
@@ -1,65 +1,52 @@
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
 github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
-github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
-github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
-github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
-github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg=
+github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/onsi/ginkgo/v2 v2.22.2 h1:/3X8Panh8/WwhU/3Ssa6rCKqPLuAkVY2I0RoyDLySlU=
+github.com/onsi/ginkgo/v2 v2.22.2/go.mod h1:oeMosUL+8LtarXBHu/c0bx2D/K9zyQ6uX3cTyztHwsk=
+github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
+github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/spf13/afero v1.6.0 h1:xoax2sJ2DT8S8xA2paPFjDCScCNeWsg75VG0DLRreiY=
-github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
-go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
+github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
+github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
 go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
-go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
-golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
-golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
-golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
-google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
+golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
+golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/apimachinery v0.31.0 h1:m9jOiSr3FoSSL5WO9bjm1n6B9KROYYgNZOb4tyZ1lBc=
-k8s.io/apimachinery v0.31.0/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
-sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
-sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/tools/setup-envtest/main.go b/tools/setup-envtest/main.go
index 7e2761a4f6..7eb5ec43d3 100644
--- a/tools/setup-envtest/main.go
+++ b/tools/setup-envtest/main.go
@@ -50,16 +50,7 @@ var (
 	binDir = flag.String("bin-dir", "",
 		"directory to store binary assets (default: $OS_SPECIFIC_DATA_DIR/envtest-binaries)")
 
-	useDeprecatedGCS = flag.Bool("use-deprecated-gcs", false, "use GCS to fetch envtest binaries. Note: This is deprecated and will be removed soon. For more details see: https://github.com/kubernetes-sigs/controller-runtime/pull/2811")
-
-	// These flags are only used with --use-deprecated-gcs.
-	remoteBucket = flag.String("remote-bucket", "kubebuilder-tools", "remote GCS bucket to download from (only used with --use-deprecated-gcs)")
-	remoteServer = flag.String("remote-server", "storage.googleapis.com",
-		"remote server to query from.  You can override this if you want to run "+
-			"an internal storage server instead, or for testing. (only used with --use-deprecated-gcs)")
-
-	// This flag is only used if --use-deprecated-gcs is not set or false (default).
-	index = flag.String("index", remote.DefaultIndexURL, "index to discover envtest binaries (only used if --use-deprecated-gcs is not set, or set to false)")
+	index = flag.String("index", remote.DefaultIndexURL, "index to discover envtest binaries")
 )
 
 // TODO(directxman12): handle interrupts?
@@ -88,29 +79,18 @@ func setupEnv(globalLog logr.Logger, version string) *envp.Env {
 	}
 	log.V(1).Info("using binaries directory", "dir", *binDir)
 
-	var client remote.Client
-	if useDeprecatedGCS != nil && *useDeprecatedGCS {
-		client = &remote.GCSClient{ //nolint:staticcheck // deprecation accepted for now
-			Log:    globalLog.WithName("storage-client"),
-			Bucket: *remoteBucket,
-			Server: *remoteServer,
-		}
-		log.V(1).Info("using deprecated GCS client", "bucket", *remoteBucket, "server", *remoteServer)
-	} else {
-		client = &remote.HTTPClient{
-			Log:      globalLog.WithName("storage-client"),
-			IndexURL: *index,
-		}
-		log.V(1).Info("using HTTP client", "index", *index)
+	client := &remote.HTTPClient{
+		Log:      globalLog.WithName("storage-client"),
+		IndexURL: *index,
 	}
+	log.V(1).Info("using HTTP client", "index", *index)
 
 	env := &envp.Env{
-		Log:              globalLog,
-		UseDeprecatedGCS: useDeprecatedGCS != nil && *useDeprecatedGCS,
-		Client:           client,
-		VerifySum:        *verify,
-		ForceDownload:    *force,
-		NoDownload:       *installedOnly,
+		Log:           globalLog,
+		Client:        client,
+		VerifySum:     *verify,
+		ForceDownload: *force,
+		NoDownload:    *installedOnly,
 		Platform: versions.PlatformItem{
 			Platform: versions.Platform{
 				OS:   *targetOS,
@@ -189,7 +169,7 @@ Commands:
 
 	use:
 		get information for the requested version, downloading it if necessary and allowed.
-		Needs a concrete platform (no wildcards), but wilcard versions are supported.
+		Needs a concrete platform (no wildcards), but wildcard versions are supported.
 
 	list:
 		list installed *and* available versions matching the given version & platform.
@@ -204,6 +184,9 @@ Commands:
 		reads a .tar.gz file from stdin and expand it into the store.
 		must have a concrete version and platform.
 
+	version:
+		list the installed version of setup-envtest.
+
 Versions:
 
 	Versions take the form of a small subset of semver selectors.
@@ -276,7 +259,6 @@ Environment Variables:
 		version = flag.Arg(1)
 	}
 	env := setupEnv(globalLog, version)
-
 	// perform our main set of actions
 	switch action := flag.Arg(0); action {
 	case "use":
@@ -294,6 +276,8 @@ Environment Variables:
 			Input:       os.Stdin,
 			PrintFormat: printFormat,
 		}.Do(env)
+	case "version":
+		workflows.Version{}.Do(env)
 	default:
 		flag.Usage()
 		envp.Exit(2, "unknown action %q", action)
diff --git a/tools/setup-envtest/remote/gcs_client.go b/tools/setup-envtest/remote/gcs_client.go
deleted file mode 100644
index 85f321d5c5..0000000000
--- a/tools/setup-envtest/remote/gcs_client.go
+++ /dev/null
@@ -1,202 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-// Copyright 2021 The Kubernetes Authors
-
-package remote
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"path"
-	"sort"
-
-	"github.com/go-logr/logr"
-	"sigs.k8s.io/controller-runtime/tools/setup-envtest/versions"
-)
-
-// objectList is the parts we need of the GCS "list-objects-in-bucket" endpoint.
-type objectList struct {
-	Items         []bucketObject `json:"items"`
-	NextPageToken string         `json:"nextPageToken"`
-}
-
-// bucketObject is the parts we need of the GCS object metadata.
-type bucketObject struct {
-	Name string `json:"name"`
-	Hash string `json:"md5Hash"`
-}
-
-var _ Client = &GCSClient{}
-
-// GCSClient is a basic client for fetching versions of the envtest binary archives
-// from GCS.
-//
-// Deprecated: This client is deprecated and will be removed soon.
-// The kubebuilder GCS bucket that we use with this client might be shutdown at any time,
-// see: https://github.com/kubernetes/k8s.io/issues/2647.
-type GCSClient struct {
-	// Bucket is the bucket to fetch from.
-	Bucket string
-
-	// Server is the GCS-like storage server
-	Server string
-
-	// Log allows us to log.
-	Log logr.Logger
-
-	// Insecure uses http for testing
-	Insecure bool
-}
-
-func (c *GCSClient) scheme() string {
-	if c.Insecure {
-		return "http"
-	}
-	return "https"
-}
-
-// ListVersions lists all available tools versions in the given bucket, along
-// with supported os/arch combos and the corresponding hash.
-//
-// The results are sorted with newer versions first.
-func (c *GCSClient) ListVersions(ctx context.Context) ([]versions.Set, error) {
-	loc := &url.URL{
-		Scheme: c.scheme(),
-		Host:   c.Server,
-		Path:   path.Join("/storage/v1/b/", c.Bucket, "o"),
-	}
-	query := make(url.Values)
-
-	knownVersions := map[versions.Concrete][]versions.PlatformItem{}
-	for cont := true; cont; {
-		c.Log.V(1).Info("listing bucket to get versions", "bucket", c.Bucket)
-
-		loc.RawQuery = query.Encode()
-		req, err := http.NewRequestWithContext(ctx, "GET", loc.String(), nil)
-		if err != nil {
-			return nil, fmt.Errorf("unable to construct request to list bucket items: %w", err)
-		}
-
-		resp, err := http.DefaultClient.Do(req)
-		if err != nil {
-			return nil, fmt.Errorf("unable to perform request to list bucket items: %w", err)
-		}
-
-		err = func() error {
-			defer resp.Body.Close()
-			if resp.StatusCode != 200 {
-				return fmt.Errorf("unable list bucket items -- got status %q from GCS", resp.Status)
-			}
-
-			var list objectList
-			if err := json.NewDecoder(resp.Body).Decode(&list); err != nil {
-				return fmt.Errorf("unable unmarshal bucket items list: %w", err)
-			}
-
-			// continue listing if needed
-			cont = list.NextPageToken != ""
-			query.Set("pageToken", list.NextPageToken)
-
-			for _, item := range list.Items {
-				ver, details := versions.ExtractWithPlatform(versions.ArchiveRE, item.Name)
-				if ver == nil {
-					c.Log.V(1).Info("skipping bucket object -- does not appear to be a versioned tools object", "name", item.Name)
-					continue
-				}
-				c.Log.V(1).Info("found version", "version", ver, "platform", details)
-				knownVersions[*ver] = append(knownVersions[*ver], versions.PlatformItem{
-					Platform: details,
-					Hash: &versions.Hash{
-						Type:     versions.MD5HashType,
-						Encoding: versions.Base64HashEncoding,
-						Value:    item.Hash,
-					},
-				})
-			}
-
-			return nil
-		}()
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	res := make([]versions.Set, 0, len(knownVersions))
-	for ver, details := range knownVersions {
-		res = append(res, versions.Set{Version: ver, Platforms: details})
-	}
-	// sort in inverse order so that the newest one is first
-	sort.Slice(res, func(i, j int) bool {
-		first, second := res[i].Version, res[j].Version
-		return first.NewerThan(second)
-	})
-
-	return res, nil
-}
-
-// GetVersion downloads the given concrete version for the given concrete platform, writing it to the out.
-func (c *GCSClient) GetVersion(ctx context.Context, version versions.Concrete, platform versions.PlatformItem, out io.Writer) error {
-	itemName := platform.ArchiveName(true, version)
-	loc := &url.URL{
-		Scheme:   c.scheme(),
-		Host:     c.Server,
-		Path:     path.Join("/storage/v1/b/", c.Bucket, "o", itemName),
-		RawQuery: "alt=media",
-	}
-
-	req, err := http.NewRequestWithContext(ctx, "GET", loc.String(), nil)
-	if err != nil {
-		return fmt.Errorf("unable to construct request to fetch %s: %w", itemName, err)
-	}
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("unable to fetch %s (%s): %w", itemName, req.URL, err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != 200 {
-		return fmt.Errorf("unable fetch %s (%s) -- got status %q from GCS", itemName, req.URL, resp.Status)
-	}
-
-	return readBody(resp, out, itemName, platform)
-}
-
-// FetchSum fetches the checksum for the given concrete version & platform into
-// the given platform item.
-func (c *GCSClient) FetchSum(ctx context.Context, ver versions.Concrete, pl *versions.PlatformItem) error {
-	itemName := pl.ArchiveName(true, ver)
-	loc := &url.URL{
-		Scheme: c.scheme(),
-		Host:   c.Server,
-		Path:   path.Join("/storage/v1/b/", c.Bucket, "o", itemName),
-	}
-
-	req, err := http.NewRequestWithContext(ctx, "GET", loc.String(), nil)
-	if err != nil {
-		return fmt.Errorf("unable to construct request to fetch metadata for %s: %w", itemName, err)
-	}
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("unable to fetch metadata for %s: %w", itemName, err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != 200 {
-		return fmt.Errorf("unable fetch metadata for %s -- got status %q from GCS", itemName, resp.Status)
-	}
-
-	var item bucketObject
-	if err := json.NewDecoder(resp.Body).Decode(&item); err != nil {
-		return fmt.Errorf("unable to unmarshal metadata for %s: %w", itemName, err)
-	}
-
-	pl.Hash = &versions.Hash{
-		Type:     versions.MD5HashType,
-		Encoding: versions.Base64HashEncoding,
-		Value:    item.Hash,
-	}
-	return nil
-}
diff --git a/tools/setup-envtest/remote/read_body.go b/tools/setup-envtest/remote/read_body.go
index 650e41282c..1c71102897 100644
--- a/tools/setup-envtest/remote/read_body.go
+++ b/tools/setup-envtest/remote/read_body.go
@@ -4,7 +4,6 @@
 package remote
 
 import (
-	//nolint:gosec // We're aware that md5 is a weak cryptographic primitive, but we don't have a choice here.
 	"crypto/md5"
 	"crypto/sha512"
 	"encoding/base64"
@@ -28,7 +27,7 @@ func readBody(resp *http.Response, out io.Writer, archiveName string, platform v
 		case versions.SHA512HashType:
 			hasher = sha512.New()
 		case versions.MD5HashType:
-			hasher = md5.New() //nolint:gosec // We're aware that md5 is a weak cryptographic primitive, but we don't have a choice here.
+			hasher = md5.New()
 		default:
 			return fmt.Errorf("hash type %s not implemented", platform.Hash.Type)
 		}
diff --git a/tools/setup-envtest/store/store.go b/tools/setup-envtest/store/store.go
index 6001eb2a4e..bb5a1f7bcd 100644
--- a/tools/setup-envtest/store/store.go
+++ b/tools/setup-envtest/store/store.go
@@ -38,7 +38,7 @@ func (i Item) String() string {
 }
 
 // Filter is a version spec & platform selector (i.e. platform
-// potentially with wilcards) to filter store items.
+// potentially with wildcards) to filter store items.
 type Filter struct {
 	Version  versions.Spec
 	Platform versions.Platform
@@ -174,7 +174,7 @@ func (s *Store) Add(ctx context.Context, item Item, contents io.Reader) (resErr
 		}
 		if err := func() error { // IIFE to get the defer properly in a loop
 			defer binOut.Close()
-			if _, err := io.Copy(binOut, tarReader); err != nil { //nolint:gosec
+			if _, err := io.Copy(binOut, tarReader); err != nil {
 				return fmt.Errorf("unable to write file %s from archive to disk for version-platform pair %s", targetPath, itemName)
 			}
 			return nil
diff --git a/tools/setup-envtest/store/store_suite_test.go b/tools/setup-envtest/store/store_suite_test.go
index c2795a3227..649c22d545 100644
--- a/tools/setup-envtest/store/store_suite_test.go
+++ b/tools/setup-envtest/store/store_suite_test.go
@@ -40,8 +40,8 @@ func zapLogger() logr.Logger {
 	return zapr.NewLogger(zapLog)
 }
 
-func logCtx() context.Context {
-	return logr.NewContext(context.Background(), testLog)
+func logCtx(ctx context.Context) context.Context {
+	return logr.NewContext(ctx, testLog)
 }
 
 func TestStore(t *testing.T) {
diff --git a/tools/setup-envtest/store/store_test.go b/tools/setup-envtest/store/store_test.go
index f0d83a1f79..575d49dd3b 100644
--- a/tools/setup-envtest/store/store_test.go
+++ b/tools/setup-envtest/store/store_test.go
@@ -47,23 +47,23 @@ var _ = Describe("Store", func() {
 		}
 	})
 	Describe("initialization", func() {
-		It("should ensure the repo root exists", func() {
+		It("should ensure the repo root exists", func(ctx SpecContext) {
 			// remove the old dir
 			Expect(st.Root.RemoveAll("")).To(Succeed(), "should be able to remove the store before trying to initialize")
 
-			Expect(st.Initialize(logCtx())).To(Succeed(), "initialization should succeed")
+			Expect(st.Initialize(logCtx(ctx))).To(Succeed(), "initialization should succeed")
 			Expect(st.Root.Stat("k8s")).NotTo(BeNil(), "store's binary dir should exist")
 		})
 
-		It("should be fine if the repo root already exists", func() {
-			Expect(st.Initialize(logCtx())).To(Succeed())
+		It("should be fine if the repo root already exists", func(ctx SpecContext) {
+			Expect(st.Initialize(logCtx(ctx))).To(Succeed())
 		})
 	})
 	Describe("listing items", func() {
-		It("should filter results by the given filter, sorted in version order (newest first)", func() {
+		It("should filter results by the given filter, sorted in version order (newest first)", func(ctx SpecContext) {
 			sel, err := versions.FromExpr("<=1.16")
 			Expect(err).NotTo(HaveOccurred(), "should be able to construct <=1.16 selector")
-			Expect(st.List(logCtx(), store.Filter{
+			Expect(st.List(logCtx(ctx), store.Filter{
 				Version:  sel,
 				Platform: versions.Platform{OS: "*", Arch: "amd64"},
 			})).To(Equal([]store.Item{
@@ -73,16 +73,16 @@ var _ = Describe("Store", func() {
 				{Version: ver(1, 14, 26), Platform: versions.Platform{OS: "linux", Arch: "amd64"}},
 			}))
 		})
-		It("should skip non-folders in the store", func() {
+		It("should skip non-folders in the store", func(ctx SpecContext) {
 			Expect(afero.WriteFile(st.Root, "k8s/2.3.6-linux-amd128", []byte{0x01}, fs.ModePerm)).To(Succeed(), "should be able to create a non-store file in the store directory")
-			Expect(st.List(logCtx(), store.Filter{
+			Expect(st.List(logCtx(ctx), store.Filter{
 				Version: versions.AnyVersion, Platform: versions.Platform{OS: "linux", Arch: "amd128"},
 			})).To(BeEmpty())
 		})
 
-		It("should skip non-matching names in the store", func() {
+		It("should skip non-matching names in the store", func(ctx SpecContext) {
 			Expect(st.Root.Mkdir("k8s/somedir-2.3.6-linux-amd128", fs.ModePerm)).To(Succeed(), "should be able to create a non-store file in the store directory")
-			Expect(st.List(logCtx(), store.Filter{
+			Expect(st.List(logCtx(ctx), store.Filter{
 				Version: versions.AnyVersion, Platform: versions.Platform{OS: "linux", Arch: "amd128"},
 			})).To(BeEmpty())
 		})
@@ -90,10 +90,10 @@ var _ = Describe("Store", func() {
 
 	Describe("removing items", func() {
 		var res []store.Item
-		BeforeEach(func() {
+		BeforeEach(func(ctx SpecContext) {
 			sel, err := versions.FromExpr("<=1.16")
 			Expect(err).NotTo(HaveOccurred(), "should be able to construct <=1.16 selector")
-			res, err = st.Remove(logCtx(), store.Filter{
+			res, err = st.Remove(logCtx(ctx), store.Filter{
 				Version:  sel,
 				Platform: versions.Platform{OS: "*", Arch: "amd64"},
 			})
@@ -125,60 +125,30 @@ var _ = Describe("Store", func() {
 		})
 	})
 
-	Describe("adding items (GCS archives)", func() {
-		archiveName := "kubebuilder-tools-1.16.3-linux-amd64.tar.gz"
-
-		It("should support .tar.gz input", func() {
-			Expect(st.Add(logCtx(), newItem, makeFakeArchive(archiveName, "kubebuilder/bin/"))).To(Succeed())
-			Expect(st.Has(newItem)).To(BeTrue(), "should have the item after adding it")
-		})
-
-		It("should extract binaries from the given archive to a directly to the item's directory, regardless of path", func() {
-			Expect(st.Add(logCtx(), newItem, makeFakeArchive(archiveName, "kubebuilder/bin/"))).To(Succeed())
-
-			dirName := newItem.Platform.BaseName(newItem.Version)
-			Expect(afero.ReadFile(st.Root, filepath.Join("k8s", dirName, "some-file"))).To(HavePrefix(archiveName + "some-file"))
-			Expect(afero.ReadFile(st.Root, filepath.Join("k8s", dirName, "other-file"))).To(HavePrefix(archiveName + "other-file"))
-		})
-
-		It("should clean up any existing item directory before creating the new one", func() {
-			item := localVersions[0]
-			Expect(st.Add(logCtx(), item, makeFakeArchive(archiveName, "kubebuilder/bin/"))).To(Succeed())
-			Expect(st.Root.Stat(filepath.Join("k8s", item.Platform.BaseName(item.Version)))).NotTo(BeNil(), "new files should exist")
-		})
-		It("should clean up if it errors before finishing", func() {
-			item := localVersions[0]
-			Expect(st.Add(logCtx(), item, new(bytes.Buffer))).NotTo(Succeed(), "should fail to extract")
-			_, err := st.Root.Stat(filepath.Join("k8s", item.Platform.BaseName(item.Version)))
-			Expect(err).To(HaveOccurred(), "the binaries dir for the item should be gone")
-
-		})
-	})
-
 	Describe("adding items (controller-tools archives)", func() {
 		archiveName := "envtest-v1.16.3-linux-amd64.tar.gz"
 
-		It("should support .tar.gz input", func() {
-			Expect(st.Add(logCtx(), newItem, makeFakeArchive(archiveName, "controller-tools/envtest/"))).To(Succeed())
+		It("should support .tar.gz input", func(ctx SpecContext) {
+			Expect(st.Add(logCtx(ctx), newItem, makeFakeArchive(archiveName, "controller-tools/envtest/"))).To(Succeed())
 			Expect(st.Has(newItem)).To(BeTrue(), "should have the item after adding it")
 		})
 
-		It("should extract binaries from the given archive to a directly to the item's directory, regardless of path", func() {
-			Expect(st.Add(logCtx(), newItem, makeFakeArchive(archiveName, "controller-tools/envtest/"))).To(Succeed())
+		It("should extract binaries from the given archive to a directly to the item's directory, regardless of path", func(ctx SpecContext) {
+			Expect(st.Add(logCtx(ctx), newItem, makeFakeArchive(archiveName, "controller-tools/envtest/"))).To(Succeed())
 
 			dirName := newItem.Platform.BaseName(newItem.Version)
 			Expect(afero.ReadFile(st.Root, filepath.Join("k8s", dirName, "some-file"))).To(HavePrefix(archiveName + "some-file"))
 			Expect(afero.ReadFile(st.Root, filepath.Join("k8s", dirName, "other-file"))).To(HavePrefix(archiveName + "other-file"))
 		})
 
-		It("should clean up any existing item directory before creating the new one", func() {
+		It("should clean up any existing item directory before creating the new one", func(ctx SpecContext) {
 			item := localVersions[0]
-			Expect(st.Add(logCtx(), item, makeFakeArchive(archiveName, "controller-tools/envtest/"))).To(Succeed())
+			Expect(st.Add(logCtx(ctx), item, makeFakeArchive(archiveName, "controller-tools/envtest/"))).To(Succeed())
 			Expect(st.Root.Stat(filepath.Join("k8s", item.Platform.BaseName(item.Version)))).NotTo(BeNil(), "new files should exist")
 		})
-		It("should clean up if it errors before finishing", func() {
+		It("should clean up if it errors before finishing", func(ctx SpecContext) {
 			item := localVersions[0]
-			Expect(st.Add(logCtx(), item, new(bytes.Buffer))).NotTo(Succeed(), "should fail to extract")
+			Expect(st.Add(logCtx(ctx), item, new(bytes.Buffer))).NotTo(Succeed(), "should fail to extract")
 			_, err := st.Root.Stat(filepath.Join("k8s", item.Platform.BaseName(item.Version)))
 			Expect(err).To(HaveOccurred(), "the binaries dir for the item should be gone")
 
diff --git a/tools/setup-envtest/version/version.go b/tools/setup-envtest/version/version.go
new file mode 100644
index 0000000000..1d148b085d
--- /dev/null
+++ b/tools/setup-envtest/version/version.go
@@ -0,0 +1,21 @@
+package version
+
+import "runtime/debug"
+
+// Version to be set using ldflags:
+// -ldflags "-X sigs.k8s.io/controller-runtime/tools/setup-envtest/version.version=v1.0.0"
+// falls back to module information is unse
+var version = ""
+
+// Version returns the version of the main module
+func Version() string {
+	if version != "" {
+		return version
+	}
+	info, ok := debug.ReadBuildInfo()
+	if !ok || info == nil || info.Main.Version == "" {
+		// binary has not been built with module support or doesn't contain a version.
+		return "(unknown)"
+	}
+	return info.Main.Version
+}
diff --git a/tools/setup-envtest/version/version_suite_test.go b/tools/setup-envtest/version/version_suite_test.go
new file mode 100644
index 0000000000..99c623e8d4
--- /dev/null
+++ b/tools/setup-envtest/version/version_suite_test.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+func TestVersioning(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "Test Version Suite")
+}
diff --git a/tools/setup-envtest/version/version_test.go b/tools/setup-envtest/version/version_test.go
new file mode 100644
index 0000000000..4178cac870
--- /dev/null
+++ b/tools/setup-envtest/version/version_test.go
@@ -0,0 +1,54 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+
+See the License for the specific language governing permissions and
+
+limitations under the License.
+*/
+
+package version
+
+import (
+	"runtime/debug"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("TestVersion", func() {
+
+	info, ok := debug.ReadBuildInfo()
+	Expect(ok).To(BeTrue())
+	tests := map[string]struct {
+		version  string
+		expected string
+	}{
+		"empty returns build info": {
+			version:  "",
+			expected: info.Main.Version,
+		},
+		"set to a value returns it": {
+			version:  "1.2.3",
+			expected: "1.2.3",
+		},
+	}
+	for name, tc := range tests {
+		It("Version set to "+name, func() {
+			versionBackup := version
+			defer func() {
+				version = versionBackup
+			}()
+			version = tc.version
+			result := Version()
+			Expect(result).To(Equal(tc.expected))
+		})
+	}
+})
diff --git a/tools/setup-envtest/versions/misc_test.go b/tools/setup-envtest/versions/misc_test.go
index dcb87be8b2..a609f4dc60 100644
--- a/tools/setup-envtest/versions/misc_test.go
+++ b/tools/setup-envtest/versions/misc_test.go
@@ -95,8 +95,7 @@ var _ = Describe("Platform", func() {
 	Specify("knows how to produce an archive name", func() {
 		plat := Platform{OS: "linux", Arch: "amd64"}
 		ver := Concrete{Major: 1, Minor: 16, Patch: 3}
-		Expect(plat.ArchiveName(true, ver)).To(Equal("kubebuilder-tools-1.16.3-linux-amd64.tar.gz"))
-		Expect(plat.ArchiveName(false, ver)).To(Equal("envtest-v1.16.3-linux-amd64.tar.gz"))
+		Expect(plat.ArchiveName(ver)).To(Equal("envtest-v1.16.3-linux-amd64.tar.gz"))
 	})
 
 	Describe("parsing", func() {
@@ -111,17 +110,6 @@ var _ = Describe("Platform", func() {
 				Expect(ver).To(BeNil())
 			})
 		})
-		Context("for archive names (GCS)", func() {
-			It("should accept strings of the form kubebuilder-tools-x.y.z-os-arch.tar.gz", func() {
-				ver, plat := ExtractWithPlatform(ArchiveRE, "kubebuilder-tools-1.16.3-linux-amd64.tar.gz")
-				Expect(ver).To(Equal(&Concrete{Major: 1, Minor: 16, Patch: 3}))
-				Expect(plat).To(Equal(Platform{OS: "linux", Arch: "amd64"}))
-			})
-			It("should reject nonsense strings", func() {
-				ver, _ := ExtractWithPlatform(ArchiveRE, "kubebuilder-tools-1.16.3-linux-amd64.tar.sum")
-				Expect(ver).To(BeNil())
-			})
-		})
 		Context("for archive names (controller-tools)", func() {
 			It("should accept strings of the form envtest-vx.y.z-os-arch.tar.gz", func() {
 				ver, plat := ExtractWithPlatform(ArchiveRE, "envtest-v1.16.3-linux-amd64.tar.gz")
diff --git a/tools/setup-envtest/versions/parse.go b/tools/setup-envtest/versions/parse.go
index 21d38bb345..cd25710b2b 100644
--- a/tools/setup-envtest/versions/parse.go
+++ b/tools/setup-envtest/versions/parse.go
@@ -107,7 +107,7 @@ func PatchSelectorFromMatch(match []string, re *regexp.Regexp) PatchSelector {
 		panic("invalid input passed as patch selector (invalid state)")
 	}
 
-	// patch is optional, means wilcard if left off
+	// patch is optional, means wildcard if left off
 	patch := AnyPoint
 	if patchRaw := match[re.SubexpIndex("patch")]; patchRaw != "" {
 		patch = PointVersionFromValidString(patchRaw)
diff --git a/tools/setup-envtest/versions/platform.go b/tools/setup-envtest/versions/platform.go
index 8b32ccd5bc..1cfbd05c06 100644
--- a/tools/setup-envtest/versions/platform.go
+++ b/tools/setup-envtest/versions/platform.go
@@ -37,11 +37,7 @@ func (p Platform) BaseName(ver Concrete) string {
 }
 
 // ArchiveName returns the full archive name for this version and platform.
-// useGCS is deprecated and will be removed when the remote.GCSClient is removed.
-func (p Platform) ArchiveName(useGCS bool, ver Concrete) string {
-	if useGCS {
-		return "kubebuilder-tools-" + p.BaseName(ver) + ".tar.gz"
-	}
+func (p Platform) ArchiveName(ver Concrete) string {
 	return "envtest-v" + p.BaseName(ver) + ".tar.gz"
 }
 
@@ -56,11 +52,11 @@ type PlatformItem struct {
 // Hash of an archive with envtest binaries.
 type Hash struct {
 	// Type of the hash.
-	// GCS uses MD5HashType, controller-tools uses SHA512HashType.
+	// controller-tools uses SHA512HashType.
 	Type HashType
 
 	// Encoding of the hash value.
-	// GCS uses Base64HashEncoding, controller-tools uses HexHashEncoding.
+	// controller-tools uses HexHashEncoding.
 	Encoding HashEncoding
 
 	// Value of the hash.
@@ -122,7 +118,6 @@ var (
 	// VersionPlatformRE matches concrete version-platform strings.
 	VersionPlatformRE = regexp.MustCompile(`^` + versionPlatformREBase + `$`)
 	// ArchiveRE matches concrete version-platform.tar.gz strings.
-	// The archives published to GCS by kubebuilder use the "kubebuilder-tools-" prefix (e.g. "kubebuilder-tools-1.30.0-darwin-amd64.tar.gz").
 	// The archives published to GitHub releases by controller-tools use the "envtest-v" prefix (e.g. "envtest-v1.30.0-darwin-amd64.tar.gz").
-	ArchiveRE = regexp.MustCompile(`^(kubebuilder-tools-|envtest-v)` + versionPlatformREBase + `\.tar\.gz$`)
+	ArchiveRE = regexp.MustCompile(`^envtest-v` + versionPlatformREBase + `\.tar\.gz$`)
 )
diff --git a/tools/setup-envtest/versions/version.go b/tools/setup-envtest/versions/version.go
index 582ed7794e..945a95006f 100644
--- a/tools/setup-envtest/versions/version.go
+++ b/tools/setup-envtest/versions/version.go
@@ -72,7 +72,7 @@ func (s PatchSelector) AsConcrete() *Concrete {
 	return &Concrete{
 		Major: s.Major,
 		Minor: s.Minor,
-		Patch: int(s.Patch), // safe to cast, we've just checked wilcards above
+		Patch: int(s.Patch), // safe to cast, we've just checked wildcards above
 	}
 }
 
diff --git a/tools/setup-envtest/workflows/workflows.go b/tools/setup-envtest/workflows/workflows.go
index fdabd995ae..fb9123d269 100644
--- a/tools/setup-envtest/workflows/workflows.go
+++ b/tools/setup-envtest/workflows/workflows.go
@@ -5,11 +5,13 @@ package workflows
 
 import (
 	"context"
+	"fmt"
 	"io"
 
 	"github.com/go-logr/logr"
 
 	envp "sigs.k8s.io/controller-runtime/tools/setup-envtest/env"
+	"sigs.k8s.io/controller-runtime/tools/setup-envtest/version"
 )
 
 // Use is a workflow that prints out information about stored
@@ -85,3 +87,12 @@ func (f Sideload) Do(env *envp.Env) {
 	env.Sideload(ctx, f.Input)
 	env.PrintInfo(f.PrintFormat)
 }
+
+// Version is the workflow that shows the current binary version
+// of setup-envtest.
+type Version struct{}
+
+// Do executes the workflow.
+func (v Version) Do(env *envp.Env) {
+	fmt.Fprintf(env.Out, "setup-envtest version: %s\n", version.Version())
+}
diff --git a/tools/setup-envtest/workflows/workflows_test.go b/tools/setup-envtest/workflows/workflows_test.go
index 8c4007a415..435ae24285 100644
--- a/tools/setup-envtest/workflows/workflows_test.go
+++ b/tools/setup-envtest/workflows/workflows_test.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"io/fs"
 	"path/filepath"
+	"runtime/debug"
 	"sort"
 	"strings"
 
@@ -48,288 +49,302 @@ const (
 	testStorePath = ".teststore"
 )
 
-const (
-	gcsMode  = "GCS"
-	httpMode = "HTTP"
-)
-
-var _ = Describe("GCS Client", func() {
-	WorkflowTest(gcsMode)
-})
+var _ = Describe("Workflows", func() {
+	var (
+		env             *envp.Env
+		out             *bytes.Buffer
+		server          *ghttp.Server
+		remoteHTTPItems itemsHTTP
+	)
+	BeforeEach(func() {
+		out = new(bytes.Buffer)
+		baseFs := afero.Afero{Fs: afero.NewMemMapFs()}
+
+		server = ghttp.NewServer()
+
+		client := &remote.HTTPClient{
+			Log:      testLog.WithName("http-client"),
+			IndexURL: fmt.Sprintf("http://%s/%s", server.Addr(), "envtest-releases.yaml"),
+		}
+
+		env = &envp.Env{
+			Log:       testLog,
+			VerifySum: true, // on by default
+			FS:        baseFs,
+			Store:     &store.Store{Root: afero.NewBasePathFs(baseFs, testStorePath)},
+			Out:       out,
+			Platform: versions.PlatformItem{ // default
+				Platform: versions.Platform{
+					OS:   "linux",
+					Arch: "amd64",
+				},
+			},
+			Client: client,
+		}
 
-var _ = Describe("HTTP Client", func() {
-	WorkflowTest(httpMode)
-})
+		fakeStore(env.FS, testStorePath)
+		remoteHTTPItems = remoteVersionsHTTP
+	})
+	JustBeforeEach(func() {
+		handleRemoteVersionsHTTP(server, remoteHTTPItems)
+	})
+	AfterEach(func() {
+		server.Close()
+		server = nil
+	})
 
-func WorkflowTest(testMode string) {
-	Describe("Workflows", func() {
-		var (
-			env             *envp.Env
-			out             *bytes.Buffer
-			server          *ghttp.Server
-			remoteGCSItems  []item
-			remoteHTTPItems itemsHTTP
-		)
+	Describe("use", func() {
+		var flow wf.Use
 		BeforeEach(func() {
-			out = new(bytes.Buffer)
-			baseFs := afero.Afero{Fs: afero.NewMemMapFs()}
-
-			server = ghttp.NewServer()
-
-			var client remote.Client
-			switch testMode {
-			case gcsMode:
-				client = &remote.GCSClient{ //nolint:staticcheck // deprecation accepted for now
-					Log:      testLog.WithName("gcs-client"),
-					Bucket:   "kubebuilder-tools-test", // test custom bucket functionality too
-					Server:   server.Addr(),
-					Insecure: true, // no https in httptest :-(
-				}
-			case httpMode:
-				client = &remote.HTTPClient{
-					Log:      testLog.WithName("http-client"),
-					IndexURL: fmt.Sprintf("http://%s/%s", server.Addr(), "envtest-releases.yaml"),
-				}
+			// some defaults for most tests
+			env.Version = versions.Spec{
+				Selector: ver(1, 16, 0),
 			}
-
-			env = &envp.Env{
-				Log:       testLog,
-				VerifySum: true, // on by default
-				FS:        baseFs,
-				Store:     &store.Store{Root: afero.NewBasePathFs(baseFs, testStorePath)},
-				Out:       out,
-				Platform: versions.PlatformItem{ // default
-					Platform: versions.Platform{
-						OS:   "linux",
-						Arch: "amd64",
-					},
-				},
-				Client: client,
-			}
-
-			fakeStore(env.FS, testStorePath)
-			remoteGCSItems = remoteVersionsGCS
-			remoteHTTPItems = remoteVersionsHTTP
-		})
-		JustBeforeEach(func() {
-			switch testMode {
-			case gcsMode:
-				handleRemoteVersionsGCS(server, remoteGCSItems)
-			case httpMode:
-				handleRemoteVersionsHTTP(server, remoteHTTPItems)
+			flow = wf.Use{
+				PrintFormat: envp.PrintPath,
 			}
 		})
-		AfterEach(func() {
-			server.Close()
-			server = nil
+
+		It("should initialize the store if it doesn't exist", func() {
+			Expect(env.FS.RemoveAll(testStorePath)).To(Succeed())
+			// need to set this to a valid remote version cause our store is now empty
+			env.Version = versions.Spec{Selector: ver(1, 16, 4)}
+			flow.Do(env)
+			Expect(env.FS.Stat(testStorePath)).NotTo(BeNil())
 		})
 
-		Describe("use", func() {
-			var flow wf.Use
+		Context("when use env is set", func() {
 			BeforeEach(func() {
-				// some defaults for most tests
-				env.Version = versions.Spec{
-					Selector: ver(1, 16, 0),
-				}
-				flow = wf.Use{
-					PrintFormat: envp.PrintPath,
-				}
+				flow.UseEnv = true
 			})
-
-			It("should initialize the store if it doesn't exist", func() {
-				Expect(env.FS.RemoveAll(testStorePath)).To(Succeed())
-				// need to set this to a valid remote version cause our store is now empty
-				env.Version = versions.Spec{Selector: ver(1, 16, 4)}
+			It("should fall back to normal behavior when the env is not set", func() {
 				flow.Do(env)
-				Expect(env.FS.Stat(testStorePath)).NotTo(BeNil())
+				Expect(out.String()).To(HaveSuffix("/1.16.0-linux-amd64"), "should fall back to a local version")
 			})
-
-			Context("when use env is set", func() {
-				BeforeEach(func() {
-					flow.UseEnv = true
-				})
-				It("should fall back to normal behavior when the env is not set", func() {
-					flow.Do(env)
-					Expect(out.String()).To(HaveSuffix("/1.16.0-linux-amd64"), "should fall back to a local version")
-				})
-				It("should fall back to normal behavior if binaries are missing", func() {
-					flow.AssetsPath = ".teststore/missing-binaries"
-					flow.Do(env)
-					Expect(out.String()).To(HaveSuffix("/1.16.0-linux-amd64"), "should fall back to a local version")
-				})
-				It("should use the value of the env if it contains the right binaries", func() {
-					flow.AssetsPath = ".teststore/good-version"
-					flow.Do(env)
-					Expect(out.String()).To(Equal(flow.AssetsPath))
-				})
-				It("should not try and check the version of the binaries", func() {
-					flow.AssetsPath = ".teststore/wrong-version"
-					flow.Do(env)
-					Expect(out.String()).To(Equal(flow.AssetsPath))
-				})
-				It("should not need to contact the network", func() {
-					server.Close()
-					flow.AssetsPath = ".teststore/good-version"
-					flow.Do(env)
-					// expect to not get a panic -- if we do, it'll cause the test to fail
-				})
+			It("should fall back to normal behavior if binaries are missing", func() {
+				flow.AssetsPath = ".teststore/missing-binaries"
+				flow.Do(env)
+				Expect(out.String()).To(HaveSuffix("/1.16.0-linux-amd64"), "should fall back to a local version")
 			})
-
-			Context("when downloads are disabled", func() {
-				BeforeEach(func() {
-					env.NoDownload = true
-					server.Close()
-				})
-
-				// It("should not contact the network") is a gimme here, because we
-				// call server.Close() above.
-
-				It("should error if no matches are found locally", func() {
-					defer shouldHaveError()
-					env.Version.Selector = versions.Concrete{Major: 9001}
-					flow.Do(env)
-				})
-				It("should settle for the latest local match if latest is requested", func() {
-					env.Version = versions.Spec{
-						CheckLatest: true,
-						Selector: versions.PatchSelector{
-							Major: 1,
-							Minor: 16,
-							Patch: versions.AnyPoint,
-						},
-					}
-
-					flow.Do(env)
-
-					// latest on "server" is 1.16.4, shouldn't use that
-					Expect(out.String()).To(HaveSuffix("/1.16.1-linux-amd64"), "should use the latest local version")
-				})
+			It("should use the value of the env if it contains the right binaries", func() {
+				flow.AssetsPath = ".teststore/good-version"
+				flow.Do(env)
+				Expect(out.String()).To(Equal(flow.AssetsPath))
 			})
+			It("should not try and check the version of the binaries", func() {
+				flow.AssetsPath = ".teststore/wrong-version"
+				flow.Do(env)
+				Expect(out.String()).To(Equal(flow.AssetsPath))
+			})
+			It("should not need to contact the network", func() {
+				server.Close()
+				flow.AssetsPath = ".teststore/good-version"
+				flow.Do(env)
+				// expect to not get a panic -- if we do, it'll cause the test to fail
+			})
+		})
 
-			Context("if latest is requested", func() {
-				It("should contact the network to see if there's anything newer", func() {
-					env.Version = versions.Spec{
-						CheckLatest: true,
-						Selector: versions.PatchSelector{
-							Major: 1, Minor: 16, Patch: versions.AnyPoint,
-						},
-					}
-					flow.Do(env)
-					Expect(out.String()).To(HaveSuffix("/1.16.4-linux-amd64"), "should use the latest remote version")
-				})
-				It("should still use the latest local if the network doesn't have anything newer", func() {
-					env.Version = versions.Spec{
-						CheckLatest: true,
-						Selector: versions.PatchSelector{
-							Major: 1, Minor: 14, Patch: versions.AnyPoint,
-						},
-					}
+		Context("when downloads are disabled", func() {
+			BeforeEach(func() {
+				env.NoDownload = true
+				server.Close()
+			})
 
-					flow.Do(env)
+			// It("should not contact the network") is a gimme here, because we
+			// call server.Close() above.
 
-					// latest on the server is 1.14.1, latest local is 1.14.26
-					Expect(out.String()).To(HaveSuffix("/1.14.26-linux-amd64"), "should use the latest local version")
-				})
+			It("should error if no matches are found locally", func() {
+				defer shouldHaveError()
+				env.Version.Selector = versions.Concrete{Major: 9001}
+				flow.Do(env)
 			})
-
-			It("should check local for a match first", func() {
-				server.Close() // confirm no network
+			It("should settle for the latest local match if latest is requested", func() {
 				env.Version = versions.Spec{
-					Selector: versions.TildeSelector{Concrete: ver(1, 16, 0)},
+					CheckLatest: true,
+					Selector: versions.PatchSelector{
+						Major: 1,
+						Minor: 16,
+						Patch: versions.AnyPoint,
+					},
 				}
+
 				flow.Do(env)
-				// latest on the server is 1.16.4, latest local is 1.16.1
+
+				// latest on "server" is 1.16.4, shouldn't use that
 				Expect(out.String()).To(HaveSuffix("/1.16.1-linux-amd64"), "should use the latest local version")
 			})
+		})
 
-			It("should fall back to the network if no local matches are found", func() {
+		Context("if latest is requested", func() {
+			It("should contact the network to see if there's anything newer", func() {
 				env.Version = versions.Spec{
-					Selector: versions.TildeSelector{Concrete: ver(1, 19, 0)},
+					CheckLatest: true,
+					Selector: versions.PatchSelector{
+						Major: 1, Minor: 16, Patch: versions.AnyPoint,
+					},
 				}
 				flow.Do(env)
-				Expect(out.String()).To(HaveSuffix("/1.19.2-linux-amd64"), "should have a remote version")
+				Expect(out.String()).To(HaveSuffix("/1.16.4-linux-amd64"), "should use the latest remote version")
 			})
-
-			It("should error out if no matches can be found anywhere", func() {
-				defer shouldHaveError()
+			It("should still use the latest local if the network doesn't have anything newer", func() {
 				env.Version = versions.Spec{
-					Selector: versions.TildeSelector{Concrete: ver(0, 0, 1)},
+					CheckLatest: true,
+					Selector: versions.PatchSelector{
+						Major: 1, Minor: 14, Patch: versions.AnyPoint,
+					},
 				}
+
 				flow.Do(env)
+
+				// latest on the server is 1.14.1, latest local is 1.14.26
+				Expect(out.String()).To(HaveSuffix("/1.14.26-linux-amd64"), "should use the latest local version")
 			})
+		})
 
-			It("should skip local versions matches with non-matching platforms", func() {
-				env.NoDownload = true // so we get an error
-				defer shouldHaveError()
-				env.Version = versions.Spec{
-					// has non-matching local versions
-					Selector: ver(1, 13, 0),
-				}
+		It("should check local for a match first", func() {
+			server.Close() // confirm no network
+			env.Version = versions.Spec{
+				Selector: versions.TildeSelector{Concrete: ver(1, 16, 0)},
+			}
+			flow.Do(env)
+			// latest on the server is 1.16.4, latest local is 1.16.1
+			Expect(out.String()).To(HaveSuffix("/1.16.1-linux-amd64"), "should use the latest local version")
+		})
 
-				flow.Do(env)
-			})
+		It("should fall back to the network if no local matches are found", func() {
+			env.Version = versions.Spec{
+				Selector: versions.TildeSelector{Concrete: ver(1, 19, 0)},
+			}
+			flow.Do(env)
+			Expect(out.String()).To(HaveSuffix("/1.19.2-linux-amd64"), "should have a remote version")
+		})
+
+		It("should error out if no matches can be found anywhere", func() {
+			defer shouldHaveError()
+			env.Version = versions.Spec{
+				Selector: versions.TildeSelector{Concrete: ver(0, 0, 1)},
+			}
+			flow.Do(env)
+		})
+
+		It("should skip local versions matches with non-matching platforms", func() {
+			env.NoDownload = true // so we get an error
+			defer shouldHaveError()
+			env.Version = versions.Spec{
+				// has non-matching local versions
+				Selector: ver(1, 13, 0),
+			}
+
+			flow.Do(env)
+		})
+
+		It("should skip remote version matches with non-matching platforms", func() {
+			defer shouldHaveError()
+			env.Version = versions.Spec{
+				// has a non-matching remote version
+				Selector: versions.TildeSelector{Concrete: ver(1, 11, 1)},
+			}
+			flow.Do(env)
+		})
+
+		Describe("verifying the checksum", func() {
+			BeforeEach(func() {
+				// Recreate remoteHTTPItems to not impact others tests.
+				remoteHTTPItems = makeContentsHTTP(remoteNamesHTTP)
+				remoteHTTPItems.index.Releases["v86.75.309"] = map[string]remote.Archive{
+					"envtest-v86.75.309-linux-amd64.tar.gz": {
+						SelfLink: "not used in this test",
+						Hash:     "nottherightone!",
+					},
+				}
+				// need a valid tar.gz file to not error from that
+				remoteHTTPItems.contents["envtest-v86.75.309-linux-amd64.tar.gz"] = remoteHTTPItems.contents["envtest-v1.10-darwin-amd64.tar.gz"]
 
-			It("should skip remote version matches with non-matching platforms", func() {
-				defer shouldHaveError()
 				env.Version = versions.Spec{
-					// has a non-matching remote version
-					Selector: versions.TildeSelector{Concrete: ver(1, 11, 1)},
+					Selector: ver(86, 75, 309),
 				}
+			})
+			Specify("when enabled, should fail if the downloaded hash doesn't match", func() {
+				defer shouldHaveError()
 				flow.Do(env)
 			})
-
-			Describe("verifying the checksum", func() {
-				BeforeEach(func() {
-					remoteGCSItems = append(remoteGCSItems, item{
-						meta: bucketObject{
-							Name: "kubebuilder-tools-86.75.309-linux-amd64.tar.gz",
-							Hash: "nottherightone!",
-						},
-						contents: remoteGCSItems[0].contents, // need a valid tar.gz file to not error from that
-					})
-					// Recreate remoteHTTPItems to not impact others tests.
-					remoteHTTPItems = makeContentsHTTP(remoteNamesHTTP)
-					remoteHTTPItems.index.Releases["v86.75.309"] = map[string]remote.Archive{
-						"envtest-v86.75.309-linux-amd64.tar.gz": {
-							SelfLink: "not used in this test",
-							Hash:     "nottherightone!",
-						},
-					}
-					// need a valid tar.gz file to not error from that
-					remoteHTTPItems.contents["envtest-v86.75.309-linux-amd64.tar.gz"] = remoteHTTPItems.contents["envtest-v1.10-darwin-amd64.tar.gz"]
-
-					env.Version = versions.Spec{
-						Selector: ver(86, 75, 309),
-					}
-				})
-				Specify("when enabled, should fail if the downloaded hash doesn't match", func() {
-					defer shouldHaveError()
-					flow.Do(env)
-				})
-				Specify("when disabled, shouldn't check the checksum at all", func() {
-					env.VerifySum = false
-					flow.Do(env)
-				})
+			Specify("when disabled, shouldn't check the checksum at all", func() {
+				env.VerifySum = false
+				flow.Do(env)
 			})
 		})
+	})
 
-		Describe("list", func() {
-			// split by fields so we're not matching on whitespace
-			listFields := func() [][]string {
-				resLines := strings.Split(strings.TrimSpace(out.String()), "\n")
-				resFields := make([][]string, len(resLines))
-				for i, line := range resLines {
-					resFields[i] = strings.Fields(line)
-				}
-				return resFields
+	Describe("list", func() {
+		// split by fields so we're not matching on whitespace
+		listFields := func() [][]string {
+			resLines := strings.Split(strings.TrimSpace(out.String()), "\n")
+			resFields := make([][]string, len(resLines))
+			for i, line := range resLines {
+				resFields[i] = strings.Fields(line)
 			}
+			return resFields
+		}
 
-			Context("when downloads are disabled", func() {
+		Context("when downloads are disabled", func() {
+			BeforeEach(func() {
+				server.Close() // ensure no network
+				env.NoDownload = true
+			})
+			It("should include local contents sorted by version", func() {
+				env.Version = versions.AnyVersion
+				env.Platform.Platform = versions.Platform{OS: "*", Arch: "*"}
+				wf.List{}.Do(env)
+
+				Expect(listFields()).To(Equal([][]string{
+					{"(installed)", "v1.17.9", "linux/amd64"},
+					{"(installed)", "v1.16.2", "ifonlysingularitywasstillathing/amd64"},
+					{"(installed)", "v1.16.2", "linux/yourimagination"},
+					{"(installed)", "v1.16.1", "linux/amd64"},
+					{"(installed)", "v1.16.0", "linux/amd64"},
+					{"(installed)", "v1.14.26", "hyperwarp/pixiedust"},
+					{"(installed)", "v1.14.26", "linux/amd64"},
+				}))
+			})
+			It("should skip non-matching local contents", func() {
+				env.Version.Selector = versions.PatchSelector{
+					Major: 1, Minor: 16, Patch: versions.AnyPoint,
+				}
+				env.Platform.Arch = "*"
+				wf.List{}.Do(env)
+
+				Expect(listFields()).To(Equal([][]string{
+					{"(installed)", "v1.16.2", "linux/yourimagination"},
+					{"(installed)", "v1.16.1", "linux/amd64"},
+					{"(installed)", "v1.16.0", "linux/amd64"},
+				}))
+			})
+		})
+		Context("when downloads are enabled", func() {
+			Context("when sorting", func() {
 				BeforeEach(func() {
-					server.Close() // ensure no network
-					env.NoDownload = true
+					// Recreate remoteHTTPItems to not impact others tests.
+					remoteHTTPItems = makeContentsHTTP(remoteNamesHTTP)
+					// Also only keep the first 7 items.
+					// Get the first 7 archive names
+					var archiveNames []string
+					for _, release := range remoteHTTPItems.index.Releases {
+						for archiveName := range release {
+							archiveNames = append(archiveNames, archiveName)
+						}
+					}
+					sort.Strings(archiveNames)
+					archiveNamesSet := sets.Set[string]{}.Insert(archiveNames[:7]...)
+					// Delete all other archives
+					for _, release := range remoteHTTPItems.index.Releases {
+						for archiveName := range release {
+							if !archiveNamesSet.Has(archiveName) {
+								delete(release, archiveName)
+							}
+						}
+					}
 				})
-				It("should include local contents sorted by version", func() {
+				It("should sort local & remote by version", func() {
 					env.Version = versions.AnyVersion
 					env.Platform.Platform = versions.Platform{OS: "*", Arch: "*"}
 					wf.List{}.Do(env)
@@ -342,160 +357,103 @@ func WorkflowTest(testMode string) {
 						{"(installed)", "v1.16.0", "linux/amd64"},
 						{"(installed)", "v1.14.26", "hyperwarp/pixiedust"},
 						{"(installed)", "v1.14.26", "linux/amd64"},
-					}))
-				})
-				It("should skip non-matching local contents", func() {
-					env.Version.Selector = versions.PatchSelector{
-						Major: 1, Minor: 16, Patch: versions.AnyPoint,
-					}
-					env.Platform.Arch = "*"
-					wf.List{}.Do(env)
-
-					Expect(listFields()).To(Equal([][]string{
-						{"(installed)", "v1.16.2", "linux/yourimagination"},
-						{"(installed)", "v1.16.1", "linux/amd64"},
-						{"(installed)", "v1.16.0", "linux/amd64"},
+						{"(available)", "v1.11.1", "potato/cherrypie"},
+						{"(available)", "v1.11.0", "darwin/amd64"},
+						{"(available)", "v1.11.0", "linux/amd64"},
+						{"(available)", "v1.10.1", "darwin/amd64"},
+						{"(available)", "v1.10.1", "linux/amd64"},
 					}))
 				})
 			})
-			Context("when downloads are enabled", func() {
-				Context("when sorting", func() {
-					BeforeEach(func() {
-						// shorten the list a bit for expediency
-						remoteGCSItems = remoteGCSItems[:7]
-
-						// Recreate remoteHTTPItems to not impact others tests.
-						remoteHTTPItems = makeContentsHTTP(remoteNamesHTTP)
-						// Also only keep the first 7 items.
-						// Get the first 7 archive names
-						var archiveNames []string
-						for _, release := range remoteHTTPItems.index.Releases {
-							for archiveName := range release {
-								archiveNames = append(archiveNames, archiveName)
-							}
-						}
-						sort.Strings(archiveNames)
-						archiveNamesSet := sets.Set[string]{}.Insert(archiveNames[:7]...)
-						// Delete all other archives
-						for _, release := range remoteHTTPItems.index.Releases {
-							for archiveName := range release {
-								if !archiveNamesSet.Has(archiveName) {
-									delete(release, archiveName)
-								}
-							}
-						}
-					})
-					It("should sort local & remote by version", func() {
-						env.Version = versions.AnyVersion
-						env.Platform.Platform = versions.Platform{OS: "*", Arch: "*"}
-						wf.List{}.Do(env)
-
-						Expect(listFields()).To(Equal([][]string{
-							{"(installed)", "v1.17.9", "linux/amd64"},
-							{"(installed)", "v1.16.2", "ifonlysingularitywasstillathing/amd64"},
-							{"(installed)", "v1.16.2", "linux/yourimagination"},
-							{"(installed)", "v1.16.1", "linux/amd64"},
-							{"(installed)", "v1.16.0", "linux/amd64"},
-							{"(installed)", "v1.14.26", "hyperwarp/pixiedust"},
-							{"(installed)", "v1.14.26", "linux/amd64"},
-							{"(available)", "v1.11.1", "potato/cherrypie"},
-							{"(available)", "v1.11.0", "darwin/amd64"},
-							{"(available)", "v1.11.0", "linux/amd64"},
-							{"(available)", "v1.10.1", "darwin/amd64"},
-							{"(available)", "v1.10.1", "linux/amd64"},
-						}))
-					})
-				})
-				It("should skip non-matching remote contents", func() {
-					env.Version.Selector = versions.PatchSelector{
-						Major: 1, Minor: 16, Patch: versions.AnyPoint,
-					}
-					env.Platform.Arch = "*"
-					wf.List{}.Do(env)
-
-					Expect(listFields()).To(Equal([][]string{
-						{"(installed)", "v1.16.2", "linux/yourimagination"},
-						{"(installed)", "v1.16.1", "linux/amd64"},
-						{"(installed)", "v1.16.0", "linux/amd64"},
-						{"(available)", "v1.16.4", "linux/amd64"},
-					}))
-				})
+			It("should skip non-matching remote contents", func() {
+				env.Version.Selector = versions.PatchSelector{
+					Major: 1, Minor: 16, Patch: versions.AnyPoint,
+				}
+				env.Platform.Arch = "*"
+				wf.List{}.Do(env)
+
+				Expect(listFields()).To(Equal([][]string{
+					{"(installed)", "v1.16.2", "linux/yourimagination"},
+					{"(installed)", "v1.16.1", "linux/amd64"},
+					{"(installed)", "v1.16.0", "linux/amd64"},
+					{"(available)", "v1.16.4", "linux/amd64"},
+				}))
 			})
 		})
+	})
 
-		Describe("cleanup", func() {
-			BeforeEach(func() {
-				server.Close() // ensure no network
-				flow := wf.Cleanup{}
-				env.Version = versions.AnyVersion
-				env.Platform.Arch = "*"
-				flow.Do(env)
-			})
+	Describe("cleanup", func() {
+		BeforeEach(func() {
+			server.Close() // ensure no network
+			flow := wf.Cleanup{}
+			env.Version = versions.AnyVersion
+			env.Platform.Arch = "*"
+			flow.Do(env)
+		})
 
-			It("should remove matching versions from the store & keep non-matching ones", func() {
-				entries, err := env.FS.ReadDir(".teststore/k8s")
-				Expect(err).NotTo(HaveOccurred(), "should be able to read the store")
-				Expect(entries).To(ConsistOf(
-					WithTransform(fs.FileInfo.Name, Equal("1.16.2-ifonlysingularitywasstillathing-amd64")),
-					WithTransform(fs.FileInfo.Name, Equal("1.14.26-hyperwarp-pixiedust")),
-				))
-			})
+		It("should remove matching versions from the store & keep non-matching ones", func() {
+			entries, err := env.FS.ReadDir(".teststore/k8s")
+			Expect(err).NotTo(HaveOccurred(), "should be able to read the store")
+			Expect(entries).To(ConsistOf(
+				WithTransform(fs.FileInfo.Name, Equal("1.16.2-ifonlysingularitywasstillathing-amd64")),
+				WithTransform(fs.FileInfo.Name, Equal("1.14.26-hyperwarp-pixiedust")),
+			))
 		})
+	})
 
-		Describe("sideload", func() {
-			var (
-				flow wf.Sideload
-			)
+	Describe("sideload", func() {
+		var (
+			flow wf.Sideload
+		)
 
-			var expectedPrefix string
-			if testMode == gcsMode {
-				// remote version fake contents are prefixed by the
-				// name for easier debugging, so we can use that here
-				expectedPrefix = remoteVersionsGCS[0].meta.Name
-			}
-			if testMode == httpMode {
-				// hard coding to one of the archives in remoteVersionsHTTP as we can't pick the "first" of a map.
-				expectedPrefix = "envtest-v1.10-darwin-amd64.tar.gz"
-			}
+		// hard coding to one of the archives in remoteVersionsHTTP as we can't pick the "first" of a map.
+		expectedPrefix := "envtest-v1.10-darwin-amd64.tar.gz"
 
-			BeforeEach(func() {
-				server.Close() // ensure no network
-				var content []byte
-				if testMode == gcsMode {
-					content = remoteVersionsGCS[0].contents
-				}
-				if testMode == httpMode {
-					content = remoteVersionsHTTP.contents[expectedPrefix]
-				}
-				flow.Input = bytes.NewReader(content)
-				flow.PrintFormat = envp.PrintPath
-			})
-			It("should initialize the store if it doesn't exist", func() {
-				env.Version.Selector = ver(1, 10, 0)
-				Expect(env.FS.RemoveAll(testStorePath)).To(Succeed())
-				flow.Do(env)
-				Expect(env.FS.Stat(testStorePath)).NotTo(BeNil())
-			})
-			It("should fail if a non-concrete version is given", func() {
-				defer shouldHaveError()
-				env.Version = versions.LatestVersion
-				flow.Do(env)
-			})
-			It("should fail if a non-concrete platform is given", func() {
-				defer shouldHaveError()
-				env.Version.Selector = ver(1, 10, 0)
-				env.Platform.Arch = "*"
-				flow.Do(env)
-			})
-			It("should load the given gizipped tarball into our store as the given version", func() {
-				env.Version.Selector = ver(1, 10, 0)
-				flow.Do(env)
-				baseName := env.Platform.BaseName(*env.Version.AsConcrete())
-				expectedPath := filepath.Join(".teststore/k8s", baseName, "some-file")
-				outContents, err := env.FS.ReadFile(expectedPath)
-				Expect(err).NotTo(HaveOccurred(), "should be able to load the unzipped file")
-				Expect(string(outContents)).To(HavePrefix(expectedPrefix), "should have the debugging prefix")
-			})
+		BeforeEach(func() {
+			server.Close() // ensure no network
+
+			content := remoteVersionsHTTP.contents[expectedPrefix]
+
+			flow.Input = bytes.NewReader(content)
+			flow.PrintFormat = envp.PrintPath
+		})
+		It("should initialize the store if it doesn't exist", func() {
+			env.Version.Selector = ver(1, 10, 0)
+			Expect(env.FS.RemoveAll(testStorePath)).To(Succeed())
+			flow.Do(env)
+			Expect(env.FS.Stat(testStorePath)).NotTo(BeNil())
+		})
+		It("should fail if a non-concrete version is given", func() {
+			defer shouldHaveError()
+			env.Version = versions.LatestVersion
+			flow.Do(env)
+		})
+		It("should fail if a non-concrete platform is given", func() {
+			defer shouldHaveError()
+			env.Version.Selector = ver(1, 10, 0)
+			env.Platform.Arch = "*"
+			flow.Do(env)
+		})
+		It("should load the given gizipped tarball into our store as the given version", func() {
+			env.Version.Selector = ver(1, 10, 0)
+			flow.Do(env)
+			baseName := env.Platform.BaseName(*env.Version.AsConcrete())
+			expectedPath := filepath.Join(".teststore/k8s", baseName, "some-file")
+			outContents, err := env.FS.ReadFile(expectedPath)
+			Expect(err).NotTo(HaveOccurred(), "should be able to load the unzipped file")
+			Expect(string(outContents)).To(HavePrefix(expectedPrefix), "should have the debugging prefix")
 		})
 	})
-}
+
+	Describe("version", func() {
+		It("should print out the version if the RELEASE_TAG is empty", func() {
+			v := wf.Version{}
+			v.Do(env)
+			info, ok := debug.ReadBuildInfo()
+			Expect(ok).To(BeTrue())
+			Expect(out.String()).ToNot(BeEmpty())
+			Expect(out.String()).To(Equal(fmt.Sprintf("setup-envtest version: %s\n", info.Main.Version)))
+		})
+	})
+
+})
diff --git a/tools/setup-envtest/workflows/workflows_testutils_test.go b/tools/setup-envtest/workflows/workflows_testutils_test.go
index e796e5d16c..6bf6db38c3 100644
--- a/tools/setup-envtest/workflows/workflows_testutils_test.go
+++ b/tools/setup-envtest/workflows/workflows_testutils_test.go
@@ -7,10 +7,8 @@ import (
 	"archive/tar"
 	"bytes"
 	"compress/gzip"
-	"crypto/md5" //nolint:gosec
 	"crypto/rand"
 	"crypto/sha512"
-	"encoding/base64"
 	"encoding/hex"
 	"fmt"
 	"net/http"
@@ -27,45 +25,6 @@ import (
 )
 
 var (
-	remoteNamesGCS = []string{
-		"kubebuilder-tools-1.10-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.10-linux-amd64.tar.gz",
-		"kubebuilder-tools-1.10.1-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.10.1-linux-amd64.tar.gz",
-		"kubebuilder-tools-1.11.0-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.11.0-linux-amd64.tar.gz",
-		"kubebuilder-tools-1.11.1-potato-cherrypie.tar.gz",
-		"kubebuilder-tools-1.12.3-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.12.3-linux-amd64.tar.gz",
-		"kubebuilder-tools-1.13.1-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.13.1-linux-amd64.tar.gz",
-		"kubebuilder-tools-1.14.1-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.14.1-linux-amd64.tar.gz",
-		"kubebuilder-tools-1.15.5-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.15.5-linux-amd64.tar.gz",
-		"kubebuilder-tools-1.16.4-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.16.4-linux-amd64.tar.gz",
-		"kubebuilder-tools-1.17.9-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.17.9-linux-amd64.tar.gz",
-		"kubebuilder-tools-1.19.0-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.19.0-linux-amd64.tar.gz",
-		"kubebuilder-tools-1.19.2-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.19.2-linux-amd64.tar.gz",
-		"kubebuilder-tools-1.19.2-linux-arm64.tar.gz",
-		"kubebuilder-tools-1.19.2-linux-ppc64le.tar.gz",
-		"kubebuilder-tools-1.20.2-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.20.2-linux-amd64.tar.gz",
-		"kubebuilder-tools-1.20.2-linux-arm64.tar.gz",
-		"kubebuilder-tools-1.20.2-linux-ppc64le.tar.gz",
-		"kubebuilder-tools-1.9-darwin-amd64.tar.gz",
-		"kubebuilder-tools-1.9-linux-amd64.tar.gz",
-		"kubebuilder-tools-v1.19.2-darwin-amd64.tar.gz",
-		"kubebuilder-tools-v1.19.2-linux-amd64.tar.gz",
-		"kubebuilder-tools-v1.19.2-linux-arm64.tar.gz",
-		"kubebuilder-tools-v1.19.2-linux-ppc64le.tar.gz",
-	}
-	remoteVersionsGCS = makeContentsGCS(remoteNamesGCS)
-
 	remoteNamesHTTP = remote.Index{
 		Releases: map[string]remote.Release{
 			"v1.10.0": map[string]remote.Archive{
@@ -149,85 +108,6 @@ var (
 	}
 )
 
-type item struct {
-	meta     bucketObject
-	contents []byte
-}
-
-// objectList is the parts we need of the GCS "list-objects-in-bucket" endpoint.
-type objectList struct {
-	Items []bucketObject `json:"items"`
-}
-
-// bucketObject is the parts we need of the GCS object metadata.
-type bucketObject struct {
-	Name string `json:"name"`
-	Hash string `json:"md5Hash"`
-}
-
-func makeContentsGCS(names []string) []item {
-	res := make([]item, len(names))
-	for i, name := range names {
-		var chunk [1024 * 48]byte // 1.5 times our chunk read size in GetVersion
-		copy(chunk[:], name)
-		if _, err := rand.Read(chunk[len(name):]); err != nil {
-			panic(err)
-		}
-		res[i] = verWithGCS(name, chunk[:])
-	}
-	return res
-}
-
-func verWithGCS(name string, contents []byte) item {
-	out := new(bytes.Buffer)
-	gzipWriter := gzip.NewWriter(out)
-	tarWriter := tar.NewWriter(gzipWriter)
-	err := tarWriter.WriteHeader(&tar.Header{
-		Name: "kubebuilder/bin/some-file",
-		Size: int64(len(contents)),
-		Mode: 0777, // so we can check that we fix this later
-	})
-	if err != nil {
-		panic(err)
-	}
-	_, err = tarWriter.Write(contents)
-	if err != nil {
-		panic(err)
-	}
-	tarWriter.Close()
-	gzipWriter.Close()
-	res := item{
-		meta:     bucketObject{Name: name},
-		contents: out.Bytes(),
-	}
-	hash := md5.Sum(res.contents) //nolint:gosec
-	res.meta.Hash = base64.StdEncoding.EncodeToString(hash[:])
-	return res
-}
-
-func handleRemoteVersionsGCS(server *ghttp.Server, versions []item) {
-	list := objectList{Items: make([]bucketObject, len(versions))}
-	for i, ver := range versions {
-		ver := ver // copy to avoid capturing the iteration variable
-		list.Items[i] = ver.meta
-		server.RouteToHandler("GET", "/storage/v1/b/kubebuilder-tools-test/o/"+ver.meta.Name, func(resp http.ResponseWriter, req *http.Request) {
-			if req.URL.Query().Get("alt") == "media" {
-				resp.WriteHeader(http.StatusOK)
-				Expect(resp.Write(ver.contents)).To(Equal(len(ver.contents)))
-			} else {
-				ghttp.RespondWithJSONEncoded(
-					http.StatusOK,
-					ver.meta,
-				)(resp, req)
-			}
-		})
-	}
-	server.RouteToHandler("GET", "/storage/v1/b/kubebuilder-tools-test/o", ghttp.RespondWithJSONEncoded(
-		http.StatusOK,
-		list,
-	))
-}
-
 type itemsHTTP struct {
 	index    remote.Index
 	contents map[string][]byte