rebase: bump k8s.io/kubernetes from 1.26.2 to 1.27.2

Bumps [k8s.io/kubernetes](https://github.com/kubernetes/kubernetes) from 1.26.2 to 1.27.2.
- [Release notes](https://github.com/kubernetes/kubernetes/releases)
- [Commits](https://github.com/kubernetes/kubernetes/compare/v1.26.2...v1.27.2)

---
updated-dependencies:
- dependency-name: k8s.io/kubernetes
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

vendor/k8s.io/kube-openapi/pkg/internal/flags.go

@@ -18,3 +18,7 @@ package internal
 
 // Used by tests to selectively disable experimental JSON unmarshaler
 var UseOptimizedJSONUnmarshaling bool = true
+var UseOptimizedJSONUnmarshalingV3 bool = true
+
+// Used by tests to selectively disable experimental JSON marshaler
+var UseOptimizedJSONMarshaling bool = true

vendor/k8s.io/kube-openapi/pkg/internal/handler/handler_cache.go

@@ -1,57 +0,0 @@
-/*
-Copyright 2021 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package handler
-
-import (
-	"sync"
-)
-
-// HandlerCache represents a lazy cache for generating a byte array
-// It is used to lazily marshal OpenAPI v2/v3 and lazily generate the ETag
-type HandlerCache struct {
-	BuildCache func() ([]byte, error)
-	once       sync.Once
-	bytes      []byte
-	err        error
-}
-
-// Get either returns the cached value or calls BuildCache() once before caching and returning
-// its results. If BuildCache returns an error, the last valid value for the cache (from prior
-// calls to New()) is used instead if possible.
-func (c *HandlerCache) Get() ([]byte, error) {
-	c.once.Do(func() {
-		bytes, err := c.BuildCache()
-		// if there is an error updating the cache, there can be situations where
-		// c.bytes contains a valid value (carried over from the previous update)
-		// but c.err is also not nil; the cache user is expected to check for this
-		c.err = err
-		if c.err == nil {
-			// don't override previous spec if we had an error
-			c.bytes = bytes
-		}
-	})
-	return c.bytes, c.err
-}
-
-// New creates a new HandlerCache for situations where a cache refresh is needed.
-// This function is not thread-safe and should not be called at the same time as Get().
-func (c *HandlerCache) New(cacheBuilder func() ([]byte, error)) HandlerCache {
-	return HandlerCache{
-		bytes:      c.bytes,
-		BuildCache: cacheBuilder,
-	}
-}

vendor/k8s.io/kube-openapi/pkg/internal/serialization.go

@@ -0,0 +1,65 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package internal
+
+import (
+	"github.com/go-openapi/jsonreference"
+	jsonv2 "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json"
+)
+
+// DeterministicMarshal calls the jsonv2 library with the deterministic
+// flag in order to have stable marshaling.
+func DeterministicMarshal(in any) ([]byte, error) {
+	return jsonv2.MarshalOptions{Deterministic: true}.Marshal(jsonv2.EncodeOptions{}, in)
+}
+
+// JSONRefFromMap populates a json reference object if the map v contains a $ref key.
+func JSONRefFromMap(jsonRef *jsonreference.Ref, v map[string]interface{}) error {
+	if v == nil {
+		return nil
+	}
+	if vv, ok := v["$ref"]; ok {
+		if str, ok := vv.(string); ok {
+			ref, err := jsonreference.New(str)
+			if err != nil {
+				return err
+			}
+			*jsonRef = ref
+		}
+	}
+	return nil
+}
+
+// SanitizeExtensions sanitizes the input map such that non extension
+// keys (non x-*, X-*) keys are dropped from the map. Returns the new
+// modified map, or nil if the map is now empty.
+func SanitizeExtensions(e map[string]interface{}) map[string]interface{} {
+	for k := range e {
+		if !IsExtensionKey(k) {
+			delete(e, k)
+		}
+	}
+	if len(e) == 0 {
+		e = nil
+	}
+	return e
+}
+
+// IsExtensionKey returns true if the input string is of format x-* or X-*
+func IsExtensionKey(k string) bool {
+	return len(k) > 1 && (k[0] == 'x' || k[0] == 'X') && k[1] == '-'
+}

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal.go

@@ -34,6 +34,13 @@ type MarshalOptions struct {
 	// unknown JSON object members.
 	DiscardUnknownMembers bool
 
+	// Deterministic specifies that the same input value will be serialized
+	// as the exact same output bytes. Different processes of
+	// the same program will serialize equal values to the same bytes,
+	// but different versions of the same program are not guaranteed
+	// to produce the exact same sequence of bytes.
+	Deterministic bool
+
 	// formatDepth is the depth at which we respect the format flag.
 	formatDepth int
 	// format is custom formatting for the value at the specified depth.

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_any.go

@@ -62,7 +62,7 @@ func unmarshalValueAny(uo UnmarshalOptions, dec *Decoder) (any, error) {
 			}
 			return dec.stringCache.make(val), nil
 		case '0':
-			fv, _ := parseFloat(val, 64) // ignore error since readValue gaurantees val is valid
+			fv, _ := parseFloat(val, 64) // ignore error since readValue guarantees val is valid
 			return fv, nil
 		default:
 			panic("BUG: invalid kind: " + k.String())
@@ -99,13 +99,32 @@ func marshalObjectAny(mo MarshalOptions, enc *Encoder, obj map[string]any) error
 	if !enc.options.AllowInvalidUTF8 {
 		enc.tokens.last.disableNamespace()
 	}
-	for name, val := range obj {
-		if err := enc.WriteToken(String(name)); err != nil {
-			return err
+	if !mo.Deterministic || len(obj) <= 1 {
+		for name, val := range obj {
+			if err := enc.WriteToken(String(name)); err != nil {
+				return err
+			}
+			if err := marshalValueAny(mo, enc, val); err != nil {
+				return err
+			}
 		}
-		if err := marshalValueAny(mo, enc, val); err != nil {
-			return err
+	} else {
+		names := getStrings(len(obj))
+		var i int
+		for name := range obj {
+			(*names)[i] = name
+			i++
 		}
+		names.Sort()
+		for _, name := range *names {
+			if err := enc.WriteToken(String(name)); err != nil {
+				return err
+			}
+			if err := marshalValueAny(mo, enc, obj[name]); err != nil {
+				return err
+			}
+		}
+		putStrings(names)
 	}
 	if err := enc.WriteToken(ObjectEnd); err != nil {
 		return err

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_default.go

@@ -5,6 +5,7 @@
 package json
 
 import (
+	"bytes"
 	"encoding/base32"
 	"encoding/base64"
 	"encoding/hex"
@@ -12,6 +13,7 @@ import (
 	"fmt"
 	"math"
 	"reflect"
+	"sort"
 	"strconv"
 	"sync"
 )
@@ -228,13 +230,7 @@ func makeBytesArshaler(t reflect.Type, fncs *arshaler) *arshaler {
 			}
 		}
 		val := enc.UnusedBuffer()
-		var b []byte
-		if va.Kind() == reflect.Array {
-			// TODO(https://go.dev/issue/47066): Avoid reflect.Value.Slice.
-			b = va.Slice(0, va.Len()).Bytes()
-		} else {
-			b = va.Bytes()
-		}
+		b := va.Bytes()
 		n := len(`"`) + encodedLen(len(b)) + len(`"`)
 		if cap(val) < n {
 			val = make([]byte, n)
@@ -248,19 +244,19 @@ func makeBytesArshaler(t reflect.Type, fncs *arshaler) *arshaler {
 	}
 	unmarshalDefault := fncs.unmarshal
 	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-		decode, decodedLen := decodeBase64, decodedLenBase64
+		decode, decodedLen, encodedLen := decodeBase64, decodedLenBase64, encodedLenBase64
 		if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
 			switch uo.format {
 			case "base64":
-				decode, decodedLen = decodeBase64, decodedLenBase64
+				decode, decodedLen, encodedLen = decodeBase64, decodedLenBase64, encodedLenBase64
 			case "base64url":
-				decode, decodedLen = decodeBase64URL, decodedLenBase64URL
+				decode, decodedLen, encodedLen = decodeBase64URL, decodedLenBase64URL, encodedLenBase64URL
 			case "base32":
-				decode, decodedLen = decodeBase32, decodedLenBase32
+				decode, decodedLen, encodedLen = decodeBase32, decodedLenBase32, encodedLenBase32
 			case "base32hex":
-				decode, decodedLen = decodeBase32Hex, decodedLenBase32Hex
+				decode, decodedLen, encodedLen = decodeBase32Hex, decodedLenBase32Hex, encodedLenBase32Hex
 			case "base16", "hex":
-				decode, decodedLen = decodeBase16, decodedLenBase16
+				decode, decodedLen, encodedLen = decodeBase16, decodedLenBase16, encodedLenBase16
 			case "array":
 				uo.format = ""
 				return unmarshalDefault(uo, dec, va)
@@ -290,23 +286,28 @@ func makeBytesArshaler(t reflect.Type, fncs *arshaler) *arshaler {
 				n--
 			}
 			n = decodedLen(n)
-			var b []byte
+			b := va.Bytes()
 			if va.Kind() == reflect.Array {
-				// TODO(https://go.dev/issue/47066): Avoid reflect.Value.Slice.
-				b = va.Slice(0, va.Len()).Bytes()
 				if n != len(b) {
 					err := fmt.Errorf("decoded base64 length of %d mismatches array length of %d", n, len(b))
 					return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
 				}
 			} else {
-				b = va.Bytes()
 				if b == nil || cap(b) < n {
 					b = make([]byte, n)
 				} else {
 					b = b[:n]
 				}
 			}
-			if _, err := decode(b, val); err != nil {
+			n2, err := decode(b, val)
+			if err == nil && len(val) != encodedLen(n2) {
+				// TODO(https://go.dev/issue/53845): RFC 4648, section 3.3,
+				// specifies that non-alphabet characters must be rejected.
+				// Unfortunately, the "base32" and "base64" packages allow
+				// '\r' and '\n' characters by default.
+				err = errors.New("illegal data at input byte " + strconv.Itoa(bytes.IndexAny(val, "\r\n")))
+			}
+			if err != nil {
 				return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
 			}
 			if va.Kind() == reflect.Slice {
@@ -412,7 +413,7 @@ func makeUintArshaler(t reflect.Type) *arshaler {
 			return nil
 		}
 
-		x := math.Float64frombits(uint64(va.Uint()))
+		x := math.Float64frombits(va.Uint())
 		return enc.writeNumber(x, rawUintNumber, mo.StringifyNumbers)
 	}
 	fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
@@ -450,7 +451,7 @@ func makeUintArshaler(t reflect.Type) *arshaler {
 				err := fmt.Errorf("cannot parse %q as unsigned integer: %w", val, strconv.ErrRange)
 				return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
 			}
-			va.SetUint(uint64(n))
+			va.SetUint(n)
 			return nil
 		}
 		return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t}
@@ -549,23 +550,9 @@ func makeFloatArshaler(t reflect.Type) *arshaler {
 	return &fncs
 }
 
-var mapIterPool = sync.Pool{
-	New: func() any { return new(reflect.MapIter) },
-}
-
-func getMapIter(mv reflect.Value) *reflect.MapIter {
-	iter := mapIterPool.Get().(*reflect.MapIter)
-	iter.Reset(mv)
-	return iter
-}
-func putMapIter(iter *reflect.MapIter) {
-	iter.Reset(reflect.Value{}) // allow underlying map to be garbage collected
-	mapIterPool.Put(iter)
-}
-
 func makeMapArshaler(t reflect.Type) *arshaler {
 	// NOTE: The logic below disables namespaces for tracking duplicate names
-	// when handling map keys with a unique represention.
+	// when handling map keys with a unique representation.
 
 	// NOTE: Values retrieved from a map are not addressable,
 	// so we shallow copy the values to make them addressable and
@@ -641,24 +628,76 @@ func makeMapArshaler(t reflect.Type) *arshaler {
 				enc.tokens.last.disableNamespace()
 			}
 
-			// NOTE: Map entries are serialized in a non-deterministic order.
-			// Users that need stable output should call RawValue.Canonicalize.
-			// TODO(go1.19): Remove use of a sync.Pool with reflect.MapIter.
-			// Calling reflect.Value.MapRange no longer allocates.
-			// See https://go.dev/cl/400675.
-			iter := getMapIter(va.Value)
-			defer putMapIter(iter)
-			for iter.Next() {
-				k.SetIterKey(iter)
-				if err := marshalKey(mko, enc, k); err != nil {
-					// TODO: If err is errMissingName, then wrap it as a
-					// SemanticError since this key type cannot be serialized
-					// as a JSON string.
-					return err
+			switch {
+			case !mo.Deterministic || n <= 1:
+				for iter := va.Value.MapRange(); iter.Next(); {
+					k.SetIterKey(iter)
+					if err := marshalKey(mko, enc, k); err != nil {
+						// TODO: If err is errMissingName, then wrap it as a
+						// SemanticError since this key type cannot be serialized
+						// as a JSON string.
+						return err
+					}
+					v.SetIterValue(iter)
+					if err := marshalVal(mo, enc, v); err != nil {
+						return err
+					}
 				}
-				v.SetIterValue(iter)
-				if err := marshalVal(mo, enc, v); err != nil {
-					return err
+			case !nonDefaultKey && t.Key().Kind() == reflect.String:
+				names := getStrings(n)
+				for i, iter := 0, va.Value.MapRange(); i < n && iter.Next(); i++ {
+					k.SetIterKey(iter)
+					(*names)[i] = k.String()
+				}
+				names.Sort()
+				for _, name := range *names {
+					if err := enc.WriteToken(String(name)); err != nil {
+						return err
+					}
+					// TODO(https://go.dev/issue/57061): Use v.SetMapIndexOf.
+					k.SetString(name)
+					v.Set(va.MapIndex(k.Value))
+					if err := marshalVal(mo, enc, v); err != nil {
+						return err
+					}
+				}
+				putStrings(names)
+			default:
+				type member struct {
+					name string // unquoted name
+					key  addressableValue
+				}
+				members := make([]member, n)
+				keys := reflect.MakeSlice(reflect.SliceOf(t.Key()), n, n)
+				for i, iter := 0, va.Value.MapRange(); i < n && iter.Next(); i++ {
+					// Marshal the member name.
+					k := addressableValue{keys.Index(i)} // indexed slice element is always addressable
+					k.SetIterKey(iter)
+					if err := marshalKey(mko, enc, k); err != nil {
+						// TODO: If err is errMissingName, then wrap it as a
+						// SemanticError since this key type cannot be serialized
+						// as a JSON string.
+						return err
+					}
+					name := enc.unwriteOnlyObjectMemberName()
+					members[i] = member{name, k}
+				}
+				// TODO: If AllowDuplicateNames is enabled, then sort according
+				// to reflect.Value as well if the names are equal.
+				// See internal/fmtsort.
+				// TODO(https://go.dev/issue/47619): Use slices.SortFunc instead.
+				sort.Slice(members, func(i, j int) bool {
+					return lessUTF16(members[i].name, members[j].name)
+				})
+				for _, member := range members {
+					if err := enc.WriteToken(String(member.name)); err != nil {
+						return err
+					}
+					// TODO(https://go.dev/issue/57061): Use v.SetMapIndexOf.
+					v.Set(va.MapIndex(member.key.Value))
+					if err := marshalVal(mo, enc, v); err != nil {
+						return err
+					}
 				}
 			}
 		}
@@ -856,7 +895,7 @@ func makeStructArshaler(t reflect.Type) *arshaler {
 			//	2. The object namespace is guaranteed to be disabled.
 			//	3. The object name is guaranteed to be valid and pre-escaped.
 			//	4. There is no need to flush the buffer (for unwrite purposes).
-			//	5. There is no possibility of an error occuring.
+			//	5. There is no possibility of an error occurring.
 			if optimizeCommon {
 				// Append any delimiters or optional whitespace.
 				if enc.tokens.last.length() > 0 {
@@ -996,7 +1035,7 @@ func makeStructArshaler(t reflect.Type) *arshaler {
 
 						if fields.inlinedFallback == nil {
 							// Skip unknown value since we have no place to store it.
-							if err := dec.skipValue(); err != nil {
+							if err := dec.SkipValue(); err != nil {
 								return err
 							}
 						} else {

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_inlined.go

@@ -5,6 +5,7 @@
 package json
 
 import (
+	"bytes"
 	"errors"
 	"reflect"
 )
@@ -89,35 +90,61 @@ func marshalInlinedFallbackAll(mo MarshalOptions, enc *Encoder, va addressableVa
 		}
 		return nil
 	} else {
-		if v.Len() == 0 {
+		m := v // must be a map[string]V
+		n := m.Len()
+		if n == 0 {
 			return nil
 		}
-		m := v
+		mk := newAddressableValue(stringType)
 		mv := newAddressableValue(m.Type().Elem())
-		for iter := m.MapRange(); iter.Next(); {
-			b, err := appendString(enc.UnusedBuffer(), iter.Key().String(), !enc.options.AllowInvalidUTF8, nil)
+		marshalKey := func(mk addressableValue) error {
+			b, err := appendString(enc.UnusedBuffer(), mk.String(), !enc.options.AllowInvalidUTF8, nil)
 			if err != nil {
 				return err
 			}
 			if insertUnquotedName != nil {
-				isVerbatim := consumeSimpleString(b) == len(b)
+				isVerbatim := bytes.IndexByte(b, '\\') < 0
 				name := unescapeStringMayCopy(b, isVerbatim)
 				if !insertUnquotedName(name) {
 					return &SyntacticError{str: "duplicate name " + string(b) + " in object"}
 				}
 			}
-			if err := enc.WriteValue(b); err != nil {
-				return err
+			return enc.WriteValue(b)
+		}
+		marshalVal := f.fncs.marshal
+		if mo.Marshalers != nil {
+			marshalVal, _ = mo.Marshalers.lookup(marshalVal, mv.Type())
+		}
+		if !mo.Deterministic || n <= 1 {
+			for iter := m.MapRange(); iter.Next(); {
+				mk.SetIterKey(iter)
+				if err := marshalKey(mk); err != nil {
+					return err
+				}
+				mv.Set(iter.Value())
+				if err := marshalVal(mo, enc, mv); err != nil {
+					return err
+				}
 			}
-
-			mv.Set(iter.Value())
-			marshal := f.fncs.marshal
-			if mo.Marshalers != nil {
-				marshal, _ = mo.Marshalers.lookup(marshal, mv.Type())
+		} else {
+			names := getStrings(n)
+			for i, iter := 0, m.Value.MapRange(); i < n && iter.Next(); i++ {
+				mk.SetIterKey(iter)
+				(*names)[i] = mk.String()
 			}
-			if err := marshal(mo, enc, mv); err != nil {
-				return err
+			names.Sort()
+			for _, name := range *names {
+				mk.SetString(name)
+				if err := marshalKey(mk); err != nil {
+					return err
+				}
+				// TODO(https://go.dev/issue/57061): Use mv.SetMapIndexOf.
+				mv.Set(m.MapIndex(mk.Value))
+				if err := marshalVal(mo, enc, mv); err != nil {
+					return err
+				}
 			}
+			putStrings(names)
 		}
 		return nil
 	}
@@ -162,7 +189,7 @@ func unmarshalInlinedFallbackNext(uo UnmarshalOptions, dec *Decoder, va addressa
 	} else {
 		name := string(unquotedName) // TODO: Intern this?
 
-		m := v
+		m := v // must be a map[string]V
 		if m.IsNil() {
 			m.Set(reflect.MakeMap(m.Type()))
 		}

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_methods.go

@@ -21,8 +21,8 @@ var (
 )
 
 // MarshalerV1 is implemented by types that can marshal themselves.
-// It is recommended that types implement MarshalerV2 unless
-// the implementation is trying to avoid a hard dependency on this package.
+// It is recommended that types implement MarshalerV2 unless the implementation
+// is trying to avoid a hard dependency on the "jsontext" package.
 //
 // It is recommended that implementations return a buffer that is safe
 // for the caller to retain and potentially mutate.

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/arshal_time.go

@@ -5,6 +5,7 @@
 package json
 
 import (
+	"errors"
 	"fmt"
 	"reflect"
 	"strings"
@@ -85,25 +86,39 @@ func makeTimeArshaler(fncs *arshaler, t reflect.Type) *arshaler {
 		fncs.nonDefault = true
 		fncs.marshal = func(mo MarshalOptions, enc *Encoder, va addressableValue) error {
 			format := time.RFC3339Nano
+			isRFC3339 := true
 			if mo.format != "" && mo.formatDepth == enc.tokens.depth() {
 				var err error
-				format, err = checkTimeFormat(mo.format)
+				format, isRFC3339, err = checkTimeFormat(mo.format)
 				if err != nil {
 					return &SemanticError{action: "marshal", GoType: t, Err: err}
 				}
 			}
 
 			tt := va.Interface().(time.Time)
-			if y := tt.Year(); y < 0 || y >= 10000 {
-				// RFC 3339 is clear that years are 4 digits exactly.
-				// See https://go.dev/issue/4556#c15 for more discussion.
-				err := fmt.Errorf("year %d outside of range [0,9999]", y)
-				return &SemanticError{action: "marshal", GoType: t, Err: err}
-			}
 			b := enc.UnusedBuffer()
 			b = append(b, '"')
 			b = tt.AppendFormat(b, format)
 			b = append(b, '"')
+			if isRFC3339 {
+				// Not all Go timestamps can be represented as valid RFC 3339.
+				// Explicitly check for these edge cases.
+				// See https://go.dev/issue/4556 and https://go.dev/issue/54580.
+				var err error
+				switch b := b[len(`"`) : len(b)-len(`"`)]; {
+				case b[len("9999")] != '-': // year must be exactly 4 digits wide
+					err = errors.New("year outside of range [0,9999]")
+				case b[len(b)-1] != 'Z':
+					c := b[len(b)-len("Z07:00")]
+					if ('0' <= c && c <= '9') || parseDec2(b[len(b)-len("07:00"):]) >= 24 {
+						err = errors.New("timezone hour outside of range [0,23]")
+					}
+				}
+				if err != nil {
+					return &SemanticError{action: "marshal", GoType: t, Err: err}
+				}
+				return enc.WriteValue(b) // RFC 3339 never needs JSON escaping
+			}
 			// The format may contain special characters that need escaping.
 			// Verify that the result is a valid JSON string (common case),
 			// otherwise escape the string correctly (slower case).
@@ -113,10 +128,11 @@ func makeTimeArshaler(fncs *arshaler, t reflect.Type) *arshaler {
 			return enc.WriteValue(b)
 		}
 		fncs.unmarshal = func(uo UnmarshalOptions, dec *Decoder, va addressableValue) error {
-			format := time.RFC3339Nano
+			format := time.RFC3339
+			isRFC3339 := true
 			if uo.format != "" && uo.formatDepth == dec.tokens.depth() {
 				var err error
-				format, err = checkTimeFormat(uo.format)
+				format, isRFC3339, err = checkTimeFormat(uo.format)
 				if err != nil {
 					return &SemanticError{action: "unmarshal", GoType: t, Err: err}
 				}
@@ -136,6 +152,29 @@ func makeTimeArshaler(fncs *arshaler, t reflect.Type) *arshaler {
 			case '"':
 				val = unescapeStringMayCopy(val, flags.isVerbatim())
 				tt2, err := time.Parse(format, string(val))
+				if isRFC3339 && err == nil {
+					// TODO(https://go.dev/issue/54580): RFC 3339 specifies
+					// the exact grammar of a valid timestamp. However,
+					// the parsing functionality in "time" is too loose and
+					// incorrectly accepts invalid timestamps as valid.
+					// Remove these manual checks when "time" checks it for us.
+					newParseError := func(layout, value, layoutElem, valueElem, message string) error {
+						return &time.ParseError{Layout: layout, Value: value, LayoutElem: layoutElem, ValueElem: valueElem, Message: message}
+					}
+					switch {
+					case val[len("2006-01-02T")+1] == ':': // hour must be two digits
+						err = newParseError(format, string(val), "15", string(val[len("2006-01-02T"):][:1]), "")
+					case val[len("2006-01-02T15:04:05")] == ',': // sub-second separator must be a period
+						err = newParseError(format, string(val), ".", ",", "")
+					case val[len(val)-1] != 'Z':
+						switch {
+						case parseDec2(val[len(val)-len("07:00"):]) >= 24: // timezone hour must be in range
+							err = newParseError(format, string(val), "Z07:00", string(val[len(val)-len("Z07:00"):]), ": timezone hour out of range")
+						case parseDec2(val[len(val)-len("00"):]) >= 60: // timezone minute must be in range
+							err = newParseError(format, string(val), "Z07:00", string(val[len(val)-len("Z07:00"):]), ": timezone minute out of range")
+						}
+					}
+				}
 				if err != nil {
 					return &SemanticError{action: "unmarshal", JSONKind: k, GoType: t, Err: err}
 				}
@@ -149,48 +188,54 @@ func makeTimeArshaler(fncs *arshaler, t reflect.Type) *arshaler {
 	return fncs
 }
 
-func checkTimeFormat(format string) (string, error) {
+func checkTimeFormat(format string) (string, bool, error) {
 	// We assume that an exported constant in the time package will
 	// always start with an uppercase ASCII letter.
 	if len(format) > 0 && 'A' <= format[0] && format[0] <= 'Z' {
 		switch format {
 		case "ANSIC":
-			return time.ANSIC, nil
+			return time.ANSIC, false, nil
 		case "UnixDate":
-			return time.UnixDate, nil
+			return time.UnixDate, false, nil
 		case "RubyDate":
-			return time.RubyDate, nil
+			return time.RubyDate, false, nil
 		case "RFC822":
-			return time.RFC822, nil
+			return time.RFC822, false, nil
 		case "RFC822Z":
-			return time.RFC822Z, nil
+			return time.RFC822Z, false, nil
 		case "RFC850":
-			return time.RFC850, nil
+			return time.RFC850, false, nil
 		case "RFC1123":
-			return time.RFC1123, nil
+			return time.RFC1123, false, nil
 		case "RFC1123Z":
-			return time.RFC1123Z, nil
+			return time.RFC1123Z, false, nil
 		case "RFC3339":
-			return time.RFC3339, nil
+			return time.RFC3339, true, nil
 		case "RFC3339Nano":
-			return time.RFC3339Nano, nil
+			return time.RFC3339Nano, true, nil
 		case "Kitchen":
-			return time.Kitchen, nil
+			return time.Kitchen, false, nil
 		case "Stamp":
-			return time.Stamp, nil
+			return time.Stamp, false, nil
 		case "StampMilli":
-			return time.StampMilli, nil
+			return time.StampMilli, false, nil
 		case "StampMicro":
-			return time.StampMicro, nil
+			return time.StampMicro, false, nil
 		case "StampNano":
-			return time.StampNano, nil
+			return time.StampNano, false, nil
 		default:
 			// Reject any format that is an exported Go identifier in case
 			// new format constants are added to the time package.
 			if strings.TrimFunc(format, isLetterOrDigit) == "" {
-				return "", fmt.Errorf("undefined format layout: %v", format)
+				return "", false, fmt.Errorf("undefined format layout: %v", format)
 			}
 		}
 	}
-	return format, nil
+	return format, false, nil
+}
+
+// parseDec2 parses b as an unsigned, base-10, 2-digit number.
+// It panics if len(b) < 2. The result is undefined if digits are not base-10.
+func parseDec2(b []byte) byte {
+	return 10*(b[0]-'0') + (b[1] - '0')
 }

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/decode.go

@@ -347,9 +347,9 @@ func (d *Decoder) PeekKind() Kind {
 	return next
 }
 
-// skipValue is semantically equivalent to calling ReadValue and discarding
+// SkipValue is semantically equivalent to calling ReadValue and discarding
 // the result except that memory is not wasted trying to hold the entire result.
-func (d *Decoder) skipValue() error {
+func (d *Decoder) SkipValue() error {
 	switch d.PeekKind() {
 	case '{', '[':
 		// For JSON objects and arrays, keep skipping all tokens
@@ -374,7 +374,7 @@ func (d *Decoder) skipValue() error {
 }
 
 // ReadToken reads the next Token, advancing the read offset.
-// The returned token is only valid until the next Peek or Read call.
+// The returned token is only valid until the next Peek, Read, or Skip call.
 // It returns io.EOF if there are no more tokens.
 func (d *Decoder) ReadToken() (Token, error) {
 	// Determine the next kind.
@@ -585,7 +585,7 @@ func (f valueFlags) isCanonical() bool  { return f&stringNonCanonical == 0 }
 
 // ReadValue returns the next raw JSON value, advancing the read offset.
 // The value is stripped of any leading or trailing whitespace.
-// The returned value is only valid until the next Peek or Read call and
+// The returned value is only valid until the next Peek, Read, or Skip call and
 // may not be mutated while the Decoder remains in use.
 // If the decoder is currently at the end token for an object or array,
 // then it reports a SyntacticError and the internal state remains unchanged.
@@ -1013,7 +1013,7 @@ func (d *Decoder) InputOffset() int64 {
 // UnreadBuffer returns the data remaining in the unread buffer,
 // which may contain zero or more bytes.
 // The returned buffer must not be mutated while Decoder continues to be used.
-// The buffer contents are valid until the next Peek or Read call.
+// The buffer contents are valid until the next Peek, Read, or Skip call.
 func (d *Decoder) UnreadBuffer() []byte {
 	return d.unreadBuffer()
 }
@@ -1213,7 +1213,7 @@ func consumeStringResumable(flags *valueFlags, b []byte, resumeOffset int, valid
 					return n, &SyntacticError{str: "invalid escape sequence " + strconv.Quote(string(b[n:n+6])) + " within string"}
 				}
 				// Only certain control characters can use the \uFFFF notation
-				// for canonical formating (per RFC 8785, section 3.2.2.2.).
+				// for canonical formatting (per RFC 8785, section 3.2.2.2.).
 				switch v1 {
 				// \uFFFF notation not permitted for these characters.
 				case '\b', '\f', '\n', '\r', '\t':

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/doc.go

@@ -8,8 +8,7 @@
 // primitive data types such as booleans, strings, and numbers,
 // in addition to structured data types such as objects and arrays.
 //
-//
-// Terminology
+// # Terminology
 //
 // This package uses the terms "encode" and "decode" for syntactic functionality
 // that is concerned with processing JSON based on its grammar, and
@@ -32,8 +31,7 @@
 //
 // See RFC 8259 for more information.
 //
-//
-// Specifications
+// # Specifications
 //
 // Relevant specifications include RFC 4627, RFC 7159, RFC 7493, RFC 8259,
 // and RFC 8785. Each RFC is generally a stricter subset of another RFC.
@@ -60,8 +58,7 @@
 // In particular, it makes specific choices about behavior that RFC 8259
 // leaves as undefined in order to ensure greater interoperability.
 //
-//
-// JSON Representation of Go structs
+// # JSON Representation of Go structs
 //
 // A Go struct is naturally represented as a JSON object,
 // where each Go struct field corresponds with a JSON object member.

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/encode.go

@@ -347,6 +347,30 @@ func (e *Encoder) unwriteEmptyObjectMember(prevName *string) bool {
 	return true
 }
 
+// unwriteOnlyObjectMemberName unwrites the only object member name
+// and returns the unquoted name.
+func (e *Encoder) unwriteOnlyObjectMemberName() string {
+	if last := e.tokens.last; !last.isObject() || last.length() != 1 {
+		panic("BUG: must be called on an object after writing first name")
+	}
+
+	// Unwrite the name and whitespace.
+	b := trimSuffixString(e.buf)
+	isVerbatim := bytes.IndexByte(e.buf[len(b):], '\\') < 0
+	name := string(unescapeStringMayCopy(e.buf[len(b):], isVerbatim))
+	e.buf = trimSuffixWhitespace(b)
+
+	// Undo state changes.
+	e.tokens.last.decrement()
+	if !e.options.AllowDuplicateNames {
+		if e.tokens.last.isActiveNamespace() {
+			e.namespaces.last().removeLast()
+		}
+		e.names.clearLast()
+	}
+	return name
+}
+
 func trimSuffixWhitespace(b []byte) []byte {
 	// NOTE: The arguments and logic are kept simple to keep this inlineable.
 	n := len(b) - 1

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/pools.go

@@ -8,6 +8,7 @@ import (
 	"bytes"
 	"io"
 	"math/bits"
+	"sort"
 	"sync"
 )
 
@@ -148,3 +149,34 @@ func putStreamingDecoder(d *Decoder) {
 		streamingDecoderPool.Put(d)
 	}
 }
+
+var stringsPools = &sync.Pool{New: func() any { return new(stringSlice) }}
+
+type stringSlice []string
+
+// getStrings returns a non-nil pointer to a slice with length n.
+func getStrings(n int) *stringSlice {
+	s := stringsPools.Get().(*stringSlice)
+	if cap(*s) < n {
+		*s = make([]string, n)
+	}
+	*s = (*s)[:n]
+	return s
+}
+
+func putStrings(s *stringSlice) {
+	if cap(*s) > 1<<10 {
+		*s = nil // avoid pinning arbitrarily large amounts of memory
+	}
+	stringsPools.Put(s)
+}
+
+// Sort sorts the string slice according to RFC 8785, section 3.2.3.
+func (ss *stringSlice) Sort() {
+	// TODO(https://go.dev/issue/47619): Use slices.SortFunc instead.
+	sort.Sort(ss)
+}
+
+func (ss *stringSlice) Len() int           { return len(*ss) }
+func (ss *stringSlice) Less(i, j int) bool { return lessUTF16((*ss)[i], (*ss)[j]) }
+func (ss *stringSlice) Swap(i, j int)      { (*ss)[i], (*ss)[j] = (*ss)[j], (*ss)[i] }

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/state.go

@@ -721,7 +721,7 @@ func (s *uintSet) has(i uint) bool {
 		return s.lo.has(i)
 	} else {
 		i -= 64
-		iHi, iLo := int(i/64), uint(i%64)
+		iHi, iLo := int(i/64), i%64
 		return iHi < len(s.hi) && s.hi[iHi].has(iLo)
 	}
 }
@@ -735,7 +735,7 @@ func (s *uintSet) insert(i uint) bool {
 		return !has
 	} else {
 		i -= 64
-		iHi, iLo := int(i/64), uint(i%64)
+		iHi, iLo := int(i/64), i%64
 		if iHi >= len(s.hi) {
 			s.hi = append(s.hi, make([]uintSet64, iHi+1-len(s.hi))...)
 			s.hi = s.hi[:cap(s.hi)]

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/token.go

@@ -112,7 +112,7 @@ func Bool(b bool) Token {
 	return False
 }
 
-// String construct a Token representing a JSON string.
+// String constructs a Token representing a JSON string.
 // The provided string should contain valid UTF-8, otherwise invalid characters
 // may be mangled as the Unicode replacement character.
 func String(s string) Token {
@@ -225,7 +225,7 @@ func (t Token) appendString(dst []byte, validateUTF8, preserveRaw bool, escapeRu
 }
 
 // String returns the unescaped string value for a JSON string.
-// For other JSON kinds, this returns the raw JSON represention.
+// For other JSON kinds, this returns the raw JSON representation.
 func (t Token) String() string {
 	// This is inlinable to take advantage of "function outlining".
 	// This avoids an allocation for the string(b) conversion
@@ -373,10 +373,10 @@ func (t Token) Int() int64 {
 		case 'i':
 			return int64(t.num)
 		case 'u':
-			if uint64(t.num) > maxInt64 {
+			if t.num > maxInt64 {
 				return maxInt64
 			}
-			return int64(uint64(t.num))
+			return int64(t.num)
 		}
 	}
 
@@ -425,7 +425,7 @@ func (t Token) Uint() uint64 {
 		// Handle exact integer value.
 		switch t.str[0] {
 		case 'u':
-			return uint64(t.num)
+			return t.num
 		case 'i':
 			if int64(t.num) < minUint64 {
 				return minUint64

vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/value.go

@@ -263,7 +263,7 @@ func reorderObjects(d *Decoder, scratch *[]byte) {
 			afterValue := d.InputOffset()
 
 			if isSorted && len(*members) > 0 {
-				isSorted = lessUTF16(prevName, name)
+				isSorted = lessUTF16(prevName, []byte(name))
 			}
 			*members = append(*members, memberName{name, beforeName, afterValue})
 			prevName = name
@@ -317,7 +317,7 @@ func reorderObjects(d *Decoder, scratch *[]byte) {
 // to the UTF-16 codepoints of the UTF-8 encoded input strings.
 // This implements the ordering specified in RFC 8785, section 3.2.3.
 // The inputs must be valid UTF-8, otherwise this may panic.
-func lessUTF16(x, y []byte) bool {
+func lessUTF16[Bytes []byte | string](x, y Bytes) bool {
 	// NOTE: This is an optimized, allocation-free implementation
 	// of lessUTF16Simple in fuzz_test.go. FuzzLessUTF16 verifies that the
 	// two implementations agree on the result of comparing any two strings.
@@ -326,8 +326,13 @@ func lessUTF16(x, y []byte) bool {
 		return ('\u0000' <= r && r <= '\uD7FF') || ('\uE000' <= r && r <= '\uFFFF')
 	}
 
+	var invalidUTF8 bool
+	x0, y0 := x, y
 	for {
 		if len(x) == 0 || len(y) == 0 {
+			if len(x) == len(y) && invalidUTF8 {
+				return string(x0) < string(y0)
+			}
 			return len(x) < len(y)
 		}
 
@@ -341,35 +346,36 @@ func lessUTF16(x, y []byte) bool {
 		}
 
 		// Decode next pair of runes as UTF-8.
-		rx, nx := utf8.DecodeRune(x)
-		ry, ny := utf8.DecodeRune(y)
+		// TODO(https://go.dev/issue/56948): Use a generic implementation
+		// of utf8.DecodeRune, or rely on a compiler optimization to statically
+		// hide the cost of a type switch (https://go.dev/issue/57072).
+		var rx, ry rune
+		var nx, ny int
+		switch any(x).(type) {
+		case string:
+			rx, nx = utf8.DecodeRuneInString(string(x))
+			ry, ny = utf8.DecodeRuneInString(string(y))
+		case []byte:
+			rx, nx = utf8.DecodeRune([]byte(x))
+			ry, ny = utf8.DecodeRune([]byte(y))
+		}
+
+		selfx := isUTF16Self(rx)
+		selfy := isUTF16Self(ry)
 		switch {
-
-		// Both runes encode as either a single or surrogate pair
-		// of UTF-16 codepoints.
-		case isUTF16Self(rx) == isUTF16Self(ry):
-			if rx != ry {
-				return rx < ry
-			}
-
 		// The x rune is a single UTF-16 codepoint, while
 		// the y rune is a surrogate pair of UTF-16 codepoints.
-		case isUTF16Self(rx):
-			ry, _ := utf16.EncodeRune(ry)
-			if rx != ry {
-				return rx < ry
-			}
-			panic("BUG: invalid UTF-8") // implies rx is an unpaired surrogate half
-
+		case selfx && !selfy:
+			ry, _ = utf16.EncodeRune(ry)
 		// The y rune is a single UTF-16 codepoint, while
 		// the x rune is a surrogate pair of UTF-16 codepoints.
-		case isUTF16Self(ry):
-			rx, _ := utf16.EncodeRune(rx)
-			if rx != ry {
-				return rx < ry
-			}
-			panic("BUG: invalid UTF-8") // implies ry is an unpaired surrogate half
+		case selfy && !selfx:
+			rx, _ = utf16.EncodeRune(rx)
 		}
+		if rx != ry {
+			return rx < ry
+		}
+		invalidUTF8 = invalidUTF8 || (rx == utf8.RuneError && nx == 1) || (ry == utf8.RuneError && ny == 1)
 		x, y = x[nx:], y[ny:]
 	}
 }