Fixup openapi controller eviction

pkg/server/openapiv3/controller.go

@@ -267,3 +267,15 @@ func (c *Controller) GetCRDSpecs(clusterName logicalcluster.Name, name string) (
 
 	return specs, nil
 }
+
+// EvictCluster removes all cached OpenAPI v3 specs for clusterName. Normally
+// the entry is cleaned per-CRD via the CRD informer's delete event handler,
+// but if the LogicalCluster delete races ahead of those CRD deletes (or any
+// CRD delete event is missed), the bucket — which holds 100KB–1MB of built
+// spec per CRD version — would leak for the lifetime of the process. Call
+// this from a LogicalCluster delete handler to bound retention.
+func (c *Controller) EvictCluster(clusterName logicalcluster.Name) {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+	delete(c.byClusterNameVersion, clusterName)
+}

pkg/server/openapiv3/controller_test.go

@@ -0,0 +1,58 @@
+/*
+Copyright 2026 The kcp Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package openapiv3
+
+import (
+	"testing"
+
+	"k8s.io/kube-openapi/pkg/cached"
+	"k8s.io/kube-openapi/pkg/spec3"
+
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// TestEvictCluster verifies EvictCluster drops the whole per-cluster
+// bucket. This is the back-stop for missed CRD delete events: if a
+// LogicalCluster is gone, every cached spec under it must go too.
+func TestEvictCluster(t *testing.T) {
+	c := &Controller{
+		byClusterNameVersion: map[logicalcluster.Name]map[string]map[string]cached.Value[*spec3.OpenAPI]{
+			"target":  {"crd-a": {"v1": cached.Static(&spec3.OpenAPI{}, "etag")}},
+			"other":   {"crd-b": {"v1": cached.Static(&spec3.OpenAPI{}, "etag")}},
+			"another": {"crd-c": {"v1": cached.Static(&spec3.OpenAPI{}, "etag")}},
+		},
+	}
+
+	c.EvictCluster("target")
+
+	if _, ok := c.byClusterNameVersion["target"]; ok {
+		t.Error("byClusterNameVersion[target] should be removed after EvictCluster")
+	}
+	if _, ok := c.byClusterNameVersion["other"]; !ok {
+		t.Error("byClusterNameVersion[other] must be preserved")
+	}
+	if _, ok := c.byClusterNameVersion["another"]; !ok {
+		t.Error("byClusterNameVersion[another] must be preserved")
+	}
+
+	// Idempotent: evicting again must not panic and must leave others alone.
+	c.EvictCluster("target")
+	c.EvictCluster("never-existed")
+	if len(c.byClusterNameVersion) != 2 {
+		t.Errorf("expected 2 remaining buckets, got %d", len(c.byClusterNameVersion))
+	}
+}

pkg/server/openapiv3_evictor.go

@@ -0,0 +1,61 @@
+/*
+Copyright 2026 The kcp Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package server
+
+import (
+	"context"
+
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/klog/v2"
+
+	"github.com/kcp-dev/logicalcluster/v3"
+	corev1alpha1 "github.com/kcp-dev/sdk/apis/core/v1alpha1"
+	corev1alpha1informers "github.com/kcp-dev/sdk/client/informers/externalversions/core/v1alpha1"
+
+	"github.com/kcp-dev/kcp/pkg/server/openapiv3"
+)
+
+// installOpenAPIV3Evictor registers a LogicalCluster delete handler that drops
+// every cached OpenAPI v3 spec for the cluster. The controller's CRD informer
+// handler scrubs entries per-CRD, but that path depends on each CRD delete
+// event being observed and ordered before the LogicalCluster delete. When that
+// ordering breaks the bucket leaks 100KB–1MB per CRD version forever. See
+// https://github.com/kcp-dev/kcp/issues/4071.
+func installOpenAPIV3Evictor(ctx context.Context, informer corev1alpha1informers.LogicalClusterClusterInformer, controller *openapiv3.Controller) {
+	logger := klog.FromContext(ctx).WithName("openapiv3-evictor")
+	_, _ = informer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		DeleteFunc: func(obj any) {
+			lc, ok := obj.(*corev1alpha1.LogicalCluster)
+			if !ok {
+				tombstone, tok := obj.(cache.DeletedFinalStateUnknown)
+				if !tok {
+					return
+				}
+				lc, ok = tombstone.Obj.(*corev1alpha1.LogicalCluster)
+				if !ok {
+					return
+				}
+			}
+			name := logicalcluster.From(lc)
+			if name == "" {
+				return
+			}
+			logger.V(4).Info("evicting OpenAPI v3 cache", "logicalcluster", name)
+			controller.EvictCluster(name)
+		},
+	})
+}

pkg/server/server.go

@@ -739,6 +739,7 @@ func (s *Server) Run(ctx context.Context) error {
 		}); err != nil {
 			return err
 		}
+		installOpenAPIV3Evictor(ctx, s.KcpSharedInformerFactory.Core().V1alpha1().LogicalClusters(), s.openAPIv3Controller)
 		go s.openAPIv3Controller.Run(ctx)
 		return nil
 	}); err != nil {