@opensoha/contracts 0.1.26 → 0.1.29

package/resource/runtime/resource_graph_enrichment_test.go

@@ -0,0 +1,201 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	cr "github.com/opensoha/soha-contracts/resource"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func graphEnrichmentFixture() (cr.ResourceGraph, ResourceGraphEnrichment) {
+	object := graphTestObject("custom.example/v1", "Widget", "owner", "owner-uid")
+	ref := enrichmentRef("cluster-a", object)
+	graph := cr.ResourceGraph{ClusterID: "cluster-a", Namespace: "ns", RootID: "opaque-pod", Nodes: []cr.ResourceGraphNode{{ID: "opaque-pod", Resource: cr.ResourceRef{ClusterID: "cluster-a", APIVersion: "v1", Kind: "Pod", Namespace: "ns", Name: "pod", UID: "pod-uid", ScopeMode: cr.ResourceScopeModeNamespace}, Status: "Running"}, {ID: "opaque-owner", Resource: ref, Status: "unresolved"}}, Edges: []cr.ResourceGraphEdge{{ID: "opaque-edge", SourceID: "opaque-owner", TargetID: "opaque-pod", Relation: "controls"}}, Warnings: []string{"existing warning"}, Evidence: []cr.ResourceEvidence{{ID: "evidence", Summary: "preserve evidence"}}}
+	input := ResourceGraphEnrichment{TargetID: "opaque-owner", Object: object, Definition: cr.ResourceRef{ClusterID: "cluster-a", APIVersion: "apiextensions.k8s.io/v1", Kind: "CustomResourceDefinition", Name: "widgets.custom.example", UID: "crd-uid", ScopeMode: cr.ResourceScopeModeCluster}}
+	return graph, input
+}
+func TestResourceGraphEnrichmentIdentityAndScope(t *testing.T) {
+	for _, test := range []struct {
+		name string
+		edit func(*ResourceGraphEnrichment)
+	}{
+		{"wrong group", func(e *ResourceGraphEnrichment) { e.Object.SetAPIVersion("apps/v1") }},
+		{"replacement", func(e *ResourceGraphEnrichment) { e.Object.SetUID("new-uid") }},
+		{"wrong kind", func(e *ResourceGraphEnrichment) { e.Object.SetKind("Deployment") }},
+		{"wrong name", func(e *ResourceGraphEnrichment) { e.Object.SetName("other") }},
+		{"cross namespace", func(e *ResourceGraphEnrichment) { e.Object.SetNamespace("other") }},
+		{"missing target", func(e *ResourceGraphEnrichment) { e.TargetID = "missing" }},
+		{"unobserved definition", func(e *ResourceGraphEnrichment) { e.Definition.UID = "" }},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			graph, input := graphEnrichmentFixture()
+			test.edit(&input)
+			_, err := EnrichResourceGraph(context.Background(), graph, []ResourceGraphEnrichment{input})
+			if !errors.Is(err, ErrInvalidResourceGraphEnrichment) {
+				t.Fatalf("identity accepted: %v", err)
+			}
+			if graph.Nodes[1].Status != "unresolved" {
+				t.Fatal("input graph mutated")
+			}
+		})
+	}
+	graph, input := graphEnrichmentFixture()
+	input.Object.SetNamespace("")
+	result, err := EnrichResourceGraph(context.Background(), graph, []ResourceGraphEnrichment{input})
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, node := range result.Nodes {
+		if node.ID == "opaque-owner" {
+			found = true
+			if node.Status == "unresolved" || node.Resource.Namespace != "" || node.Resource.ScopeMode != cr.ResourceScopeModeCluster {
+				t.Fatalf("scope not corrected: %+v", node)
+			}
+		}
+	}
+	if !found {
+		t.Fatal("opaque target ID changed")
+	}
+	if !graphTestEdge(result, "defines", "widgets.custom.example", "owner") {
+		t.Fatal("CRD defines direction incorrect")
+	}
+	if !reflect.DeepEqual(result.Evidence, graph.Evidence) || result.Warnings[0] != "existing warning" {
+		t.Fatal("evidence/warnings changed")
+	}
+	for _, edge := range result.Edges {
+		if edge.Relation == "controls" && edge.ID != "opaque-edge" {
+			t.Fatal("existing edge ID rewritten")
+		}
+	}
+}
+func TestResourceGraphEnrichmentOwnerMetadataAndIdempotency(t *testing.T) {
+	for _, controller := range []bool{false, true} {
+		t.Run(fmt.Sprint(controller), func(t *testing.T) {
+			graph, input := graphEnrichmentFixture()
+			graphTestOwner(input.Object, "custom.example/v1", "Parent", "parent", "parent-uid", controller)
+			input.Object.Object["spec"] = map[string]interface{}{"secret": "MUST-NOT-LEAK"}
+			input.Object.Object["data"] = map[string]interface{}{"token": "MUST-NOT-LEAK"}
+			result, err := EnrichResourceGraph(context.Background(), graph, []ResourceGraphEnrichment{input, input})
+			if err != nil {
+				t.Fatal(err)
+			}
+			relation := "owns"
+			if controller {
+				relation = "controls"
+			}
+			if !graphTestEdge(result, relation, "parent", "owner") {
+				t.Fatal("owner/controller relation missing")
+			}
+			for _, node := range result.Nodes {
+				if node.Resource.Name == "parent" && node.Status != "unresolved" {
+					t.Fatal("unobserved parent confirmed")
+				}
+			}
+			encoded, _ := json.Marshal(result)
+			if strings.Contains(string(encoded), "MUST-NOT-LEAK") {
+				t.Fatal("unknown payload exposed")
+			}
+			again, err := EnrichResourceGraph(context.Background(), result, []ResourceGraphEnrichment{input})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(result, again) {
+				t.Fatalf("repeated enrichment not stable\n%+v\n%+v", result, again)
+			}
+		})
+	}
+}
+func TestResourceGraphEnrichmentCancellationAndBudget(t *testing.T) {
+	graph, input := graphEnrichmentFixture()
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	_, err := EnrichResourceGraph(ctx, graph, []ResourceGraphEnrichment{input})
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("cancellation ignored: %v", err)
+	}
+	for len(graph.Nodes) < ResourceGraphNodeLimit {
+		index := len(graph.Nodes)
+		graph.Nodes = append(graph.Nodes, cr.ResourceGraphNode{ID: fmt.Sprintf("extra-%d", index), Resource: cr.ResourceRef{ClusterID: graph.ClusterID, APIVersion: "v1", Kind: "Pod", Name: fmt.Sprint(index), Namespace: "ns", ScopeMode: cr.ResourceScopeModeNamespace}})
+	}
+	result, err := EnrichResourceGraph(context.Background(), graph, []ResourceGraphEnrichment{input})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(result.Nodes) > 500 || len(result.Edges) > 1000 || !strings.Contains(strings.Join(result.Warnings, " "), "enrichment is partial") {
+		t.Fatal("budget overflow silent")
+	}
+	graph.Nodes = append(graph.Nodes, graph.Nodes[0])
+	_, err = EnrichResourceGraph(context.Background(), graph, nil)
+	if !errors.Is(err, ErrResourceGraphBudget) {
+		t.Fatalf("invalid initial budget accepted: %v", err)
+	}
+}
+func TestResourceGraphMetadataJSONBoundaries(t *testing.T) {
+	graph, input := graphEnrichmentFixture()
+	content := []byte(`{"apiVersion":"custom.example/v1","kind":"Widget","metadata":{"name":"owner","namespace":"ns","uid":"owner-uid","annotations":{"secret":"MUST-NOT-LEAK"}},"spec":{"credential":"MUST-NOT-LEAK"},"data":{"password":"MUST-NOT-LEAK"}}`)
+	metadata := ResourceGraphMetadataEnrichment{TargetID: input.TargetID, Content: content, Definition: input.Definition}
+	result, err := EnrichResourceGraphFromMetadataJSON(context.Background(), graph, []ResourceGraphMetadataEnrichment{metadata})
+	if err != nil {
+		t.Fatal(err)
+	}
+	encoded, _ := json.Marshal(result)
+	if strings.Contains(string(encoded), "MUST-NOT-LEAK") {
+		t.Fatal("JSON payload exposed")
+	}
+	metadata.Content = make([]byte, ResourceGraphMetadataJSONLimit+1)
+	_, err = EnrichResourceGraphFromMetadataJSON(context.Background(), graph, []ResourceGraphMetadataEnrichment{metadata})
+	if !errors.Is(err, ErrResourceGraphBudget) {
+		t.Fatal("JSON size unbounded")
+	}
+	_, err = EnrichResourceGraphFromMetadataJSON(context.Background(), graph, make([]ResourceGraphMetadataEnrichment, 17))
+	if !errors.Is(err, ErrResourceGraphBudget) {
+		t.Fatal("JSON item count unbounded")
+	}
+	metadata.Content = []byte(`{"metadata":`)
+	_, err = EnrichResourceGraphFromMetadataJSON(context.Background(), graph, []ResourceGraphMetadataEnrichment{metadata})
+	if !errors.Is(err, ErrInvalidResourceGraphEnrichment) {
+		t.Fatal("malformed JSON accepted")
+	}
+}
+
+func TestResourceGraphEnrichmentDepthAndStableEdgeIDs(t *testing.T) {
+	graph, input := graphEnrichmentFixture()
+	middle := graph.Nodes[1]
+	middle.ID = "middle"
+	middle.Resource.Name = "middle"
+	middle.Resource.UID = "middle-uid"
+	middle.Status = ""
+	far := middle
+	far.ID = "far"
+	far.Resource.Name = "far"
+	far.Resource.UID = "far-uid"
+	graph.Nodes = append(graph.Nodes, middle, far)
+	graph.Edges = []cr.ResourceGraphEdge{{ID: "edge-one", SourceID: "middle", TargetID: "opaque-pod", Relation: "controls"}, {ID: "edge-two", SourceID: "far", TargetID: "middle", Relation: "controls"}, {ID: "edge-three", SourceID: "opaque-owner", TargetID: "far", Relation: "controls"}}
+	graphTestOwner(input.Object, "custom.example/v1", "Parent", "beyond-depth", "parent-uid", true)
+	result, err := EnrichResourceGraph(context.Background(), graph, []ResourceGraphEnrichment{input})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if graphTestHas(result, "beyond-depth") || graphTestHas(result, "widgets.custom.example") {
+		t.Fatal("enrichment crossed three-hop boundary")
+	}
+	if !strings.Contains(strings.Join(result.Warnings, " "), "enrichment is partial") {
+		t.Fatal("depth omission silent")
+	}
+	for _, original := range graph.Edges {
+		found := false
+		for _, edge := range result.Edges {
+			if edge == original {
+				found = true
+			}
+		}
+		if !found {
+			t.Fatalf("existing opaque edge modified: %+v", original)
+		}
+	}
+}

package/resource/runtime/resource_graph_metadata.go

@@ -0,0 +1,125 @@
+package runtime
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"mime"
+	"net/http"
+
+	"k8s.io/client-go/metadata"
+	"k8s.io/client-go/rest"
+)
+
+const resourceGraphMetadataAccept = "application/json;as=PartialObjectMetadata;g=meta.k8s.io;v=v1"
+const resourceGraphMetadataResponseLimit = 1 << 20
+
+// NewResourceGraphMetadataClient creates a metadata-only Graph client. It rejects
+// full-object fallback and validates bounded metadata envelopes before SDK decoding.
+// The caller's REST configuration and transport wrappers remain intact.
+func NewResourceGraphMetadataClient(config *rest.Config) (metadata.Interface, error) {
+	if config == nil {
+		return nil, fmt.Errorf("resource graph metadata REST configuration is unavailable")
+	}
+	strict := rest.CopyConfig(config)
+	strict.Wrap(func(base http.RoundTripper) http.RoundTripper {
+		return resourceGraphMetadataTransport{RoundTripper: base}
+	})
+	return metadata.NewForConfig(strict)
+}
+
+type resourceGraphMetadataTransport struct{ http.RoundTripper }
+
+func (t resourceGraphMetadataTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	request = request.Clone(request.Context())
+	request.Header.Set("Accept", resourceGraphMetadataAccept)
+	response, err := t.RoundTripper.RoundTrip(request)
+	if err != nil {
+		return response, err
+	}
+	body := response.Body
+	defer func() { _ = body.Close() }()
+	// A redirected request would pass through the Kubernetes authentication
+	// transport again, which can attach credentials to the new endpoint.
+	if response.StatusCode >= 300 && response.StatusCode < 400 {
+		return nil, fmt.Errorf("resource graph metadata endpoint redirected")
+	}
+	var payload []byte
+	if response.StatusCode >= 200 && response.StatusCode < 300 {
+		mediaType, _, contentTypeErr := mime.ParseMediaType(response.Header.Get("Content-Type"))
+		if contentTypeErr != nil || mediaType != "application/json" {
+			return nil, fmt.Errorf("resource graph metadata response is not JSON metadata")
+		}
+		payload, err = readResourceGraphMetadataResponse(body)
+	} else {
+		payload, err = io.ReadAll(io.LimitReader(body, resourceGraphMetadataResponseLimit+1))
+		if len(payload) > resourceGraphMetadataResponseLimit {
+			return nil, fmt.Errorf("resource graph metadata response exceeds its size limit")
+		}
+	}
+	if err != nil {
+		if canceled := request.Context().Err(); canceled != nil {
+			return nil, canceled
+		}
+		return nil, err
+	}
+	response.Body = io.NopCloser(bytes.NewReader(payload))
+	response.ContentLength = int64(len(payload))
+	return response, nil
+}
+
+// Reject ordinary objects before the SDK's permissive metadata conversion runs.
+func readResourceGraphMetadataResponse(reader io.Reader) ([]byte, error) {
+	var payload bytes.Buffer
+	decoder := json.NewDecoder(io.TeeReader(io.LimitReader(reader, resourceGraphMetadataResponseLimit+1), &payload))
+	token, err := decoder.Token()
+	if err != nil || token != json.Delim('{') {
+		return nil, fmt.Errorf("invalid resource graph metadata envelope")
+	}
+	seen := map[string]bool{}
+	for decoder.More() {
+		token, err = decoder.Token()
+		key, ok := token.(string)
+		if err != nil || !ok || seen[key] {
+			return nil, fmt.Errorf("invalid resource graph metadata field")
+		}
+		seen[key] = true
+		if err = readResourceGraphMetadataField(decoder, key); err != nil {
+			return nil, err
+		}
+	}
+	if _, err = decoder.Token(); err != nil {
+		return nil, fmt.Errorf("invalid resource graph metadata envelope")
+	}
+	if !seen["kind"] || !seen["apiVersion"] || !seen["metadata"] {
+		return nil, fmt.Errorf("resource graph response is not PartialObjectMetadata")
+	}
+	var extra any
+	if decoder.Decode(&extra) != io.EOF || payload.Len() > resourceGraphMetadataResponseLimit {
+		return nil, fmt.Errorf("resource graph metadata response exceeds its envelope or size limit")
+	}
+	return payload.Bytes(), nil
+}
+
+func readResourceGraphMetadataField(decoder *json.Decoder, key string) error {
+	switch key {
+	case "kind", "apiVersion":
+		want := "PartialObjectMetadata"
+		if key == "apiVersion" {
+			want = "meta.k8s.io/v1"
+		}
+		var value string
+		if err := decoder.Decode(&value); err != nil || value != want {
+			return fmt.Errorf("resource graph response is not PartialObjectMetadata")
+		}
+	case "metadata":
+		var value json.RawMessage
+		if err := decoder.Decode(&value); err != nil || len(value) == 0 || value[0] != '{' {
+			return fmt.Errorf("invalid resource graph object metadata")
+		}
+	default:
+		return fmt.Errorf("resource graph response contains a non-metadata field")
+	}
+	return nil
+}

package/resource/runtime/resource_graph_metadata_test.go

@@ -0,0 +1,204 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/rest"
+)
+
+func TestResourceGraphMetadataTransportNeverFallsBackToSecretPayload(t *testing.T) {
+	for _, status := range []int32{http.StatusOK, http.StatusForbidden, http.StatusNotAcceptable} {
+		t.Run(http.StatusText(int(status)), func(t *testing.T) {
+			var requests atomic.Int32
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				requests.Add(1)
+				if r.Method != http.MethodGet || r.URL.Path != "/api/v1/namespaces/team-a/secrets/credentials" {
+					t.Errorf("unexpected metadata request: %s %s", r.Method, r.URL.Path)
+				}
+				if r.Header.Get("Accept") != resourceGraphMetadataAccept {
+					t.Errorf("unsafe Secret negotiation: %q", r.Header.Get("Accept"))
+				}
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(int(status))
+				if status == http.StatusOK {
+					_ = json.NewEncoder(w).Encode(metav1.PartialObjectMetadata{TypeMeta: metav1.TypeMeta{APIVersion: "meta.k8s.io/v1", Kind: "PartialObjectMetadata"}, ObjectMeta: metav1.ObjectMeta{Name: "credentials", Namespace: "team-a", UID: "secret-uid"}})
+					return
+				}
+				reason := metav1.StatusReasonForbidden
+				if status == http.StatusNotAcceptable {
+					reason = metav1.StatusReasonNotAcceptable
+				}
+				_ = json.NewEncoder(w).Encode(metav1.Status{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "Status"}, Status: "Failure", Reason: reason, Code: status})
+			}))
+			defer server.Close()
+			config := &rest.Config{Host: server.URL}
+			client, err := NewResourceGraphMetadataClient(config)
+			if err != nil {
+				t.Fatal(err)
+			}
+			result, err := client.Resource(schema.GroupVersionResource{Version: "v1", Resource: "secrets"}).Namespace("team-a").Get(context.Background(), "credentials", metav1.GetOptions{})
+			switch status {
+			case http.StatusOK:
+				if err != nil || result.UID != "secret-uid" {
+					t.Fatalf("metadata=%+v err=%v", result, err)
+				}
+			case http.StatusForbidden:
+				if !apierrors.IsForbidden(err) {
+					t.Fatalf("forbidden mapping lost: %v", err)
+				}
+			case http.StatusNotAcceptable:
+				if !apierrors.IsNotAcceptable(err) {
+					t.Fatalf("metadata rejection lost: %v", err)
+				}
+			}
+			if requests.Load() != 1 {
+				t.Fatalf("metadata request fell back or retried: %d", requests.Load())
+			}
+			if config.WrapTransport != nil {
+				t.Fatal("shared REST configuration was mutated")
+			}
+		})
+	}
+}
+
+func TestResourceGraphMetadataTransportRejectsOrdinaryObjects(t *testing.T) {
+	for _, tc := range []struct{ name, contentType, payload string }{
+		{"ordinary Secret", "application/json", `{"kind":"Secret","apiVersion":"v1","metadata":{"name":"credentials","namespace":"team-a"},"data":{"password":"must-not-read"}}`},
+		{"disguised Secret", resourceGraphMetadataAccept, `{"kind":"Secret","apiVersion":"v1","metadata":{"name":"credentials"},"data":{"password":"must-not-read"}}`},
+		{"payload on metadata", "application/json", `{"kind":"PartialObjectMetadata","apiVersion":"meta.k8s.io/v1","metadata":{"name":"credentials"},"data":{"password":"must-not-read"}}`},
+		{"wrong metadata version", "application/json", `{"kind":"PartialObjectMetadata","apiVersion":"v1","metadata":{"name":"credentials"}}`},
+		{"missing identity", "application/json", `{"metadata":{"name":"credentials"}}`},
+		{"duplicate identity", "application/json", `{"kind":"PartialObjectMetadata","kind":"Secret","apiVersion":"meta.k8s.io/v1","metadata":{"name":"credentials"}}`},
+		{"trailing object", "application/json", `{"kind":"PartialObjectMetadata","apiVersion":"meta.k8s.io/v1","metadata":{}} {"kind":"Secret"}`},
+		{"non-json metadata", "application/yaml", "kind: PartialObjectMetadata"},
+		{"oversized metadata", "application/json", `{"kind":"PartialObjectMetadata","apiVersion":"meta.k8s.io/v1","metadata":{"name":"` + strings.Repeat("a", resourceGraphMetadataResponseLimit) + `"}}`},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var requests atomic.Int32
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				requests.Add(1)
+				w.Header().Set("Content-Type", tc.contentType)
+				_, _ = io.WriteString(w, tc.payload)
+			}))
+			defer server.Close()
+			client, err := NewResourceGraphMetadataClient(&rest.Config{Host: server.URL})
+			if err != nil {
+				t.Fatal(err)
+			}
+			result, err := client.Resource(schema.GroupVersionResource{Version: "v1", Resource: "secrets"}).Namespace("team-a").Get(context.Background(), "credentials", metav1.GetOptions{})
+			if err == nil || result != nil || strings.Contains(err.Error(), "must-not-read") {
+				t.Fatalf("ordinary payload accepted or exposed: result=%+v err=%v", result, err)
+			}
+			if requests.Load() != 1 {
+				t.Fatalf("unsafe payload retried or fell back: %d", requests.Load())
+			}
+		})
+	}
+}
+
+func TestResourceGraphMetadataTransportRejectsCredentialRedirect(t *testing.T) {
+	var redirected atomic.Bool
+	target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		redirected.Store(true)
+		w.WriteHeader(http.StatusForbidden)
+	}))
+	defer target.Close()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "Bearer synthetic-graph-token" {
+			t.Error("authenticated metadata request did not carry its credential")
+		}
+		http.Redirect(w, r, target.URL, http.StatusTemporaryRedirect)
+	}))
+	defer server.Close()
+	client, err := NewResourceGraphMetadataClient(&rest.Config{Host: server.URL, BearerToken: "synthetic-graph-token"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = client.Resource(schema.GroupVersionResource{Version: "v1", Resource: "secrets"}).Namespace("team-a").Get(context.Background(), "credentials", metav1.GetOptions{})
+	if err == nil || !strings.Contains(err.Error(), "endpoint redirected") || redirected.Load() {
+		t.Fatalf("redirect was not rejected: requested=%v err=%v", redirected.Load(), err)
+	}
+}
+
+func TestResourceGraphMetadataTransportBoundsErrorPayload(t *testing.T) {
+	for _, status := range []int{http.StatusForbidden, http.StatusNotAcceptable, http.StatusInternalServerError} {
+		t.Run(http.StatusText(status), func(t *testing.T) {
+			transport := resourceGraphMetadataTransport{RoundTripper: resourceGraphCancelRoundTripper(func(*http.Request) (*http.Response, error) {
+				return &http.Response{StatusCode: status, Body: io.NopCloser(strings.NewReader(strings.Repeat("a", resourceGraphMetadataResponseLimit+1)))}, nil
+			})}
+			request := httptest.NewRequest(http.MethodGet, "https://cluster.invalid/api/v1/namespaces/team-a/secrets/credentials", nil)
+			response, err := transport.RoundTrip(request)
+			if response != nil {
+				if closeErr := response.Body.Close(); closeErr != nil {
+					t.Errorf("close unexpected response body: %v", closeErr)
+				}
+			}
+			if err == nil || !strings.Contains(err.Error(), "size limit") || response != nil {
+				t.Fatalf("oversized error reached the metadata client: response=%v err=%v", response, err)
+			}
+		})
+	}
+}
+
+type resourceGraphCancelRoundTripper func(*http.Request) (*http.Response, error)
+
+func (f resourceGraphCancelRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
+	return f(request)
+}
+
+type resourceGraphCancelBody struct {
+	io.ReadCloser
+	cancel context.CancelFunc
+	read   *atomic.Bool
+}
+
+func (b resourceGraphCancelBody) Read(payload []byte) (int, error) {
+	b.read.Store(true)
+	b.cancel()
+	return b.ReadCloser.Read(payload)
+}
+
+func TestResourceGraphMetadataTransportRetainsBodyReadCancellation(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_, _ = io.WriteString(w, `{"kind":"PartialObjectMetadata","apiVersion":"meta.k8s.io/v1","metadata":`)
+		if err := http.NewResponseController(w).Flush(); err != nil {
+			t.Errorf("flush metadata response: %v", err)
+			return
+		}
+		<-r.Context().Done()
+	}))
+	defer server.Close()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	var bodyRead atomic.Bool
+	config := &rest.Config{Host: server.URL, WrapTransport: func(base http.RoundTripper) http.RoundTripper {
+		return resourceGraphCancelRoundTripper(func(request *http.Request) (*http.Response, error) {
+			response, err := base.RoundTrip(request)
+			if err == nil {
+				response.Body = resourceGraphCancelBody{ReadCloser: response.Body, cancel: cancel, read: &bodyRead}
+			}
+			return response, err
+		})
+	}}
+	client, err := NewResourceGraphMetadataClient(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = client.Resource(schema.GroupVersionResource{Version: "v1", Resource: "secrets"}).Namespace("team-a").Get(ctx, "credentials", metav1.GetOptions{})
+	if !bodyRead.Load() || !errors.Is(err, context.Canceled) {
+		t.Fatalf("HTTP 200 body cancellation lost: bodyRead=%v err=%v", bodyRead.Load(), err)
+	}
+}