Refactore integration test (#150)

Signed-off-by: Jian Qiu <jqiu@redhat.com>
2026-08-19 04:06:35 +00:00 · 2023-05-31 02:34:06 -04:00
parent 116ae8cc28
commit 8a05d4b030
148 changed files with 888 additions and 1428 deletions
@@ -13,7 +13,7 @@ include $(addprefix ./vendor/github.com/openshift/build-machinery-go/make/, \
 )

 # Include the integration setup makefile.
-include ./test/integration-test.mk
+include ./test/integration/integration-test.mk

 # Add packages to do unit test
 GO_TEST_PACKAGES :=./pkg/...
@@ -16,7 +16,7 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.8.2
 	golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1
-	golang.org/x/net v0.8.0
+	golang.org/x/net v0.10.0
 	k8s.io/api v0.26.3
 	k8s.io/apiextensions-apiserver v0.26.3
 	k8s.io/apimachinery v0.26.3
@@ -99,12 +99,12 @@ require (
 	go.uber.org/zap v1.24.0 // indirect
 	golang.org/x/crypto v0.1.0 // indirect
 	golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5 // indirect
-	golang.org/x/sync v0.1.0 // indirect
-	golang.org/x/sys v0.6.0 // indirect
-	golang.org/x/term v0.6.0 // indirect
-	golang.org/x/text v0.8.0 // indirect
+	golang.org/x/sync v0.2.0 // indirect
+	golang.org/x/sys v0.8.0 // indirect
+	golang.org/x/term v0.8.0 // indirect
+	golang.org/x/text v0.9.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.7.0 // indirect
+	golang.org/x/tools v0.9.1 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21 // indirect
@@ -720,6 +720,7 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.1-0.20200828183125-ce943fd02449/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -765,8 +766,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -788,8 +789,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
+golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -849,14 +850,14 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.6.0 h1:clScbb1cHjoCkyRbWwBEUZ5H/tIFu5TAXIqaZD0Gcjw=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -867,8 +868,8 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -933,8 +934,8 @@ golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.7.0 h1:W4OVu8VVOaIO0yzWMNdepAulS7YfoS3Zabrm8DOXXU4=
-golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
+golang.org/x/tools v0.9.1 h1:8WMNJAz3zrtPmnYC7ISf5dEn3MT0gY7jBJfw27yrrLo=
+golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -2,8 +2,6 @@ package version

 import (
 	"k8s.io/apimachinery/pkg/version"
-	"k8s.io/component-base/metrics"
-	"k8s.io/component-base/metrics/legacyregistry"
 )

 var (
@@ -32,16 +30,3 @@ func Get() version.Info {
 		BuildDate:  buildDate,
 	}
 }
-
-func init() {
-	buildInfo := metrics.NewGaugeVec(
-		&metrics.GaugeOpts{
-			Name: "open_cluster_management_build_info",
-			Help: "A metric with a constant '1' value labeled by major, minor, git commit & git version from which Open Cluster Management was built.",
-		},
-		[]string{"major", "minor", "gitCommit", "gitVersion"},
-	)
-	buildInfo.WithLabelValues(majorFromGit, minorFromGit, commitFromGit, versionFromGit).Set(1)
-
-	legacyregistry.MustRegister(buildInfo)
-}
@@ -1,8 +1,9 @@
-package benchmark
+package placement

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"testing"
 	"time"

@@ -20,7 +21,6 @@ import (

 	controllers "open-cluster-management.io/ocm/pkg/placement/controllers"
 	scheduling "open-cluster-management.io/ocm/pkg/placement/controllers/scheduling"
-	"open-cluster-management.io/ocm/test/placement/util"
 	"sigs.k8s.io/controller-runtime/pkg/envtest"
 )

@@ -27,24 +27,24 @@ clean-integration-test:
 clean: clean-integration-test

 test-registration-integration: ensure-kubebuilder-tools
-	go test -c ./test/registration/integration -o ./registration-integration.test
+	go test -c ./test/integration/registration -o ./registration-integration.test
 	./registration-integration.test -ginkgo.slowSpecThreshold=15 -ginkgo.v -ginkgo.failFast
 .PHONY: test-registration-integration

 test-work-integration: ensure-kubebuilder-tools
-	go test -c ./test/work/integration -o ./work-integration.test
+	go test -c ./test/integration/work -o ./work-integration.test
 	./work-integration.test -ginkgo.slowSpecThreshold=15 -ginkgo.v -ginkgo.failFast
 .PHONY: test-work-integration

 test-placement-integration: ensure-kubebuilder-tools
-	go test -c ./test/placement/integration -o ./placement-integration.test
+	go test -c ./test/integration/placement -o ./placement-integration.test
 	./placement-integration.test -ginkgo.slowSpecThreshold=15 -ginkgo.v -ginkgo.failFast
 .PHONY: test-placement-integration

 test-registration-operator-integration: ensure-kubebuilder-tools
-	go test -c ./test/registration-operator/integration -o ./registration-operator-integration.test
+	go test -c ./test/integration/operator -o ./registration-operator-integration.test
 	./registration-operator-integration.test -ginkgo.slowSpecThreshold=15 -ginkgo.v -ginkgo.failFast
 .PHONY: test-registration-operator-integration

-test-integration: ensure-kubebuilder-tools test-registration-operator-integration test-registration-integration test-placement-integration test-work-integration
+test-integration: test-registration-operator-integration test-registration-integration test-placement-integration test-work-integration
 .PHONY: test-integration
@@ -1,24 +1,23 @@
-package integration
+package operator

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"time"

 	"github.com/onsi/ginkgo/v2"
 	"github.com/onsi/gomega"
 	"github.com/openshift/library-go/pkg/operator/resource/resourceapply"
-	operatorapiv1 "open-cluster-management.io/api/operator/v1"
-	v1 "open-cluster-management.io/api/operator/v1"
-	"open-cluster-management.io/ocm/pkg/registration-operator/helpers"
-	"open-cluster-management.io/ocm/test/registration-operator/integration/util"
-
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/util/cert"
+	operatorapiv1 "open-cluster-management.io/api/operator/v1"
+	v1 "open-cluster-management.io/api/operator/v1"
+	"open-cluster-management.io/ocm/pkg/registration-operator/helpers"
 )

 func updateDeploymentStatus(kubeClient kubernetes.Interface, namespace, deploymentName string) {
@@ -1,8 +1,9 @@
-package integration
+package operator

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"time"

 	"github.com/onsi/ginkgo/v2"
@@ -22,7 +23,6 @@ import (
 	"open-cluster-management.io/ocm/pkg/registration-operator/helpers"
 	"open-cluster-management.io/ocm/pkg/registration-operator/operators/clustermanager"
 	certrotation "open-cluster-management.io/ocm/pkg/registration-operator/operators/clustermanager/controllers/certrotationcontroller"
-	"open-cluster-management.io/ocm/test/registration-operator/integration/util"
 )

 func startHubOperator(ctx context.Context, mode v1.InstallMode) {
@@ -1,4 +1,4 @@
 // Package integration provides integration tests for open-cluster-management registration-operator, the test cases include
 // - deploy/update/remove the cluster manager
 // - deploy/update/remove the klusterlet
-package integration
+package operator
@@ -1,4 +1,4 @@
-package integration
+package operator

 import (
 	"context"
@@ -1,9 +1,8 @@
-package integration
+package operator

 import (
 	"context"
 	"fmt"
-
 	"github.com/onsi/ginkgo/v2"
 	"github.com/onsi/gomega"
 	corev1 "k8s.io/api/core/v1"
@@ -11,7 +10,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/rand"
 	operatorapiv1 "open-cluster-management.io/api/operator/v1"
 	"open-cluster-management.io/ocm/pkg/registration-operator/helpers"
-	"open-cluster-management.io/ocm/test/registration-operator/integration/util"
+	"open-cluster-management.io/ocm/test/integration/util"
 )

 var _ = ginkgo.Describe("Klusterlet Hosted mode", func() {
@@ -1,4 +1,4 @@
-package integration
+package operator

 import (
 	"context"
@@ -20,7 +20,7 @@ import (
 	operatorapiv1 "open-cluster-management.io/api/operator/v1"
 	"open-cluster-management.io/ocm/pkg/registration-operator/helpers"
 	"open-cluster-management.io/ocm/pkg/registration-operator/operators/klusterlet"
-	"open-cluster-management.io/ocm/test/registration-operator/integration/util"
+	"open-cluster-management.io/ocm/test/integration/util"
 )

 func startKlusterletOperator(ctx context.Context) {
@@ -1,8 +1,9 @@
-package integration
+package placement

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"sort"
 	"time"

@@ -17,7 +18,6 @@ import (
 	clusterapiv1alpha1 "open-cluster-management.io/api/cluster/v1alpha1"
 	clusterapiv1beta1 "open-cluster-management.io/api/cluster/v1beta1"
 	clusterapiv1beta2 "open-cluster-management.io/api/cluster/v1beta2"
-	"open-cluster-management.io/ocm/test/placement/util"
 )

 func assertPlacementDecisionCreated(placement *clusterapiv1beta1.Placement) {
@@ -1,8 +1,9 @@
-package integration
+package placement

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"time"

 	"github.com/onsi/ginkgo/v2"
@@ -15,7 +16,6 @@ import (
 	clusterapiv1beta1 "open-cluster-management.io/api/cluster/v1beta1"
 	controllers "open-cluster-management.io/ocm/pkg/placement/controllers"
 	"open-cluster-management.io/ocm/pkg/placement/controllers/scheduling"
-	"open-cluster-management.io/ocm/test/placement/util"
 )

 const (
@@ -1,8 +1,9 @@
-package integration
+package placement

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"time"

 	"github.com/onsi/ginkgo/v2"
@@ -14,7 +15,6 @@ import (
 	clusterapiv1beta1 "open-cluster-management.io/api/cluster/v1beta1"
 	controllers "open-cluster-management.io/ocm/pkg/placement/controllers"
 	"open-cluster-management.io/ocm/pkg/placement/controllers/scheduling"
-	"open-cluster-management.io/ocm/test/placement/util"
 )

 var _ = ginkgo.Describe("Prioritizers", func() {
@@ -1,4 +1,4 @@
-package integration
+package placement

 import (
 	"testing"
@@ -1,8 +1,9 @@
-package integration
+package placement

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"time"

 	"github.com/onsi/ginkgo/v2"
@@ -15,7 +16,6 @@ import (
 	clusterapiv1beta1 "open-cluster-management.io/api/cluster/v1beta1"
 	controllers "open-cluster-management.io/ocm/pkg/placement/controllers"
 	"open-cluster-management.io/ocm/pkg/placement/controllers/scheduling"
-	"open-cluster-management.io/ocm/test/placement/util"
 )

 var _ = ginkgo.Describe("TaintToleration", func() {
@@ -1,25 +1,24 @@
-package integration_test
+package registration_test

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"path"
 	"time"

 	"github.com/onsi/ginkgo/v2"
 	"github.com/onsi/gomega"

-	addonv1alpha1 "open-cluster-management.io/api/addon/v1alpha1"
-	clusterv1 "open-cluster-management.io/api/cluster/v1"
-	"open-cluster-management.io/ocm/pkg/features"
-	"open-cluster-management.io/ocm/pkg/registration/spoke"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
-
 	coordv1 "k8s.io/api/coordination/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/rand"
+	addonv1alpha1 "open-cluster-management.io/api/addon/v1alpha1"
+	clusterv1 "open-cluster-management.io/api/cluster/v1"
+	"open-cluster-management.io/ocm/pkg/features"
+	"open-cluster-management.io/ocm/pkg/registration/spoke"
 )

 var _ = ginkgo.Describe("Addon Lease Resync", func() {
@@ -175,7 +174,7 @@ var _ = ginkgo.Describe("Addon Lease Resync", func() {
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}

-		cancel = util.RunAgent("addontest", agentOptions, spokeCfg)
+		cancel = runAgent("addontest", agentOptions, spokeCfg)
 	})

 	ginkgo.AfterEach(func() {
@@ -1,8 +1,9 @@
-package integration_test
+package registration_test

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"path"
 	"reflect"
 	"strings"
@@ -22,7 +23,6 @@ import (
 	"open-cluster-management.io/ocm/pkg/features"
 	"open-cluster-management.io/ocm/pkg/registration/clientcert"
 	"open-cluster-management.io/ocm/pkg/registration/spoke"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
 )

 var _ = ginkgo.Describe("Addon Registration", func() {
@@ -49,7 +49,7 @@ var _ = ginkgo.Describe("Addon Registration", func() {
 		}

 		// run registration agent
-		cancel = util.RunAgent("addontest", agentOptions, spokeCfg)
+		cancel = runAgent("addontest", agentOptions, spokeCfg)
 	})

 	ginkgo.AfterEach(
@@ -1,6 +1,7 @@
-package integration_test
+package registration_test

 import (
+	"open-cluster-management.io/ocm/test/integration/util"
 	"path"
 	"time"

@@ -8,7 +9,6 @@ import (
 	"github.com/onsi/gomega"

 	"open-cluster-management.io/ocm/pkg/registration/spoke"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
 )

 var _ = ginkgo.Describe("Certificate Rotation", func() {
@@ -28,7 +28,7 @@ var _ = ginkgo.Describe("Certificate Rotation", func() {
 		}

 		// run registration agent
-		cancel := util.RunAgent("rotationtest", agentOptions, spokeCfg)
+		cancel := runAgent("rotationtest", agentOptions, spokeCfg)
 		defer cancel()

 		// after bootstrap the spokecluster and csr should be created
@@ -1,4 +1,4 @@
-package integration_test
+package registration_test

 import (
 	"context"
@@ -1,8 +1,9 @@
-package integration_test
+package registration_test

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"os"
 	"path"
 	"time"
@@ -18,6 +19,7 @@ import (
 	"k8s.io/client-go/kubernetes/scheme"
 	"sigs.k8s.io/controller-runtime/pkg/envtest"

+	"github.com/openshift/library-go/pkg/controller/controllercmd"
 	addonv1alpha1 "open-cluster-management.io/api/addon/v1alpha1"
 	addonclientset "open-cluster-management.io/api/client/addon/clientset/versioned"
 	clusterclientset "open-cluster-management.io/api/client/cluster/clientset/versioned"
@@ -26,9 +28,6 @@ import (
 	"open-cluster-management.io/ocm/pkg/registration/clientcert"
 	"open-cluster-management.io/ocm/pkg/registration/hub"
 	"open-cluster-management.io/ocm/pkg/registration/spoke"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
-
-	"github.com/openshift/library-go/pkg/controller/controllercmd"
 )

 var _ = ginkgo.Describe("Disaster Recovery", func() {
@@ -98,7 +97,7 @@ var _ = ginkgo.Describe("Disaster Recovery", func() {
 			HubKubeconfigDir:         hubKubeconfigDir,
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}
-		return util.RunAgent("addontest", agentOptions, spokeCfg)
+		return runAgent("addontest", agentOptions, spokeCfg)
 	}

 	assertSuccessClusterBootstrap := func(testNamespace, managedClusterName, hubKubeconfigSecret string, hubKubeClient, spokeKubeClient kubernetes.Interface, hubClusterClient clusterclientset.Interface, auth *util.TestAuthn) {
@@ -4,4 +4,4 @@
 // - registration agent rotate its certificate after its certificate is expired
 // - registration agent recovery from invalid bootstrap kubeconfig
 // - registration agent recovery from invalid hub kubeconfig
-package integration
+package registration
@@ -1,4 +1,4 @@
-package integration_test
+package registration_test

 import (
 	"context"
@@ -1,8 +1,9 @@
-package integration_test
+package registration_test

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"os"
 	"path"
 	"testing"
@@ -28,8 +29,6 @@ import (
 	"open-cluster-management.io/ocm/pkg/registration/spoke"
 	"open-cluster-management.io/ocm/pkg/registration/spoke/addon"
 	"open-cluster-management.io/ocm/pkg/registration/spoke/managedcluster"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
-
 	"sigs.k8s.io/controller-runtime/pkg/envtest"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
@@ -70,6 +69,21 @@ var CRDPaths = []string{
 	"./vendor/open-cluster-management.io/api/cluster/v1alpha1/0000_02_clusters.open-cluster-management.io_clusterclaims.crd.yaml",
 }

+func runAgent(name string, opt spoke.SpokeAgentOptions, cfg *rest.Config) context.CancelFunc {
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		err := opt.RunSpokeAgent(ctx, &controllercmd.ControllerContext{
+			KubeConfig:    cfg,
+			EventRecorder: util.NewIntegrationTestEventRecorder(name),
+		})
+		if err != nil {
+			return
+		}
+	}()
+
+	return cancel
+}
+
 func TestIntegration(t *testing.T) {
 	gomega.RegisterFailHandler(ginkgo.Fail)
 	ginkgo.RunSpecs(t, "Integration Suite")
@@ -1,4 +1,4 @@
-package integration_test
+package registration_test

 import (
 	"context"
@@ -1,22 +1,21 @@
-package integration_test
+package registration_test

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"path"
 	"time"

 	"github.com/onsi/ginkgo/v2"
 	"github.com/onsi/gomega"

-	clusterv1 "open-cluster-management.io/api/cluster/v1"
-	"open-cluster-management.io/ocm/pkg/registration/spoke"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
-
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/rand"
+	clusterv1 "open-cluster-management.io/api/cluster/v1"
+	"open-cluster-management.io/ocm/pkg/registration/spoke"
 )

 var _ = ginkgo.Describe("Cluster Lease Update", func() {
@@ -39,7 +38,7 @@ var _ = ginkgo.Describe("Cluster Lease Update", func() {
 			HubKubeconfigDir:         hubKubeconfigDir,
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}
-		cancel := util.RunAgent("cluster-leasetest", agentOptions, spokeCfg)
+		cancel := runAgent("cluster-leasetest", agentOptions, spokeCfg)
 		defer cancel()

 		bootstrapManagedCluster(managedClusterName, hubKubeconfigSecret, util.TestLeaseDurationSeconds)
@@ -57,7 +56,7 @@ var _ = ginkgo.Describe("Cluster Lease Update", func() {
 			HubKubeconfigDir:         hubKubeconfigDir,
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}
-		stop := util.RunAgent("cluster-availabletest", agentOptions, spokeCfg)
+		stop := runAgent("cluster-availabletest", agentOptions, spokeCfg)

 		bootstrapManagedCluster(managedClusterName, hubKubeconfigSecret, util.TestLeaseDurationSeconds)
 		assertAvailableCondition(managedClusterName, metav1.ConditionTrue, 0)
@@ -76,7 +75,7 @@ var _ = ginkgo.Describe("Cluster Lease Update", func() {
 			HubKubeconfigDir:         hubKubeconfigDir,
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}
-		stop = util.RunAgent("cluster-availabletest", agentOptions, spokeCfg)
+		stop = runAgent("cluster-availabletest", agentOptions, spokeCfg)
 		defer stop()

 		// after one grace period, make sure the managed cluster available condition is recovered
@@ -93,7 +92,7 @@ var _ = ginkgo.Describe("Cluster Lease Update", func() {
 			HubKubeconfigDir:         hubKubeconfigDir,
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}
-		cancel := util.RunAgent("cluster-leasetest", agentOptions, spokeCfg)
+		cancel := runAgent("cluster-leasetest", agentOptions, spokeCfg)
 		defer cancel()

 		bootstrapManagedCluster(managedClusterName, hubKubeconfigSecret, util.TestLeaseDurationSeconds)
@@ -143,7 +142,7 @@ var _ = ginkgo.Describe("Cluster Lease Update", func() {
 			HubKubeconfigDir:         hubKubeconfigDir,
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}
-		stop := util.RunAgent("cluster-leasetest", agentOptions, spokeCfg)
+		stop := runAgent("cluster-leasetest", agentOptions, spokeCfg)

 		bootstrapManagedCluster(managedClusterName, hubKubeconfigSecret, 60)
 		assertAvailableCondition(managedClusterName, metav1.ConditionTrue, 0)
@@ -1,4 +1,4 @@
-package integration_test
+package registration_test

 import (
 	"context"
@@ -1,7 +1,8 @@
-package integration_test
+package registration_test

 import (
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"path"
 	"reflect"
 	"time"
@@ -9,13 +10,11 @@ import (
 	"github.com/onsi/ginkgo/v2"
 	"github.com/onsi/gomega"

-	clusterv1 "open-cluster-management.io/api/cluster/v1"
-	"open-cluster-management.io/ocm/pkg/registration/spoke"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
-
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
+	clusterv1 "open-cluster-management.io/api/cluster/v1"
+	"open-cluster-management.io/ocm/pkg/registration/spoke"
 )

 var _ = ginkgo.Describe("Agent Recovery", func() {
@@ -42,7 +41,7 @@ var _ = ginkgo.Describe("Agent Recovery", func() {
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}

-		cancel := util.RunAgent("bootstrap-recoverytest", agentOptions, spokeCfg)
+		cancel := runAgent("bootstrap-recoverytest", agentOptions, spokeCfg)
 		defer cancel()

 		// the managedcluster should not be created
@@ -129,7 +128,7 @@ var _ = ginkgo.Describe("Agent Recovery", func() {
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}

-		cancel := util.RunAgent("hubkubeconfig-recoverytest", agentOptions, spokeCfg)
+		cancel := runAgent("hubkubeconfig-recoverytest", agentOptions, spokeCfg)
 		defer cancel()

 		// after bootstrap the spokecluster and csr should be created
@@ -1,20 +1,19 @@
-package integration_test
+package registration_test

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"path"
 	"time"

 	"github.com/onsi/ginkgo/v2"
 	"github.com/onsi/gomega"

-	clusterv1 "open-cluster-management.io/api/cluster/v1"
-	"open-cluster-management.io/ocm/pkg/registration/spoke"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
-
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clusterv1 "open-cluster-management.io/api/cluster/v1"
+	"open-cluster-management.io/ocm/pkg/registration/spoke"
 )

 var _ = ginkgo.Describe("Agent Restart", func() {
@@ -41,7 +40,7 @@ var _ = ginkgo.Describe("Agent Restart", func() {
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}

-		stopAgent := util.RunAgent("restart-test", agentOptions, spokeCfg)
+		stopAgent := runAgent("restart-test", agentOptions, spokeCfg)

 		ginkgo.By("Check existence of csr and ManagedCluster")
 		// the csr should be created
@@ -116,7 +115,7 @@ var _ = ginkgo.Describe("Agent Restart", func() {
 			HubKubeconfigDir:         hubKubeconfigDir,
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}
-		stopAgent = util.RunAgent("restart-test", agentOptions, spokeCfg)
+		stopAgent = runAgent("restart-test", agentOptions, spokeCfg)
 		defer stopAgent()

 		ginkgo.By("Check if ManagedCluster joins the hub")
@@ -169,7 +168,7 @@ var _ = ginkgo.Describe("Agent Restart", func() {
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}

-		stopAgent := util.RunAgent("restart-test", agentOptions, spokeCfg)
+		stopAgent := runAgent("restart-test", agentOptions, spokeCfg)

 		ginkgo.By("Check existence of csr and ManagedCluster")
 		// the csr should be created
@@ -230,7 +229,7 @@ var _ = ginkgo.Describe("Agent Restart", func() {
 			HubKubeconfigDir:         hubKubeconfigDir,
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}
-		stopAgent = util.RunAgent("restart-test", agentOptions, spokeCfg)
+		stopAgent = runAgent("restart-test", agentOptions, spokeCfg)
 		defer stopAgent()

 		ginkgo.By("Check the existence of csr and the new ManagedCluster")
@@ -1,7 +1,8 @@
-package integration_test
+package registration_test

 import (
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"path"
 	"time"

@@ -11,7 +12,6 @@ import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	clusterv1 "open-cluster-management.io/api/cluster/v1"
 	"open-cluster-management.io/ocm/pkg/registration/spoke"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
 )

 var _ = ginkgo.Describe("Cluster Auto Approval", func() {
@@ -35,7 +35,7 @@ var _ = ginkgo.Describe("Cluster Auto Approval", func() {
 		}

 		// run registration agent
-		cancel := util.RunAgent("autoapprovaltest", agentOptions, spokeCfg)
+		cancel := runAgent("autoapprovaltest", agentOptions, spokeCfg)
 		defer cancel()

 		gomega.Eventually(func() error {
@@ -1,8 +1,9 @@
-package integration_test
+package registration_test

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"path"
 	"reflect"
 	"time"
@@ -16,7 +17,6 @@ import (
 	clusterv1 "open-cluster-management.io/api/cluster/v1"
 	clusterv1alpha1 "open-cluster-management.io/api/cluster/v1alpha1"
 	"open-cluster-management.io/ocm/pkg/registration/spoke"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
 )

 var _ = ginkgo.Describe("Cluster Claim", func() {
@@ -55,7 +55,7 @@ var _ = ginkgo.Describe("Cluster Claim", func() {
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 			MaxCustomClusterClaims:   maxCustomClusterClaims,
 		}
-		cancel = util.RunAgent("claimtest", agentOptions, spokeCfg)
+		cancel = runAgent("claimtest", agentOptions, spokeCfg)
 	})

 	ginkgo.AfterEach(
@@ -1,7 +1,8 @@
-package integration_test
+package registration_test

 import (
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"path"
 	"time"

@@ -11,7 +12,6 @@ import (

 	clusterv1 "open-cluster-management.io/api/cluster/v1"
 	"open-cluster-management.io/ocm/pkg/registration/spoke"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
 )

 var _ = ginkgo.Describe("Joining Process", func() {
@@ -31,7 +31,7 @@ var _ = ginkgo.Describe("Joining Process", func() {
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}

-		cancel := util.RunAgent("joiningtest", agentOptions, spokeCfg)
+		cancel := runAgent("joiningtest", agentOptions, spokeCfg)
 		defer cancel()

 		// the spoke cluster and csr should be created after bootstrap
@@ -1,7 +1,8 @@
-package integration_test
+package registration_test

 import (
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"path"
 	"time"

@@ -11,7 +12,6 @@ import (

 	clusterv1 "open-cluster-management.io/api/cluster/v1"
 	"open-cluster-management.io/ocm/pkg/registration/spoke"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
 )

 var _ = ginkgo.Describe("Collecting Node Resource", func() {
@@ -37,7 +37,7 @@ var _ = ginkgo.Describe("Collecting Node Resource", func() {
 			ClusterHealthCheckPeriod: 1 * time.Minute,
 		}

-		cancel := util.RunAgent("resorucetest", agentOptions, spokeCfg)
+		cancel := runAgent("resorucetest", agentOptions, spokeCfg)
 		defer cancel()

 		// the spoke cluster and csr should be created after bootstrap
@@ -1,4 +1,4 @@
-package integration_test
+package registration_test

 import (
 	"context"
@@ -13,7 +13,7 @@ import (
 	"open-cluster-management.io/ocm/pkg/registration/helpers"
 	"open-cluster-management.io/ocm/pkg/registration/hub/taint"
 	"open-cluster-management.io/ocm/pkg/registration/spoke"
-	"open-cluster-management.io/ocm/test/registration/integration/util"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"path"
 	"time"
 )
@@ -3,23 +3,63 @@ package util
 import (
 	"context"
 	"fmt"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes"
+	workclientset "open-cluster-management.io/api/client/work/clientset/versioned"
+	workapiv1 "open-cluster-management.io/api/work/v1"
 	"reflect"
 	"sort"

 	"github.com/onsi/gomega"

-	corev1 "k8s.io/api/core/v1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/client-go/dynamic"
-	"k8s.io/client-go/kubernetes"

-	workclientset "open-cluster-management.io/api/client/work/clientset/versioned"
-	workapiv1 "open-cluster-management.io/api/work/v1"
+	operatorclientset "open-cluster-management.io/api/client/operator/clientset/versioned"
 )

+const (
+	eventuallyTimeout  = 60 // seconds
+	eventuallyInterval = 1  // seconds
+)
+
+func AssertKlusterletCondition(
+	name string, operatorClient operatorclientset.Interface, expectedType, expectedReason string, expectedWorkStatus metav1.ConditionStatus) {
+	gomega.Eventually(func() error {
+		klusterlet, err := operatorClient.OperatorV1().Klusterlets().Get(context.Background(), name, metav1.GetOptions{})
+		if err != nil {
+			return err
+		}
+
+		// check work status condition
+		if !HasCondition(klusterlet.Status.Conditions, expectedType, expectedReason, expectedWorkStatus) {
+			return fmt.Errorf("expect have type %s with reason %s and status %s, but got %v",
+				expectedType, expectedReason, expectedWorkStatus, klusterlet.Status.Conditions)
+		}
+		return nil
+	}, eventuallyTimeout, eventuallyInterval).ShouldNot(gomega.HaveOccurred())
+}
+
+func AssertClusterManagerCondition(
+	name string, operatorClient operatorclientset.Interface, expectedType, expectedReason string, expectedWorkStatus metav1.ConditionStatus) {
+	gomega.Eventually(func() error {
+		clusterManager, err := operatorClient.OperatorV1().ClusterManagers().Get(context.Background(), name, metav1.GetOptions{})
+		if err != nil {
+			return err
+		}
+
+		// check work status condition
+		if !HasCondition(clusterManager.Status.Conditions, expectedType, expectedReason, expectedWorkStatus) {
+			return fmt.Errorf("expect have type %s with reason %s and status %s, but got %v",
+				expectedType, expectedReason, expectedWorkStatus, clusterManager.Status.Conditions)
+		}
+		return nil
+	}, eventuallyTimeout, eventuallyInterval).ShouldNot(gomega.HaveOccurred())
+}
+
 func AssertWorkCondition(namespace, name string, workClient workclientset.Interface, expectedType string, expectedWorkStatus metav1.ConditionStatus,
 	expectedManifestStatuses []metav1.ConditionStatus, eventuallyTimeout, eventuallyInterval int) {
 	gomega.Eventually(func() error {
@@ -249,3 +289,22 @@ func AssertAppliedResources(hubHash, workName string, gvrs []schema.GroupVersion
 		return nil
 	}, eventuallyTimeout, eventuallyInterval).ShouldNot(gomega.HaveOccurred())
 }
+
+func HaveManifestCondition(conditions []workapiv1.ManifestCondition, expectedType string, expectedStatuses []metav1.ConditionStatus) bool {
+	if len(conditions) != len(expectedStatuses) {
+		return false
+	}
+
+	for index, condition := range conditions {
+		expectedStatus := expectedStatuses[index]
+		if expectedStatus == "" {
+			continue
+		}
+
+		if ok := meta.IsStatusConditionPresentAndEqual(condition.Conditions, expectedType, expectedStatus); !ok {
+			return false
+		}
+	}
+
+	return true
+}
@@ -16,18 +16,9 @@ import (
 	"path"
 	"time"

-	"github.com/onsi/ginkgo/v2"
-
-	clusterclientset "open-cluster-management.io/api/client/cluster/clientset/versioned"
-	clusterv1 "open-cluster-management.io/api/cluster/v1"
-
-	"github.com/openshift/library-go/pkg/controller/controllercmd"
-	"github.com/openshift/library-go/pkg/operator/events"
-
 	certificates "k8s.io/api/certificates/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
@@ -35,8 +26,6 @@ import (
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
 	certutil "k8s.io/client-go/util/cert"
 	"k8s.io/client-go/util/keyutil"
-	"k8s.io/client-go/util/retry"
-	"open-cluster-management.io/ocm/pkg/registration/spoke"
 	"sigs.k8s.io/controller-runtime/pkg/envtest"
 )

@@ -56,7 +45,12 @@ var (
 	DefaultTestAuthn = NewTestAuthn(caFile, caKeyFile)
 )

-func createKubeConfig(context string, securePort string, serverCertFile, certFile, keyFile string) (*clientcmdapi.Config, error) {
+type TestAuthn struct {
+	caFile    string
+	caKeyFile string
+}
+
+func createKubeConfigByClientCert(context string, securePort string, serverCertFile, certFile, keyFile string) (*clientcmdapi.Config, error) {
 	caData, err := ioutil.ReadFile(serverCertFile)
 	if err != nil {
 		return nil, err
@@ -80,11 +74,6 @@ func createKubeConfig(context string, securePort string, serverCertFile, certFil
 	return config, nil
 }

-type TestAuthn struct {
-	caFile    string
-	caKeyFile string
-}
-
 func NewTestAuthn(caFile, caKeyFile string) *TestAuthn {
 	return &TestAuthn{
 		caFile:    caFile,
@@ -200,7 +189,7 @@ func (t *TestAuthn) CreateBootstrapKubeConfig(configFileName, serverCertFile, se
 		return err
 	}

-	config, err := createKubeConfig(configFileName, securePort, serverCertFile, path.Join(configDir, "bootstrap.crt"), path.Join(configDir, "bootstrap.key"))
+	config, err := createKubeConfigByClientCert(configFileName, securePort, serverCertFile, path.Join(configDir, "bootstrap.crt"), path.Join(configDir, "bootstrap.key"))
 	if err != nil {
 		return err
 	}
@@ -509,130 +498,3 @@ func (t *TestAuthn) FillCertificateToApprovedCSR(kubeClient kubernetes.Interface

 	return nil
 }
-
-func GetManagedCluster(clusterClient clusterclientset.Interface, spokeClusterName string) (*clusterv1.ManagedCluster, error) {
-	spokeCluster, err := clusterClient.ClusterV1().ManagedClusters().Get(context.TODO(), spokeClusterName, metav1.GetOptions{})
-	if err != nil {
-		return nil, err
-	}
-	return spokeCluster, nil
-}
-
-func AcceptManagedCluster(clusterClient clusterclientset.Interface, spokeClusterName string) error {
-	return AcceptManagedClusterWithLeaseDuration(clusterClient, spokeClusterName, 60)
-}
-
-func AcceptManagedClusterWithLeaseDuration(clusterClient clusterclientset.Interface, spokeClusterName string, leaseDuration int32) error {
-	return retry.RetryOnConflict(retry.DefaultBackoff, func() error {
-		spokeCluster, err := GetManagedCluster(clusterClient, spokeClusterName)
-		if err != nil {
-			return err
-		}
-		spokeCluster.Spec.HubAcceptsClient = true
-		spokeCluster.Spec.LeaseDurationSeconds = leaseDuration
-		_, err = clusterClient.ClusterV1().ManagedClusters().Update(context.TODO(), spokeCluster, metav1.UpdateOptions{})
-		return err
-	})
-}
-
-func CreateNode(kubeClient kubernetes.Interface, name string, capacity, allocatable corev1.ResourceList) error {
-	node := &corev1.Node{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: name,
-		},
-		Status: corev1.NodeStatus{
-			Capacity:    capacity,
-			Allocatable: allocatable,
-		},
-	}
-	_, err := kubeClient.CoreV1().Nodes().Create(context.TODO(), node, metav1.CreateOptions{})
-	return err
-}
-
-func CordonNode(kubeClient kubernetes.Interface, name string) error {
-	node, err := kubeClient.CoreV1().Nodes().Get(context.TODO(), name, metav1.GetOptions{})
-	if err != nil {
-		return err
-	}
-
-	node = node.DeepCopy()
-	node.Spec.Unschedulable = true
-	_, err = kubeClient.CoreV1().Nodes().Update(context.TODO(), node, metav1.UpdateOptions{})
-	return err
-}
-
-func NewResourceList(cpu, mem int) corev1.ResourceList {
-	return corev1.ResourceList{
-		corev1.ResourceCPU:    *resource.NewQuantity(int64(cpu), resource.DecimalExponent),
-		corev1.ResourceMemory: *resource.NewQuantity(int64(1024*1024*mem), resource.BinarySI),
-	}
-}
-
-func CmpResourceQuantity(key string, nodeResourceList corev1.ResourceList, clusterResorceList clusterv1.ResourceList) bool {
-	nodeResource, ok := nodeResourceList[corev1.ResourceName(key)]
-	if !ok {
-		return false
-	}
-	clusterResouce, ok := clusterResorceList[clusterv1.ResourceName(key)]
-	if !ok {
-		return false
-	}
-	return nodeResource.Equal(clusterResouce)
-}
-
-func NewIntegrationTestEventRecorder(componet string) events.Recorder {
-	return &IntegrationTestEventRecorder{component: componet}
-}
-
-type IntegrationTestEventRecorder struct {
-	component string
-}
-
-func (r *IntegrationTestEventRecorder) ComponentName() string {
-	return r.component
-}
-
-func (r *IntegrationTestEventRecorder) ForComponent(c string) events.Recorder {
-	return &IntegrationTestEventRecorder{component: c}
-}
-
-func (r *IntegrationTestEventRecorder) WithContext(ctx context.Context) events.Recorder {
-	return r
-}
-
-func (r *IntegrationTestEventRecorder) WithComponentSuffix(suffix string) events.Recorder {
-	return r.ForComponent(fmt.Sprintf("%s-%s", r.ComponentName(), suffix))
-}
-
-func (r *IntegrationTestEventRecorder) Event(reason, message string) {
-	fmt.Fprintf(ginkgo.GinkgoWriter, "Event: [%s] %v: %v \n", r.component, reason, message)
-}
-
-func (r *IntegrationTestEventRecorder) Eventf(reason, messageFmt string, args ...interface{}) {
-	r.Event(reason, fmt.Sprintf(messageFmt, args...))
-}
-
-func (r *IntegrationTestEventRecorder) Warning(reason, message string) {
-	fmt.Fprintf(ginkgo.GinkgoWriter, "Warning: [%s] %v: %v \n", r.component, reason, message)
-}
-
-func (r *IntegrationTestEventRecorder) Warningf(reason, messageFmt string, args ...interface{}) {
-	r.Warning(reason, fmt.Sprintf(messageFmt, args...))
-}
-
-func (r *IntegrationTestEventRecorder) Shutdown() {}
-
-func RunAgent(name string, opt spoke.SpokeAgentOptions, cfg *rest.Config) context.CancelFunc {
-	ctx, cancel := context.WithCancel(context.Background())
-	go func() {
-		err := opt.RunSpokeAgent(ctx, &controllercmd.ControllerContext{
-			KubeConfig:    cfg,
-			EventRecorder: NewIntegrationTestEventRecorder(name),
-		})
-		if err != nil {
-			return
-		}
-	}()
-
-	return cancel
-}
@@ -0,0 +1,59 @@
+package util
+
+import (
+	cryptorand "crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"time"
+
+	certutil "k8s.io/client-go/util/cert"
+)
+
+func NewCert(notAfter time.Time) []byte {
+	caKey, err := rsa.GenerateKey(cryptorand.Reader, 2048)
+	if err != nil {
+		panic(err)
+	}
+
+	caCert, err := certutil.NewSelfSignedCACert(certutil.Config{CommonName: "open-cluster-management.io"}, caKey)
+	if err != nil {
+		panic(err)
+	}
+
+	key, err := rsa.GenerateKey(cryptorand.Reader, 2048)
+	if err != nil {
+		panic(err)
+	}
+
+	certDERBytes, err := x509.CreateCertificate(
+		cryptorand.Reader,
+		&x509.Certificate{
+			Subject: pkix.Name{
+				CommonName: "test",
+			},
+			SerialNumber: big.NewInt(1),
+			NotBefore:    caCert.NotBefore,
+			NotAfter:     notAfter,
+			KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+			ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		},
+		caCert,
+		key.Public(),
+		caKey,
+	)
+	if err != nil {
+		panic(err)
+	}
+
+	cert, err := x509.ParseCertificate(certDERBytes)
+	if err != nil {
+		panic(err)
+	}
+	return pem.EncodeToMemory(&pem.Block{
+		Type:  certutil.CertificateBlockType,
+		Bytes: cert.Raw,
+	})
+}
@@ -0,0 +1,55 @@
+package util
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+	clientcmdlatest "k8s.io/client-go/tools/clientcmd/api/latest"
+)
+
+func NewKubeConfig(config *rest.Config) []byte {
+	configData, _ := runtime.Encode(clientcmdlatest.Codec, &clientcmdapi.Config{
+		Clusters: map[string]*clientcmdapi.Cluster{"test-cluster": {
+			Server:                config.Host,
+			InsecureSkipTLSVerify: true,
+		}},
+		Contexts: map[string]*clientcmdapi.Context{"test-context": {
+			Cluster:  "test-cluster",
+			AuthInfo: "test-user",
+		}},
+		AuthInfos: map[string]*clientcmdapi.AuthInfo{
+			"test-user": {
+				ClientCertificateData: config.CertData,
+				ClientKeyData:         config.KeyData,
+			},
+		},
+		CurrentContext: "test-context",
+	})
+	return configData
+}
+
+func CreateKubeconfigFile(clientConfig *rest.Config, filename string) error {
+	// Build kubeconfig.
+	kubeconfig := clientcmdapi.Config{
+		Clusters: map[string]*clientcmdapi.Cluster{"default-cluster": {
+			Server:                   clientConfig.Host,
+			InsecureSkipTLSVerify:    clientConfig.Insecure,
+			CertificateAuthorityData: clientConfig.CAData,
+		}},
+		AuthInfos: map[string]*clientcmdapi.AuthInfo{"default-auth": {
+			ClientCertificate:     clientConfig.CertFile,
+			ClientCertificateData: clientConfig.CertData,
+			ClientKey:             clientConfig.KeyFile,
+			ClientKeyData:         clientConfig.KeyData,
+		}},
+		Contexts: map[string]*clientcmdapi.Context{"default-context": {
+			Cluster:   "default-cluster",
+			AuthInfo:  "default-auth",
+			Namespace: "configuration",
+		}},
+		CurrentContext: "default-context",
+	}
+
+	return clientcmd.WriteToFile(kubeconfig, filename)
+}
@@ -0,0 +1,82 @@
+package util
+
+import (
+	"context"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/util/retry"
+	clusterclientset "open-cluster-management.io/api/client/cluster/clientset/versioned"
+	clusterv1 "open-cluster-management.io/api/cluster/v1"
+)
+
+func GetManagedCluster(clusterClient clusterclientset.Interface, spokeClusterName string) (*clusterv1.ManagedCluster, error) {
+	spokeCluster, err := clusterClient.ClusterV1().ManagedClusters().Get(context.TODO(), spokeClusterName, metav1.GetOptions{})
+	if err != nil {
+		return nil, err
+	}
+	return spokeCluster, nil
+}
+
+func AcceptManagedCluster(clusterClient clusterclientset.Interface, spokeClusterName string) error {
+	return AcceptManagedClusterWithLeaseDuration(clusterClient, spokeClusterName, 60)
+}
+
+func AcceptManagedClusterWithLeaseDuration(clusterClient clusterclientset.Interface, spokeClusterName string, leaseDuration int32) error {
+	return retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		spokeCluster, err := GetManagedCluster(clusterClient, spokeClusterName)
+		if err != nil {
+			return err
+		}
+		spokeCluster.Spec.HubAcceptsClient = true
+		spokeCluster.Spec.LeaseDurationSeconds = leaseDuration
+		_, err = clusterClient.ClusterV1().ManagedClusters().Update(context.TODO(), spokeCluster, metav1.UpdateOptions{})
+		return err
+	})
+}
+
+func CreateNode(kubeClient kubernetes.Interface, name string, capacity, allocatable corev1.ResourceList) error {
+	node := &corev1.Node{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+		Status: corev1.NodeStatus{
+			Capacity:    capacity,
+			Allocatable: allocatable,
+		},
+	}
+	_, err := kubeClient.CoreV1().Nodes().Create(context.TODO(), node, metav1.CreateOptions{})
+	return err
+}
+
+func CordonNode(kubeClient kubernetes.Interface, name string) error {
+	node, err := kubeClient.CoreV1().Nodes().Get(context.TODO(), name, metav1.GetOptions{})
+	if err != nil {
+		return err
+	}
+
+	node = node.DeepCopy()
+	node.Spec.Unschedulable = true
+	_, err = kubeClient.CoreV1().Nodes().Update(context.TODO(), node, metav1.UpdateOptions{})
+	return err
+}
+
+func NewResourceList(cpu, mem int) corev1.ResourceList {
+	return corev1.ResourceList{
+		corev1.ResourceCPU:    *resource.NewQuantity(int64(cpu), resource.DecimalExponent),
+		corev1.ResourceMemory: *resource.NewQuantity(int64(1024*1024*mem), resource.BinarySI),
+	}
+}
+
+func CmpResourceQuantity(key string, nodeResourceList corev1.ResourceList, clusterResorceList clusterv1.ResourceList) bool {
+	nodeResource, ok := nodeResourceList[corev1.ResourceName(key)]
+	if !ok {
+		return false
+	}
+	clusterResouce, ok := clusterResorceList[clusterv1.ResourceName(key)]
+	if !ok {
+		return false
+	}
+	return nodeResource.Equal(clusterResouce)
+}
@@ -0,0 +1,105 @@
+package util
+
+import (
+	"context"
+	corev1 "k8s.io/api/core/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/kubernetes"
+	workapiv1 "open-cluster-management.io/api/work/v1"
+)
+
+func NewManifestWork(namespace, name string, manifests []workapiv1.Manifest) *workapiv1.ManifestWork {
+	work := &workapiv1.ManifestWork{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: namespace,
+		},
+		Spec: workapiv1.ManifestWorkSpec{
+			Workload: workapiv1.ManifestsTemplate{
+				Manifests: manifests,
+			},
+		},
+	}
+
+	if name != "" {
+		work.Name = name
+	} else {
+		work.GenerateName = "work-"
+	}
+
+	return work
+}
+
+func NewConfigmap(namespace, name string, data map[string]string, finalizers []string) *corev1.ConfigMap {
+	cm := &corev1.ConfigMap{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "ConfigMap",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:  namespace,
+			Name:       name,
+			Finalizers: finalizers,
+		},
+		Data: data,
+	}
+
+	return cm
+}
+
+func NewRoleForManifest(namespace, name string, rules ...rbacv1.PolicyRule) *rbacv1.Role {
+	return &rbacv1.Role{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Role",
+			APIVersion: "rbac.authorization.k8s.io/v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+		},
+		Rules: rules,
+	}
+}
+
+func NewRoleBindingForManifest(namespace, name string, rule rbacv1.RoleRef,
+	subjects ...rbacv1.Subject) *rbacv1.RoleBinding {
+	return &rbacv1.RoleBinding{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "RoleBinding",
+			APIVersion: "rbac.authorization.k8s.io/v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+		},
+		Subjects: subjects,
+		RoleRef:  rule,
+	}
+}
+
+func ToManifest(object runtime.Object) workapiv1.Manifest {
+	manifest := workapiv1.Manifest{}
+	manifest.Object = object
+	return manifest
+}
+
+func RemoveConfigmapFinalizers(kubeClient kubernetes.Interface, namespace string, names ...string) error {
+	for _, name := range names {
+		cm, err := kubeClient.CoreV1().ConfigMaps(namespace).Get(context.Background(), name, metav1.GetOptions{})
+		if errors.IsNotFound(err) {
+			continue
+		}
+		if err != nil {
+			return err
+		}
+		cm.Finalizers = nil
+		_, err = kubeClient.CoreV1().ConfigMaps(cm.Namespace).Update(context.Background(), cm, metav1.UpdateOptions{})
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
@@ -1,8 +1,9 @@
-package integration
+package work

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"time"

 	"github.com/onsi/ginkgo/v2"
@@ -13,7 +14,6 @@ import (
 	utilrand "k8s.io/apimachinery/pkg/util/rand"
 	workapiv1 "open-cluster-management.io/api/work/v1"
 	"open-cluster-management.io/ocm/pkg/work/spoke"
-	"open-cluster-management.io/ocm/test/work/integration/util"
 )

 var _ = ginkgo.Describe("ManifestWork Status Feedback", func() {
@@ -2,4 +2,4 @@
 // - create work
 // - update work
 // - delete work
-package integration
+package work
@@ -1,9 +1,10 @@
-package integration
+package work

 import (
 	"context"
 	"encoding/json"
 	"open-cluster-management.io/ocm/pkg/features"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"time"

 	jsonpatch "github.com/evanphx/json-patch"
@@ -17,7 +18,6 @@ import (
 	workclientset "open-cluster-management.io/api/client/work/clientset/versioned"
 	workapiv1 "open-cluster-management.io/api/work/v1"
 	"open-cluster-management.io/ocm/pkg/work/spoke"
-	"open-cluster-management.io/ocm/test/work/integration/util"
 )

 var _ = ginkgo.Describe("ManifestWork Executor Subject", func() {
@@ -1,8 +1,9 @@
-package integration
+package work

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"

 	"github.com/onsi/ginkgo/v2"
 	"github.com/onsi/gomega"
@@ -14,7 +15,6 @@ import (
 	clusterv1beta1 "open-cluster-management.io/api/cluster/v1beta1"
 	workapiv1 "open-cluster-management.io/api/work/v1"
 	workapiv1alpha1 "open-cluster-management.io/api/work/v1alpha1"
-	"open-cluster-management.io/ocm/test/work/integration/util"
 )

 var _ = ginkgo.Describe("ManifestWorkReplicaSet", func() {
@@ -1,9 +1,10 @@
-package integration
+package work

 import (
 	"context"
 	"fmt"
 	"open-cluster-management.io/ocm/pkg/features"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"time"

 	"github.com/onsi/ginkgo/v2"
@@ -17,7 +18,6 @@ import (
 	ocmfeature "open-cluster-management.io/api/feature"
 	workapiv1 "open-cluster-management.io/api/work/v1"
 	"open-cluster-management.io/ocm/pkg/work/spoke"
-	"open-cluster-management.io/ocm/test/work/integration/util"
 )

 var _ = ginkgo.Describe("ManifestWork Status Feedback", func() {
@@ -1,7 +1,8 @@
-package integration
+package work

 import (
 	"context"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"os"
 	"path"
 	"testing"
@@ -23,7 +24,6 @@ import (
 	workclientset "open-cluster-management.io/api/client/work/clientset/versioned"
 	workapiv1 "open-cluster-management.io/api/work/v1"
 	"open-cluster-management.io/ocm/pkg/work/helper"
-	"open-cluster-management.io/ocm/test/work/integration/util"
 )

 const (
@@ -1,8 +1,9 @@
-package integration
+package work

 import (
 	"context"
 	"fmt"
+	util "open-cluster-management.io/ocm/test/integration/util"
 	"os"
 	"path"
 	"time"
@@ -17,7 +18,6 @@ import (
 	workclientset "open-cluster-management.io/api/client/work/clientset/versioned"
 	workapiv1 "open-cluster-management.io/api/work/v1"
 	"open-cluster-management.io/ocm/pkg/work/spoke"
-	"open-cluster-management.io/ocm/test/work/integration/util"
 	"sigs.k8s.io/controller-runtime/pkg/envtest"
 )

@@ -1,8 +1,9 @@
-package integration
+package work

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"time"

 	"github.com/onsi/ginkgo/v2"
@@ -15,7 +16,6 @@ import (
 	"k8s.io/utils/pointer"
 	workapiv1 "open-cluster-management.io/api/work/v1"
 	"open-cluster-management.io/ocm/pkg/work/spoke"
-	"open-cluster-management.io/ocm/test/work/integration/util"
 )

 var _ = ginkgo.Describe("ManifestWork Update Strategy", func() {
@@ -1,8 +1,9 @@
-package integration
+package work

 import (
 	"context"
 	"fmt"
+	"open-cluster-management.io/ocm/test/integration/util"
 	"time"

 	"github.com/onsi/ginkgo/v2"
@@ -20,7 +21,6 @@ import (

 	workapiv1 "open-cluster-management.io/api/work/v1"
 	"open-cluster-management.io/ocm/pkg/work/spoke"
-	"open-cluster-management.io/ocm/test/work/integration/util"
 )

 func startWorkAgent(ctx context.Context, o *spoke.WorkloadAgentOptions) {
@@ -69,11 +69,28 @@ var _ = ginkgo.Describe("ManifestWork", func() {
 	})

 	ginkgo.AfterEach(func() {
+		err = hubWorkClient.WorkV1().ManifestWorks(o.SpokeClusterName).Delete(context.Background(), work.Name, metav1.DeleteOptions{})
+		if !errors.IsNotFound(err) {
+			gomega.Expect(err).ToNot(gomega.HaveOccurred())
+		}
+
+		gomega.Eventually(func() error {
+			_, err := hubWorkClient.WorkV1().ManifestWorks(o.SpokeClusterName).Get(context.Background(), work.Name, metav1.GetOptions{})
+			if errors.IsNotFound(err) {
+				return nil
+			}
+			if err != nil {
+				return err
+			}
+			return fmt.Errorf("work %s in namespace %s still exists", work.Name, o.SpokeClusterName)
+		}, eventuallyTimeout, eventuallyInterval).Should(gomega.Succeed())
+
+		err := spokeKubeClient.CoreV1().Namespaces().Delete(context.Background(), o.SpokeClusterName, metav1.DeleteOptions{})
+		gomega.Expect(err).ToNot(gomega.HaveOccurred())
+
 		if cancel != nil {
 			cancel()
 		}
-		err := spokeKubeClient.CoreV1().Namespaces().Delete(context.Background(), o.SpokeClusterName, metav1.DeleteOptions{})
-		gomega.Expect(err).ToNot(gomega.HaveOccurred())
 	})

 	ginkgo.Context("With a single manifest", func() {
@@ -591,6 +608,11 @@ var _ = ginkgo.Describe("ManifestWork", func() {
 			}
 		})

+		ginkgo.AfterEach(func() {
+			err = util.RemoveConfigmapFinalizers(spokeKubeClient, o.SpokeClusterName, "cm1", "cm2", "cm3")
+			gomega.Expect(err).ToNot(gomega.HaveOccurred())
+		})
+
 		ginkgo.It("should remove applied resource for stale manifest from list once the resource is gone", func() {
 			util.AssertExistenceOfConfigMaps(manifests, spokeKubeClient, eventuallyTimeout, eventuallyInterval)

@@ -613,12 +635,8 @@ var _ = ginkgo.Describe("ManifestWork", func() {
 			// remove finalizer from the applied resources for stale manifest after 2 seconds
 			go func() {
 				time.Sleep(2 * time.Second)
-				cm := manifests[0].Object.(*corev1.ConfigMap)
-				cm, err := spokeKubeClient.CoreV1().ConfigMaps(cm.Namespace).Get(context.Background(), cm.Name, metav1.GetOptions{})
-				if err == nil {
-					cm.Finalizers = nil
-					_, _ = spokeKubeClient.CoreV1().ConfigMaps(cm.Namespace).Update(context.Background(), cm, metav1.UpdateOptions{})
-				}
+				// remove finalizers of cm1
+				_ = util.RemoveConfigmapFinalizers(spokeKubeClient, o.SpokeClusterName, "cm1")
 			}()

 			// check if resource created by stale manifest is deleted once it is removed from applied resource list
@@ -1,51 +0,0 @@
-package util
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/onsi/gomega"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	operatorclientset "open-cluster-management.io/api/client/operator/clientset/versioned"
-)
-
-const (
-	eventuallyTimeout  = 60 // seconds
-	eventuallyInterval = 1  // seconds
-)
-
-func AssertKlusterletCondition(
-	name string, operatorClient operatorclientset.Interface, expectedType, expectedReason string, expectedWorkStatus metav1.ConditionStatus) {
-	gomega.Eventually(func() error {
-		klusterlet, err := operatorClient.OperatorV1().Klusterlets().Get(context.Background(), name, metav1.GetOptions{})
-		if err != nil {
-			return err
-		}
-
-		// check work status condition
-		if !HasCondition(klusterlet.Status.Conditions, expectedType, expectedReason, expectedWorkStatus) {
-			return fmt.Errorf("expect have type %s with reason %s and status %s, but got %v",
-				expectedType, expectedReason, expectedWorkStatus, klusterlet.Status.Conditions)
-		}
-		return nil
-	}, eventuallyTimeout, eventuallyInterval).ShouldNot(gomega.HaveOccurred())
-}
-
-func AssertClusterManagerCondition(
-	name string, operatorClient operatorclientset.Interface, expectedType, expectedReason string, expectedWorkStatus metav1.ConditionStatus) {
-	gomega.Eventually(func() error {
-		clusterManager, err := operatorClient.OperatorV1().ClusterManagers().Get(context.Background(), name, metav1.GetOptions{})
-		if err != nil {
-			return err
-		}
-
-		// check work status condition
-		if !HasCondition(clusterManager.Status.Conditions, expectedType, expectedReason, expectedWorkStatus) {
-			return fmt.Errorf("expect have type %s with reason %s and status %s, but got %v",
-				expectedType, expectedReason, expectedWorkStatus, clusterManager.Status.Conditions)
-		}
-		return nil
-	}, eventuallyTimeout, eventuallyInterval).ShouldNot(gomega.HaveOccurred())
-}
@@ -1,152 +0,0 @@
-package util
-
-import (
-	"context"
-	cryptorand "crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/pem"
-	"fmt"
-	"math/big"
-	"time"
-
-	"github.com/onsi/ginkgo/v2"
-
-	"github.com/openshift/library-go/pkg/operator/events"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/rest"
-	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
-	clientcmdlatest "k8s.io/client-go/tools/clientcmd/api/latest"
-	certutil "k8s.io/client-go/util/cert"
-)
-
-func NewIntegrationTestEventRecorder(componet string) events.Recorder {
-	return &IntegrationTestEventRecorder{component: componet}
-}
-
-type IntegrationTestEventRecorder struct {
-	component string
-}
-
-func (r *IntegrationTestEventRecorder) ComponentName() string {
-	return r.component
-}
-
-func (r *IntegrationTestEventRecorder) WithContext(ctx context.Context) events.Recorder {
-	return r
-}
-
-func (r *IntegrationTestEventRecorder) ForComponent(c string) events.Recorder {
-	return &IntegrationTestEventRecorder{component: c}
-}
-
-func (r *IntegrationTestEventRecorder) WithComponentSuffix(suffix string) events.Recorder {
-	return r.ForComponent(fmt.Sprintf("%s-%s", r.ComponentName(), suffix))
-}
-
-func (r *IntegrationTestEventRecorder) Event(reason, message string) {
-	fmt.Fprintf(ginkgo.GinkgoWriter, "Event: [%s] %v: %v \n", r.component, reason, message)
-}
-
-func (r *IntegrationTestEventRecorder) Eventf(reason, messageFmt string, args ...interface{}) {
-	r.Event(reason, fmt.Sprintf(messageFmt, args...))
-}
-
-func (r *IntegrationTestEventRecorder) Warning(reason, message string) {
-	fmt.Fprintf(ginkgo.GinkgoWriter, "Warning: [%s] %v: %v \n", r.component, reason, message)
-}
-
-func (r *IntegrationTestEventRecorder) Warningf(reason, messageFmt string, args ...interface{}) {
-	r.Warning(reason, fmt.Sprintf(messageFmt, args...))
-}
-
-func (r *IntegrationTestEventRecorder) Shutdown() {}
-
-func HasCondition(conditions []metav1.Condition, expectedType, expectedReason string, expectedStatus metav1.ConditionStatus) bool {
-	for _, condition := range conditions {
-		if condition.Type != expectedType {
-			continue
-		}
-
-		if condition.Status != expectedStatus {
-			return false
-		}
-
-		if condition.Reason != expectedReason {
-			return false
-		}
-
-		return true
-	}
-
-	return false
-}
-
-func NewKubeConfig(config *rest.Config) []byte {
-	configData, _ := runtime.Encode(clientcmdlatest.Codec, &clientcmdapi.Config{
-		Clusters: map[string]*clientcmdapi.Cluster{"test-cluster": {
-			Server:                config.Host,
-			InsecureSkipTLSVerify: true,
-		}},
-		Contexts: map[string]*clientcmdapi.Context{"test-context": {
-			Cluster:  "test-cluster",
-			AuthInfo: "test-user",
-		}},
-		AuthInfos: map[string]*clientcmdapi.AuthInfo{
-			"test-user": {
-				ClientCertificateData: config.CertData,
-				ClientKeyData:         config.KeyData,
-			},
-		},
-		CurrentContext: "test-context",
-	})
-	return configData
-}
-
-func NewCert(notAfter time.Time) []byte {
-	caKey, err := rsa.GenerateKey(cryptorand.Reader, 2048)
-	if err != nil {
-		panic(err)
-	}
-
-	caCert, err := certutil.NewSelfSignedCACert(certutil.Config{CommonName: "open-cluster-management.io"}, caKey)
-	if err != nil {
-		panic(err)
-	}
-
-	key, err := rsa.GenerateKey(cryptorand.Reader, 2048)
-	if err != nil {
-		panic(err)
-	}
-
-	certDERBytes, err := x509.CreateCertificate(
-		cryptorand.Reader,
-		&x509.Certificate{
-			Subject: pkix.Name{
-				CommonName: "test",
-			},
-			SerialNumber: big.NewInt(1),
-			NotBefore:    caCert.NotBefore,
-			NotAfter:     notAfter,
-			KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
-			ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
-		},
-		caCert,
-		key.Public(),
-		caKey,
-	)
-	if err != nil {
-		panic(err)
-	}
-
-	cert, err := x509.ParseCertificate(certDERBytes)
-	if err != nil {
-		panic(err)
-	}
-	return pem.EncodeToMemory(&pem.Block{
-		Type:  certutil.CertificateBlockType,
-		Bytes: cert.Raw,
-	})
-}
@@ -1,45 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-  <testsuite name="Integration Suite" tests="42" failures="0" errors="0" time="0.004">
-      <testcase name="ManifestWork Update Strategy Create only strategy deployed resource should not be updated when work is updated" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Update Strategy Server side apply strategy deployed resource should be applied when work is updated" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Update Strategy Server side apply strategy should get conflict if a field is taken by another manager" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Update Strategy Server side apply strategy two manifest works with different field manager" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Update Strategy Server side apply strategy with delete options" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Status Feedback Deployment Status feedback should return well known statuses" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Status Feedback Deployment Status feedback should return statuses by JSONPaths" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Status Feedback Deployment Status feedback should return none for resources with no wellKnowne status" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Status Feedback Resource sharing and adoption between manifestworks shared resource between the manifestwork should be kept when one manifestwork is deleted" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Status Feedback Resource sharing and adoption between manifestworks shared resource between the manifestwork should be kept when the shared resource is removed from one manifestwork" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Status Feedback Delete options Orphan deletion of the whole manifestwork" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Status Feedback Delete options Selectively Orphan deletion of the manifestwork" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Status Feedback Delete options Keep the resource when remove it from manifests with orphan deletion option" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Status Feedback Delete options Clean the resource when orphan deletion option is removed" classname="Integration Suite" time="0"></testcase>
-      <testcase name="Unmanaged ApplieManifestWork Should delete unmanaged applied work should keep old appliemanifestwork with different agent id" classname="Integration Suite" time="0"></testcase>
-      <testcase name="Unmanaged ApplieManifestWork Should delete unmanaged applied work should remove old appliemanifestwork if applied again on new hub" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork With a single manifest should create work and then apply it successfully" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork With a single manifest should update work and then apply it successfully" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork With a single manifest should delete work successfully" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork With multiple manifests should create work and then apply it successfully" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork With multiple manifests should update work and then apply it successfully" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork With multiple manifests should delete work successfully" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork With CRD and CR in manifests should create CRD and CR successfully" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork With CRD and CR in manifests should merge annotation of existing CR" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork With CRD and CR in manifests should keep the finalizer unchanged of existing CR" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork With CRD and CR in manifests should delete CRD and CR successfully" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork With Service Account, Role, RoleBinding and Deployment in manifests should create Service Account, Role, RoleBinding and Deployment successfully" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork With Service Account, Role, RoleBinding and Deployment in manifests should update Service Account and Deployment successfully" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Foreground deletion should remove applied resource for stale manifest from list once the resource is gone" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Foreground deletion should delete manifest work eventually after all applied resources are gone" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Foreground deletion should delete applied manifest work if it is orphan" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Executor Subject Apply the resource with executor Executor does not have permission" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Executor Subject Apply the resource with executor Executor does not have permission to partial resources" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Executor Subject Apply the resource with executor Executor has permission for all resources" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Executor Subject Apply the resource with executor deleting validating Executor does not have delete permission and delete option is foreground" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Executor Subject Apply the resource with executor deleting validating Executor does not have delete permission and delete option is orphan" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Executor Subject Apply the resource with executor deleting validating Executor does not have delete permission and delete option is selectively orphan" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Executor Subject Apply the resource with executor escalation validating no permission" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Executor Subject Apply the resource with executor escalation validating no permission for already existing resource" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Executor Subject Apply the resource with executor escalation validating with permission" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Executor Subject Apply the resource with executor escalation validating with permission for already exist resource" classname="Integration Suite" time="0"></testcase>
-      <testcase name="ManifestWork Executor Subject Caches are in effect Permission change" classname="Integration Suite" time="0"></testcase>
-  </testsuite>
@@ -1,182 +0,0 @@
-package util
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/onsi/ginkgo/v2"
-
-	"github.com/openshift/library-go/pkg/operator/events"
-	corev1 "k8s.io/api/core/v1"
-	rbacv1 "k8s.io/api/rbac/v1"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/tools/clientcmd"
-	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
-
-	workapiv1 "open-cluster-management.io/api/work/v1"
-)
-
-func HaveManifestCondition(conditions []workapiv1.ManifestCondition, expectedType string, expectedStatuses []metav1.ConditionStatus) bool {
-	if len(conditions) != len(expectedStatuses) {
-		return false
-	}
-
-	for index, condition := range conditions {
-		expectedStatus := expectedStatuses[index]
-		if expectedStatus == "" {
-			continue
-		}
-
-		if ok := meta.IsStatusConditionPresentAndEqual(condition.Conditions, expectedType, expectedStatus); !ok {
-			return false
-		}
-	}
-
-	return true
-}
-
-func NewManifestWork(namespace, name string, manifests []workapiv1.Manifest) *workapiv1.ManifestWork {
-	work := &workapiv1.ManifestWork{
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace: namespace,
-		},
-		Spec: workapiv1.ManifestWorkSpec{
-			Workload: workapiv1.ManifestsTemplate{
-				Manifests: manifests,
-			},
-		},
-	}
-
-	if name != "" {
-		work.Name = name
-	} else {
-		work.GenerateName = "work-"
-	}
-
-	return work
-}
-
-func NewConfigmap(namespace, name string, data map[string]string, finalizers []string) *corev1.ConfigMap {
-	cm := &corev1.ConfigMap{
-		TypeMeta: metav1.TypeMeta{
-			Kind:       "ConfigMap",
-			APIVersion: "v1",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Namespace:  namespace,
-			Name:       name,
-			Finalizers: finalizers,
-		},
-		Data: data,
-	}
-
-	return cm
-}
-
-func NewRoleForManifest(namespace, name string, rules ...rbacv1.PolicyRule) *rbacv1.Role {
-	return &rbacv1.Role{
-		TypeMeta: metav1.TypeMeta{
-			Kind:       "Role",
-			APIVersion: "rbac.authorization.k8s.io/v1",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
-			Namespace: namespace,
-		},
-		Rules: rules,
-	}
-}
-
-func NewRoleBindingForManifest(namespace, name string, rule rbacv1.RoleRef,
-	subjects ...rbacv1.Subject) *rbacv1.RoleBinding {
-	return &rbacv1.RoleBinding{
-		TypeMeta: metav1.TypeMeta{
-			Kind:       "RoleBinding",
-			APIVersion: "rbac.authorization.k8s.io/v1",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
-			Namespace: namespace,
-		},
-		Subjects: subjects,
-		RoleRef:  rule,
-	}
-}
-
-func ToManifest(object runtime.Object) workapiv1.Manifest {
-	manifest := workapiv1.Manifest{}
-	manifest.Object = object
-	return manifest
-}
-
-func CreateKubeconfigFile(clientConfig *rest.Config, filename string) error {
-	// Build kubeconfig.
-	kubeconfig := clientcmdapi.Config{
-		Clusters: map[string]*clientcmdapi.Cluster{"default-cluster": {
-			Server:                   clientConfig.Host,
-			InsecureSkipTLSVerify:    clientConfig.Insecure,
-			CertificateAuthorityData: clientConfig.CAData,
-		}},
-		AuthInfos: map[string]*clientcmdapi.AuthInfo{"default-auth": {
-			ClientCertificate:     clientConfig.CertFile,
-			ClientCertificateData: clientConfig.CertData,
-			ClientKey:             clientConfig.KeyFile,
-			ClientKeyData:         clientConfig.KeyData,
-		}},
-		Contexts: map[string]*clientcmdapi.Context{"default-context": {
-			Cluster:   "default-cluster",
-			AuthInfo:  "default-auth",
-			Namespace: "configuration",
-		}},
-		CurrentContext: "default-context",
-	}
-
-	return clientcmd.WriteToFile(kubeconfig, filename)
-}
-
-func NewIntegrationTestEventRecorder(componet string) events.Recorder {
-	return &IntegrationTestEventRecorder{component: componet}
-}
-
-type IntegrationTestEventRecorder struct {
-	component string
-}
-
-func (r *IntegrationTestEventRecorder) ComponentName() string {
-	return r.component
-}
-
-func (r *IntegrationTestEventRecorder) WithContext(ctx context.Context) events.Recorder {
-	return r
-}
-
-func (r *IntegrationTestEventRecorder) ForComponent(c string) events.Recorder {
-	r.component = c
-	return r
-}
-
-func (r *IntegrationTestEventRecorder) WithComponentSuffix(suffix string) events.Recorder {
-	return r.ForComponent(fmt.Sprintf("%s-%s", r.ComponentName(), suffix))
-}
-
-func (r *IntegrationTestEventRecorder) Event(reason, message string) {
-	fmt.Fprintf(ginkgo.GinkgoWriter, "Event: [%s] %v: %v \n", r.component, reason, message)
-}
-
-func (r *IntegrationTestEventRecorder) Eventf(reason, messageFmt string, args ...interface{}) {
-	r.Event(reason, fmt.Sprintf(messageFmt, args...))
-}
-
-func (r *IntegrationTestEventRecorder) Warning(reason, message string) {
-	fmt.Fprintf(ginkgo.GinkgoWriter, "Warning: [%s] %v: %v \n", r.component, reason, message)
-}
-
-func (r *IntegrationTestEventRecorder) Warningf(reason, messageFmt string, args ...interface{}) {
-	r.Warning(reason, fmt.Sprintf(messageFmt, args...))
-}
-
-func (r *IntegrationTestEventRecorder) Shutdown() {
-}
@@ -99,14 +99,20 @@ Care should be taken when parsing and interpreting HTML, whether full documents
 or fragments, within the framework of the HTML specification, especially with
 regard to untrusted inputs.

-This package provides both a tokenizer and a parser. Only the parser constructs
-a DOM according to the HTML specification, resolving malformed and misplaced
-tags where appropriate. The tokenizer simply tokenizes the HTML presented to it,
-and as such does not resolve issues that may exist in the processed HTML,
-producing a literal interpretation of the input.
+This package provides both a tokenizer and a parser, which implement the
+tokenization, and tokenization and tree construction stages of the WHATWG HTML
+parsing specification respectively. While the tokenizer parses and normalizes
+individual HTML tokens, only the parser constructs the DOM tree from the
+tokenized HTML, as described in the tree construction stage of the
+specification, dynamically modifying or extending the docuemnt's DOM tree.

-If your use case requires semantically well-formed HTML, as defined by the
-WHATWG specifiction, the parser should be used rather than the tokenizer.
+If your use case requires semantically well-formed HTML documents, as defined by
+the WHATWG specification, the parser should be used rather than the tokenizer.
+
+In security contexts, if trust decisions are being made using the tokenized or
+parsed content, the input must be re-serialized (for instance by using Render or
+Token.String) in order for those trust decisions to hold, as the process of
+tokenization or parsing may alter the content.
 */
 package html // import "golang.org/x/net/html"

@@ -88,13 +88,9 @@ func (p *pipe) Write(d []byte) (n int, err error) {
 		p.c.L = &p.mu
 	}
 	defer p.c.Signal()
-	if p.err != nil {
+	if p.err != nil || p.breakErr != nil {
 		return 0, errClosedPipeWrite
 	}
-	if p.breakErr != nil {
-		p.unread += len(d)
-		return len(d), nil // discard when there is no reader
-	}
 	return p.b.Write(d)
 }

@@ -1822,15 +1822,18 @@ func (sc *serverConn) processData(f *DataFrame) error {
 		}

 		if len(data) > 0 {
+			st.bodyBytes += int64(len(data))
 			wrote, err := st.body.Write(data)
 			if err != nil {
+				// The handler has closed the request body.
+				// Return the connection-level flow control for the discarded data,
+				// but not the stream-level flow control.
 				sc.sendWindowUpdate(nil, int(f.Length)-wrote)
-				return sc.countError("body_write_err", streamError(id, ErrCodeStreamClosed))
+				return nil
 			}
 			if wrote != len(data) {
 				panic("internal error: bad Writer")
 			}
-			st.bodyBytes += int64(len(data))
 		}

 		// Return any padded flow control now, since we won't
@@ -560,10 +560,11 @@ func (t *Transport) RoundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Res
 		traceGotConn(req, cc, reused)
 		res, err := cc.RoundTrip(req)
 		if err != nil && retry <= 6 {
+			roundTripErr := err
 			if req, err = shouldRetryRequest(req, err); err == nil {
 				// After the first retry, do exponential backoff with 10% jitter.
 				if retry == 0 {
-					t.vlogf("RoundTrip retrying after failure: %v", err)
+					t.vlogf("RoundTrip retrying after failure: %v", roundTripErr)
 					continue
 				}
 				backoff := float64(uint(1) << (uint(retry) - 1))
@@ -572,7 +573,7 @@ func (t *Transport) RoundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Res
 				timer := backoffNewTimer(d)
 				select {
 				case <-timer.C:
-					t.vlogf("RoundTrip retrying after failure: %v", err)
+					t.vlogf("RoundTrip retrying after failure: %v", roundTripErr)
 					continue
 				case <-req.Context().Done():
 					timer.Stop()
@@ -1265,6 +1266,27 @@ func (cc *ClientConn) RoundTrip(req *http.Request) (*http.Response, error) {
 		return res, nil
 	}

+	cancelRequest := func(cs *clientStream, err error) error {
+		cs.cc.mu.Lock()
+		defer cs.cc.mu.Unlock()
+		cs.abortStreamLocked(err)
+		if cs.ID != 0 {
+			// This request may have failed because of a problem with the connection,
+			// or for some unrelated reason. (For example, the user might have canceled
+			// the request without waiting for a response.) Mark the connection as
+			// not reusable, since trying to reuse a dead connection is worse than
+			// unnecessarily creating a new one.
+			//
+			// If cs.ID is 0, then the request was never allocated a stream ID and
+			// whatever went wrong was unrelated to the connection. We might have
+			// timed out waiting for a stream slot when StrictMaxConcurrentStreams
+			// is set, for example, in which case retrying on a different connection
+			// will not help.
+			cs.cc.doNotReuse = true
+		}
+		return err
+	}
+
 	for {
 		select {
 		case <-cs.respHeaderRecv:
@@ -1279,15 +1301,12 @@ func (cc *ClientConn) RoundTrip(req *http.Request) (*http.Response, error) {
 				return handleResponseHeaders()
 			default:
 				waitDone()
-				return nil, cs.abortErr
+				return nil, cancelRequest(cs, cs.abortErr)
 			}
 		case <-ctx.Done():
-			err := ctx.Err()
-			cs.abortStream(err)
-			return nil, err
+			return nil, cancelRequest(cs, ctx.Err())
 		case <-cs.reqCancel:
-			cs.abortStream(errRequestCanceled)
-			return nil, errRequestCanceled
+			return nil, cancelRequest(cs, errRequestCanceled)
 		}
 	}
 }
@@ -2555,6 +2574,9 @@ func (b transportResponseBody) Close() error {
 	cs := b.cs
 	cc := cs.cc

+	cs.bufPipe.BreakWithError(errClosedResponseBody)
+	cs.abortStream(errClosedResponseBody)
+
 	unread := cs.bufPipe.Len()
 	if unread > 0 {
 		cc.mu.Lock()
@@ -2573,9 +2595,6 @@ func (b transportResponseBody) Close() error {
 		cc.wmu.Unlock()
 	}

-	cs.bufPipe.BreakWithError(errClosedResponseBody)
-	cs.abortStream(errClosedResponseBody)
-
 	select {
 	case <-cs.donec:
 	case <-cs.ctx.Done():
@@ -0,0 +1,70 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build aix || solaris
+// +build aix solaris
+
+package unix
+
+import (
+	"unsafe"
+)
+
+// ioctl itself should not be exposed directly, but additional get/set
+// functions for specific types are permissible.
+
+// IoctlSetInt performs an ioctl operation which sets an integer value
+// on fd, using the specified request number.
+func IoctlSetInt(fd int, req int, value int) error {
+	return ioctl(fd, req, uintptr(value))
+}
+
+// IoctlSetPointerInt performs an ioctl operation which sets an
+// integer value on fd, using the specified request number. The ioctl
+// argument is called with a pointer to the integer value, rather than
+// passing the integer value directly.
+func IoctlSetPointerInt(fd int, req int, value int) error {
+	v := int32(value)
+	return ioctlPtr(fd, req, unsafe.Pointer(&v))
+}
+
+// IoctlSetWinsize performs an ioctl on fd with a *Winsize argument.
+//
+// To change fd's window size, the req argument should be TIOCSWINSZ.
+func IoctlSetWinsize(fd int, req int, value *Winsize) error {
+	// TODO: if we get the chance, remove the req parameter and
+	// hardcode TIOCSWINSZ.
+	return ioctlPtr(fd, req, unsafe.Pointer(value))
+}
+
+// IoctlSetTermios performs an ioctl on fd with a *Termios.
+//
+// The req value will usually be TCSETA or TIOCSETA.
+func IoctlSetTermios(fd int, req int, value *Termios) error {
+	// TODO: if we get the chance, remove the req parameter.
+	return ioctlPtr(fd, req, unsafe.Pointer(value))
+}
+
+// IoctlGetInt performs an ioctl operation which gets an integer value
+// from fd, using the specified request number.
+//
+// A few ioctl requests use the return value as an output parameter;
+// for those, IoctlRetInt should be used instead of this function.
+func IoctlGetInt(fd int, req int) (int, error) {
+	var value int
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
+	return value, err
+}
+
+func IoctlGetWinsize(fd int, req int) (*Winsize, error) {
+	var value Winsize
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
+	return &value, err
+}
+
+func IoctlGetTermios(fd int, req int) (*Termios, error) {
+	var value Termios
+	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
+	return &value, err
+}
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.

-//go:build aix || darwin || dragonfly || freebsd || hurd || linux || netbsd || openbsd || solaris
-// +build aix darwin dragonfly freebsd hurd linux netbsd openbsd solaris
+//go:build darwin || dragonfly || freebsd || hurd || linux || netbsd || openbsd
+// +build darwin dragonfly freebsd hurd linux netbsd openbsd

 package unix

@@ -17,14 +17,14 @@ import (

 // IoctlSetInt performs an ioctl operation which sets an integer value
 // on fd, using the specified request number.
-func IoctlSetInt(fd int, req uint, value int) error {
+func IoctlSetInt(fd int, req int, value int) error {
 	return ioctl(fd, req, uintptr(value))
 }

 // IoctlSetWinsize performs an ioctl on fd with a *Winsize argument.
 //
 // To change fd's window size, the req argument should be TIOCSWINSZ.
-func IoctlSetWinsize(fd int, req uint, value *Winsize) error {
+func IoctlSetWinsize(fd int, req int, value *Winsize) error {
 	// TODO: if we get the chance, remove the req parameter and
 	// hardcode TIOCSWINSZ.
 	return ioctlPtr(fd, req, unsafe.Pointer(value))
@@ -33,7 +33,7 @@ func IoctlSetWinsize(fd int, req uint, value *Winsize) error {
 // IoctlSetTermios performs an ioctl on fd with a *Termios.
 //
 // The req value is expected to be TCSETS, TCSETSW, or TCSETSF
-func IoctlSetTermios(fd int, req uint, value *Termios) error {
+func IoctlSetTermios(fd int, req int, value *Termios) error {
 	if (req != TCSETS) && (req != TCSETSW) && (req != TCSETSF) {
 		return ENOSYS
 	}
@@ -47,13 +47,13 @@ func IoctlSetTermios(fd int, req uint, value *Termios) error {
 //
 // A few ioctl requests use the return value as an output parameter;
 // for those, IoctlRetInt should be used instead of this function.
-func IoctlGetInt(fd int, req uint) (int, error) {
+func IoctlGetInt(fd int, req int) (int, error) {
 	var value int
 	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
 	return value, err
 }

-func IoctlGetWinsize(fd int, req uint) (*Winsize, error) {
+func IoctlGetWinsize(fd int, req int) (*Winsize, error) {
 	var value Winsize
 	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
 	return &value, err
@@ -62,7 +62,7 @@ func IoctlGetWinsize(fd int, req uint) (*Winsize, error) {
 // IoctlGetTermios performs an ioctl on fd with a *Termios.
 //
 // The req value is expected to be TCGETS
-func IoctlGetTermios(fd int, req uint) (*Termios, error) {
+func IoctlGetTermios(fd int, req int) (*Termios, error) {
 	var value Termios
 	if req != TCGETS {
 		return &value, ENOSYS
@@ -66,6 +66,7 @@ includes_Darwin='
 #include <sys/ptrace.h>
 #include <sys/select.h>
 #include <sys/socket.h>
+#include <sys/stat.h>
 #include <sys/un.h>
 #include <sys/sockio.h>
 #include <sys/sys_domain.h>
@@ -203,6 +204,7 @@ struct ltchars {
 #include <sys/timerfd.h>
 #include <sys/uio.h>
 #include <sys/xattr.h>
+#include <netinet/udp.h>
 #include <linux/audit.h>
 #include <linux/bpf.h>
 #include <linux/can.h>
@@ -517,10 +519,11 @@ ccflags="$@"
 		$2 ~ /^LOCK_(SH|EX|NB|UN)$/ ||
 		$2 ~ /^LO_(KEY|NAME)_SIZE$/ ||
 		$2 ~ /^LOOP_(CLR|CTL|GET|SET)_/ ||
-		$2 ~ /^(AF|SOCK|SO|SOL|IPPROTO|IP|IPV6|TCP|MCAST|EVFILT|NOTE|SHUT|PROT|MAP|MFD|T?PACKET|MSG|SCM|MCL|DT|MADV|PR|LOCAL|TCPOPT)_/ ||
+		$2 ~ /^(AF|SOCK|SO|SOL|IPPROTO|IP|IPV6|TCP|MCAST|EVFILT|NOTE|SHUT|PROT|MAP|MFD|T?PACKET|MSG|SCM|MCL|DT|MADV|PR|LOCAL|TCPOPT|UDP)_/ ||
 		$2 ~ /^NFC_(GENL|PROTO|COMM|RF|SE|DIRECTION|LLCP|SOCKPROTO)_/ ||
 		$2 ~ /^NFC_.*_(MAX)?SIZE$/ ||
 		$2 ~ /^RAW_PAYLOAD_/ ||
+		$2 ~ /^[US]F_/ ||
 		$2 ~ /^TP_STATUS_/ ||
 		$2 ~ /^FALLOC_/ ||
 		$2 ~ /^ICMPV?6?_(FILTER|SEC)/ ||
@@ -408,8 +408,8 @@ func (w WaitStatus) CoreDump() bool { return w&0x80 == 0x80 }

 func (w WaitStatus) TrapCause() int { return -1 }

-//sys	ioctl(fd int, req uint, arg uintptr) (err error)
-//sys	ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) = ioctl
+//sys	ioctl(fd int, req int, arg uintptr) (err error)
+//sys	ioctlPtr(fd int, req int, arg unsafe.Pointer) (err error) = ioctl

 // fcntl must never be called with cmd=F_DUP2FD because it doesn't work on AIX
 // There is no way to create a custom fcntl and to keep //sys fcntl easily,
@@ -8,7 +8,6 @@
 package unix

 //sysnb	Getrlimit(resource int, rlim *Rlimit) (err error) = getrlimit64
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error) = setrlimit64
 //sys	Seek(fd int, offset int64, whence int) (off int64, err error) = lseek64

 //sys	mmap(addr uintptr, length uintptr, prot int, flags int, fd int, offset int64) (xaddr uintptr, err error)
@@ -8,7 +8,6 @@
 package unix

 //sysnb	Getrlimit(resource int, rlim *Rlimit) (err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
 //sys	Seek(fd int, offset int64, whence int) (off int64, err error) = lseek

 //sys	mmap(addr uintptr, length uintptr, prot int, flags int, fd int, offset int64) (xaddr uintptr, err error) = mmap64
@@ -613,6 +613,7 @@ func SysctlKinfoProcSlice(name string, args ...int) ([]KinfoProc, error) {
 //sys	Rmdir(path string) (err error)
 //sys	Seek(fd int, offset int64, whence int) (newoffset int64, err error) = SYS_LSEEK
 //sys	Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err error)
+//sys	Setattrlist(path string, attrlist *Attrlist, attrBuf []byte, options int) (err error)
 //sys	Setegid(egid int) (err error)
 //sysnb	Seteuid(euid int) (err error)
 //sysnb	Setgid(gid int) (err error)
@@ -622,7 +623,6 @@ func SysctlKinfoProcSlice(name string, args ...int) ([]KinfoProc, error) {
 //sys	Setprivexec(flag int) (err error)
 //sysnb	Setregid(rgid int, egid int) (err error)
 //sysnb	Setreuid(ruid int, euid int) (err error)
-//sysnb	Setrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Setsid() (pid int, err error)
 //sysnb	Settimeofday(tp *Timeval) (err error)
 //sysnb	Setuid(uid int) (err error)
@@ -676,7 +676,6 @@ func SysctlKinfoProcSlice(name string, args ...int) ([]KinfoProc, error) {
 // Kqueue_from_portset_np
 // Kqueue_portset
 // Getattrlist
-// Setattrlist
 // Getdirentriesattr
 // Searchfs
 // Delete
@@ -326,7 +326,6 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sysnb	Setreuid(ruid int, euid int) (err error)
 //sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
 //sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Setsid() (pid int, err error)
 //sysnb	Settimeofday(tp *Timeval) (err error)
 //sysnb	Setuid(uid int) (err error)
@@ -433,7 +433,6 @@ func Dup3(oldfd, newfd, flags int) error {
 //sysnb	Setreuid(ruid int, euid int) (err error)
 //sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
 //sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Setsid() (pid int, err error)
 //sysnb	Settimeofday(tp *Timeval) (err error)
 //sysnb	Setuid(uid int) (err error)
@@ -1873,7 +1873,6 @@ func Getpgrp() (pid int) {
 //sys	OpenTree(dfd int, fileName string, flags uint) (r int, err error)
 //sys	PerfEventOpen(attr *PerfEventAttr, pid int, cpu int, groupFd int, flags int) (fd int, err error)
 //sys	PivotRoot(newroot string, putold string) (err error) = SYS_PIVOT_ROOT
-//sysnb	Prlimit(pid int, resource int, newlimit *Rlimit, old *Rlimit) (err error) = SYS_PRLIMIT64
 //sys	Prctl(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 uintptr) (err error)
 //sys	Pselect(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timespec, sigmask *Sigset_t) (n int, err error) = SYS_PSELECT6
 //sys	read(fd int, p []byte) (n int, err error)
@@ -1887,6 +1886,15 @@ func Getpgrp() (pid int) {
 //sysnb	Settimeofday(tv *Timeval) (err error)
 //sys	Setns(fd int, nstype int) (err error)

+//go:linkname syscall_prlimit syscall.prlimit
+func syscall_prlimit(pid, resource int, newlimit, old *syscall.Rlimit) error
+
+func Prlimit(pid, resource int, newlimit, old *Rlimit) error {
+	// Just call the syscall version, because as of Go 1.21
+	// it will affect starting a new process.
+	return syscall_prlimit(pid, resource, (*syscall.Rlimit)(newlimit), (*syscall.Rlimit)(old))
+}
+
 // PrctlRetInt performs a prctl operation specified by option and further
 // optional arguments arg2 through arg5 depending on option. It returns a
 // non-negative integer that is returned by the prctl syscall.
@@ -97,33 +97,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {
 	return
 }

-//sysnb	setrlimit(resource int, rlim *rlimit32) (err error) = SYS_SETRLIMIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	err = Prlimit(0, resource, rlim, nil)
-	if err != ENOSYS {
-		return err
-	}
-
-	rl := rlimit32{}
-	if rlim.Cur == rlimInf64 {
-		rl.Cur = rlimInf32
-	} else if rlim.Cur < uint64(rlimInf32) {
-		rl.Cur = uint32(rlim.Cur)
-	} else {
-		return EINVAL
-	}
-	if rlim.Max == rlimInf64 {
-		rl.Max = rlimInf32
-	} else if rlim.Max < uint64(rlimInf32) {
-		rl.Max = uint32(rlim.Max)
-	} else {
-		return EINVAL
-	}
-
-	return setrlimit(resource, &rl)
-}
-
 func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 	newoffset, errno := seek(fd, offset, whence)
 	if errno != 0 {
@@ -46,7 +46,6 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)

@@ -171,33 +171,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {
 	return
 }

-//sysnb	setrlimit(resource int, rlim *rlimit32) (err error) = SYS_SETRLIMIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	err = Prlimit(0, resource, rlim, nil)
-	if err != ENOSYS {
-		return err
-	}
-
-	rl := rlimit32{}
-	if rlim.Cur == rlimInf64 {
-		rl.Cur = rlimInf32
-	} else if rlim.Cur < uint64(rlimInf32) {
-		rl.Cur = uint32(rlim.Cur)
-	} else {
-		return EINVAL
-	}
-	if rlim.Max == rlimInf64 {
-		rl.Max = rlimInf32
-	} else if rlim.Max < uint64(rlimInf32) {
-		rl.Max = uint32(rlim.Max)
-	} else {
-		return EINVAL
-	}
-
-	return setrlimit(resource, &rl)
-}
-
 func (r *PtraceRegs) PC() uint64 { return uint64(r.Uregs[15]) }

 func (r *PtraceRegs) SetPC(pc uint64) { r.Uregs[15] = uint32(pc) }
@@ -39,7 +39,6 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	setrlimit(resource int, rlim *Rlimit) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)

@@ -143,15 +142,6 @@ func Getrlimit(resource int, rlim *Rlimit) error {
 	return getrlimit(resource, rlim)
 }

-// Setrlimit prefers the prlimit64 system call. See issue 38604.
-func Setrlimit(resource int, rlim *Rlimit) error {
-	err := Prlimit(0, resource, rlim, nil)
-	if err != ENOSYS {
-		return err
-	}
-	return setrlimit(resource, rlim)
-}
-
 func (r *PtraceRegs) PC() uint64 { return r.Pc }

 func (r *PtraceRegs) SetPC(pc uint64) { r.Pc = pc }
@@ -126,11 +126,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {
 	return
 }

-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	err = Prlimit(0, resource, rlim, nil)
-	return
-}
-
 func futimesat(dirfd int, path string, tv *[2]Timeval) (err error) {
 	if tv == nil {
 		return utimensat(dirfd, path, nil, 0)
@@ -37,7 +37,6 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
 //sys	Statfs(path string, buf *Statfs_t) (err error)
@@ -151,33 +151,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {
 	return
 }

-//sysnb	setrlimit(resource int, rlim *rlimit32) (err error) = SYS_SETRLIMIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	err = Prlimit(0, resource, rlim, nil)
-	if err != ENOSYS {
-		return err
-	}
-
-	rl := rlimit32{}
-	if rlim.Cur == rlimInf64 {
-		rl.Cur = rlimInf32
-	} else if rlim.Cur < uint64(rlimInf32) {
-		rl.Cur = uint32(rlim.Cur)
-	} else {
-		return EINVAL
-	}
-	if rlim.Max == rlimInf64 {
-		rl.Max = rlimInf32
-	} else if rlim.Max < uint64(rlimInf32) {
-		rl.Max = uint32(rlim.Max)
-	} else {
-		return EINVAL
-	}
-
-	return setrlimit(resource, &rl)
-}
-
 func (r *PtraceRegs) PC() uint64 { return r.Epc }

 func (r *PtraceRegs) SetPC(pc uint64) { r.Epc = pc }
@@ -159,33 +159,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {
 	return
 }

-//sysnb	setrlimit(resource int, rlim *rlimit32) (err error) = SYS_SETRLIMIT
-
-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	err = Prlimit(0, resource, rlim, nil)
-	if err != ENOSYS {
-		return err
-	}
-
-	rl := rlimit32{}
-	if rlim.Cur == rlimInf64 {
-		rl.Cur = rlimInf32
-	} else if rlim.Cur < uint64(rlimInf32) {
-		rl.Cur = uint32(rlim.Cur)
-	} else {
-		return EINVAL
-	}
-	if rlim.Max == rlimInf64 {
-		rl.Max = rlimInf32
-	} else if rlim.Max < uint64(rlimInf32) {
-		rl.Max = uint32(rlim.Max)
-	} else {
-		return EINVAL
-	}
-
-	return setrlimit(resource, &rl)
-}
-
 func (r *PtraceRegs) PC() uint32 { return r.Nip }

 func (r *PtraceRegs) SetPC(pc uint32) { r.Nip = pc }
@@ -34,7 +34,6 @@ package unix
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
 //sys	Stat(path string, stat *Stat_t) (err error)
@@ -38,7 +38,6 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)

@@ -34,7 +34,6 @@ import (
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
 //sys	Stat(path string, stat *Stat_t) (err error)
 //sys	Statfs(path string, buf *Statfs_t) (err error)
@@ -31,7 +31,6 @@ package unix
 //sys	sendfile(outfd int, infd int, offset *int64, count int) (written int, err error)
 //sys	setfsgid(gid int) (prev int, err error)
 //sys	setfsuid(uid int) (prev int, err error)
-//sysnb	Setrlimit(resource int, rlim *Rlimit) (err error)
 //sys	Shutdown(fd int, how int) (err error)
 //sys	Splice(rfd int, roff *int64, wfd int, woff *int64, len int, flags int) (n int64, err error)
 //sys	Stat(path string, stat *Stat_t) (err error)
@@ -340,7 +340,6 @@ func Statvfs(path string, buf *Statvfs_t) (err error) {
 //sys	Setpriority(which int, who int, prio int) (err error)
 //sysnb	Setregid(rgid int, egid int) (err error)
 //sysnb	Setreuid(ruid int, euid int) (err error)
-//sysnb	Setrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Setsid() (pid int, err error)
 //sysnb	Settimeofday(tp *Timeval) (err error)
 //sysnb	Setuid(uid int) (err error)
@@ -501,7 +500,6 @@ func Statvfs(path string, buf *Statvfs_t) (err error) {
 // compat_43_osendmsg
 // compat_43_osethostid
 // compat_43_osethostname
-// compat_43_osetrlimit
 // compat_43_osigblock
 // compat_43_osigsetmask
 // compat_43_osigstack
@@ -294,7 +294,6 @@ func Uname(uname *Utsname) error {
 //sysnb	Setreuid(ruid int, euid int) (err error)
 //sysnb	Setresgid(rgid int, egid int, sgid int) (err error)
 //sysnb	Setresuid(ruid int, euid int, suid int) (err error)
-//sysnb	Setrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Setrtable(rtable int) (err error)
 //sysnb	Setsid() (pid int, err error)
 //sysnb	Settimeofday(tp *Timeval) (err error)
@@ -545,24 +545,24 @@ func Minor(dev uint64) uint32 {
 * Expose the ioctl function
 */

-//sys	ioctlRet(fd int, req uint, arg uintptr) (ret int, err error) = libc.ioctl
-//sys	ioctlPtrRet(fd int, req uint, arg unsafe.Pointer) (ret int, err error) = libc.ioctl
+//sys	ioctlRet(fd int, req int, arg uintptr) (ret int, err error) = libc.ioctl
+//sys	ioctlPtrRet(fd int, req int, arg unsafe.Pointer) (ret int, err error) = libc.ioctl

-func ioctl(fd int, req uint, arg uintptr) (err error) {
+func ioctl(fd int, req int, arg uintptr) (err error) {
 	_, err = ioctlRet(fd, req, arg)
 	return err
 }

-func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+func ioctlPtr(fd int, req int, arg unsafe.Pointer) (err error) {
 	_, err = ioctlPtrRet(fd, req, arg)
 	return err
 }

-func IoctlSetTermio(fd int, req uint, value *Termio) error {
+func IoctlSetTermio(fd int, req int, value *Termio) error {
 	return ioctlPtr(fd, req, unsafe.Pointer(value))
 }

-func IoctlGetTermio(fd int, req uint) (*Termio, error) {
+func IoctlGetTermio(fd int, req int) (*Termio, error) {
 	var value Termio
 	err := ioctlPtr(fd, req, unsafe.Pointer(&value))
 	return &value, err
@@ -665,7 +665,6 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sys	Setpriority(which int, who int, prio int) (err error)
 //sysnb	Setregid(rgid int, egid int) (err error)
 //sysnb	Setreuid(ruid int, euid int) (err error)
-//sysnb	Setrlimit(which int, lim *Rlimit) (err error)
 //sysnb	Setsid() (pid int, err error)
 //sysnb	Setuid(uid int) (err error)
 //sys	Shutdown(s int, how int) (err error) = libsocket.shutdown
@@ -1080,11 +1079,11 @@ func Getmsg(fd int, cl []byte, data []byte) (retCl []byte, retData []byte, flags
 	return retCl, retData, flags, nil
 }

-func IoctlSetIntRetInt(fd int, req uint, arg int) (int, error) {
+func IoctlSetIntRetInt(fd int, req int, arg int) (int, error) {
 	return ioctlRet(fd, req, uintptr(arg))
 }

-func IoctlSetString(fd int, req uint, val string) error {
+func IoctlSetString(fd int, req int, val string) error {
 	bs := make([]byte, len(val)+1)
 	copy(bs[:len(bs)-1], val)
 	err := ioctlPtr(fd, req, unsafe.Pointer(&bs[0]))
@@ -1120,7 +1119,7 @@ func (l *Lifreq) GetLifruUint() uint {
 	return *(*uint)(unsafe.Pointer(&l.Lifru[0]))
 }

-func IoctlLifreq(fd int, req uint, l *Lifreq) error {
+func IoctlLifreq(fd int, req int, l *Lifreq) error {
 	return ioctlPtr(fd, req, unsafe.Pointer(l))
 }

@@ -1131,6 +1130,6 @@ func (s *Strioctl) SetInt(i int) {
 	s.Dp = (*int8)(unsafe.Pointer(&i))
 }

-func IoctlSetStrioctlRetInt(fd int, req uint, s *Strioctl) (int, error) {
+func IoctlSetStrioctlRetInt(fd int, req int, s *Strioctl) (int, error) {
 	return ioctlPtrRet(fd, req, unsafe.Pointer(s))
 }
@@ -587,3 +587,10 @@ func emptyIovecs(iov []Iovec) bool {
 	}
 	return true
 }
+
+// Setrlimit sets a resource limit.
+func Setrlimit(resource int, rlim *Rlimit) error {
+	// Just call the syscall version, because as of Go 1.21
+	// it will affect starting a new process.
+	return syscall.Setrlimit(resource, (*syscall.Rlimit)(rlim))
+}
@@ -212,8 +212,8 @@ func (cmsg *Cmsghdr) SetLen(length int) {
 //sys	sendmsg(s int, msg *Msghdr, flags int) (n int, err error) = SYS___SENDMSG_A
 //sys   mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error) = SYS_MMAP
 //sys   munmap(addr uintptr, length uintptr) (err error) = SYS_MUNMAP
-//sys   ioctl(fd int, req uint, arg uintptr) (err error) = SYS_IOCTL
-//sys   ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) = SYS_IOCTL
+//sys   ioctl(fd int, req int, arg uintptr) (err error) = SYS_IOCTL
+//sys   ioctlPtr(fd int, req int, arg unsafe.Pointer) (err error) = SYS_IOCTL

 //sys   Access(path string, mode uint32) (err error) = SYS___ACCESS_A
 //sys   Chdir(path string) (err error) = SYS___CHDIR_A
@@ -1270,6 +1270,16 @@ const (
 	SEEK_END                                = 0x2
 	SEEK_HOLE                               = 0x3
 	SEEK_SET                                = 0x0
+	SF_APPEND                               = 0x40000
+	SF_ARCHIVED                             = 0x10000
+	SF_DATALESS                             = 0x40000000
+	SF_FIRMLINK                             = 0x800000
+	SF_IMMUTABLE                            = 0x20000
+	SF_NOUNLINK                             = 0x100000
+	SF_RESTRICTED                           = 0x80000
+	SF_SETTABLE                             = 0x3fff0000
+	SF_SUPPORTED                            = 0x9f0000
+	SF_SYNTHETIC                            = 0xc0000000
 	SHUT_RD                                 = 0x0
 	SHUT_RDWR                               = 0x2
 	SHUT_WR                                 = 0x1
@@ -1543,6 +1553,15 @@ const (
 	TIOCTIMESTAMP                           = 0x40107459
 	TIOCUCNTL                               = 0x80047466
 	TOSTOP                                  = 0x400000
+	UF_APPEND                               = 0x4
+	UF_COMPRESSED                           = 0x20
+	UF_DATAVAULT                            = 0x80
+	UF_HIDDEN                               = 0x8000
+	UF_IMMUTABLE                            = 0x2
+	UF_NODUMP                               = 0x1
+	UF_OPAQUE                               = 0x8
+	UF_SETTABLE                             = 0xffff
+	UF_TRACKED                              = 0x40
 	VDISCARD                                = 0xf
 	VDSUSP                                  = 0xb
 	VEOF                                    = 0x0
@@ -1270,6 +1270,16 @@ const (
 	SEEK_END                                = 0x2
 	SEEK_HOLE                               = 0x3
 	SEEK_SET                                = 0x0
+	SF_APPEND                               = 0x40000
+	SF_ARCHIVED                             = 0x10000
+	SF_DATALESS                             = 0x40000000
+	SF_FIRMLINK                             = 0x800000
+	SF_IMMUTABLE                            = 0x20000
+	SF_NOUNLINK                             = 0x100000
+	SF_RESTRICTED                           = 0x80000
+	SF_SETTABLE                             = 0x3fff0000
+	SF_SUPPORTED                            = 0x9f0000
+	SF_SYNTHETIC                            = 0xc0000000
 	SHUT_RD                                 = 0x0
 	SHUT_RDWR                               = 0x2
 	SHUT_WR                                 = 0x1
@@ -1543,6 +1553,15 @@ const (
 	TIOCTIMESTAMP                           = 0x40107459
 	TIOCUCNTL                               = 0x80047466
 	TOSTOP                                  = 0x400000
+	UF_APPEND                               = 0x4
+	UF_COMPRESSED                           = 0x20
+	UF_DATAVAULT                            = 0x80
+	UF_HIDDEN                               = 0x8000
+	UF_IMMUTABLE                            = 0x2
+	UF_NODUMP                               = 0x1
+	UF_OPAQUE                               = 0x8
+	UF_SETTABLE                             = 0xffff
+	UF_TRACKED                              = 0x40
 	VDISCARD                                = 0xf
 	VDSUSP                                  = 0xb
 	VEOF                                    = 0x0
@@ -2967,6 +2967,7 @@ const (
 	SOL_TCP                                     = 0x6
 	SOL_TIPC                                    = 0x10f
 	SOL_TLS                                     = 0x11a
+	SOL_UDP                                     = 0x11
 	SOL_X25                                     = 0x106
 	SOL_XDP                                     = 0x11b
 	SOMAXCONN                                   = 0x1000
@@ -3251,6 +3252,19 @@ const (
 	TRACEFS_MAGIC                               = 0x74726163
 	TS_COMM_LEN                                 = 0x20
 	UDF_SUPER_MAGIC                             = 0x15013346
+	UDP_CORK                                    = 0x1
+	UDP_ENCAP                                   = 0x64
+	UDP_ENCAP_ESPINUDP                          = 0x2
+	UDP_ENCAP_ESPINUDP_NON_IKE                  = 0x1
+	UDP_ENCAP_GTP0                              = 0x4
+	UDP_ENCAP_GTP1U                             = 0x5
+	UDP_ENCAP_L2TPINUDP                         = 0x3
+	UDP_GRO                                     = 0x68
+	UDP_NO_CHECK6_RX                            = 0x66
+	UDP_NO_CHECK6_TX                            = 0x65
+	UDP_SEGMENT                                 = 0x67
+	UDP_V4_FLOW                                 = 0x2
+	UDP_V6_FLOW                                 = 0x6
 	UMOUNT_NOFOLLOW                             = 0x8
 	USBDEVICE_SUPER_MAGIC                       = 0x9fa2
 	UTIME_NOW                                   = 0x3fffffff
@@ -124,7 +124,6 @@ int utime(uintptr_t, uintptr_t);
 unsigned long long getsystemcfg(int);
 int umount(uintptr_t);
 int getrlimit64(int, uintptr_t);
-int setrlimit64(int, uintptr_t);
 long long lseek64(int, long long, int);
 uintptr_t mmap(uintptr_t, uintptr_t, int, int, int, long long);

@@ -213,7 +212,7 @@ func wait4(pid Pid_t, status *_C_int, options int, rusage *Rusage) (wpid Pid_t,

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

-func ioctl(fd int, req uint, arg uintptr) (err error) {
+func ioctl(fd int, req int, arg uintptr) (err error) {
 	r0, er := C.ioctl(C.int(fd), C.int(req), C.uintptr_t(arg))
 	if r0 == -1 && er != nil {
 		err = er
@@ -223,7 +222,7 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

-func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
+func ioctlPtr(fd int, req int, arg unsafe.Pointer) (err error) {
 	r0, er := C.ioctl(C.int(fd), C.int(req), C.uintptr_t(uintptr(arg)))
 	if r0 == -1 && er != nil {
 		err = er
@@ -1464,16 +1463,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	r0, er := C.setrlimit64(C.int(resource), C.uintptr_t(uintptr(unsafe.Pointer(rlim))))
-	if r0 == -1 && er != nil {
-		err = er
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Seek(fd int, offset int64, whence int) (off int64, err error) {
 	r0, er := C.lseek64(C.int(fd), C.longlong(offset), C.int(whence))
 	off = int64(r0)
@@ -93,8 +93,8 @@ func wait4(pid Pid_t, status *_C_int, options int, rusage *Rusage) (wpid Pid_t,

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

-func ioctl(fd int, req uint, arg uintptr) (err error) {
-	_, e1 := callioctl(fd, int(req), arg)
+func ioctl(fd int, req int, arg uintptr) (err error) {
+	_, e1 := callioctl(fd, req, arg)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -103,8 +103,8 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

-func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
-	_, e1 := callioctl_ptr(fd, int(req), arg)
+func ioctlPtr(fd int, req int, arg unsafe.Pointer) (err error) {
+	_, e1 := callioctl_ptr(fd, req, arg)
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
@@ -1422,16 +1422,6 @@ func Getrlimit(resource int, rlim *Rlimit) (err error) {

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

-func Setrlimit(resource int, rlim *Rlimit) (err error) {
-	_, e1 := callsetrlimit(resource, uintptr(unsafe.Pointer(rlim)))
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Seek(fd int, offset int64, whence int) (off int64, err error) {
 	r0, e1 := calllseek(fd, offset, whence)
 	off = int64(r0)
@@ -124,7 +124,6 @@ import (
 //go:cgo_import_dynamic libc_getsystemcfg getsystemcfg "libc.a/shr_64.o"
 //go:cgo_import_dynamic libc_umount umount "libc.a/shr_64.o"
 //go:cgo_import_dynamic libc_getrlimit getrlimit "libc.a/shr_64.o"
-//go:cgo_import_dynamic libc_setrlimit setrlimit "libc.a/shr_64.o"
 //go:cgo_import_dynamic libc_lseek lseek "libc.a/shr_64.o"
 //go:cgo_import_dynamic libc_mmap64 mmap64 "libc.a/shr_64.o"

@@ -242,7 +241,6 @@ import (
 //go:linkname libc_getsystemcfg libc_getsystemcfg
 //go:linkname libc_umount libc_umount
 //go:linkname libc_getrlimit libc_getrlimit
-//go:linkname libc_setrlimit libc_setrlimit
 //go:linkname libc_lseek libc_lseek
 //go:linkname libc_mmap64 libc_mmap64

@@ -363,7 +361,6 @@ var (
 	libc_getsystemcfg,
 	libc_umount,
 	libc_getrlimit,
-	libc_setrlimit,
 	libc_lseek,
 	libc_mmap64 syscallFunc
 )
@@ -1179,13 +1176,6 @@ func callgetrlimit(resource int, rlim uintptr) (r1 uintptr, e1 Errno) {

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

-func callsetrlimit(resource int, rlim uintptr) (r1 uintptr, e1 Errno) {
-	r1, _, e1 = rawSyscall6(uintptr(unsafe.Pointer(&libc_setrlimit)), 2, uintptr(resource), rlim, 0, 0, 0, 0)
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func calllseek(fd int, offset int64, whence int) (r1 uintptr, e1 Errno) {
 	r1, _, e1 = syscall6(uintptr(unsafe.Pointer(&libc_lseek)), 3, uintptr(fd), uintptr(offset), uintptr(whence), 0, 0, 0)
 	return
@@ -123,7 +123,6 @@ int utime(uintptr_t, uintptr_t);
 unsigned long long getsystemcfg(int);
 int umount(uintptr_t);
 int getrlimit(int, uintptr_t);
-int setrlimit(int, uintptr_t);
 long long lseek(int, long long, int);
 uintptr_t mmap64(uintptr_t, uintptr_t, int, int, int, long long);

@@ -131,6 +130,7 @@ uintptr_t mmap64(uintptr_t, uintptr_t, int, int, int, long long);
 import "C"
 import (
 	"syscall"
+	"unsafe"
 )

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
@@ -1055,14 +1055,6 @@ func callgetrlimit(resource int, rlim uintptr) (r1 uintptr, e1 Errno) {

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

-func callsetrlimit(resource int, rlim uintptr) (r1 uintptr, e1 Errno) {
-	r1 = uintptr(C.setrlimit(C.int(resource), C.uintptr_t(rlim)))
-	e1 = syscall.GetErrno()
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func calllseek(fd int, offset int64, whence int) (r1 uintptr, e1 Errno) {
 	r1 = uintptr(C.lseek(C.int(fd), C.longlong(offset), C.int(whence)))
 	e1 = syscall.GetErrno()
@@ -1992,6 +1992,31 @@ var libc_select_trampoline_addr uintptr

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

+func Setattrlist(path string, attrlist *Attrlist, attrBuf []byte, options int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(attrBuf) > 0 {
+		_p1 = unsafe.Pointer(&attrBuf[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall6(libc_setattrlist_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(attrlist)), uintptr(_p1), uintptr(len(attrBuf)), uintptr(options), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setattrlist_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setattrlist setattrlist "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Setegid(egid int) (err error) {
 	_, _, e1 := syscall_syscall(libc_setegid_trampoline_addr, uintptr(egid), 0, 0)
 	if e1 != 0 {
@@ -2123,20 +2148,6 @@ var libc_setreuid_trampoline_addr uintptr

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := syscall_rawSyscall(libc_setrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-var libc_setrlimit_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_setrlimit setrlimit "/usr/lib/libSystem.B.dylib"
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := syscall_rawSyscall(libc_setsid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
@@ -705,6 +705,11 @@ TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
 DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)

+TEXT libc_setattrlist_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setattrlist(SB)
+GLOBL	·libc_setattrlist_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setattrlist_trampoline_addr(SB)/8, $libc_setattrlist_trampoline<>(SB)
+
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)

@@ -759,12 +764,6 @@ TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)

-TEXT libc_setrlimit_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_setrlimit(SB)
-
-GLOBL	·libc_setrlimit_trampoline_addr(SB), RODATA, $8
-DATA	·libc_setrlimit_trampoline_addr(SB)/8, $libc_setrlimit_trampoline<>(SB)
-
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)

@@ -1992,6 +1992,31 @@ var libc_select_trampoline_addr uintptr

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

+func Setattrlist(path string, attrlist *Attrlist, attrBuf []byte, options int) (err error) {
+	var _p0 *byte
+	_p0, err = BytePtrFromString(path)
+	if err != nil {
+		return
+	}
+	var _p1 unsafe.Pointer
+	if len(attrBuf) > 0 {
+		_p1 = unsafe.Pointer(&attrBuf[0])
+	} else {
+		_p1 = unsafe.Pointer(&_zero)
+	}
+	_, _, e1 := syscall_syscall6(libc_setattrlist_trampoline_addr, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(attrlist)), uintptr(_p1), uintptr(len(attrBuf)), uintptr(options), 0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+var libc_setattrlist_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_setattrlist setattrlist "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Setegid(egid int) (err error) {
 	_, _, e1 := syscall_syscall(libc_setegid_trampoline_addr, uintptr(egid), 0, 0)
 	if e1 != 0 {
@@ -2123,20 +2148,6 @@ var libc_setreuid_trampoline_addr uintptr

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := syscall_rawSyscall(libc_setrlimit_trampoline_addr, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-var libc_setrlimit_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_setrlimit setrlimit "/usr/lib/libSystem.B.dylib"
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := syscall_rawSyscall(libc_setsid_trampoline_addr, 0, 0, 0)
 	pid = int(r0)
@@ -705,6 +705,11 @@ TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
 DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)

+TEXT libc_setattrlist_trampoline<>(SB),NOSPLIT,$0-0
+	JMP	libc_setattrlist(SB)
+GLOBL	·libc_setattrlist_trampoline_addr(SB), RODATA, $8
+DATA	·libc_setattrlist_trampoline_addr(SB)/8, $libc_setattrlist_trampoline<>(SB)
+
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)

@@ -759,12 +764,6 @@ TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)

-TEXT libc_setrlimit_trampoline<>(SB),NOSPLIT,$0-0
-	JMP	libc_setrlimit(SB)
-
-GLOBL	·libc_setrlimit_trampoline_addr(SB), RODATA, $8
-DATA	·libc_setrlimit_trampoline_addr(SB)/8, $libc_setrlimit_trampoline<>(SB)
-
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)

@@ -1410,16 +1410,6 @@ func Setresuid(ruid int, euid int, suid int) (err error) {

 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT

-func Setrlimit(which int, lim *Rlimit) (err error) {
-	_, _, e1 := RawSyscall(SYS_SETRLIMIT, uintptr(which), uintptr(unsafe.Pointer(lim)), 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Setsid() (pid int, err error) {
 	r0, _, e1 := RawSyscall(SYS_SETSID, 0, 0, 0)
 	pid = int(r0)
--- a/Show More
+++ b/Show More