Add an integration test to verify root path cleanup

test/integration/apiserver/discovery/discovery_test.go

@@ -37,6 +37,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
 	discoveryendpoint "k8s.io/apiserver/pkg/endpoints/discovery/aggregated"
 	genericfeatures "k8s.io/apiserver/pkg/features"
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
@@ -241,6 +242,7 @@ func TestAggregatedAPIServiceDiscovery(t *testing.T) {
 
 	// For each groupversion served by our resourcemanager, create an APIService
 	// object connected to our fake APIServer
+	var groupVersions []metav1.GroupVersion
 	for _, versionInfo := range basicTestGroup.Versions {
 		groupVersion := metav1.GroupVersion{
 			Group:   basicTestGroup.Name,
@@ -248,14 +250,19 @@ func TestAggregatedAPIServiceDiscovery(t *testing.T) {
 		}
 
 		require.NoError(t, registerAPIService(ctx, client, groupVersion, service))
-		defer func() {
+		groupVersions = append(groupVersions, groupVersion)
-			require.NoError(t, unregisterAPIService(ctx, client, groupVersion))
-		}()
 	}
 
 	// Keep repeatedly fetching document from aggregator.
 	// Check to see if it contains our service within a reasonable amount of time
 	require.NoError(t, WaitForGroups(ctx, client, basicTestGroupWithFixup))
+	require.NoError(t, WaitForRootPaths(t, ctx, client, sets.New("/apis/"+basicTestGroup.Name), nil))
+
+	// Unregister and ensure the group gets dropped from root paths
+	for _, groupVersion := range groupVersions {
+		require.NoError(t, unregisterAPIService(ctx, client, groupVersion))
+	}
+	require.NoError(t, WaitForRootPaths(t, ctx, client, nil, sets.New("/apis/"+basicTestGroup.Name)))
 }
 
 func runTestCases(t *testing.T, cases []testCase) {

test/integration/apiserver/discovery/framework.go

@@ -22,6 +22,7 @@ import (
 	"fmt"
 	"reflect"
 	"strings"
+	"testing"
 	"time"
 
 	apiextensions "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
@@ -29,6 +30,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/dynamic"
 	"k8s.io/client-go/kubernetes"
@@ -573,6 +575,29 @@ func WaitForGroupsAbsent(ctx context.Context, client testClient, groups ...strin
 
 }
 
+func WaitForRootPaths(t *testing.T, ctx context.Context, client testClient, requirePaths, forbidPaths sets.Set[string]) error {
+	return wait.PollUntilContextTimeout(ctx, 250*time.Millisecond, maxTimeout, true, func(ctx context.Context) (done bool, err error) {
+		statusContent, err := client.Discovery().RESTClient().Get().AbsPath("/").SetHeader("Accept", "application/json").DoRaw(ctx)
+		if err != nil {
+			return false, err
+		}
+		rootPaths := metav1.RootPaths{}
+		if err := json.Unmarshal(statusContent, &rootPaths); err != nil {
+			return false, err
+		}
+		paths := sets.New(rootPaths.Paths...)
+		if missing := requirePaths.Difference(paths); len(missing) > 0 {
+			t.Logf("missing required root paths %v", sets.List(missing))
+			return false, nil
+		}
+		if present := forbidPaths.Intersection(paths); len(present) > 0 {
+			t.Logf("present forbidden root paths %v", sets.List(present))
+			return false, nil
+		}
+		return true, nil
+	})
+}
+
 func WaitForGroups(ctx context.Context, client testClient, groups ...apidiscoveryv2beta1.APIGroupDiscovery) error {
 	return WaitForResultWithCondition(ctx, client, func(groupList apidiscoveryv2beta1.APIGroupDiscoveryList) bool {
 		for _, searchGroup := range groups {