Repository: kubernetes-sigs/kueue

Issue:
MultiKueue: support authentication to worker clusters using ClusterProfile
**What would you like to be added**:

An integration with [ClusterProfiles](https://github.com/kubernetes/enhancements/tree/master/keps/sig-multicluster/5339-clusterprofile-plugin-credentials).

**Why is this needed**:

- Currently we use for authentication long-living secrets generated for worker clusters. Some users are cautious about long-living secrets. They could be rotated / regenerated, but it is an extra effort.
- ClusterProfile is an important k8s API designed for managing multiple clusters. It seems still Alpha, but we could start the integration early.
- - Easier setup for providers supporting Workload Identity mechanism

**Completion requirements**:

We could start with a prototype.

This enhancement requires the following artifacts:

- [ ] Design doc (probably an extension to the MultiKueue KEP)
- [ ] API change (probably to determine which authentication is to be used)
- [ ] Docs update

The artifacts should be linked in subsequent comments.


Hints from issue comments:
@mimowo: cc @tenzen-y @gabesaba @mwysokin @mwielgus @mbobrovskyi @kannon92: cc @haoqing0110 

I know your group has been involved in sig-multicluster so I'd love your thoughts also.@linde: cc @corentone, @hdp617, @knee-berts, @zhang-xuebin
@linde: /assign @hdp617@k8s-ci-robot: @linde: GitHub didn't allow me to assign the following users: hdp617.

Note that only [kubernetes-sigs members](https://github.com/orgs/kubernetes-sigs/people) with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see [the contributor guide](https://git.k8s.io/community/contributors/guide/first-contribution.md#issue-assignment-in-github)

<details>

In response to [this](https://github.com/kubernetes-sigs/kueue/issues/6714#issuecomment-3250754140):

>/assign @hdp617


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>@hdp617: Thanks for creating this issue! We've had some discussions about using the ClusterProfile API and the credential plugins introduced in [KEP-5339](https://github.com/kubernetes/enhancements/blob/master/keps/sig-multicluster/5339-clusterprofile-plugin-credentials/README.md) for cluster authentication. Happy to take this one.@haoqing0110: OCM (Open Cluster Management) community is planning to [support ClusterProfile credentials plugin](https://github.com/open-cluster-management-io/ocm/issues/1163). And we're very happy to see that MultiKueue supports ClusterProfile, this will bring benefits to the current [ OCM + MultiKueue integration](https://kueue.sigs.k8s.io/docs/tasks/manage/setup_multikueue/#optional-setup-multikueue-with-open-cluster-management).@mimowo: /assign @hdp617
Thanks for willing to work on it 👍 @kishorerj: I am open to contribute on this as well.. We have few customers in GKE who need this feature @hdp617  @mimowo 


Solution patch:
diff --git a/.golangci.yaml b/.golangci.yaml
index e43fff907..89b2dee22 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -15,6 +15,7 @@ linters:
     - loggercheck
     - makezero
     - misspell
+    - modernize
     - nilerr
     - nilnesserr
     - nolintlint
@@ -76,6 +77,9 @@ linters:
       forbid:
         - pattern: ^sort\.Slice$
           msg: Please use slices.SortFunc instead of sort.Slice for better performance and consistency
+    modernize:
+      disable:
+        - omitzero
   exclusions:
     generated: lax
     presets:
@@ -90,6 +94,9 @@ linters:
       - linters:
           - staticcheck
         text: 'SA1019: j.Status.RayClusterStatus.State is deprecated: the State field is replaced by the Conditions field.'
+      - linters:
+          - staticcheck
+        text: 'SA1019: features.* is deprecated: planned to be removed in .*'
       - linters:
           - fatcontext
         path: ^test/*
diff --git a/Makefile-deps.mk b/Makefile-deps.mk
index 8b6212934..3a830a48f 100644
--- a/Makefile-deps.mk
+++ b/Makefile-deps.mk
@@ -64,6 +64,7 @@ JOBSET_ROOT = $(shell $(GO_CMD) list -m -mod=readonly -f "{{.Dir}}" sigs.k8s.io/
 CLUSTER_AUTOSCALER_ROOT = $(shell $(GO_CMD) list -m -mod=readonly -f "{{.Dir}}" k8s.io/autoscaler/cluster-autoscaler/apis)
 APPWRAPPER_ROOT = $(shell $(GO_CMD) list -m -mod=readonly -f "{{.Dir}}" github.com/project-codeflare/appwrapper)
 LEADERWORKERSET_ROOT = $(shell $(GO_CMD) list -m -mod=readonly -f "{{.Dir}}" sigs.k8s.io/lws)
+CLUSTERPROFILE_ROOT = $(shell $(GO_CMD) list -m -mod=readonly -f "{{.Dir}}" sigs.k8s.io/cluster-inventory-api)
 
 ##@ Tools
 
@@ -221,8 +222,13 @@ leaderworkerset-operator-crd: ## Copy the CRDs from the leaderworkerset-operator
 	mkdir -p $(EXTERNAL_CRDS_DIR)/leaderworkerset-operator/
 	cp -f $(LEADERWORKERSET_ROOT)/config/crd/bases/* $(EXTERNAL_CRDS_DIR)/leaderworkerset-operator/
 
+.PHONY: clusterprofile-crd
+clusterprofile-crd: ## Copy the CRDs from the clusterprofile to the dep-crds directory.
+	mkdir -p $(EXTERNAL_CRDS_DIR)/clusterprofile/
+	cp -f $(CLUSTERPROFILE_ROOT)/config/crd/bases/* $(EXTERNAL_CRDS_DIR)/clusterprofile/
+
 .PHONY: dep-crds
-dep-crds: mpi-operator-crd kf-training-operator-crd kf-trainer-crd kf-trainer-runtimes ray-operator-crd jobset-operator-crd leaderworkerset-operator-crd cluster-autoscaler-crd appwrapper-crd appwrapper-manifests kf-training-operator-manifests ray-operator-manifests kf-trainer-manifests ## Copy the CRDs from the external operators to the dep-crds directory.
+dep-crds: mpi-operator-crd kf-training-operator-crd kf-trainer-crd kf-trainer-runtimes ray-operator-crd jobset-operator-crd leaderworkerset-operator-crd cluster-autoscaler-crd appwrapper-crd appwrapper-manifests kf-training-operator-manifests ray-operator-manifests kf-trainer-manifests clusterprofile-crd ## Copy the CRDs from the external operators to the dep-crds directory.
 	@echo "Copying CRDs from external operators to dep-crds directory"
 
 .PHONY: kueuectl-docs
diff --git a/Makefile-test.mk b/Makefile-test.mk
index 8ef254289..d991bde62 100644
--- a/Makefile-test.mk
+++ b/Makefile-test.mk
@@ -284,4 +284,4 @@ test-e2e-kueueviz: setup-e2e-env ## Run end-to-end tests for kueueviz without ru
 	CYPRESS_SCREENSHOTS_FOLDER=$(ARTIFACTS)/cypress/screenshots CYPRESS_VIDEOS_FOLDER=$(ARTIFACTS)/cypress/videos \
 	ARTIFACTS=$(ARTIFACTS) KIND_CLUSTER_NAME=$(KIND_CLUSTER_NAME) PROJECT_DIR=$(PROJECT_DIR)/ \
 	KIND_CLUSTER_FILE="kind-cluster.yaml" IMAGE_TAG=$(IMAGE_TAG) \
-	${PROJECT_DIR}/hack/e2e-kueueviz-backend.sh
+	${PROJECT_DIR}/hack/e2e-kueueviz-backend.sh
\ No newline at end of file
diff --git a/apis/config/v1beta1/configuration_conversion.go b/apis/config/v1beta1/configuration_conversion.go
index 2482ac8e8..14371a38d 100644
--- a/apis/config/v1beta1/configuration_conversion.go
+++ b/apis/config/v1beta1/configuration_conversion.go
@@ -84,3 +84,7 @@ func Convert_v1beta2_WaitForPodsReady_To_v1beta1_WaitForPodsReady(in *v1beta2.Wa
 	}
 	return nil
 }
+
+func Convert_v1beta2_MultiKueue_To_v1beta1_MultiKueue(in *v1beta2.MultiKueue, out *MultiKueue, s conversionapi.Scope) error {
+	return autoConvert_v1beta2_MultiKueue_To_v1beta1_MultiKueue(in, out, s)
+}
diff --git a/apis/config/v1beta1/configuration_types.go b/apis/config/v1beta1/configuration_types.go
index fa8e2394f..9c45d31cd 100644
--- a/apis/config/v1beta1/configuration_types.go
+++ b/apis/config/v1beta1/configuration_types.go
@@ -84,6 +84,7 @@ type Configuration struct {
 
 	// QueueVisibility is configuration to expose the information about the top
 	// pending workloads.
+	//
 	// Deprecated: This field will be removed on v1beta2, use VisibilityOnDemand
 	// (https://kueue.sigs.k8s.io/docs/tasks/manage/monitor_pending_workloads/pending_workloads_on_demand/)
 	// instead.
@@ -413,6 +414,7 @@ type Integrations struct {
 	// the expected format is `Kind.version.group.com`.
 	ExternalFrameworks []string `json:"externalFrameworks,omitempty"`
 	// PodOptions defines kueue controller behaviour for pod objects
+	//
 	// Deprecated: This field will be removed on v1beta2, use ManagedJobsNamespaceSelector
 	// (https://kueue.sigs.k8s.io/docs/tasks/run/plain_pods/)
 	// instead.
diff --git a/apis/config/v1beta1/zz_generated.conversion.go b/apis/config/v1beta1/zz_generated.conversion.go
index 3ed7d9303..a2705d29a 100644
--- a/apis/config/v1beta1/zz_generated.conversion.go
+++ b/apis/config/v1beta1/zz_generated.conversion.go
@@ -144,11 +144,6 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
-	if err := s.AddGeneratedConversionFunc((*v1beta2.MultiKueue)(nil), (*MultiKueue)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1beta2_MultiKueue_To_v1beta1_MultiKueue(a.(*v1beta2.MultiKueue), b.(*MultiKueue), scope)
-	}); err != nil {
-		return err
-	}
 	if err := s.AddGeneratedConversionFunc((*MultiKueueExternalFramework)(nil), (*v1beta2.MultiKueueExternalFramework)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1beta1_MultiKueueExternalFramework_To_v1beta2_MultiKueueExternalFramework(a.(*MultiKueueExternalFramework), b.(*v1beta2.MultiKueueExternalFramework), scope)
 	}); err != nil {
@@ -234,6 +229,11 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
+	if err := s.AddConversionFunc((*v1beta2.MultiKueue)(nil), (*MultiKueue)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1beta2_MultiKueue_To_v1beta1_MultiKueue(a.(*v1beta2.MultiKueue), b.(*MultiKueue), scope)
+	}); err != nil {
+		return err
+	}
 	if err := s.AddConversionFunc((*v1beta2.WaitForPodsReady)(nil), (*WaitForPodsReady)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1beta2_WaitForPodsReady_To_v1beta1_WaitForPodsReady(a.(*v1beta2.WaitForPodsReady), b.(*WaitForPodsReady), scope)
 	}); err != nil {
@@ -316,7 +316,15 @@ func autoConvert_v1beta1_Configuration_To_v1beta2_Configuration(in *Configuratio
 		out.Integrations = nil
 	}
 	// WARNING: in.QueueVisibility requires manual conversion: does not exist in peer-type
-	out.MultiKueue = (*v1beta2.MultiKueue)(unsafe.Pointer(in.MultiKueue))
+	if in.MultiKueue != nil {
+		in, out := &in.MultiKueue, &out.MultiKueue
+		*out = new(v1beta2.MultiKueue)
+		if err := Convert_v1beta1_MultiKueue_To_v1beta2_MultiKueue(*in, *out, s); err != nil {
+			return err
+		}
+	} else {
+		out.MultiKueue = nil
+	}
 	if in.FairSharing != nil {
 		in, out := &in.FairSharing, &out.FairSharing
 		*out = new(v1beta2.FairSharing)
@@ -360,7 +368,15 @@ func autoConvert_v1beta2_Configuration_To_v1beta1_Configuration(in *v1beta2.Conf
 	} else {
 		out.Integrations = nil
 	}
-	out.MultiKueue = (*MultiKueue)(unsafe.Pointer(in.MultiKueue))
+	if in.MultiKueue != nil {
+		in, out := &in.MultiKueue, &out.MultiKueue
+		*out = new(MultiKueue)
+		if err := Convert_v1beta2_MultiKueue_To_v1beta1_MultiKueue(*in, *out, s); err != nil {
+			return err
+		}
+	} else {
+		out.MultiKueue = nil
+	}
 	if in.FairSharing != nil {
 		in, out := &in.FairSharing, &out.FairSharing
 		*out = new(FairSharing)
@@ -613,14 +629,10 @@ func autoConvert_v1beta2_MultiKueue_To_v1beta1_MultiKueue(in *v1beta2.MultiKueue
 	out.WorkerLostTimeout = (*metav1.Duration)(unsafe.Pointer(in.WorkerLostTimeout))
 	out.DispatcherName = (*string)(unsafe.Pointer(in.DispatcherName))
 	out.ExternalFrameworks = *(*[]MultiKueueExternalFramework)(unsafe.Pointer(&in.ExternalFrameworks))
+	// WARNING: in.ClusterProfileConfig requires manual conversion: does not exist in peer-type
 	return nil
 }
 
-// Convert_v1beta2_MultiKueue_To_v1beta1_MultiKueue is an autogenerated conversion function.
-func Convert_v1beta2_MultiKueue_To_v1beta1_MultiKueue(in *v1beta2.MultiKueue, out *MultiKueue, s conversion.Scope) error {
-	return autoConvert_v1beta2_MultiKueue_To_v1beta1_MultiKueue(in, out, s)
-}
-
 func autoConvert_v1beta1_MultiKueueExternalFramework_To_v1beta2_MultiKueueExternalFramework(in *MultiKueueExternalFramework, out *v1beta2.MultiKueueExternalFramework, s conversion.Scope) error {
 	out.Name = in.Name
 	return nil
diff --git a/apis/config/v1beta2/configuration_types.go b/apis/config/v1beta2/configuration_types.go
index 8c18113cc..1da9ed503 100644
--- a/apis/config/v1beta2/configuration_types.go
+++ b/apis/config/v1beta2/configuration_types.go
@@ -21,6 +21,7 @@ import (
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
 	configv1alpha1 "k8s.io/component-base/config/v1alpha1"
 )
 
@@ -274,6 +275,10 @@ type MultiKueue struct {
 	// GroupVersionKind (GVK) for MultiKueue operations.
 	// +optional
 	ExternalFrameworks []MultiKueueExternalFramework `json:"externalFrameworks,omitempty"`
+
+	// ClusterProfileConfig defines configuration for using the ClusterProfile API.
+	// +optional
+	ClusterProfileConfig *ClusterProfileConfig `json:"clusterProfileConfig,omitempty"`
 }
 
 // MultiKueueExternalFramework defines a framework that is not built-in.
@@ -367,6 +372,21 @@ type InternalCertManagement struct {
 	WebhookSecretName *string `json:"webhookSecretName,omitempty"`
 }
 
+// ClusterProfileConfig defines configuration for using the ClusterProfile API in MultiKueue.
+type ClusterProfileConfig struct {
+	// CredentialsProviders defines a list of providers to obtain credentials of worker clusters
+	// using the ClusterProfile API.
+	CredentialsProviders []ClusterProfileCredentialsProvider `json:"credentialsProviders,omitempty"`
+}
+
+// ClusterProfileCredentialsProvider defines a credentials provider in the ClusterProfile API.
+type ClusterProfileCredentialsProvider struct {
+	// Name is the name of the provider.
+	Name string `json:"name"`
+	//  ExecConfig is the exec configuration to obtain credentials.
+	ExecConfig *clientcmdapi.ExecConfig `json:"execConfig"`
+}
+
 type ClientConnection struct {
 	// QPS controls the number of queries per second allowed for K8S api server
 	// connection.
diff --git a/apis/config/v1beta2/zz_generated.deepcopy.go b/apis/config/v1beta2/zz_generated.deepcopy.go
index 69cc90bd1..033b4af1f 100644
--- a/apis/config/v1beta2/zz_generated.deepcopy.go
+++ b/apis/config/v1beta2/zz_generated.deepcopy.go
@@ -24,6 +24,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/tools/clientcmd/api"
 	"k8s.io/component-base/config/v1alpha1"
 	timex "time"
 )
@@ -77,6 +78,48 @@ func (in *ClientConnection) DeepCopy() *ClientConnection {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterProfileConfig) DeepCopyInto(out *ClusterProfileConfig) {
+	*out = *in
+	if in.CredentialsProviders != nil {
+		in, out := &in.CredentialsProviders, &out.CredentialsProviders
+		*out = make([]ClusterProfileCredentialsProvider, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProfileConfig.
+func (in *ClusterProfileConfig) DeepCopy() *ClusterProfileConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterProfileConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterProfileCredentialsProvider) DeepCopyInto(out *ClusterProfileCredentialsProvider) {
+	*out = *in
+	if in.ExecConfig != nil {
+		in, out := &in.ExecConfig, &out.ExecConfig
+		*out = new(api.ExecConfig)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProfileCredentialsProvider.
+func (in *ClusterProfileCredentialsProvider) DeepCopy() *ClusterProfileCredentialsProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterProfileCredentialsProvider)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Configuration) DeepCopyInto(out *Configuration) {
 	*out = *in
@@ -397,6 +440,11 @@ func (in *MultiKueue) DeepCopyInto(out *MultiKueue) {
 		*out = make([]MultiKueueExternalFramework, len(*in))
 		copy(*out, *in)
 	}
+	if in.ClusterProfileConfig != nil {
+		in, out := &in.ClusterProfileConfig, &out.ClusterProfileConfig
+		*out = new(ClusterProfileConfig)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MultiKueue.
diff --git a/apis/kueue/v1beta1/admissioncheck_types.go b/apis/kueue/v1beta1/admissioncheck_types.go
index 98b986766..0a301f28f 100644
--- a/apis/kueue/v1beta1/admissioncheck_types.go
+++ b/apis/kueue/v1beta1/admissioncheck_types.go
@@ -57,6 +57,7 @@ type AdmissionCheckSpec struct {
 	// state goes to "Unknown". The default is 15 min.
 	// +optional
 	// +kubebuilder:default=15
+	//
 	// Deprecated: retryDelayMinutes has already been deprecated since v0.8 and will be removed in v1beta2.
 	RetryDelayMinutes *int64 `json:"retryDelayMinutes,omitempty"`
 
diff --git a/apis/kueue/v1beta1/clusterqueue_types.go b/apis/kueue/v1beta1/clusterqueue_types.go
index 74231178e..41cad04bb 100644
--- a/apis/kueue/v1beta1/clusterqueue_types.go
+++ b/apis/kueue/v1beta1/clusterqueue_types.go
@@ -306,6 +306,7 @@ type ClusterQueueStatus struct {
 
 	// pendingWorkloadsStatus contains the information exposed about the current
 	// status of the pending workloads in the cluster queue.
+	//
 	// Deprecated: This field is no longer effective since v0.14.0, which means Kueue no longer stores and updates information.
 	// You can migrate to VisibilityOnDemand
 	// (https://kueue.sigs.k8s.io/docs/tasks/manage/monitor_pending_workloads/pending_workloads_on_demand/)
diff --git a/apis/kueue/v1beta1/localqueue_types.go b/apis/kueue/v1beta1/localqueue_types.go
index 45ea97a5f..eb0110345 100644
--- a/apis/kueue/v1beta1/localqueue_types.go
+++ b/apis/kueue/v1beta1/localqueue_types.go
@@ -155,6 +155,7 @@ type LocalQueueStatus struct {
 	// +listMapKey=name
 	// +kubebuilder:validation:MaxItems=16
 	// +optional
+	//
 	// Deprecated: Flavors is deprecated and marked for removal in v1beta2.
 	Flavors []LocalQueueFlavorStatus `json:"flavors,omitempty"`
 
diff --git a/apis/kueue/v1beta1/multikueue_conversion.go b/apis/kueue/v1beta1/multikueue_conversion.go
new file mode 100644
index 000000000..6c0f66fc6
--- /dev/null
+++ b/apis/kueue/v1beta1/multikueue_conversion.go
@@ -0,0 +1,44 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	conversionapi "k8s.io/apimachinery/pkg/conversion"
+
+	"sigs.k8s.io/kueue/apis/kueue/v1beta2"
+)
+
+//lint:file-ignore ST1003 "generated Convert_* calls below use underscores"
+//revive:disable:var-naming
+
+func Convert_v1beta2_MultiKueueClusterSpec_To_v1beta1_MultiKueueClusterSpec(in *v1beta2.MultiKueueClusterSpec, out *MultiKueueClusterSpec, s conversionapi.Scope) error {
+	if in.KubeConfig != nil {
+		out.KubeConfig = KubeConfig{
+			Location:     in.KubeConfig.Location,
+			LocationType: LocationType(in.KubeConfig.LocationType),
+		}
+	}
+	return autoConvert_v1beta2_MultiKueueClusterSpec_To_v1beta1_MultiKueueClusterSpec(in, out, s)
+}
+
+func Convert_v1beta1_MultiKueueClusterSpec_To_v1beta2_MultiKueueClusterSpec(in *MultiKueueClusterSpec, out *v1beta2.MultiKueueClusterSpec, s conversionapi.Scope) error {
+	out.KubeConfig = &v1beta2.KubeConfig{
+		Location:     in.KubeConfig.Location,
+		LocationType: v1beta2.LocationType(in.KubeConfig.LocationType),
+	}
+	return autoConvert_v1beta1_MultiKueueClusterSpec_To_v1beta2_MultiKueueClusterSpec(in, out, s)
+}
diff --git a/apis/kueue/v1beta1/zz_generated.conversion.go b/apis/kueue/v1beta1/zz_generated.conversion.go
index 73c1922da..5086f8a92 100644
--- a/apis/kueue/v1beta1/zz_generated.conversion.go
+++ b/apis/kueue/v1beta1/zz_generated.conversion.go
@@ -358,16 +358,6 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
-	if err := s.AddGeneratedConversionFunc((*MultiKueueClusterSpec)(nil), (*v1beta2.MultiKueueClusterSpec)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1beta1_MultiKueueClusterSpec_To_v1beta2_MultiKueueClusterSpec(a.(*MultiKueueClusterSpec), b.(*v1beta2.MultiKueueClusterSpec), scope)
-	}); err != nil {
-		return err
-	}
-	if err := s.AddGeneratedConversionFunc((*v1beta2.MultiKueueClusterSpec)(nil), (*MultiKueueClusterSpec)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_v1beta2_MultiKueueClusterSpec_To_v1beta1_MultiKueueClusterSpec(a.(*v1beta2.MultiKueueClusterSpec), b.(*MultiKueueClusterSpec), scope)
-	}); err != nil {
-		return err
-	}
 	if err := s.AddGeneratedConversionFunc((*MultiKueueClusterStatus)(nil), (*v1beta2.MultiKueueClusterStatus)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1beta1_MultiKueueClusterStatus_To_v1beta2_MultiKueueClusterStatus(a.(*MultiKueueClusterStatus), b.(*v1beta2.MultiKueueClusterStatus), scope)
 	}); err != nil {
@@ -738,6 +728,11 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
+	if err := s.AddConversionFunc((*MultiKueueClusterSpec)(nil), (*v1beta2.MultiKueueClusterSpec)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1beta1_MultiKueueClusterSpec_To_v1beta2_MultiKueueClusterSpec(a.(*MultiKueueClusterSpec), b.(*v1beta2.MultiKueueClusterSpec), scope)
+	}); err != nil {
+		return err
+	}
 	if err := s.AddConversionFunc((*TopologyAssignment)(nil), (*v1beta2.TopologyAssignment)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1beta1_TopologyAssignment_To_v1beta2_TopologyAssignment(a.(*TopologyAssignment), b.(*v1beta2.TopologyAssignment), scope)
 	}); err != nil {
@@ -763,6 +758,11 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
+	if err := s.AddConversionFunc((*v1beta2.MultiKueueClusterSpec)(nil), (*MultiKueueClusterSpec)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_v1beta2_MultiKueueClusterSpec_To_v1beta1_MultiKueueClusterSpec(a.(*v1beta2.MultiKueueClusterSpec), b.(*MultiKueueClusterSpec), scope)
+	}); err != nil {
+		return err
+	}
 	if err := s.AddConversionFunc((*v1beta2.TopologyAssignment)(nil), (*TopologyAssignment)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1beta2_TopologyAssignment_To_v1beta1_TopologyAssignment(a.(*v1beta2.TopologyAssignment), b.(*TopologyAssignment), scope)
 	}); err != nil {
@@ -1681,7 +1681,17 @@ func Convert_v1beta2_MultiKueueCluster_To_v1beta1_MultiKueueCluster(in *v1beta2.
 
 func autoConvert_v1beta1_MultiKueueClusterList_To_v1beta2_MultiKueueClusterList(in *MultiKueueClusterList, out *v1beta2.MultiKueueClusterList, s conversion.Scope) error {
 	out.ListMeta = in.ListMeta
-	out.Items = *(*[]v1beta2.MultiKueueCluster)(unsafe.Pointer(&in.Items))
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]v1beta2.MultiKueueCluster, len(*in))
+		for i := range *in {
+			if err := Convert_v1beta1_MultiKueueCluster_To_v1beta2_MultiKueueCluster(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
 	return nil
 }
 
@@ -1692,7 +1702,17 @@ func Convert_v1beta1_MultiKueueClusterList_To_v1beta2_MultiKueueClusterList(in *
 
 func autoConvert_v1beta2_MultiKueueClusterList_To_v1beta1_MultiKueueClusterList(in *v1beta2.MultiKueueClusterList, out *MultiKueueClusterList, s conversion.Scope) error {
 	out.ListMeta = in.ListMeta
-	out.Items = *(*[]MultiKueueCluster)(unsafe.Pointer(&in.Items))
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]MultiKueueCluster, len(*in))
+		for i := range *in {
+			if err := Convert_v1beta2_MultiKueueCluster_To_v1beta1_MultiKueueCluster(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
 	return nil
 }
 
@@ -1702,29 +1722,16 @@ func Convert_v1beta2_MultiKueueClusterList_To_v1beta1_MultiKueueClusterList(in *
 }
 
 func autoConvert_v1beta1_MultiKueueClusterSpec_To_v1beta2_MultiKueueClusterSpec(in *MultiKueueClusterSpec, out *v1beta2.MultiKueueClusterSpec, s conversion.Scope) error {
-	if err := Convert_v1beta1_KubeConfig_To_v1beta2_KubeConfig(&in.KubeConfig, &out.KubeConfig, s); err != nil {
-		return err
-	}
+	// WARNING: in.KubeConfig requires manual conversion: inconvertible types (sigs.k8s.io/kueue/apis/kueue/v1beta1.KubeConfig vs *sigs.k8s.io/kueue/apis/kueue/v1beta2.KubeConfig)
 	return nil
 }
 
-// Convert_v1beta1_MultiKueueClusterSpec_To_v1beta2_MultiKueueClusterSpec is an autogenerated conversion function.
-func Convert_v1beta1_MultiKueueClusterSpec_To_v1beta2_MultiKueueClusterSpec(in *MultiKueueClusterSpec, out *v1beta2.MultiKueueClusterSpec, s conversion.Scope) error {
-	return autoConvert_v1beta1_MultiKueueClusterSpec_To_v1beta2_MultiKueueClusterSpec(in, out, s)
-}
-
 func autoConvert_v1beta2_MultiKueueClusterSpec_To_v1beta1_MultiKueueClusterSpec(in *v1beta2.MultiKueueClusterSpec, out *MultiKueueClusterSpec, s conversion.Scope) error {
-	if err := Convert_v1beta2_KubeConfig_To_v1beta1_KubeConfig(&in.KubeConfig, &out.KubeConfig, s); err != nil {
-		return err
-	}
+	// WARNING: in.KubeConfig requires manual conversion: inconvertible types (*sigs.k8s.io/kueue/apis/kueue/v1beta2.KubeConfig vs sigs.k8s.io/kueue/apis/kueue/v1beta1.KubeConfig)
+	// WARNING: in.ClusterProfile requires manual conversion: does not exist in peer-type
 	return nil
 }
 
-// Convert_v1beta2_MultiKueueClusterSpec_To_v1beta1_MultiKueueClusterSpec is an autogenerated conversion function.
-func Convert_v1beta2_MultiKueueClusterSpec_To_v1beta1_MultiKueueClusterSpec(in *v1beta2.MultiKueueClusterSpec, out *MultiKueueClusterSpec, s conversion.Scope) error {
-	return autoConvert_v1beta2_MultiKueueClusterSpec_To_v1beta1_MultiKueueClusterSpec(in, out, s)
-}
-
 func autoConvert_v1beta1_MultiKueueClusterStatus_To_v1beta2_MultiKueueClusterStatus(in *MultiKueueClusterStatus, out *v1beta2.MultiKueueClusterStatus, s conversion.Scope) error {
 	out.Conditions = *(*[]v1.Condition)(unsafe.Pointer(&in.Conditions))
 	return nil
diff --git a/apis/kueue/v1beta2/multikueue_types.go b/apis/kueue/v1beta2/multikueue_types.go
index e27f2c119..f9ab6c466 100644
--- a/apis/kueue/v1beta2/multikueue_types.go
+++ b/apis/kueue/v1beta2/multikueue_types.go
@@ -62,10 +62,30 @@ type KubeConfig struct {
 	LocationType LocationType `json:"locationType"`
 }
 
+// +kubebuilder:validation:ExactlyOneOf=kubeConfig;clusterProfile
+
 type MultiKueueClusterSpec struct {
 	// kubeConfig is information on how to connect to the cluster.
+	// +optional
+	KubeConfig *KubeConfig `json:"kubeConfig,omitempty,omitzero"`
+
+	// clusterProfile is the reference to the ClusterProfile object used to connect to the cluster.
+	// +optional
+	ClusterProfile *ClusterProfileReference `json:"clusterProfile,omitempty"`
+}
+
+type ClusterProfileReference struct {
+	// name of the ClusterProfile.
+	// +kubebuilder:validation:MaxLength=256
+	// +kubebuilder:validation:MinLength=1
+	// +required
+	Name string `json:"name,omitempty"`
+
+	// namespace of the ClusterProfile.
+	// +kubebuilder:validation:MaxLength=256
+	// +kubebuilder:validation:MinLength=1
 	// +required
-	KubeConfig KubeConfig `json:"kubeConfig,omitempty,omitzero"`
+	Namespace string `json:"namespace,omitempty"`
 }
 
 type MultiKueueClusterStatus struct {
diff --git a/apis/kueue/v1beta2/zz_generated.deepcopy.go b/apis/kueue/v1beta2/zz_generated.deepcopy.go
index ba0dc1d4f..9ea20cb1e 100644
--- a/apis/kueue/v1beta2/zz_generated.deepcopy.go
+++ b/apis/kueue/v1beta2/zz_generated.deepcopy.go
@@ -297,6 +297,21 @@ func (in *BorrowWithinCohort) DeepCopy() *BorrowWithinCohort {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterProfileReference) DeepCopyInto(out *ClusterProfileReference) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProfileReference.
+func (in *ClusterProfileReference) DeepCopy() *ClusterProfileReference {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterProfileReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ClusterQueue) DeepCopyInto(out *ClusterQueue) {
 	*out = *in
@@ -867,7 +882,7 @@ func (in *MultiKueueCluster) DeepCopyInto(out *MultiKueueCluster) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	out.Spec = in.Spec
+	in.Spec.DeepCopyInto(&out.Spec)
 	in.Status.DeepCopyInto(&out.Status)
 }
 
@@ -924,7 +939,16 @@ func (in *MultiKueueClusterList) DeepCopyObject() runtime.Object {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *MultiKueueClusterSpec) DeepCopyInto(out *MultiKueueClusterSpec) {
 	*out = *in
-	out.KubeConfig = in.KubeConfig
+	if in.KubeConfig != nil {
+		in, out := &in.KubeConfig, &out.KubeConfig
+		*out = new(KubeConfig)
+		**out = **in
+	}
+	if in.ClusterProfile != nil {
+		in, out := &in.ClusterProfile, &out.ClusterProfile
+		*out = new(ClusterProfileReference)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MultiKueueClusterSpec.
diff --git a/charts/kueue/templates/crd/kueue.x-k8s.io_admissionchecks.yaml b/charts/kueue/templates/crd/kueue.x-k8s.io_admissionchecks.yaml
index a7b8fb703..4aecde07b 100644
--- a/charts/kueue/templates/crd/kueue.x-k8s.io_admissionchecks.yaml
+++ b/charts/kueue/templates/crd/kueue.x-k8s.io_admissionchecks.yaml
@@ -100,6 +100,7 @@ spec:
                     retryDelayMinutes specifies how long to keep the workload suspended after
                     a failed check (after it transitioned to False). When the delay period has passed, the check
                     state goes to "Unknown". The default is 15 min.
+
                     Deprecated: retryDelayMinutes has already been deprecated since v0.8 and will be removed in v1beta2.
                   format: int64
                   type: integer
diff --git a/charts/kueue/templates/crd/kueue.x-k8s.io_clusterqueues.yaml b/charts/kueue/templates/crd/kueue.x-k8s.io_clusterqueues.yaml
index 36657c77d..238758e6b 100644
--- a/charts/kueue/templates/crd/kueue.x-k8s.io_clusterqueues.yaml
+++ b/charts/kueue/templates/crd/kueue.x-k8s.io_clusterqueues.yaml
@@ -770,6 +770,7 @@ spec:
                   description: |-
                     pendingWorkloadsStatus contains the information exposed about the current
                     status of the pending workloads in the cluster queue.
+
                     Deprecated: This field is no longer effective since v0.14.0, which means Kueue no longer stores and updates information.
                     You can migrate to VisibilityOnDemand
                     (https://kueue.sigs.k8s.io/docs/tasks/manage/monitor_pending_workloads/pending_workloads_on_demand/)
diff --git a/charts/kueue/templates/crd/kueue.x-k8s.io_localqueues.yaml b/charts/kueue/templates/crd/kueue.x-k8s.io_localqueues.yaml
index 62e490de2..7a3b03e7a 100644
--- a/charts/kueue/templates/crd/kueue.x-k8s.io_localqueues.yaml
+++ b/charts/kueue/templates/crd/kueue.x-k8s.io_localqueues.yaml
@@ -294,6 +294,7 @@ spec:
                 flavors:
                   description: |-
                     flavors lists all currently available ResourceFlavors in specified ClusterQueue.
+
                     Deprecated: Flavors is deprecated and marked for removal in v1beta2.
                   items:
                     description: 'Deprecated: LocalQueueFlavorStatus is deprecated and marked for removal in v1beta2.'
diff --git a/charts/kueue/templates/crd/kueue.x-k8s.io_multikueueclusters.yaml b/charts/kueue/templates/crd/kueue.x-k8s.io_multikueueclusters.yaml
index b5175084c..0ae93fa2d 100644
--- a/charts/kueue/templates/crd/kueue.x-k8s.io_multikueueclusters.yaml
+++ b/charts/kueue/templates/crd/kueue.x-k8s.io_multikueueclusters.yaml
@@ -198,6 +198,23 @@ spec:
             spec:
               description: spec is the specification of the MultiKueueCluster.
               properties:
+                clusterProfile:
+                  description: clusterProfile is the reference to the ClusterProfile object used to connect to the cluster.
+                  properties:
+                    name:
+                      description: name of the ClusterProfile.
+                      maxLength: 256
+                      minLength: 1
+                      type: string
+                    namespace:
+                      description: namespace of the ClusterProfile.
+                      maxLength: 256
+                      minLength: 1
+                      type: string
+                  required:
+                    - name
+                    - namespace
+                  type: object
                 kubeConfig:
                   description: kubeConfig is information on how to connect to the cluster.
                   properties:
@@ -220,9 +237,10 @@ spec:
                   required:
                     - location
                   type: object
-              required:
-                - kubeConfig
               type: object
+              x-kubernetes-validations:
+                - message: exactly one of the fields in [kubeConfig clusterProfile] must be set
+                  rule: '[has(self.kubeConfig),has(self.clusterProfile)].filter(x,x==true).size() == 1'
             status:
               description: status is the status of the MultiKueueCluster.
               properties:
diff --git a/charts/kueue/templates/rbac/role.yaml b/charts/kueue/templates/rbac/role.yaml
index 0b6758e2f..7b03fe162 100644
--- a/charts/kueue/templates/rbac/role.yaml
+++ b/charts/kueue/templates/rbac/role.yaml
@@ -313,6 +313,14 @@ rules:
       - get
       - list
       - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - clusterprofiles
+    verbs:
+      - get
+      - list
+      - watch
   - apiGroups:
       - node.k8s.io
     resources:
diff --git a/client-go/applyconfiguration/kueue/v1beta2/clusterprofilereference.go b/client-go/applyconfiguration/kueue/v1beta2/clusterprofilereference.go
new file mode 100644
index 000000000..e2bc8e47a
--- /dev/null
+++ b/client-go/applyconfiguration/kueue/v1beta2/clusterprofilereference.go
@@ -0,0 +1,47 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta2
+
+// ClusterProfileReferenceApplyConfiguration represents a declarative configuration of the ClusterProfileReference type for use
+// with apply.
+type ClusterProfileReferenceApplyConfiguration struct {
+	Name      *string `json:"name,omitempty"`
+	Namespace *string `json:"namespace,omitempty"`
+}
+
+// ClusterProfileReferenceApplyConfiguration constructs a declarative configuration of the ClusterProfileReference type for use with
+// apply.
+func ClusterProfileReference() *ClusterProfileReferenceApplyConfiguration {
+	return &ClusterProfileReferenceApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ClusterProfileReferenceApplyConfiguration) WithName(value string) *ClusterProfileReferenceApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ClusterProfileReferenceApplyConfiguration) WithNamespace(value string) *ClusterProfileReferenceApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
diff --git a/client-go/applyconfiguration/kueue/v1beta2/multikueueclusterspec.go b/client-go/applyconfiguration/kueue/v1beta2/multikueueclusterspec.go
index 1b1e8b6cf..08e8d6eaf 100644
--- a/client-go/applyconfiguration/kueue/v1beta2/multikueueclusterspec.go
+++ b/client-go/applyconfiguration/kueue/v1beta2/multikueueclusterspec.go
@@ -20,7 +20,8 @@ package v1beta2
 // MultiKueueClusterSpecApplyConfiguration represents a declarative configuration of the MultiKueueClusterSpec type for use
 // with apply.
 type MultiKueueClusterSpecApplyConfiguration struct {
-	KubeConfig *KubeConfigApplyConfiguration `json:"kubeConfig,omitempty"`
+	KubeConfig     *KubeConfigApplyConfiguration              `json:"kubeConfig,omitempty"`
+	ClusterProfile *ClusterProfileReferenceApplyConfiguration `json:"clusterProfile,omitempty"`
 }
 
 // MultiKueueClusterSpecApplyConfiguration constructs a declarative configuration of the MultiKueueClusterSpec type for use with
@@ -36,3 +37,11 @@ func (b *MultiKueueClusterSpecApplyConfiguration) WithKubeConfig(value *KubeConf
 	b.KubeConfig = value
 	return b
 }
+
+// WithClusterProfile sets the ClusterProfile field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ClusterProfile field is set to the value of the last call.
+func (b *MultiKueueClusterSpecApplyConfiguration) WithClusterProfile(value *ClusterProfileReferenceApplyConfiguration) *MultiKueueClusterSpecApplyConfiguration {
+	b.ClusterProfile = value
+	return b
+}
diff --git a/client-go/applyconfiguration/utils.go b/client-go/applyconfiguration/utils.go
index 4a50fa25e..d774f9ae1 100644
--- a/client-go/applyconfiguration/utils.go
+++ b/client-go/applyconfiguration/utils.go
@@ -195,6 +195,8 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &kueuev1beta2.AdmissionScopeApplyConfiguration{}
 	case v1beta2.SchemeGroupVersion.WithKind("BorrowWithinCohort"):
 		return &kueuev1beta2.BorrowWithinCohortApplyConfiguration{}
+	case v1beta2.SchemeGroupVersion.WithKind("ClusterProfileReference"):
+		return &kueuev1beta2.ClusterProfileReferenceApplyConfiguration{}
 	case v1beta2.SchemeGroupVersion.WithKind("ClusterQueue"):
 		return &kueuev1beta2.ClusterQueueApplyConfiguration{}
 	case v1beta2.SchemeGroupVersion.WithKind("ClusterQueuePreemption"):
diff --git a/cmd/kueue/main.go b/cmd/kueue/main.go
index 87068d79b..878c6ca63 100644
--- a/cmd/kueue/main.go
+++ b/cmd/kueue/main.go
@@ -40,6 +40,7 @@ import (
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/util/flowcontrol"
 	"k8s.io/utils/ptr"
+	inventoryv1alpha1 "sigs.k8s.io/cluster-inventory-api/apis/v1alpha1"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/certwatcher"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
@@ -101,6 +102,7 @@ func init() {
 	utilruntime.Must(configapiv1beta1.AddToScheme(scheme))
 	utilruntime.Must(configapi.AddToScheme(scheme))
 	utilruntime.Must(autoscaling.AddToScheme(scheme))
+	utilruntime.Must(inventoryv1alpha1.AddToScheme(scheme))
 	// Add any additional framework integration types.
 	utilruntime.Must(
 		jobframework.ForEachIntegration(func(_ string, cb jobframework.IntegrationCallbacks) error {
@@ -377,6 +379,7 @@ func setupControllers(ctx context.Context, mgr ctrl.Manager, cCache *schdcache.C
 			multikueue.WithWorkerLostTimeout(cfg.MultiKueue.WorkerLostTimeout.Duration),
 			multikueue.WithAdapters(adapters),
 			multikueue.WithDispatcherName(ptr.Deref(cfg.MultiKueue.DispatcherName, configapi.MultiKueueDispatcherModeAllAtOnce)),
+			multikueue.WithClusterProfiles(cfg.MultiKueue.ClusterProfileConfig),
 		); err != nil {
 			return fmt.Errorf("could not setup MultiKueue controller: %w", err)
 		}
diff --git a/cmd/kueueviz/backend/middleware/cors.go b/cmd/kueueviz/backend/middleware/cors.go
index 2620358b3..45cd38382 100644
--- a/cmd/kueueviz/backend/middleware/cors.go
+++ b/cmd/kueueviz/backend/middleware/cors.go
@@ -65,8 +65,8 @@ func ConfigureCORS() (cors.Config, error) {
 
 	if allowedOriginsEnv != "" {
 		// Split comma-separated origins and validate each
-		rawOrigins := strings.Split(allowedOriginsEnv, ",")
-		for _, origin := range rawOrigins {
+		rawOrigins := strings.SplitSeq(allowedOriginsEnv, ",")
+		for origin := range rawOrigins {
 			origin = strings.TrimSpace(origin)
 			if cleanOrigin, valid := validateOrigin(origin); valid {
 				allowedOrigins = append(allowedOrigins, cleanOrigin)
diff --git a/config/components/crd/bases/kueue.x-k8s.io_admissionchecks.yaml b/config/components/crd/bases/kueue.x-k8s.io_admissionchecks.yaml
index a78a59fde..0aa7a45f8 100644
--- a/config/components/crd/bases/kueue.x-k8s.io_admissionchecks.yaml
+++ b/config/components/crd/bases/kueue.x-k8s.io_admissionchecks.yaml
@@ -78,6 +78,7 @@ spec:
                   retryDelayMinutes specifies how long to keep the workload suspended after
                   a failed check (after it transitioned to False). When the delay period has passed, the check
                   state goes to "Unknown". The default is 15 min.
+
                   Deprecated: retryDelayMinutes has already been deprecated since v0.8 and will be removed in v1beta2.
                 format: int64
                 type: integer
diff --git a/config/components/crd/bases/kueue.x-k8s.io_clusterqueues.yaml b/config/components/crd/bases/kueue.x-k8s.io_clusterqueues.yaml
index 0bc089e93..49f62c81d 100644
--- a/config/components/crd/bases/kueue.x-k8s.io_clusterqueues.yaml
+++ b/config/components/crd/bases/kueue.x-k8s.io_clusterqueues.yaml
@@ -754,6 +754,7 @@ spec:
                 description: |-
                   pendingWorkloadsStatus contains the information exposed about the current
                   status of the pending workloads in the cluster queue.
+
                   Deprecated: This field is no longer effective since v0.14.0, which means Kueue no longer stores and updates information.
                   You can migrate to VisibilityOnDemand
                   (https://kueue.sigs.k8s.io/docs/tasks/manage/monitor_pending_workloads/pending_workloads_on_demand/)
diff --git a/config/components/crd/bases/kueue.x-k8s.io_localqueues.yaml b/config/components/crd/bases/kueue.x-k8s.io_localqueues.yaml
index 25d21369b..c05dbf32f 100644
--- a/config/components/crd/bases/kueue.x-k8s.io_localqueues.yaml
+++ b/config/components/crd/bases/kueue.x-k8s.io_localqueues.yaml
@@ -268,6 +268,7 @@ spec:
               flavors:
                 description: |-
                   flavors lists all currently available ResourceFlavors in specified ClusterQueue.
+
                   Deprecated: Flavors is deprecated and marked for removal in v1beta2.
                 items:
                   description: 'Deprecated: LocalQueueFlavorStatus is deprecated and
diff --git a/config/components/crd/bases/kueue.x-k8s.io_multikueueclusters.yaml b/config/components/crd/bases/kueue.x-k8s.io_multikueueclusters.yaml
index b99bd85fb..9c54384db 100644
--- a/config/components/crd/bases/kueue.x-k8s.io_multikueueclusters.yaml
+++ b/config/components/crd/bases/kueue.x-k8s.io_multikueueclusters.yaml
@@ -177,6 +177,24 @@ spec:
           spec:
             description: spec is the specification of the MultiKueueCluster.
             properties:
+              clusterProfile:
+                description: clusterProfile is the reference to the ClusterProfile
+                  object used to connect to the cluster.
+                properties:
+                  name:
+                    description: name of the ClusterProfile.
+                    maxLength: 256
+                    minLength: 1
+                    type: string
+                  namespace:
+                    description: namespace of the ClusterProfile.
+                    maxLength: 256
+                    minLength: 1
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
               kubeConfig:
                 description: kubeConfig is information on how to connect to the cluster.
                 properties:
@@ -199,9 +217,12 @@ spec:
                 required:
                 - location
                 type: object
-            required:
-            - kubeConfig
             type: object
+            x-kubernetes-validations:
+            - message: exactly one of the fields in [kubeConfig clusterProfile] must
+                be set
+              rule: '[has(self.kubeConfig),has(self.clusterProfile)].filter(x,x==true).size()
+                == 1'
           status:
             description: status is the status of the MultiKueueCluster.
             properties:
diff --git a/config/components/rbac/role.yaml b/config/components/rbac/role.yaml
index f6d955306..fa5ca8ef1 100644
--- a/config/components/rbac/role.yaml
+++ b/config/components/rbac/role.yaml
@@ -294,6 +294,14 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - multicluster.x-k8s.io
+  resources:
+  - clusterprofiles
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - node.k8s.io
   resources:
diff --git a/go.mod b/go.mod
index 7a4e879bc..1796b6875 100644
--- a/go.mod
+++ b/go.mod
@@ -37,6 +37,7 @@ require (
 	k8s.io/kubectl v0.34.1
 	k8s.io/metrics v0.34.1
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
+	sigs.k8s.io/cluster-inventory-api v0.0.0-20251028164203-2e3fabb46733
 	sigs.k8s.io/controller-runtime v0.22.4
 	sigs.k8s.io/jobset v0.10.1
 	sigs.k8s.io/lws v0.7.0
diff --git a/go.sum b/go.sum
index 67e0a63ec..376d2b6c5 100644
--- a/go.sum
+++ b/go.sum
@@ -168,6 +168,10 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
+github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
 github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns=
 github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
 github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
@@ -369,6 +373,8 @@ gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -410,6 +416,8 @@ k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzk
 k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0 h1:qPrZsv1cwQiFeieFlRqT627fVZ+tyfou/+S5S0H5ua0=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
+sigs.k8s.io/cluster-inventory-api v0.0.0-20251028164203-2e3fabb46733 h1:l90ANqblqFrE4L2QLLk+9iPjfmaLRvOFL51l/fgwUgg=
+sigs.k8s.io/cluster-inventory-api v0.0.0-20251028164203-2e3fabb46733/go.mod h1:guwenlZ9iIfYlNxn7ExCfugOLTh6wjjRX3adC36YCmQ=
 sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A=
 sigs.k8s.io/controller-runtime v0.22.4/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8=
 sigs.k8s.io/gateway-api v1.4.0 h1:ZwlNM6zOHq0h3WUX2gfByPs2yAEsy/EenYJB78jpQfQ=
diff --git a/hack/depcheck/Dockerfile b/hack/depcheck/Dockerfile
index ed627e3bc..14e389fe2 100644
--- a/hack/depcheck/Dockerfile
+++ b/hack/depcheck/Dockerfile
@@ -6,6 +6,9 @@ WORKDIR /app
 # Copy package files
 COPY package*.json ./
 
+# Skip downloading the binary since this is just for dependency check
+ENV CYPRESS_INSTALL_BINARY=0
+
 # Install ALL dependencies (including dev dependencies needed for build)
 RUN npm install
 
diff --git a/hack/internal/tools/go.mod b/hack/internal/tools/go.mod
index 6cc09aaf2..6e6d1ae0c 100644
--- a/hack/internal/tools/go.mod
+++ b/hack/internal/tools/go.mod
@@ -22,7 +22,7 @@ tool (
 
 require (
 	github.com/gohugoio/hugo v0.147.7
-	github.com/golangci/golangci-lint/v2 v2.5.0
+	github.com/golangci/golangci-lint/v2 v2.6.1
 	github.com/google/go-cmp v0.7.0
 	github.com/kubernetes-sigs/reference-docs/genref v0.28.0
 	github.com/mikefarah/yq/v4 v4.48.1
@@ -49,9 +49,9 @@ require (
 	al.essio.dev/pkg/shellescape v1.5.1 // indirect
 	cel.dev/expr v0.24.0 // indirect
 	cloud.google.com/go v0.121.2 // indirect
-	cloud.google.com/go/auth v0.16.3 // indirect
+	cloud.google.com/go/auth v0.16.5 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/compute/metadata v0.7.0 // indirect
+	cloud.google.com/go/compute/metadata v0.8.0 // indirect
 	cloud.google.com/go/iam v1.5.2 // indirect
 	cloud.google.com/go/monitoring v1.24.2 // indirect
 	cloud.google.com/go/storage v1.53.0 // indirect
@@ -60,7 +60,7 @@ require (
 	dev.gaijin.team/go/exhaustruct/v4 v4.0.0 // indirect
 	dev.gaijin.team/go/golib v0.6.0 // indirect
 	github.com/4meepo/tagalign v1.4.3 // indirect
-	github.com/Abirdcfly/dupword v0.1.6 // indirect
+	github.com/Abirdcfly/dupword v0.1.7 // indirect
 	github.com/AdminBenni/iota-mixing v1.0.0 // indirect
 	github.com/AlwxSin/noinlineerr v1.0.5 // indirect
 	github.com/Antonboom/errname v1.1.1 // indirect
@@ -77,7 +77,7 @@ require (
 	github.com/BurntSushi/locker v0.0.0-20171006230638-a6e239ea1c69 // indirect
 	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/Djarvur/go-err113 v0.1.1 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
@@ -101,8 +101,8 @@ require (
 	github.com/alingse/nilnesserr v0.2.0 // indirect
 	github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/ashanbrown/forbidigo/v2 v2.1.0 // indirect
-	github.com/ashanbrown/makezero/v2 v2.0.1 // indirect
+	github.com/ashanbrown/forbidigo/v2 v2.3.0 // indirect
+	github.com/ashanbrown/makezero/v2 v2.1.0 // indirect
 	github.com/aws/aws-sdk-go v1.55.5 // indirect
 	github.com/aws/aws-sdk-go-v2 v1.36.1 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.3 // indirect
@@ -146,16 +146,16 @@ require (
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/blizzy78/varnamelen v0.8.0 // indirect
 	github.com/bombsimon/wsl/v4 v4.7.0 // indirect
-	github.com/bombsimon/wsl/v5 v5.2.0 // indirect
+	github.com/bombsimon/wsl/v5 v5.3.0 // indirect
 	github.com/breml/bidichk v0.3.3 // indirect
 	github.com/breml/errchkjson v0.4.1 // indirect
 	github.com/butuzov/ireturn v0.4.0 // indirect
 	github.com/butuzov/mirror v1.3.0 // indirect
-	github.com/catenacyber/perfsprint v0.9.1 // indirect
+	github.com/catenacyber/perfsprint v0.10.0 // indirect
 	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chai2010/gettext-go v1.0.2 // indirect
-	github.com/charithe/durationcheck v0.0.10 // indirect
+	github.com/charithe/durationcheck v0.0.11 // indirect
 	github.com/charmbracelet/colorprofile v0.3.1 // indirect
 	github.com/charmbracelet/lipgloss v1.1.0 // indirect
 	github.com/charmbracelet/x/ansi v0.9.3 // indirect
@@ -205,12 +205,12 @@ require (
 	github.com/fzipp/gocyclo v0.6.0 // indirect
 	github.com/getkin/kin-openapi v0.132.0 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
-	github.com/ghostiam/protogetter v0.3.16 // indirect
-	github.com/go-critic/go-critic v0.13.0 // indirect
+	github.com/ghostiam/protogetter v0.3.17 // indirect
+	github.com/go-critic/go-critic v0.14.2 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
@@ -231,7 +231,7 @@ require (
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/goccy/go-yaml v1.18.0 // indirect
-	github.com/godoc-lint/godoc-lint v0.10.0 // indirect
+	github.com/godoc-lint/godoc-lint v0.10.1 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/gohugoio/go-i18n/v2 v2.1.3-0.20230805085216-e63c13218d0e // indirect
@@ -249,7 +249,6 @@ require (
 	github.com/golangci/gofmt v0.0.0-20250704145412-3e58ba0443c6 // indirect
 	github.com/golangci/golines v0.0.0-20250217232252-b35a6149b587 // indirect
 	github.com/golangci/misspell v0.7.0 // indirect
-	github.com/golangci/nilerr v0.0.0-20250918000102-015671e622fe // indirect
 	github.com/golangci/plugin-module-register v0.1.2 // indirect
 	github.com/golangci/revgrep v0.8.0 // indirect
 	github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e // indirect
@@ -257,7 +256,7 @@ require (
 	github.com/gomarkdown/markdown v0.0.0-20240328165702-4d01890c35c0 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
-	github.com/google/pprof v0.0.0-20250630185457-6e76a2b096b5 // indirect
+	github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
@@ -269,6 +268,7 @@ require (
 	github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
 	github.com/gostaticanalysis/comment v1.5.0 // indirect
 	github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect
+	github.com/gostaticanalysis/nilerr v0.1.2 // indirect
 	github.com/gosuri/uitable v0.0.4 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
 	github.com/hairyhenderson/go-codeowners v0.7.0 // indirect
@@ -291,21 +291,21 @@ require (
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/julz/importas v0.2.0 // indirect
-	github.com/karamaru-alpha/copyloopvar v1.2.1 // indirect
+	github.com/karamaru-alpha/copyloopvar v1.2.2 // indirect
 	github.com/kisielk/errcheck v1.9.0 // indirect
 	github.com/kkHAIKE/contextcheck v1.1.6 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/kulti/thelper v0.7.1 // indirect
-	github.com/kunwardeep/paralleltest v1.0.14 // indirect
+	github.com/kunwardeep/paralleltest v1.0.15 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/kyokomi/emoji/v2 v2.2.13 // indirect
 	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
 	github.com/lasiar/canonicalheader v1.1.2 // indirect
-	github.com/ldez/exptostd v0.4.4 // indirect
-	github.com/ldez/gomoddirectives v0.7.0 // indirect
+	github.com/ldez/exptostd v0.4.5 // indirect
+	github.com/ldez/gomoddirectives v0.7.1 // indirect
 	github.com/ldez/grignotin v0.10.1 // indirect
 	github.com/ldez/tagliatelle v0.7.2 // indirect
 	github.com/ldez/usetesting v0.5.0 // indirect
@@ -349,7 +349,7 @@ require (
 	github.com/niklasfasching/go-org v1.7.0 // indirect
 	github.com/nishanths/exhaustive v0.12.0 // indirect
 	github.com/nishanths/predeclared v0.2.2 // indirect
-	github.com/nunnatsa/ginkgolinter v0.21.0 // indirect
+	github.com/nunnatsa/ginkgolinter v0.21.2 // indirect
 	github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
 	github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
 	github.com/olekukonko/errors v1.1.0 // indirect
@@ -371,8 +371,8 @@ require (
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.65.0 // indirect
 	github.com/prometheus/procfs v0.17.0 // indirect
-	github.com/quasilyte/go-ruleguard v0.4.4 // indirect
-	github.com/quasilyte/go-ruleguard/dsl v0.3.22 // indirect
+	github.com/quasilyte/go-ruleguard v0.4.5 // indirect
+	github.com/quasilyte/go-ruleguard/dsl v0.3.23 // indirect
 	github.com/quasilyte/gogrep v0.5.0 // indirect
 	github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 // indirect
 	github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 // indirect
@@ -388,7 +388,7 @@ require (
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
 	github.com/sashamelentyev/usestdlibvars v1.29.0 // indirect
-	github.com/securego/gosec/v2 v2.22.8 // indirect
+	github.com/securego/gosec/v2 v2.22.10 // indirect
 	github.com/sergi/go-diff v1.2.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
@@ -436,8 +436,8 @@ require (
 	gitlab.com/bosi/decorder v0.4.2 // indirect
 	go-simpler.org/musttag v0.14.0 // indirect
 	go-simpler.org/sloglint v0.11.1 // indirect
-	go.augendre.info/arangolint v0.2.0 // indirect
-	go.augendre.info/fatcontext v0.8.1 // indirect
+	go.augendre.info/arangolint v0.3.1 // indirect
+	go.augendre.info/fatcontext v0.9.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
@@ -445,8 +445,8 @@ require (
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
 	go.opentelemetry.io/otel v1.37.0 // indirect
 	go.opentelemetry.io/otel/metric v1.37.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.36.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
 	go.opentelemetry.io/otel/trace v1.37.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
@@ -456,9 +456,9 @@ require (
 	gocloud.dev v0.40.0 // indirect
 	golang.org/x/crypto v0.43.0 // indirect
 	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
-	golang.org/x/exp/typeparams v0.0.0-20250911091902-df9299821621 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20251023183803-a4bb9ffd2546 // indirect
 	golang.org/x/image v0.27.0 // indirect
-	golang.org/x/mod v0.28.0 // indirect
+	golang.org/x/mod v0.29.0 // indirect
 	golang.org/x/net v0.46.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sync v0.17.0 // indirect
@@ -466,14 +466,14 @@ require (
 	golang.org/x/term v0.36.0 // indirect
 	golang.org/x/text v0.30.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.37.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9 // indirect
 	google.golang.org/api v0.246.0 // indirect
 	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250728155136-f173205681a0 // indirect
-	google.golang.org/grpc v1.74.2 // indirect
-	google.golang.org/protobuf v1.36.7 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c // indirect
+	google.golang.org/grpc v1.75.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
@@ -501,8 +501,8 @@ require (
 	k8s.io/kubelet v0.34.1 // indirect
 	k8s.io/metrics v0.34.1 // indirect
 	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
-	mvdan.cc/gofumpt v0.9.1 // indirect
-	mvdan.cc/unparam v0.0.0-20250301125049-0df0534333a4 // indirect
+	mvdan.cc/gofumpt v0.9.2 // indirect
+	mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 // indirect
 	oras.land/oras-go/v2 v2.6.0 // indirect
 	rsc.io/qr v0.2.0 // indirect
 	sigs.k8s.io/controller-runtime v0.22.3 // indirect
diff --git a/hack/internal/tools/go.sum b/hack/internal/tools/go.sum
index bc4a200ad..42da85970 100644
--- a/hack/internal/tools/go.sum
+++ b/hack/internal/tools/go.sum
@@ -27,8 +27,8 @@ cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmW
 cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
 cloud.google.com/go v0.121.2 h1:v2qQpN6Dx9x2NmwrqlesOt3Ys4ol5/lFZ6Mg1B7OJCg=
 cloud.google.com/go v0.121.2/go.mod h1:nRFlrHq39MNVWu+zESP2PosMWA0ryJw8KUBZ2iZpxbw=
-cloud.google.com/go/auth v0.16.3 h1:kabzoQ9/bobUmnseYnBO6qQG7q4a/CffFRlJSxv2wCc=
-cloud.google.com/go/auth v0.16.3/go.mod h1:NucRGjaXfzP1ltpcQ7On/VTZ0H4kWB5Jy+Y9Dnm76fA=
+cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI=
+cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
@@ -37,8 +37,8 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute/metadata v0.7.0 h1:PBWF+iiAerVNe8UCHxdOt6eHLVc3ydFeOCw78U8ytSU=
-cloud.google.com/go/compute/metadata v0.7.0/go.mod h1:j5MvL9PprKL39t166CoB1uVHfQMs4tFQZZcKwksXUjo=
+cloud.google.com/go/compute/metadata v0.8.0 h1:HxMRIbao8w17ZX6wBnjhcDkW6lTFpgcaobyVfZWqRLA=
+cloud.google.com/go/compute/metadata v0.8.0/go.mod h1:sYOGTp851OV9bOFJ9CH7elVvyzopvWQFNNghtDQ/Biw=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8=
@@ -76,8 +76,8 @@ filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/4meepo/tagalign v1.4.3 h1:Bnu7jGWwbfpAie2vyl63Zup5KuRv21olsPIha53BJr8=
 github.com/4meepo/tagalign v1.4.3/go.mod h1:00WwRjiuSbrRJnSVeGWPLp2epS5Q/l4UEy0apLLS37c=
-github.com/Abirdcfly/dupword v0.1.6 h1:qeL6u0442RPRe3mcaLcbaCi2/Y/hOcdtw6DE9odjz9c=
-github.com/Abirdcfly/dupword v0.1.6/go.mod h1:s+BFMuL/I4YSiFv29snqyjwzDp4b65W2Kvy+PKzZ6cw=
+github.com/Abirdcfly/dupword v0.1.7 h1:2j8sInznrje4I0CMisSL6ipEBkeJUJAmK1/lfoNGWrQ=
+github.com/Abirdcfly/dupword v0.1.7/go.mod h1:K0DkBeOebJ4VyOICFdppB23Q0YMOgVafM0zYW0n9lF4=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/AdminBenni/iota-mixing v1.0.0 h1:Os6lpjG2dp/AE5fYBPAA1zfa2qMdCAWwPMCgpwKq7wo=
@@ -118,8 +118,8 @@ github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7Oputl
 github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
 github.com/Djarvur/go-err113 v0.1.1 h1:eHfopDqXRwAi+YmCUas75ZE0+hoBHJ2GQNLYRSxao4g=
 github.com/Djarvur/go-err113 v0.1.1/go.mod h1:IaWJdYFLg76t2ihfflPZnM1LIQszWOsFDh2hhhAVF6k=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 h1:ErKg/3iS1AKcTkf3yixlZ54f9U1rljCkQyEXWUnIUxc=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0/go.mod h1:yAZHSGnqScoU556rBOVkwLze6WP5N+U11RHuWaGVxwY=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 h1:UQUsRi8WTzhZntp5313l+CHIAT95ojUI2lpP/ExlZa4=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0/go.mod h1:Cz6ft6Dkn3Et6l2v2a9/RpN7epQ1GtDlO6lj8bEcOvw=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 h1:fYE9p3esPxA/C0rQ0AHhP0drtPXDRhaWiwg1DPqO7IU=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0/go.mod h1:BnBReJLvVYx2CS/UHOgVz2BXKXD9wsQPxZug20nZhd0=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.51.0 h1:OqVGm6Ei3x5+yZmSJG1Mh2NwHvpVmZ08CB5qJhT9Nuk=
@@ -182,10 +182,10 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/ashanbrown/forbidigo/v2 v2.1.0 h1:NAxZrWqNUQiDz19FKScQ/xvwzmij6BiOw3S0+QUQ+Hs=
-github.com/ashanbrown/forbidigo/v2 v2.1.0/go.mod h1:0zZfdNAuZIL7rSComLGthgc/9/n2FqspBOH90xlCHdA=
-github.com/ashanbrown/makezero/v2 v2.0.1 h1:r8GtKetWOgoJ4sLyUx97UTwyt2dO7WkGFHizn/Lo8TY=
-github.com/ashanbrown/makezero/v2 v2.0.1/go.mod h1:kKU4IMxmYW1M4fiEHMb2vc5SFoPzXvgbMR9gIp5pjSw=
+github.com/ashanbrown/forbidigo/v2 v2.3.0 h1:OZZDOchCgsX5gvToVtEBoV2UWbFfI6RKQTir2UZzSxo=
+github.com/ashanbrown/forbidigo/v2 v2.3.0/go.mod h1:5p6VmsG5/1xx3E785W9fouMxIOkvY2rRV9nMdWadd6c=
+github.com/ashanbrown/makezero/v2 v2.1.0 h1:snuKYMbqosNokUKm+R6/+vOPs8yVAi46La7Ck6QYSaE=
+github.com/ashanbrown/makezero/v2 v2.1.0/go.mod h1:aEGT/9q3S8DHeE57C88z2a6xydvgx8J5hgXIGWgo0MY=
 github.com/aws/aws-sdk-go v1.55.5 h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU=
 github.com/aws/aws-sdk-go v1.55.5/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/aws/aws-sdk-go-v2 v1.36.1 h1:iTDl5U6oAhkNPba0e1t1hrwAo02ZMqbrGq4k5JBWM5E=
@@ -276,8 +276,8 @@ github.com/blizzy78/varnamelen v0.8.0 h1:oqSblyuQvFsW1hbBHh1zfwrKe3kcSj0rnXkKzsQ
 github.com/blizzy78/varnamelen v0.8.0/go.mod h1:V9TzQZ4fLJ1DSrjVDfl89H7aMnTvKkApdHeyESmyR7k=
 github.com/bombsimon/wsl/v4 v4.7.0 h1:1Ilm9JBPRczjyUs6hvOPKvd7VL1Q++PL8M0SXBDf+jQ=
 github.com/bombsimon/wsl/v4 v4.7.0/go.mod h1:uV/+6BkffuzSAVYD+yGyld1AChO7/EuLrCF/8xTiapg=
-github.com/bombsimon/wsl/v5 v5.2.0 h1:PyCCwd3Q7abGs3e34IW4jLYlBS+FbsU6iK+Tb3NnDp4=
-github.com/bombsimon/wsl/v5 v5.2.0/go.mod h1:Gp8lD04z27wm3FANIUPZycXp+8huVsn0oxc+n4qfV9I=
+github.com/bombsimon/wsl/v5 v5.3.0 h1:nZWREJFL6U3vgW/B1lfDOigl+tEF6qgs6dGGbFeR0UM=
+github.com/bombsimon/wsl/v5 v5.3.0/go.mod h1:Gp8lD04z27wm3FANIUPZycXp+8huVsn0oxc+n4qfV9I=
 github.com/breml/bidichk v0.3.3 h1:WSM67ztRusf1sMoqH6/c4OBCUlRVTKq+CbSeo0R17sE=
 github.com/breml/bidichk v0.3.3/go.mod h1:ISbsut8OnjB367j5NseXEGGgO/th206dVa427kR8YTE=
 github.com/breml/errchkjson v0.4.1 h1:keFSS8D7A2T0haP9kzZTi7o26r7kE3vymjZNeNDRDwg=
@@ -288,8 +288,8 @@ github.com/butuzov/ireturn v0.4.0 h1:+s76bF/PfeKEdbG8b54aCocxXmi0wvYdOVsWxVO7n8E
 github.com/butuzov/ireturn v0.4.0/go.mod h1:ghI0FrCmap8pDWZwfPisFD1vEc56VKH4NpQUxDHta70=
 github.com/butuzov/mirror v1.3.0 h1:HdWCXzmwlQHdVhwvsfBb2Au0r3HyINry3bDWLYXiKoc=
 github.com/butuzov/mirror v1.3.0/go.mod h1:AEij0Z8YMALaq4yQj9CPPVYOyJQyiexpQEQgihajRfI=
-github.com/catenacyber/perfsprint v0.9.1 h1:5LlTp4RwTooQjJCvGEFV6XksZvWE7wCOUvjD2z0vls0=
-github.com/catenacyber/perfsprint v0.9.1/go.mod h1:q//VWC2fWbcdSLEY1R3l8n0zQCDPdE4IjZwyY1HMunM=
+github.com/catenacyber/perfsprint v0.10.0 h1:AZj1mYyxbxLRqmnYOeguZXEQwWOgQGm2wzLI5d7Hl/0=
+github.com/catenacyber/perfsprint v0.10.0/go.mod h1:DJTGsi/Zufpuus6XPGJyKOTMELe347o6akPvWG9Zcsc=
 github.com/ccojocar/zxcvbn-go v1.0.4 h1:FWnCIRMXPj43ukfX000kvBZvV6raSxakYr1nzyNrUcc=
 github.com/ccojocar/zxcvbn-go v1.0.4/go.mod h1:3GxGX+rHmueTUMvm5ium7irpyjmm7ikxYFOSJB21Das=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
@@ -299,8 +299,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
 github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
-github.com/charithe/durationcheck v0.0.10 h1:wgw73BiocdBDQPik+zcEoBG/ob8uyBHf2iyoHGPf5w4=
-github.com/charithe/durationcheck v0.0.10/go.mod h1:bCWXb7gYRysD1CU3C+u4ceO49LoGOY1C1L6uouGNreQ=
+github.com/charithe/durationcheck v0.0.11 h1:g1/EX1eIiKS57NTWsYtHDZ/APfeXKhye1DidBcABctk=
+github.com/charithe/durationcheck v0.0.11/go.mod h1:x5iZaixRNl8ctbM+3B2RrPG5t856TxRyVQEnbIEM2X4=
 github.com/charmbracelet/colorprofile v0.3.1 h1:k8dTHMd7fgw4bnFd7jXTLZrSU/CQrKnL3m+AxCzDz40=
 github.com/charmbracelet/colorprofile v0.3.1/go.mod h1:/GkGusxNs8VB/RSOh3fu0TJmQ4ICMMPApIIVn0KszZ0=
 github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
@@ -446,16 +446,16 @@ github.com/getkin/kin-openapi v0.132.0 h1:3ISeLMsQzcb5v26yeJrBcdTCEQTag36ZjaGk7M
 github.com/getkin/kin-openapi v0.132.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/ghostiam/protogetter v0.3.16 h1:UkrisuJBYLnZW6FcYUNBDJOqY3X22RtoYMlCsiNlFFA=
-github.com/ghostiam/protogetter v0.3.16/go.mod h1:4SRRIv6PcjkIMpUkRUsP4TsUTqO/N3Fmvwivuc/sCHA=
+github.com/ghostiam/protogetter v0.3.17 h1:sjGPErP9o7i2Ym+z3LsQzBdLCNaqbYy2iJQPxGXg04Q=
+github.com/ghostiam/protogetter v0.3.17/go.mod h1:AivIX1eKA/TcUmzZdzbl+Tb8tjIe8FcyG6JFyemQAH4=
 github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=
 github.com/gkampitakis/ciinfo v0.3.2/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
 github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=
 github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=
 github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=
 github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=
-github.com/go-critic/go-critic v0.13.0 h1:kJzM7wzltQasSUXtYyTl6UaPVySO6GkaR1thFnJ6afY=
-github.com/go-critic/go-critic v0.13.0/go.mod h1:M/YeuJ3vOCQDnP2SU+ZhjgRzwzcBW87JqLpMJLrZDLI=
+github.com/go-critic/go-critic v0.14.2 h1:PMvP5f+LdR8p6B29npvChUXbD1vrNlKDf60NJtgMBOo=
+github.com/go-critic/go-critic v0.14.2/go.mod h1:xwntfW6SYAd7h1OqDzmN6hBX/JxsEKl5up/Y2bsxgVQ=
 github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
 github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
@@ -465,8 +465,8 @@ github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs
 github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
 github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
 github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
@@ -520,8 +520,8 @@ github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
 github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
-github.com/godoc-lint/godoc-lint v0.10.0 h1:OcyrziBi18sQSEpib6NesVHEJ/Xcng97NunePBA48g4=
-github.com/godoc-lint/godoc-lint v0.10.0/go.mod h1:KleLcHu/CGSvkjUH2RvZyoK1MBC7pDQg4NxMYLcBBsw=
+github.com/godoc-lint/godoc-lint v0.10.1 h1:ZPUVzlDtJfA+P688JfPJPkI/SuzcBr/753yGIk5bOPA=
+github.com/godoc-lint/godoc-lint v0.10.1/go.mod h1:KleLcHu/CGSvkjUH2RvZyoK1MBC7pDQg4NxMYLcBBsw=
 github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
 github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
@@ -583,14 +583,12 @@ github.com/golangci/go-printf-func-name v0.1.1 h1:hIYTFJqAGp1iwoIfsNTpoq1xZAarog
 github.com/golangci/go-printf-func-name v0.1.1/go.mod h1:Es64MpWEZbh0UBtTAICOZiB+miW53w/K9Or/4QogJss=
 github.com/golangci/gofmt v0.0.0-20250704145412-3e58ba0443c6 h1:jlKy3uQkETB3zMBK8utduvojT+If2nDAM1pWpEzXjaY=
 github.com/golangci/gofmt v0.0.0-20250704145412-3e58ba0443c6/go.mod h1:OyaRySOXorMn8zJqFku8YsKptIhPkANyKKTMC+rqMCs=
-github.com/golangci/golangci-lint/v2 v2.5.0 h1:BDRg4ASm4J1y/DSRY6zwJ5tr5Yy8ZqbZ79XrCeFxaQo=
-github.com/golangci/golangci-lint/v2 v2.5.0/go.mod h1:IJtWJBZkLbx7AVrIUzLd8Oi3ADtwaNpWbR3wthVWHcc=
+github.com/golangci/golangci-lint/v2 v2.6.1 h1:yTYVG6BJ4eG9QE815BAQDrC2xBbTB8lW11jg+YQ0b1c=
+github.com/golangci/golangci-lint/v2 v2.6.1/go.mod h1:zlg/a5aw46LvRBHZ3OOwwsCtkjWTrn3wm5qowoteCRg=
 github.com/golangci/golines v0.0.0-20250217232252-b35a6149b587 h1:RXtAfHDBWAv49/t94l3j9Iqvy6eXL/nm56EejqrZuQc=
 github.com/golangci/golines v0.0.0-20250217232252-b35a6149b587/go.mod h1:k9mmcyWKSTMcPPvQUCfRWWQ9VHJ1U9Dc0R7kaXAgtnQ=
 github.com/golangci/misspell v0.7.0 h1:4GOHr/T1lTW0hhR4tgaaV1WS/lJ+ncvYCoFKmqJsj0c=
 github.com/golangci/misspell v0.7.0/go.mod h1:WZyyI2P3hxPY2UVHs3cS8YcllAeyfquQcKfdeE9AFVg=
-github.com/golangci/nilerr v0.0.0-20250918000102-015671e622fe h1:F1pK9tBy41i7eesBFkSNMldwtiAaWiU+3fT/24sTnNI=
-github.com/golangci/nilerr v0.0.0-20250918000102-015671e622fe/go.mod h1:CtTxAluxD2ng9aIT9bPrVoMuISFWCD+SaxtvYtdWA2k=
 github.com/golangci/plugin-module-register v0.1.2 h1:e5WM6PO6NIAEcij3B053CohVp3HIYbzSuP53UAYgOpg=
 github.com/golangci/plugin-module-register v0.1.2/go.mod h1:1+QGTsKBvAIvPvoY/os+G5eoqxWn70HYDm2uvUyGuVw=
 github.com/golangci/revgrep v0.8.0 h1:EZBctwbVd0aMeRnNUsFogoyayvKHyxlV3CdUA46FX2s=
@@ -646,8 +644,8 @@ github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20250630185457-6e76a2b096b5 h1:xhMrHhTJ6zxu3gA4enFM9MLn9AY7613teCdFnlUVbSQ=
-github.com/google/pprof v0.0.0-20250630185457-6e76a2b096b5/go.mod h1:5hDyRhoBCxViHszMt12TnOpEI4VVi+U8Gm9iphldiMA=
+github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY=
+github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
@@ -681,6 +679,8 @@ github.com/gostaticanalysis/comment v1.5.0 h1:X82FLl+TswsUMpMh17srGRuKaaXprTaytm
 github.com/gostaticanalysis/comment v1.5.0/go.mod h1:V6eb3gpCv9GNVqb6amXzEUX3jXLVK/AdA+IrAMSqvEc=
 github.com/gostaticanalysis/forcetypeassert v0.2.0 h1:uSnWrrUEYDr86OCxWa4/Tp2jeYDlogZiZHzGkWFefTk=
 github.com/gostaticanalysis/forcetypeassert v0.2.0/go.mod h1:M5iPavzE9pPqWyeiVXSFghQjljW1+l/Uke3PXHS6ILY=
+github.com/gostaticanalysis/nilerr v0.1.2 h1:S6nk8a9N8g062nsx63kUkF6AzbHGw7zzyHMcpu52xQU=
+github.com/gostaticanalysis/nilerr v0.1.2/go.mod h1:A19UHhoY3y8ahoL7YKz6sdjDtduwTSI4CsymaC2htPA=
 github.com/gostaticanalysis/testutil v0.3.1-0.20210208050101-bfb5c8eec0e4/go.mod h1:D+FIZ+7OahH3ePw/izIEeH5I06eKs1IKI4Xr64/Am3M=
 github.com/gostaticanalysis/testutil v0.5.0 h1:Dq4wT1DdTwTGCQQv3rl3IvD5Ld0E6HiY+3Zh0sUGqw8=
 github.com/gostaticanalysis/testutil v0.5.0/go.mod h1:OLQSbuM6zw2EvCcXTz1lVq5unyoNft372msDY0nY5Hs=
@@ -748,8 +748,8 @@ github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/julz/importas v0.2.0 h1:y+MJN/UdL63QbFJHws9BVC5RpA2iq0kpjrFajTGivjQ=
 github.com/julz/importas v0.2.0/go.mod h1:pThlt589EnCYtMnmhmRYY/qn9lCf/frPOK+WMx3xiJY=
-github.com/karamaru-alpha/copyloopvar v1.2.1 h1:wmZaZYIjnJ0b5UoKDjUHrikcV0zuPyyxI4SVplLd2CI=
-github.com/karamaru-alpha/copyloopvar v1.2.1/go.mod h1:nFmMlFNlClC2BPvNaHMdkirmTJxVCY0lhxBtlfOypMM=
+github.com/karamaru-alpha/copyloopvar v1.2.2 h1:yfNQvP9YaGQR7VaWLYcfZUlRP2eo2vhExWKxD/fP6q0=
+github.com/karamaru-alpha/copyloopvar v1.2.2/go.mod h1:oY4rGZqZ879JkJMtX3RRkcXRkmUvH0x35ykgaKgsgJY=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/errcheck v1.9.0 h1:9xt1zI9EBfcYBvdU1nVrzMzzUPUtPKs9bVSIM3TAb3M=
 github.com/kisielk/errcheck v1.9.0/go.mod h1:kQxWMMVZgIkDq7U8xtG/n2juOjbLgZtedi0D+/VL/i8=
@@ -772,8 +772,8 @@ github.com/kubernetes-sigs/reference-docs/genref v0.28.0 h1:bJwEH8owjdLFK8q11A+E
 github.com/kubernetes-sigs/reference-docs/genref v0.28.0/go.mod h1:qzjorDM+q2M7QGyiviy5/LRocNn0Dza4Q05tqJ6WG+Y=
 github.com/kulti/thelper v0.7.1 h1:fI8QITAoFVLx+y+vSyuLBP+rcVIB8jKooNSCT2EiI98=
 github.com/kulti/thelper v0.7.1/go.mod h1:NsMjfQEy6sd+9Kfw8kCP61W1I0nerGSYSFnGaxQkcbs=
-github.com/kunwardeep/paralleltest v1.0.14 h1:wAkMoMeGX/kGfhQBPODT/BL8XhK23ol/nuQ3SwFaUw8=
-github.com/kunwardeep/paralleltest v1.0.14/go.mod h1:di4moFqtfz3ToSKxhNjhOZL+696QtJGCFe132CbBLGk=
+github.com/kunwardeep/paralleltest v1.0.15 h1:ZMk4Qt306tHIgKISHWFJAO1IDQJLc6uDyJMLyncOb6w=
+github.com/kunwardeep/paralleltest v1.0.15/go.mod h1:di4moFqtfz3ToSKxhNjhOZL+696QtJGCFe132CbBLGk=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/kyokomi/emoji/v2 v2.2.13 h1:GhTfQa67venUUvmleTNFnb+bi7S3aocF7ZCXU9fSO7U=
@@ -784,10 +784,10 @@ github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 h1:P6pPBnrTSX3DEVR4fDembhR
 github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0/go.mod h1:vmVJ0l/dxyfGW6FmdpVm2joNMFikkuWg0EoCKLGUMNw=
 github.com/lasiar/canonicalheader v1.1.2 h1:vZ5uqwvDbyJCnMhmFYimgMZnJMjwljN5VGY0VKbMXb4=
 github.com/lasiar/canonicalheader v1.1.2/go.mod h1:qJCeLFS0G/QlLQ506T+Fk/fWMa2VmBUiEI2cuMK4djI=
-github.com/ldez/exptostd v0.4.4 h1:58AtQjnLcT/tI5W/1KU7xE/O7zW9RAWB6c/ScQAnfus=
-github.com/ldez/exptostd v0.4.4/go.mod h1:QfdzPw6oHjFVdNV7ILoPu5sw3OZ3OG1JS0I5JN3J4Js=
-github.com/ldez/gomoddirectives v0.7.0 h1:EOx8Dd56BZYSez11LVgdj025lKwlP0/E5OLSl9HDwsY=
-github.com/ldez/gomoddirectives v0.7.0/go.mod h1:wR4v8MN9J8kcwvrkzrx6sC9xe9Cp68gWYCsda5xvyGc=
+github.com/ldez/exptostd v0.4.5 h1:kv2ZGUVI6VwRfp/+bcQ6Nbx0ghFWcGIKInkG/oFn1aQ=
+github.com/ldez/exptostd v0.4.5/go.mod h1:QRjHRMXJrCTIm9WxVNH6VW7oN7KrGSht69bIRwvdFsM=
+github.com/ldez/gomoddirectives v0.7.1 h1:FaULkvUIG36hj6chpwa+FdCNGZBsD7/fO+p7CCsM6pE=
+github.com/ldez/gomoddirectives v0.7.1/go.mod h1:auDNtakWJR1rC+YX7ar+HmveqXATBAyEK1KYpsIRW/8=
 github.com/ldez/grignotin v0.10.1 h1:keYi9rYsgbvqAZGI1liek5c+jv9UUjbvdj3Tbn5fn4o=
 github.com/ldez/grignotin v0.10.1/go.mod h1:UlDbXFCARrXbWGNGP3S5vsysNXAPhnSuBufpTEbwOas=
 github.com/ldez/tagliatelle v0.7.2 h1:KuOlL70/fu9paxuxbeqlicJnCspCRjH0x8FW+NfgYUk=
@@ -899,8 +899,8 @@ github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm
 github.com/nishanths/predeclared v0.2.2/go.mod h1:RROzoN6TnGQupbC+lqggsOlcgysk3LMK/HI84Mp280c=
 github.com/norwoodj/helm-docs v1.14.2 h1:Ew3bCq1hZqMnnTopkk66Uy2mGwu/jAclAx+3JAVp1To=
 github.com/norwoodj/helm-docs v1.14.2/go.mod h1:qdo76rorOkPDme8nsV5e0JBAYrs56kzvZMYW83k1kgc=
-github.com/nunnatsa/ginkgolinter v0.21.0 h1:IYwuX+ajy3G1MezlMLB1BENRtFj16+Evyi4uki1NOOQ=
-github.com/nunnatsa/ginkgolinter v0.21.0/go.mod h1:QlzY9UP9zaqu58FjYxhp9bnjuwXwG1bfW5rid9ChNMw=
+github.com/nunnatsa/ginkgolinter v0.21.2 h1:khzWfm2/Br8ZemX8QM1pl72LwM+rMeW6VUbQ4rzh0Po=
+github.com/nunnatsa/ginkgolinter v0.21.2/go.mod h1:GItSI5fw7mCGLPmkvGYrr1kEetZe7B593jcyOpyabsY=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY=
@@ -970,10 +970,10 @@ github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2
 github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
 github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
 github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
-github.com/quasilyte/go-ruleguard v0.4.4 h1:53DncefIeLX3qEpjzlS1lyUmQoUEeOWPFWqaTJq9eAQ=
-github.com/quasilyte/go-ruleguard v0.4.4/go.mod h1:Vl05zJ538vcEEwu16V/Hdu7IYZWyKSwIy4c88Ro1kRE=
-github.com/quasilyte/go-ruleguard/dsl v0.3.22 h1:wd8zkOhSNr+I+8Qeciml08ivDt1pSXe60+5DqOpCjPE=
-github.com/quasilyte/go-ruleguard/dsl v0.3.22/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
+github.com/quasilyte/go-ruleguard v0.4.5 h1:AGY0tiOT5hJX9BTdx/xBdoCubQUAE2grkqY2lSwvZcA=
+github.com/quasilyte/go-ruleguard v0.4.5/go.mod h1:Vl05zJ538vcEEwu16V/Hdu7IYZWyKSwIy4c88Ro1kRE=
+github.com/quasilyte/go-ruleguard/dsl v0.3.23 h1:lxjt5B6ZCiBeeNO8/oQsegE6fLeCzuMRoVWSkXC4uvY=
+github.com/quasilyte/go-ruleguard/dsl v0.3.23/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
 github.com/quasilyte/gogrep v0.5.0 h1:eTKODPXbI8ffJMN+W2aE0+oL0z/nh8/5eNdiO34SOAo=
 github.com/quasilyte/gogrep v0.5.0/go.mod h1:Cm9lpz9NZjEoL1tgZ2OgeUKPIxL1meE7eo60Z6Sk+Ng=
 github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 h1:TCg2WBOl980XxGFEZSS6KlBGIV0diGdySzxATTWoqaU=
@@ -1017,8 +1017,8 @@ github.com/sashamelentyev/interfacebloat v1.1.0 h1:xdRdJp0irL086OyW1H/RTZTr1h/tM
 github.com/sashamelentyev/interfacebloat v1.1.0/go.mod h1:+Y9yU5YdTkrNvoX0xHc84dxiN1iBi9+G8zZIhPVoNjQ=
 github.com/sashamelentyev/usestdlibvars v1.29.0 h1:8J0MoRrw4/NAXtjQqTHrbW9NN+3iMf7Knkq057v4XOQ=
 github.com/sashamelentyev/usestdlibvars v1.29.0/go.mod h1:8PpnjHMk5VdeWlVb4wCdrB8PNbLqZ3wBZTZWkrpZZL8=
-github.com/securego/gosec/v2 v2.22.8 h1:3NMpmfXO8wAVFZPNsd3EscOTa32Jyo6FLLlW53bexMI=
-github.com/securego/gosec/v2 v2.22.8/go.mod h1:ZAw8K2ikuH9qDlfdV87JmNghnVfKB1XC7+TVzk6Utto=
+github.com/securego/gosec/v2 v2.22.10 h1:ntbBqdWXnu46DUOXn+R2SvPo3PiJCDugTCgTW2g4tQg=
+github.com/securego/gosec/v2 v2.22.10/go.mod h1:9UNjK3tLpv/w2b0+7r82byV43wCJDNtEDQMeS+H/g2w=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
@@ -1160,10 +1160,10 @@ go-simpler.org/musttag v0.14.0 h1:XGySZATqQYSEV3/YTy+iX+aofbZZllJaqwFWs+RTtSo=
 go-simpler.org/musttag v0.14.0/go.mod h1:uP8EymctQjJ4Z1kUnjX0u2l60WfUdQxCwSNKzE1JEOE=
 go-simpler.org/sloglint v0.11.1 h1:xRbPepLT/MHPTCA6TS/wNfZrDzkGvCCqUv4Bdwc3H7s=
 go-simpler.org/sloglint v0.11.1/go.mod h1:2PowwiCOK8mjiF+0KGifVOT8ZsCNiFzvfyJeJOIt8MQ=
-go.augendre.info/arangolint v0.2.0 h1:2NP/XudpPmfBhQKX4rMk+zDYIj//qbt4hfZmSSTcpj8=
-go.augendre.info/arangolint v0.2.0/go.mod h1:Vx4KSJwu48tkE+8uxuf0cbBnAPgnt8O1KWiT7bljq7w=
-go.augendre.info/fatcontext v0.8.1 h1:/T4+cCjpL9g71gJpcFAgVo/K5VFpqlN+NPU7QXxD5+A=
-go.augendre.info/fatcontext v0.8.1/go.mod h1:r3Qz4ZOzex66wfyyj5VZ1xUcl81vzvHQ6/GWzzlMEwA=
+go.augendre.info/arangolint v0.3.1 h1:n2E6p8f+zfXSFLa2e2WqFPp4bfvcuRdd50y6cT65pSo=
+go.augendre.info/arangolint v0.3.1/go.mod h1:6ZKzEzIZuBQwoSvlKT+qpUfIbBfFCE5gbAoTg0/117g=
+go.augendre.info/fatcontext v0.9.0 h1:Gt5jGD4Zcj8CDMVzjOJITlSb9cEch54hjRRlN3qDojE=
+go.augendre.info/fatcontext v0.9.0/go.mod h1:L94brOAT1OOUNue6ph/2HnwxoNlds9aXDF2FcUntbNw=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -1212,12 +1212,12 @@ go.opentelemetry.io/otel/log v0.8.0 h1:egZ8vV5atrUWUbnSsHn6vB8R21G2wrKqNiDt3iWer
 go.opentelemetry.io/otel/log v0.8.0/go.mod h1:M9qvDdUTRCopJcGRKg57+JSQ9LgLBrwwfC32epk5NX8=
 go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
 go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
-go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
-go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
 go.opentelemetry.io/otel/sdk/log v0.8.0 h1:zg7GUYXqxk1jnGF/dTdLPrK06xJdrXgqgFLnI4Crxvs=
 go.opentelemetry.io/otel/sdk/log v0.8.0/go.mod h1:50iXr0UVwQrYS45KbruFrEt4LvAdCaWWgIrsN3ZQggo=
-go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
-go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
 go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
 go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
 go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
@@ -1266,8 +1266,8 @@ golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 h1:e66Fs6Z+fZTbFBAxKfP3PALWB
 golang.org/x/exp v0.0.0-20240909161429-701f63a606c0/go.mod h1:2TbTHSBQa924w8M6Xs1QcRcFwyucIwBGpK1p2f1YFFY=
 golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
-golang.org/x/exp/typeparams v0.0.0-20250911091902-df9299821621 h1:Yl4H5w2RV7L/dvSHp2GerziT5K2CORgFINPaMFxWGWw=
-golang.org/x/exp/typeparams v0.0.0-20250911091902-df9299821621/go.mod h1:4Mzdyp/6jzw9auFDJ3OMF5qksa7UvPnzKqTVGcb04ms=
+golang.org/x/exp/typeparams v0.0.0-20251023183803-a4bb9ffd2546 h1:HDjDiATsGqvuqvkDvgJjD1IgPrVekcSXVVE21JwvzGE=
+golang.org/x/exp/typeparams v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:4Mzdyp/6jzw9auFDJ3OMF5qksa7UvPnzKqTVGcb04ms=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/image v0.0.0-20210220032944-ac19c3e999fb/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -1301,8 +1301,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.28.0 h1:gQBtGhjxykdjY9YhZpSlZIsbnaE2+PgjfLWUQTnoZ1U=
-golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1519,8 +1519,8 @@ golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
 golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
-golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE=
-golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
@@ -1531,6 +1531,8 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9 h1:LLhsEBxRTBLuKlQxFBYUOU8xyFgXv6cOTp2HASDlsDk=
 golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
 google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
@@ -1597,10 +1599,10 @@ google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
-google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY=
-google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250728155136-f173205681a0 h1:MAKi5q709QWfnkkpNQ0M12hYJ1+e8qYVDyowc4U1XZM=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250728155136-f173205681a0/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 h1:FiusG7LWj+4byqhbvmB+Q93B/mOxJLN2DTozDuZm4EU=
+google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:kXqgZtrWaf6qS3jZOCnCH7WYfrvFjkC51bM8fz3RsCA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c h1:qXWI/sQtv5UKboZ/zUk7h+mrf/lXORyI+n9DKDAusdg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1617,8 +1619,8 @@ google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
 google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
-google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1629,8 +1631,8 @@ google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
-google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -1720,10 +1722,10 @@ k8s.io/metrics v0.34.1 h1:374Rexmp1xxgRt64Bi0TsjAM8cA/Y8skwCoPdjtIslE=
 k8s.io/metrics v0.34.1/go.mod h1:Drf5kPfk2NJrlpcNdSiAAHn/7Y9KqxpRNagByM7Ei80=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-mvdan.cc/gofumpt v0.9.1 h1:p5YT2NfFWsYyTieYgwcQ8aKV3xRvFH4uuN/zB2gBbMQ=
-mvdan.cc/gofumpt v0.9.1/go.mod h1:3xYtNemnKiXaTh6R4VtlqDATFwBbdXI8lJvH/4qk7mw=
-mvdan.cc/unparam v0.0.0-20250301125049-0df0534333a4 h1:WjUu4yQoT5BHT1w8Zu56SP8367OuBV5jvo+4Ulppyf8=
-mvdan.cc/unparam v0.0.0-20250301125049-0df0534333a4/go.mod h1:rthT7OuvRbaGcd5ginj6dA2oLE7YNlta9qhBNNdCaLE=
+mvdan.cc/gofumpt v0.9.2 h1:zsEMWL8SVKGHNztrx6uZrXdp7AX8r421Vvp23sz7ik4=
+mvdan.cc/gofumpt v0.9.2/go.mod h1:iB7Hn+ai8lPvofHd9ZFGVg2GOr8sBUw1QUWjNbmIL/s=
+mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 h1:ssMzja7PDPJV8FStj7hq9IKiuiKhgz9ErWw+m68e7DI=
+mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15/go.mod h1:4M5MMXl2kW6fivUT6yRGpLLPNfuGtU2Z0cPvFquGDYU=
 oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
 oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
diff --git a/hack/internal/tools/yaml-processor/yamlproc/processor.go b/hack/internal/tools/yaml-processor/yamlproc/processor.go
index 2e8e180cc..1d43f662e 100644
--- a/hack/internal/tools/yaml-processor/yamlproc/processor.go
+++ b/hack/internal/tools/yaml-processor/yamlproc/processor.go
@@ -185,7 +185,7 @@ func (fp *FileProcessor) ProcessFile(fileOps FileOperations, options ProcessingP
 
 	outputPath := filepath.Join(fileOps.OutputDir, filepath.Base(fileOps.Path))
 
-	prefix := []byte(fmt.Sprintf("{{/* Code generated by %s. DO NOT EDIT. */}}\n\n", filepath.Base(os.Args[0])))
+	prefix := fmt.Appendf(nil, "{{/* Code generated by %s. DO NOT EDIT. */}}\n\n", filepath.Base(os.Args[0]))
 
 	if options.BoilerplatePath != "" {
 		boilerplate, err := loadBoilerplate(options.BoilerplatePath)
diff --git a/keps/6757-failure-recovery/README.md b/keps/6757-failure-recovery/README.md
new file mode 100644
index 000000000..cac2ba83a
--- /dev/null
+++ b/keps/6757-failure-recovery/README.md
@@ -0,0 +1,412 @@
+# KEP-6757: Failure Recovery
+
+<!-- toc -->
+- [Summary](#summary)
+- [Motivation](#motivation)
+  - [Goals](#goals)
+  - [Non-Goals](#non-goals)
+- [Proposal](#proposal)
+  - [User Stories (Optional)](#user-stories-optional)
+    - [Story 1](#story-1)
+  - [Risks and Mitigations](#risks-and-mitigations)
+    - [Replacing Pods Which Are Still Running](#replacing-pods-which-are-still-running)
+- [Design Details](#design-details)
+  - [Affected Pods](#affected-pods)
+  - [Grace Period](#grace-period)
+  - [Observability](#observability)
+  - [Implementation Overview](#implementation-overview)
+  - [Test Plan](#test-plan)
+    - [Unit Tests](#unit-tests)
+    - [Integration Tests](#integration-tests)
+  - [Graduation Criteria](#graduation-criteria)
+    - [Alpha](#alpha)
+  - [Beta](#beta)
+- [Implementation History](#implementation-history)
+- [Drawbacks](#drawbacks)
+- [Alternatives](#alternatives)
+  - [Do Nothing](#do-nothing)
+  - [Control All Pods Managed By Kueue](#control-all-pods-managed-by-kueue)
+  - [Introduce a <code>FailureRecoveryPolicy</code> API](#introduce-a-failurerecoverypolicy-api)
+  - [Leveraging Core Kubernetes Non-Graceful Node Shutdown Handling](#leveraging-core-kubernetes-non-graceful-node-shutdown-handling)
+<!-- /toc -->
+
+## Summary
+
+This KEP introduces an opt-in mechanism of timeout-based graceful handling of zombie pods,
+i.e. pods that are stuck in the `Pending`/`Running` state due to a node-level failure.
+
+## Motivation
+
+Currently, a network partition or a malfunction of the `kubelet` (or a more general node failure) results in the pods running on that node to become stuck.
+When the `kubelet` fails to send its regular heartbeat to the control plane within `node-monitor-grace-period`, the node is deemed unhealthy and is assigned the `node.kubernetes.io/unreachable` taint. By default, Kubernetes [automatically adds a 5-minute toleration](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/#taint-based-evictions) for pods running in the affected node (this can be explicitly set by a different value by the user/controller).
+If the heartbeat is resumed within this toleration period, the control plane removes the taints and the pods continue running.
+On the other hand, if it is not resumed, then the pods are marked for termination (i.e. their `deletionTimestamp` is set in `etcd`).
+
+The complete flow of pod termination in this case is as follows:
+1. `node-a` stops sending a heartbeat to the control plane.
+1. **After `node-monitor-grace-period` elapses ([50 seconds by default](https://kubernetes.io/docs/reference/node/node-status/#condition))**, the `node.kubernetes.io/unreachable` taint is added to `node-a`.
+1. A toleration ([5 minutes by default](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/#taint-based-evictions)) for the `node.kubernetes.io/unreachable` is added to pods running on `node-a`.
+1. **After the toleration time elapses**, the control plane marks the pods for termination by setting their `deletionTimestamp`
+and `deletionGracePeriodSeconds` ([30 seconds by default](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination-flow)).
+1. **After the deletion grace period elapses**, the `kubelet` should send the `SIGKILL` signal to the pods to terminate them and set their phase accordingly.
+Regardless of whether this happens or not, the control plane will not see this update because of the lack of communication with the `kubelet`.
+1. The pod remains in a `Terminating` state.
+
+The pod can also become "stuck" if the loss of communication occurs **after** the pod was marked for termination:
+
+1. `pod-a` running on `node-a` is marked for termination. Its `deletionTimestamp` and `deletionGracePeriodSeconds` are set.
+1. `node-a` stops sending a heartbeat to the control plane.
+1. **After the deletion grace period elapses**, the `kubelet` should send the `SIGKILL` signal to the pods to terminate them and set their phase accordingly.
+Regardless of whether this happens or not, the control plane will not see this update because of the lack of communication with the `kubelet`.
+1. The pod remains in a `Terminating` state.
+
+Without a functioning `kubelet`, the pods have no way of progressing beyond that point on their own.
+Such pods, colloquially called "zombie pods", remain terminating until the node is healed or they are manually removed.
+This is a crucial safety measure, as in that scenario the control plane has no way to confirm that the pods actually stopped
+and released all their resources. It is especially relevant for stateful applications and might result in data corruption.
+For example, the stuck pod might still be writing to a `PersistentVolume` when a replacement is started
+(which is likely in the case of network partitions, where the node is functioning correctly, just unable to communicate with the control plane).
+
+Nevertheless, it became clear that in some cases having a mechanism that would unblock replacement pods from starting would be beneficial.
+In particular, `Job`-based `Workload`s with `podReplacementPolicy: Failed` are unable to make progress when this issue occurs and require manual administration intervention.
+
+### Goals
+
+* Maximize the quota usage for `Workload`s by recovering from a common failure pattern that:
+  * Prevents `Job`s using `podReplacementPolicy: Failed` from making progress.
+
+### Non-Goals
+
+* Detecting whether a zombie pod was terminated properly and released all it's resources.
+
+## Proposal
+
+* Introduce a controller that moves zombie `Pod`s into the `Failed` phase.
+  * The controller is enabled via a feature gate.
+* Introduce a `kueue.x-k8s.io/safe-to-forcefully-terminate` annotation that limits which pods are affected by the new controller.
+
+### User Stories (Optional)
+
+#### Story 1
+
+I'm a user running a distributed Machine Learning workload based on `Job`.
+I set `podReplacementPolicy: Failed` to prevent duplicate task registration errors during node drains or preemptions,
+as my framework expects exactly one pod per worker index.
+
+Some nodes in my cluster often go offline for long periods of time, during which my job is unable to make progress -
+replacement pods will not be scheduled as long as the node remains offline. I'd like for my jobs to be automatically unblocked
+as soon as possible, so I can make best use of the available resources (since the training process is synchronized,
+there is no risk of data corruption in my case).
+
+### Risks and Mitigations
+
+#### Replacing Pods Which Are Still Running
+
+Starting a replacement pod without a guarantee that the original one was properly terminated carries an inherent risk
+and might result in inconsistencies, as discussed above.
+If this risk is not communicated to the user properly and the feature is not sufficiently explicit in its behavior,
+the users might mistake it for a general issue within Kueue/the broader Kubernetes ecosystem.
+
+As this risk stems from the behavior of the `kubelet` and control plane themselves, it cannot be fully mitigated without major changes in how Kubernetes operates.
+Instead, it should be adequately documented to prevent users without a compatible use-case from using it.
+Moreover, enabling this feature should require opt-in both from:
+1. The Administrator - by enabling the feature globally.
+2. The User - by opting specific workloads into the failure recovery mechanism.
+
+Controlling the covered workloads, instead of applying the recovery globally, will guarantee that only pods that were deemed "safe to forcefully terminate" are affected.
+
+## Design Details
+
+### Affected Pods
+
+In order to allow the first adopters to control which pods are affected by the new controller, a new `Pod` annotation will be introduced:
+```yaml
+kueue.x-k8s.io/safe-to-forcefully-terminate: "true"
+```
+
+Only pods containing the new annotation will be affected by the controller, for example:
+```yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  generateName: sample-job-
+  namespace: default
+  labels:
+    kueue.x-k8s.io/queue-name: user-queue
+spec:
+  parallelism: 3
+  completions: 3
+  podReplacementPolicy: Failed
+  template:
+    metadata:
+      annotations:
+        kueue.x-k8s.io/safe-to-forcefully-terminate: "true"  // <- new annotation
+    spec:
+      containers:
+      - name: dummy-job
+        image: registry.k8s.io/e2e-test-images/agnhost:2.53
+        command: [ "/bin/sh" ]
+        args: [ "-c", "sleep 600" ]
+        resources:
+          requests:
+            cpu: "1"
+            memory: "200Mi"
+      restartPolicy: Never
+```
+
+> The controller is not limited to pods managed by Kueue (i.e. having the `kueue.x-k8s.io/managed` or `kueue.x-k8s.io/podset` label). All pods in the cluster that have the new annotation will be affected.
+
+### Grace Period
+
+When a pod is marked for termination, it's assigned with a `deletionGracePeriodSeconds`.
+This grace period defines the amount of time the pod has to terminate gracefully.
+This KEP defines "pods stuck terminating" as pods that were not terminated **1 minute** after the `deletionGracePeriodSeconds` elapsed.
+The value of 1 minute is chosen to get initial feedback about the feature and help inform the decision on the structure of the API and setting defaults makes sense when graduating to beta.
+
+### Observability
+
+Since this feature relies on interplay with existing Kubernetes mechanism, it should be possible for users to trace
+pod terminations back to the new controller. This will allow for easier troubleshooting and attribution, which is crucial
+when gathering initial user feedback.
+
+To address that, a new `ForcefullyTerminated` `PodCondition` object will be assigned to the pod when it is terminated by the new controller.
+
+```yaml
+apiVersion: v1
+kind: Pod
+spec:
+  # ...
+  terminationGracePeriodSeconds: 30
+status:
+  conditions:
+  # grace period = `terminationGracePeriodSeconds` + 60s (default threshold in the KEP)
+  - message: 'Pod forcefully terminated after 90s grace period due to unreachable node `node-a` (triggered by `kueue.x-k8s.io/safe-to-forcefully-terminate annotation`)'
+    reason: KueueForcefullyTerminated
+    status: "True"
+    type: KueueFailureRecovery
+    # ...
+```
+
+Additionally, an analogous `Warning` event will be emitted for the affected pod:
+
+```yaml
+apiVersion: v1
+kind: Event
+type: Warning
+involvedObject:
+  apiVersion: v1
+  kind: Pod
+  name: pod-a
+  namespace: default
+message: 'Pod forcefully terminated after 90s grace period due to unreachable node `node-a` (triggered by `kueue.x-k8s.io/safe-to-forcefully-terminate annotation`)'
+reason: KueueForcefullyTerminated
+reportingComponent: pod-termination-controller
+source:
+  component: pod-termination-controller
+```
+
+### Implementation Overview
+
+Enabling the `FailureRecoveryPolicy` feature gate will turn on a controller, which manages the failed nodes.
+
+The controller has to **ignore** updates to pods that:
+1. Are not terminating.
+    * `pod.DeletionTimestamp == nil`
+1. Are in a terminal phase.
+    * `pod.Status.Phase != corev1.PodRunning && pod.Status.Phase != corev1.PodPending`
+1. Are not annotated with the new `kueue.x-k8s.io/safe-to-forcefully-terminate` annotation.
+1. Are **not** scheduled on a node tainted with `node.kubernetes.io/unreachable`.
+    * This explicitly ignores pods assigned to nodes that still have a running kubelet.
+    For example, nodes with the `node.kubernetes.io/not-ready` taint experiencing resource pressure
+    that makes pod termination take longer.
+
+For relevant (not ignored) terminating pods, the reconciliation behaves in the following way:
+1. It computes the amount of time elapsed since the the pod's `gracefulTerminationGracePeriod` elapsed:
+    1. If it's below the default timeout of **1 minute**, the reconciler will requeue the object to be re-evaluated once the thershold is reached.
+    1. Otherwise, if the threshold of **1 minute** was reached, the pod will be deemed "zombie" and transitioned into the `PodFailed` phase.
+
+### Test Plan
+
+[x] I/we understand the owners of the involved components may require updates to
+existing tests to make this code solid enough prior to committing the changes necessary
+to implement this enhancement.
+
+#### Unit Tests
+
+The proposal will be covered with unit tests for:
+1. Configuration parsing.
+1. Controller behavior:
+    1. Whether it ignores irrelevant pods (not terminating, already failed/succeeded, not annotated).
+    1. Whether it correctly schedules a reconciliation for when the grace period elapses.
+    1. Whether it updates the pod's phase to `Failed` after the grace period elapses.
+
+#### Integration Tests
+
+The proposal will be covered with integrations tests that check whether:
+1. Adding a deletion timestamp to the pod requeues a reconciliation loop for when the grace period elapses.
+1. After the grace period elapses, the pod is marked as `Failed`.
+1. Replacement pods are scheduled in the place of the failed pod (optional, technically 1+2 is sufficient to prove this).
+
+Existing integration tests should prove that this feature does not impact Kueue during normal operation.
+
+### Graduation Criteria
+
+#### Alpha
+
+- Feature gate disabled by default.
+- Positive feedback from the users.
+
+### Beta
+
+- Feature gate enabled by default.
+- Re-evaluate the introduction of the `FailureRecoveryPolicy` API.
+
+## Implementation History
+
+2025-09-08: The [issue](https://github.com/kubernetes-sigs/kueue/issues/6757) is raised in Kueue.
+
+2025-09-12: The [issue](https://github.com/kubernetes/kubernetes/issues/134038) is raised in core Kubernetes.
+
+2025-10-17: First draft of the KEP.
+
+## Drawbacks
+
+* The same feature is discussed in core Kubernetes ([kubernetes/issues/134038](https://github.com/kubernetes/kubernetes/issues/134038)), so the underlying issue could potentially be fixed upstream. The timeline of an upstream change is long, but if the feature is deemed not time-critical, it could be fixed at the source instead of in Kueue.
+* This feature introduces a potential footgun to Kueue users and could turn out to be to volatile/risky to use in most affected cases.
+* It introduces yet another responsibility for Kueue - on top of quota management and scheduling, it will also start performing failure recovery.
+
+## Alternatives
+
+### Do Nothing
+
+Since this feature spawned a lengthy discussion about its riskiness and there are other controllers in the ecosystem which deal with
+node problem remediation (e.g. [medik8s](https://github.com/medik8s/self-node-remediation)), an alternative would be to do nothing,
+wait for the upstream conversations to be resolved and propose an alternative solution (external to Kueue) to the affected users.
+
+The biggest benefit of this approach is that it requires no implementation effort.
+
+**Reasons for discarding/deferring**
+
+1. Forces users to run another system alongside Kueue, making deploying Kueue more complex those cases.
+
+### Control All Pods Managed By Kueue
+
+Instead of limiting the affected pods with the new annotation, the controlled could cover all pods managed by Kueue.
+
+**Reasons for discarding/deferring**
+
+1. It will make the feature harder to test for the early adopters, since they would have to commit all the pods to test
+an alpha feature.
+
+### Introduce a `FailureRecoveryPolicy` API
+
+The `Configuration` struct could be extended to add `FailureRecoveryPolicy`:
+
+```go
+type Configuration struct {
+  // ...
+
+  // FailureRecoveryPolicy is used to enable automatic failure recovery mechanisms.
+  // +optional
+  FailureRecoveryPolicy *FailureRecoveryPolicy `json:"failureRecoveryPolicy,omitempty"`
+}
+
+type FailureRecoveryPolicy struct {
+  // Rules specifies the rules to be enabled for failure recovery.
+  // Exactly one rule can be specified. We keep the API flexible to accommodate
+  // setting more rules in the future.
+  Rules []FailureRecoveryRule `json:"rules"`
+}
+
+type FailureRecoveryRule struct {
+  // Exactly one of the fields below must be specified.
+
+  // TerminatePod enables and contains configuration for the `TerminatePod` strategy.
+  // This strategy recovers stuck pods by forcefully terminating them after a configured
+  // grace period elapses.
+  // Currently specifying the field is required. We keep the API flexible to allow
+  // introducing other rule actions in the future.
+  // +optional
+  TerminatePod *TerminatePodConfig `json:"terminatePod,omitempty"`
+}
+
+type TerminatePodConfig struct {
+  // PodLabelSelector specifies the scope of resources covered by `TerminatePod` failure recovery -
+  // resources not matching the selector are ignored by the controller.
+  PodLabelSelector metav1.LabelSelector `json:"podLabelSelector"`
+
+  // ForcefulTerminationGracePeriod is the duration between when the pod's `deletionGracePeriodSeconds`
+  // elapses and when the pod should be forcefully terminated.
+  // Represented using metav1.Duration (e.g. "10m", "1h30m").
+  ForcefulTerminationGracePeriod metav1.Duration `json:"forcefulTerminationGracePeriod"`
+}
+```
+
+This API requires opt-in both from the administrators and user's end, as the workloads would
+have to be labeled in order for them to be covered with failure recovery.
+
+An example failure recovery configuration:
+
+```yaml
+failureRecoveryPolicy:
+  rules:
+  - terminatePod:
+      podLabelSelector:
+        matchExpressions:
+        - key: example.com/pod-safe-to-fail
+          operator: In
+          values: [ "true" ]
+      forcefulTerminationGracePeriod: 5m
+```
+
+With the new API, the proposal is to **not** set a default value for the forceful termination grace period.
+This puts configuration over convention, as it will make the user consciously think about the
+grace period the need for their specific use case, without risking a faulty default.
+
+Since enabling the feature is inherently risky, this serves as an additional explicit
+acknowledgement of this risk from the user's end.
+
+Alternatively, a default value can be inferred from the `terminationGracePeriodSeconds`.
+For example, it could be a multiple of that value. Nevertheless, this still runs the risk of
+setting a very small value or even 0, depending on the user's configuration.
+
+**Reasons for discarding/deferring**
+
+1. `FailureRecoveryPolicy` would have to be added to the **beta** `Configuration` API.
+To avoid committing to a specific structure (and the feature in general), it is more prudent to gather initial feedback
+with a feature gate first, then decide how to best represent it in the API.
+1. As mentioned in the [Do Nothing](#do-nothing) alternative, the issue this KEP is trying to mitigate might be solved at the core Kubernetes level. If so, deprecating an annotation (proposed in the KEP) is simpler than deprecating an API.
+
+### Leveraging Core Kubernetes Non-Graceful Node Shutdown Handling
+
+Core Kubernetes already contains logic for [non-graceful node shutdown handling](https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/#non-graceful-node-shutdown) and [automatic garbage collection](https://github.com/kubernetes/kubernetes/blob/4870d987d0a4aac2d9223d4c0b9f22858c0d1590/pkg/controller/podgc/gc_controller.go) of `Pod`s running on such nodes (tainted with the `node.kubernetes.io/out-of-service` taint).
+It updates the `Pod`s status and deletes it from `etcd`. The recovery controller could use this fact to terminate stuck pods by automatically adding this taint to nodes which are unreachable for some configurable time.
+
+Given the API proposal, this approach could potentially be implemented as an alternative
+ recovery strategy in the future (see [Introduce a <code>FailureRecoveryPolicy</code> API](#introduce-a-failurerecoverypolicy-api)).
+
+ ```go
+ type FailureRecoveryRule struct {
+  // ...
+
+  // TaintNodeOutOfServiceConfig enables and contains configuration for the `TaintNodeOutOfService` strategy.
+  // This strategy recovers stuck pods by tainting an unreachable node with the `out-of-service` taint, allowing
+  // the pod garbage-collector to terminate the pods scheduled on that node.
+  // +optional
+  TaintNodeOutOfServiceConfig *TaintNodeOutOfServiceConfig `json:"taintNodeOutOfServiceConfig,omitempty"`
+}
+
+type TaintNodeOutOfServiceConfig struct {
+  UnreachableNodeTimeout *time.Duration `json:"unreachableNodeTimeout"`
+}
+ ```
+
+Compared to the final proposal, this approach has the following benefits:
+
+1. It uses an existing Kubernetes mechanism.
+2. Concerns are tidily separated - the recovery controller simply says the node is out of service, the garbage collector in the control plane can decide how and when to clean it up.
+
+
+**Reasons for discarding/deferring**
+
+1. The effect would be node-wide pod deletion, regardless of whether they were managed by Kueue or not, breaking any guarantees of isolation.
diff --git a/keps/6757-failure-recovery/kep.yaml b/keps/6757-failure-recovery/kep.yaml
new file mode 100644
index 000000000..a3ac1ac72
--- /dev/null
+++ b/keps/6757-failure-recovery/kep.yaml
@@ -0,0 +1,34 @@
+title: Failure Recovery
+kep-number: 6757
+authors:
+  - "@kshalot"
+status: provisional
+creation-date: 2025-10-17
+reviewers:
+  - "@mimowo"
+  - "@tenzen-y"
+  - "@olekzabl"
+approvers:
+  - "@mimowo"
+  - "@tenzen-y"
+
+stage: alpha
+
+# The most recent milestone for which work toward delivery of this KEP has been
+# done. This can be the current (upcoming) milestone, if it is being actively
+# worked on.
+latest-milestone: "v0.15"
+
+# The milestone at which this feature was, or is targeted to be, at each stage.
+milestone:
+  alpha: "v0.15"
+
+# The following PRR answers are required at alpha release
+# List the feature gate name and the components for which it must be enabled
+feature-gates:
+  - name: FailureRecoveryPolicy
+disable-supported: true
+
+# The following PRR answers are required at beta release
+# metrics:
+#   - my_feature_metric
diff --git a/keps/693-multikueue/README.md b/keps/693-multikueue/README.md
index 158a5df56..7a2e6ee70 100644
--- a/keps/693-multikueue/README.md
+++ b/keps/693-multikueue/README.md
@@ -189,9 +189,22 @@ const (
     SecretLocationType LocationType = "Secret"
 )
 
-type MultiKueueClusterSpec {
-    // Information how to connect to the cluster.
-    KubeConfig KubeConfig `json:"kubeConfig"`
+// +kubebuilder:validation:ExactlyOneOf=kubeConfig;clusterProfile
+
+type MultiKueueClusterSpec struct {
+    // Information about how to connect to the cluster.
+    // Exactly one of KubeConfig or ClusterProfile must be specified.
+
+    // KubeConfig is the direct specification of the kubeconfig for the remote cluster.
+    // This field can only be configured when ClusterProfile is not specified.
+    // +optional
+    KubeConfig *KubeConfig `json:"kubeConfig,omitempty"`
+
+    // ClusterProfile is a reference to a ClusterProfile object.
+    // The controller will use the information from the ClusterProfile to connect to the remote cluster.
+    // This field can only be configured when KubeConfig is not specified.
+    // +optional
+    ClusterProfile *ClusterProfileReference `json:"clusterProfile,omitempty"`
 }
 
 type KubeConfig struct {
@@ -205,7 +218,15 @@ type KubeConfig struct {
     LocationType LocationType `json:"locationType"`
 }
 
-type MultiKueueClusterStatus {
+type ClusterProfileReference struct {
+  // Name of the ClusterProfile.
+  Name string `json:"name"`
+
+  // Namespace of the ClusterProfile.
+  Namespace string `json:"namespace"`
+}
+
+type MultiKueueClusterStatus struct {
    Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
 }
 ```
@@ -221,15 +242,54 @@ admission checks, use ProvisioningRequest, etc.
 
 #### MultiKueueCluster Controller
 
-Will monitor all cluster definitions and maintain 
+Will monitor all `MultiKueueCluster` definitions and maintain 
 the Kube clients for all of them. Any connectivity problems will be reported both in
-MultiKueueCluster status and Events. MultiKueue controller 
-will make sure that whenever the kubeconfig is refreshed, the appropriate 
-clients will also be recreated and attempt to reconnect when the connection to the
-target cluster is lost.
+the `MultiKueueCluster`'s status and via Events.
+
+The controller obtains cluster credentials based on the `MultiKueueCluster` spec:
+
+- When `kubeConfig` is provided, the controller uses it directly. It ensures that
+  whenever the underlying kubeconfig (e.g., in a Secret) is refreshed, the client
+  is recreated.
+
+- When `clusterProfile` is provided, the controller relies on the
+  [client-go credential plugin mechanism](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) to obtain and refresh credentials for the remote cluster as described in [KEP-5339](https://github.com/kubernetes/enhancements/blob/master/keps/sig-multicluster/5339-clusterprofile-plugin-credentials/README.md).
+
+  The authentication flow is as follows:
+  1. The controller reads the `ClusterProfile` object referenced by the `MultiKueueCluster`. The `ClusterProfile` contains a list of access providers.
+  2. The controller uses this configuration to match the access provider with the credentials provider and invoke the credential plugin binary. The list of credentials providers is configured in the `CredentialsProviders` section under `ClusterProfileConfig` in the `MultiKueue` in the Configuration API.
+
+```go
+type MultiKueue struct {
+  ...
+	// ClusterProfileConfig defines configuration for using the ClusterProfile API.
+	// +optional
+	ClusterProfileConfig *ClusterProfileConfig `json:"clusterProfileConfig,omitempty"`
+}
+
+// ClusterProfileConfig defines configuration for using the ClusterProfile API in MultiKueue.
+type ClusterProfileConfig struct {
+	// CredentialsProviders defines a list of providers to obtain credentials of worker clusters
+	// using the ClusterProfile API.
+	CredentialsProviders []ClusterProfileCredentialsProvider `json:"credentialsProviders,omitempty"`
+}
+
+// ClusterProfileCredentialsProvider defines a credentials provider in the ClusterProfile API.
+type ClusterProfileCredentialsProvider struct {
+	// Name is the name of the provider.
+	Name string `json:"name"`
+	//  ExecConfig is the exec configuration to obtain credentials.
+	ExecConfig *clientcmdapi.ExecConfig `json:"execConfig"`
+}
+```
+
+  3. The plugin is responsible for the actual authentication process. This might involve calling an external HTTP endpoint (e.g., a cloud provider's metadata service or an OIDC provider) to generate a short-lived authentication token. The details of this process are specific to the plugin and are opaque to Kueue. It returns the credentials, including the token, to the controller.
+  4. The controller uses these credentials to configure a Kubernetes client for the worker cluster.
+
+  Token refreshing is also managed automatically by the client-go library. When a token is expired or about to expire, client-go re-invokes the plugin to fetch a new one.
 
-Creation of kubeconfig files is outside of the MultiKueue scope, and is cloud
-provider/environment dependant.
+Creation of kubeconfig files or ClusterProfile objects is outside of the MultiKueue scope, and is cloud
+provider/environment dependent.
 
 #### AdmissionCheck Controller
 
@@ -316,6 +376,7 @@ type MultiKueue struct {
 	GCInterval *metav1.Duration `json:"gcInterval"`
 	Origin *string `json:"origin,omitempty"`
 	WorkerLostTimeout *metav1.Duration `json:"workerLostTimeout,omitempty"`
+	ClusterProfileConfig *ClusterProfileConfig `json:"clusterProfileConfig,omitempty"`
 }
 ```
 
@@ -327,6 +388,7 @@ This is used by multikueue in components like its [garbage collector](#garbage-c
 that ware created by this multikueue manager cluster and delete them if their local counterpart no longer exists.
 - `WorkerLostTimeout` - defines the time a local workload's multikueue admission check state is kept Ready
 if the connection with its reserving worker cluster is lost.
+- `ClusterProfileConfig` - defines the configuration for the ClusterProfile API.
 
 
 ### MultiKueue Dispatcher API
diff --git a/pkg/controller/admissionchecks/multikueue/controllers.go b/pkg/controller/admissionchecks/multikueue/controllers.go
index 8cdd382b1..84a98f5f7 100644
--- a/pkg/controller/admissionchecks/multikueue/controllers.go
+++ b/pkg/controller/admissionchecks/multikueue/controllers.go
@@ -19,11 +19,13 @@ package multikueue
 import (
 	"time"
 
+	"sigs.k8s.io/cluster-inventory-api/pkg/credentials"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	configapi "sigs.k8s.io/kueue/apis/config/v1beta2"
 	"sigs.k8s.io/kueue/pkg/constants"
 	"sigs.k8s.io/kueue/pkg/controller/jobframework"
+	"sigs.k8s.io/kueue/pkg/features"
 	"sigs.k8s.io/kueue/pkg/util/admissioncheck"
 )
 
@@ -34,12 +36,13 @@ const (
 )
 
 type SetupOptions struct {
-	gcInterval        time.Duration
-	origin            string
-	workerLostTimeout time.Duration
-	eventsBatchPeriod time.Duration
-	adapters          map[string]jobframework.MultiKueueAdapter
-	dispatcherName    string
+	gcInterval           time.Duration
+	origin               string
+	workerLostTimeout    time.Duration
+	eventsBatchPeriod    time.Duration
+	adapters             map[string]jobframework.MultiKueueAdapter
+	dispatcherName       string
+	clusterProfileConfig *configapi.ClusterProfileConfig
 }
 
 type SetupOption func(o *SetupOptions)
@@ -90,6 +93,12 @@ func WithDispatcherName(dispatcherName string) SetupOption {
 	}
 }
 
+func WithClusterProfiles(clusterProfiles *configapi.ClusterProfileConfig) SetupOption {
+	return func(o *SetupOptions) {
+		o.clusterProfileConfig = clusterProfiles
+	}
+}
+
 func SetupControllers(mgr ctrl.Manager, namespace string, opts ...SetupOption) error {
 	options := &SetupOptions{
 		gcInterval:        defaultGCInterval,
@@ -115,7 +124,21 @@ func SetupControllers(mgr ctrl.Manager, namespace string, opts ...SetupOption) e
 		return err
 	}
 
-	cRec := newClustersReconciler(mgr.GetClient(), namespace, options.gcInterval, options.origin, fsWatcher, options.adapters)
+	var cpCreds *credentials.CredentialsProvider
+	if features.Enabled(features.MultiKueueClusterProfile) {
+		if options.clusterProfileConfig != nil {
+			p := []credentials.Provider{}
+			for _, provider := range options.clusterProfileConfig.CredentialsProviders {
+				p = append(p, credentials.Provider{
+					Name:       provider.Name,
+					ExecConfig: provider.ExecConfig,
+				})
+			}
+			cpCreds = credentials.New(p)
+		}
+	}
+
+	cRec := newClustersReconciler(mgr.GetClient(), namespace, options.gcInterval, options.origin, fsWatcher, options.adapters, cpCreds)
 	err = cRec.setupWithManager(mgr)
 	if err != nil {
 		return err
diff --git a/pkg/controller/admissionchecks/multikueue/indexer.go b/pkg/controller/admissionchecks/multikueue/indexer.go
index 03c2370eb..c745e64c5 100644
--- a/pkg/controller/admissionchecks/multikueue/indexer.go
+++ b/pkg/controller/admissionchecks/multikueue/indexer.go
@@ -24,11 +24,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	kueue "sigs.k8s.io/kueue/apis/kueue/v1beta2"
+	"sigs.k8s.io/kueue/pkg/features"
 	"sigs.k8s.io/kueue/pkg/util/admissioncheck"
 )
 
 const (
 	UsingKubeConfigs               = "spec.kubeconfigs"
+	UsingClusterProfiles           = "spec.clusterprofiles"
 	UsingMultiKueueClusters        = "spec.multiKueueClusters"
 	AdmissionCheckUsingConfigKey   = "spec.multiKueueConfig"
 	WorkloadsWithAdmissionCheckKey = "status.admissionChecks"
@@ -44,10 +46,26 @@ func getIndexUsingKubeConfigs(configNamespace string) func(obj client.Object) []
 		if !isCluster {
 			return nil
 		}
+		if cluster.Spec.KubeConfig == nil {
+			return nil
+		}
 		return []string{strings.Join([]string{configNamespace, cluster.Spec.KubeConfig.Location}, "/")}
 	}
 }
 
+func getIndexUsingClusterProfiles(configNamespace string) func(obj client.Object) []string {
+	return func(obj client.Object) []string {
+		cluster, isCluster := obj.(*kueue.MultiKueueCluster)
+		if !isCluster {
+			return nil
+		}
+		if cluster.Spec.ClusterProfile == nil {
+			return nil
+		}
+		return []string{strings.Join([]string{configNamespace, cluster.Spec.ClusterProfile.Namespace, cluster.Spec.ClusterProfile.Name}, "/")}
+	}
+}
+
 func indexUsingMultiKueueClusters(obj client.Object) []string {
 	config, isConfig := obj.(*kueue.MultiKueueConfig)
 	if !isConfig {
@@ -60,6 +78,11 @@ func SetupIndexer(ctx context.Context, indexer client.FieldIndexer, configNamesp
 	if err := indexer.IndexField(ctx, &kueue.MultiKueueCluster{}, UsingKubeConfigs, getIndexUsingKubeConfigs(configNamespace)); err != nil {
 		return fmt.Errorf("setting index on clusters using kubeconfig: %w", err)
 	}
+	if features.Enabled(features.MultiKueueClusterProfile) {
+		if err := indexer.IndexField(ctx, &kueue.MultiKueueCluster{}, UsingClusterProfiles, getIndexUsingClusterProfiles(configNamespace)); err != nil {
+			return fmt.Errorf("setting index on clusters using cluster profiles: %w", err)
+		}
+	}
 	if err := indexer.IndexField(ctx, &kueue.MultiKueueConfig{}, UsingMultiKueueClusters, indexUsingMultiKueueClusters); err != nil {
 		return fmt.Errorf("setting index on configs using clusters: %w", err)
 	}
diff --git a/pkg/controller/admissionchecks/multikueue/multikueuecluster.go b/pkg/controller/admissionchecks/multikueue/multikueuecluster.go
index 3c61c1ff8..a4b8cd607 100644
--- a/pkg/controller/admissionchecks/multikueue/multikueuecluster.go
+++ b/pkg/controller/admissionchecks/multikueue/multikueuecluster.go
@@ -40,10 +40,12 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/validation"
 	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
 	"k8s.io/client-go/util/workqueue"
 	"k8s.io/klog/v2"
 	"k8s.io/utils/ptr"
+	inventoryv1alpha1 "sigs.k8s.io/cluster-inventory-api/apis/v1alpha1"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/event"
@@ -75,7 +77,12 @@ func retryAfter(failedAttempts uint) time.Duration {
 	return (1 << (min(failedAttempts, retryMaxSteps) - 1)) * retryIncrement
 }
 
-type clientWithWatchBuilder func(config []byte, options client.Options) (client.WithWatch, error)
+type clientWithWatchBuilder func(config *clientConfig, options client.Options) (client.WithWatch, error)
+
+type clientConfig struct {
+	Kubeconfig []byte
+	RestConfig *rest.Config
+}
 
 type remoteClient struct {
 	clusterName  string
@@ -84,7 +91,7 @@ type remoteClient struct {
 	wlUpdateCh   chan<- event.GenericEvent
 	watchEndedCh chan<- event.GenericEvent
 	watchCancel  func()
-	kubeconfig   []byte
+	config       *clientConfig
 	origin       string
 	adapters     map[string]jobframework.MultiKueueAdapter
 
@@ -110,8 +117,11 @@ func newRemoteClient(localClient client.Client, wlUpdateCh, watchEndedCh chan<-
 	return rc
 }
 
-func newClientWithWatch(kubeconfig []byte, options client.Options) (client.WithWatch, error) {
-	restConfig, err := clientcmd.RESTConfigFromKubeConfig(kubeconfig)
+func newClientWithWatch(config *clientConfig, options client.Options) (client.WithWatch, error) {
+	if config.RestConfig != nil {
+		return client.NewWithWatch(config.RestConfig, options)
+	}
+	restConfig, err := clientcmd.RESTConfigFromKubeConfig(config.Kubeconfig)
 	if err != nil {
 		return nil, err
 	}
@@ -137,15 +147,15 @@ func (*workloadKueueWatcher) WorkloadKeyFor(o runtime.Object) (types.NamespacedN
 // setConfig - will try to recreate the k8s client and restart watching if the new config is different than
 // the one currently used or a reconnect was requested.
 // If the encountered error is not permanent the duration after which a retry should be done is returned.
-func (rc *remoteClient) setConfig(watchCtx context.Context, kubeconfig []byte) (*time.Duration, error) {
-	configChanged := !equality.Semantic.DeepEqual(kubeconfig, rc.kubeconfig)
+func (rc *remoteClient) setConfig(watchCtx context.Context, config *clientConfig) (*time.Duration, error) {
+	configChanged := !equality.Semantic.DeepEqual(config, rc.config)
 	if !configChanged && !rc.connecting.Load() {
 		return nil, nil
 	}
 
 	rc.StopWatchers()
 	if configChanged {
-		rc.kubeconfig = kubeconfig
+		rc.config = config
 		rc.failedConnAttempts = 0
 	}
 
@@ -153,7 +163,7 @@ func (rc *remoteClient) setConfig(watchCtx context.Context, kubeconfig []byte) (
 	if rc.builderOverride != nil {
 		builder = rc.builderOverride
 	}
-	remoteClient, err := builder(kubeconfig, client.Options{Scheme: rc.localClient.Scheme()})
+	remoteClient, err := builder(config, client.Options{Scheme: rc.localClient.Scheme()})
 	if err != nil {
 		return nil, err
 	}
@@ -340,6 +350,12 @@ type clustersReconciler struct {
 	fsWatcher *KubeConfigFSWatcher
 
 	adapters map[string]jobframework.MultiKueueAdapter
+
+	cpCreds clusterProfileCreds
+}
+
+type clusterProfileCreds interface {
+	BuildConfigFromCP(clusterprofile *inventoryv1alpha1.ClusterProfile) (*rest.Config, error)
 }
 
 var _ manager.Runnable = (*clustersReconciler)(nil)
@@ -360,7 +376,7 @@ func (c *clustersReconciler) stopAndRemoveCluster(clusterName string) {
 	}
 }
 
-func (c *clustersReconciler) setRemoteClientConfig(ctx context.Context, clusterName string, kubeconfig []byte, origin string) (*time.Duration, error) {
+func (c *clustersReconciler) setRemoteClientConfig(ctx context.Context, clusterName string, config *clientConfig, origin string) (*time.Duration, error) {
 	c.lock.Lock()
 	defer c.lock.Unlock()
 
@@ -376,7 +392,7 @@ func (c *clustersReconciler) setRemoteClientConfig(ctx context.Context, clusterN
 	clientLog := ctrl.LoggerFrom(c.rootContext).WithValues("clusterName", clusterName)
 	clientCtx := ctrl.LoggerInto(c.rootContext, clientLog)
 
-	if retryAfter, err := client.setConfig(clientCtx, kubeconfig); err != nil {
+	if retryAfter, err := client.setConfig(clientCtx, config); err != nil {
 		ctrl.LoggerFrom(ctx).Error(err, "failed to set kubeConfig in the remote client")
 		return retryAfter, err
 	}
@@ -407,33 +423,21 @@ func (c *clustersReconciler) Reconcile(ctx context.Context, req reconcile.Reques
 		return reconcile.Result{}, nil //nolint:nilerr // nil is intentional, as either the cluster is deleted, or not found
 	}
 
-	// get the kubeconfig
-	kubeConfig, retry, err := c.getKubeConfig(ctx, &cluster.Spec.KubeConfig)
+	clientConfig, retry, reason, err := c.loadClientConfig(ctx, cluster)
 	if retry {
 		return reconcile.Result{}, err
 	}
 	if err != nil {
-		log.Error(err, "reading kubeconfig")
+		log.Error(err, "loading client config failed")
 		c.stopAndRemoveCluster(req.Name)
-		return reconcile.Result{}, c.updateStatus(ctx, cluster, false, "BadConfig", err.Error())
-	}
-
-	if features.Enabled(features.MultiKueueAllowInsecureKubeconfigs) {
-		log.V(3).Info("Feature MultiKueueAllowInsecureKubeconfigs is enabled, skipping kubeconfig validation")
-	} else {
-		err = validateKubeconfig(kubeConfig)
-		if err != nil {
-			log.Error(err, "validating kubeconfig failed")
-			c.stopAndRemoveCluster(req.Name)
-			if updateErr := c.updateStatus(ctx, cluster, false, "InsecureKubeConfig", fmt.Sprintf("insecure kubeconfig: %v", err)); updateErr != nil {
-				return reconcile.Result{}, fmt.Errorf("failed to update MultiKueueCluster status: %w after detecting insecure kubeconfig: %w", updateErr, err)
-			}
-			return reconcile.Result{}, fmt.Errorf("validating kubeconfig failed: %w", err)
+		if updateErr := c.updateStatus(ctx, cluster, false, reason, fmt.Sprintf("load client config failed: %v", err)); updateErr != nil {
+			return reconcile.Result{}, fmt.Errorf("failed to update MultiKueueCluster status: %w after failing to load client config: %w", updateErr, err)
 		}
+		return reconcile.Result{}, fmt.Errorf("failed to load client config, reason: %s, error: %w", reason, err)
 	}
 
-	if retryAfter, err := c.setRemoteClientConfig(ctx, cluster.Name, kubeConfig, c.origin); err != nil {
-		log.Error(err, "setting kubeconfig", "retryAfter", retryAfter)
+	if retryAfter, err := c.setRemoteClientConfig(ctx, cluster.Name, clientConfig, c.origin); err != nil {
+		log.Error(err, "setting client config", "retryAfter", retryAfter)
 		if err := c.updateStatus(ctx, cluster, false, "ClientConnectionFailed", err.Error()); err != nil {
 			return reconcile.Result{}, err
 		} else {
@@ -444,6 +448,34 @@ func (c *clustersReconciler) Reconcile(ctx context.Context, req reconcile.Reques
 	return reconcile.Result{}, client.IgnoreNotFound(c.updateStatus(ctx, cluster, true, "Active", "Connected"))
 }
 
+func (c *clustersReconciler) loadClientConfig(ctx context.Context, cluster *kueue.MultiKueueCluster) (*clientConfig, bool, string, error) {
+	log := ctrl.LoggerFrom(ctx)
+	if cluster.Spec.ClusterProfile != nil {
+		if !features.Enabled(features.MultiKueueClusterProfile) {
+			return nil, false, "MultiKueueClusterProfileFeatureDisabled", errors.New("MultiKueueClusterProfile feature gate is disabled")
+		}
+		restConfig, retry, err := c.getRestConfigFromClusterProfile(ctx, cluster.Spec.ClusterProfile)
+		if err != nil {
+			return nil, retry, "BadClusterProfile", err
+		}
+		return &clientConfig{RestConfig: restConfig}, false, "", nil
+	}
+
+	kubeConfig, retry, err := c.getKubeConfig(ctx, cluster.Spec.KubeConfig)
+	if err != nil {
+		return nil, retry, "BadKubeConfig", err
+	}
+
+	if features.Enabled(features.MultiKueueAllowInsecureKubeconfigs) {
+		log.V(3).Info("Feature MultiKueueAllowInsecureKubeconfigs is enabled, skipping kubeconfig validation")
+		return &clientConfig{Kubeconfig: kubeConfig}, false, "", nil
+	}
+	if err := validateKubeconfig(kubeConfig); err != nil {
+		return nil, false, "InsecureKubeConfig", err
+	}
+	return &clientConfig{Kubeconfig: kubeConfig}, false, "", nil
+}
+
 // validateKubeconfig checks that the provided kubeconfig content is safe to use
 // in a MultiKueueCluster context.
 func validateKubeconfig(kubeconfig []byte) error {
@@ -452,7 +484,6 @@ func validateKubeconfig(kubeconfig []byte) error {
 	if err != nil {
 		return fmt.Errorf("failed to parse kubeconfig(apiconfig): %v", err)
 	}
-
 	if config.AuthInfos != nil {
 		for _, authInfo := range config.AuthInfos {
 			// Token is allowed due to service account tokens usage
@@ -461,7 +492,6 @@ func validateKubeconfig(kubeconfig []byte) error {
 			}
 		}
 	}
-
 	// Validate each cluster config
 	for name, cluster := range config.Clusters {
 		// Require TLS
@@ -502,7 +532,6 @@ func validateKubeconfig(kubeconfig []byte) error {
 	if restConfig.AuthProvider != nil {
 		return errors.New("auth providers are not allowed")
 	}
-
 	return nil
 }
 
@@ -525,6 +554,10 @@ func isValidHostname(server string) bool {
 }
 
 func (c *clustersReconciler) getKubeConfig(ctx context.Context, ref *kueue.KubeConfig) ([]byte, bool, error) {
+	if ref == nil {
+		return nil, false, errors.New("kubeconfig reference is nil")
+	}
+
 	if ref.LocationType == kueue.SecretLocationType {
 		return c.getKubeConfigFromSecret(ctx, ref.Location)
 	}
@@ -532,6 +565,20 @@ func (c *clustersReconciler) getKubeConfig(ctx context.Context, ref *kueue.KubeC
 	return c.getKubeConfigFromPath(ref.Location)
 }
 
+func (c *clustersReconciler) getRestConfigFromClusterProfile(ctx context.Context, profileRef *kueue.ClusterProfileReference) (*rest.Config, bool, error) {
+	cp := &inventoryv1alpha1.ClusterProfile{}
+	if err := c.localClient.Get(ctx, types.NamespacedName{Name: profileRef.Name, Namespace: profileRef.Namespace}, cp); err != nil {
+		return nil, !apierrors.IsNotFound(err), err
+	}
+
+	restConfig, err := c.cpCreds.BuildConfigFromCP(cp)
+	if err != nil {
+		return nil, false, err
+	}
+
+	return restConfig, false, nil
+}
+
 func (c *clustersReconciler) getKubeConfigFromSecret(ctx context.Context, secretName string) ([]byte, bool, error) {
 	sec := corev1.Secret{}
 	secretObjKey := types.NamespacedName{
@@ -608,8 +655,9 @@ func (c *clustersReconciler) getRemoteClients() []*remoteClient {
 // +kubebuilder:rbac:groups="",resources=events,verbs=create;watch;update
 // +kubebuilder:rbac:groups=kueue.x-k8s.io,resources=multikueueclusters,verbs=get;list;watch
 // +kubebuilder:rbac:groups=kueue.x-k8s.io,resources=multikueueclusters/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=multicluster.x-k8s.io,resources=clusterprofiles,verbs=get;list;watch
 
-func newClustersReconciler(c client.Client, namespace string, gcInterval time.Duration, origin string, fsWatcher *KubeConfigFSWatcher, adapters map[string]jobframework.MultiKueueAdapter) *clustersReconciler {
+func newClustersReconciler(c client.Client, namespace string, gcInterval time.Duration, origin string, fsWatcher *KubeConfigFSWatcher, adapters map[string]jobframework.MultiKueueAdapter, cpCreds clusterProfileCreds) *clustersReconciler {
 	return &clustersReconciler{
 		localClient:     c,
 		configNamespace: namespace,
@@ -620,6 +668,7 @@ func newClustersReconciler(c client.Client, namespace string, gcInterval time.Du
 		watchEndedCh:    make(chan event.GenericEvent, eventChBufferSize),
 		fsWatcher:       fsWatcher,
 		adapters:        adapters,
+		cpCreds:         cpCreds,
 	}
 }
 
@@ -650,7 +699,7 @@ func (c *clustersReconciler) setupWithManager(mgr ctrl.Manager) error {
 	filter := predicate.Funcs{
 		CreateFunc: func(ce event.CreateEvent) bool {
 			if cluster, isCluster := ce.Object.(*kueue.MultiKueueCluster); isCluster {
-				if cluster.Spec.KubeConfig.LocationType == kueue.PathLocationType {
+				if cluster.Spec.KubeConfig != nil && cluster.Spec.KubeConfig.LocationType == kueue.PathLocationType {
 					err := c.fsWatcher.AddOrUpdate(cluster.Name, cluster.Spec.KubeConfig.Location)
 					if err != nil {
 						filterLog.Error(err, "AddOrUpdate FS watch", "cluster", klog.KObj(cluster))
@@ -666,14 +715,16 @@ func (c *clustersReconciler) setupWithManager(mgr ctrl.Manager) error {
 				return true
 			}
 
-			if clusterNew.Spec.KubeConfig.LocationType == kueue.SecretLocationType && clusterOld.Spec.KubeConfig.LocationType == kueue.PathLocationType {
+			clusterNewHasKubeConfigPath := clusterNew.Spec.KubeConfig != nil && clusterNew.Spec.KubeConfig.LocationType == kueue.PathLocationType
+			clusterOldHasKubeConfigPath := clusterOld.Spec.KubeConfig != nil && clusterOld.Spec.KubeConfig.LocationType == kueue.PathLocationType
+			if clusterOldHasKubeConfigPath && !clusterNewHasKubeConfigPath {
 				err := c.fsWatcher.Remove(clusterOld.Name)
 				if err != nil {
 					filterLog.Error(err, "Remove FS watch", "cluster", klog.KObj(clusterOld))
 				}
 			}
 
-			if clusterNew.Spec.KubeConfig.LocationType == kueue.PathLocationType {
+			if clusterNewHasKubeConfigPath {
 				err := c.fsWatcher.AddOrUpdate(clusterNew.Name, clusterNew.Spec.KubeConfig.Location)
 				if err != nil {
 					filterLog.Error(err, "AddOrUpdate FS watch", "cluster", klog.KObj(clusterNew))
@@ -683,7 +734,7 @@ func (c *clustersReconciler) setupWithManager(mgr ctrl.Manager) error {
 		},
 		DeleteFunc: func(de event.DeleteEvent) bool {
 			if cluster, isCluster := de.Object.(*kueue.MultiKueueCluster); isCluster {
-				if cluster.Spec.KubeConfig.LocationType == kueue.PathLocationType {
+				if cluster.Spec.KubeConfig != nil && cluster.Spec.KubeConfig.LocationType == kueue.PathLocationType {
 					err := c.fsWatcher.Remove(cluster.Name)
 					if err != nil {
 						filterLog.Error(err, "Remove FS watch", "cluster", klog.KObj(cluster))
diff --git a/pkg/controller/admissionchecks/multikueue/workload.go b/pkg/controller/admissionchecks/multikueue/workload.go
index d2db66bd6..dd4f920f7 100644
--- a/pkg/controller/admissionchecks/multikueue/workload.go
+++ b/pkg/controller/admissionchecks/multikueue/workload.go
@@ -358,7 +358,7 @@ func (w *wlReconciler) reconcileGroup(ctx context.Context, group *wlGroup) (reco
 		}
 
 		// finish workload and copy the status to the local one
-		return reconcile.Result{}, workload.Finish(ctx, w.client, group.local, remoteFinishedCond.Reason, remoteFinishedCond.Message, kueue.MultiKueueControllerName, w.clock)
+		return reconcile.Result{}, workload.Finish(ctx, w.client, group.local, remoteFinishedCond.Reason, remoteFinishedCond.Message, w.clock)
 	}
 
 	// 2. delete all workloads that are out of sync (other than scaled-down elastic workloads)
@@ -443,9 +443,9 @@ func (w *wlReconciler) nominateAndSynchronizeWorkers(ctx context.Context, group
 			nominatedWorkers = append(nominatedWorkers, workerName)
 		}
 		if group.local.Status.ClusterName == nil && !equality.Semantic.DeepEqual(group.local.Status.NominatedClusterNames, nominatedWorkers) {
-			if err := workload.PatchAdmissionStatus(ctx, w.client, group.local, w.clock, func() (*kueue.Workload, bool, error) {
+			if err := workload.PatchAdmissionStatus(ctx, w.client, group.local, w.clock, func() (bool, error) {
 				group.local.Status.NominatedClusterNames = nominatedWorkers
-				return group.local, true, nil
+				return true, nil
 			}); err != nil {
 				log.V(2).Error(err, "Failed to patch nominated clusters", "workload", klog.KObj(group.local))
 				return reconcile.Result{}, err
@@ -646,7 +646,7 @@ func (w *wlReconciler) syncReservingRemoteState(ctx context.Context, group *wlGr
 		return nil
 	}
 
-	if err := workload.PatchAdmissionStatus(ctx, w.client, group.local, w.clock, func() (*kueue.Workload, bool, error) {
+	if err := workload.PatchAdmissionStatus(ctx, w.client, group.local, w.clock, func() (bool, error) {
 		if needsTopologyUpdate {
 			updateDelayedTopologyRequest(group.local, group.remotes[reservingRemote])
 		}
@@ -668,7 +668,7 @@ func (w *wlReconciler) syncReservingRemoteState(ctx context.Context, group *wlGr
 			group.local.Status.NominatedClusterNames = nil
 		}
 
-		return group.local, true, nil
+		return true, nil
 	}); err != nil {
 		log.V(2).Error(err, "Failed to patch workload", "workload", klog.KObj(group.local))
 		return err
diff --git a/pkg/controller/core/workload_controller.go b/pkg/controller/core/workload_controller.go
index 29a0bca8a..b16e5e426 100644
--- a/pkg/controller/core/workload_controller.go
+++ b/pkg/controller/core/workload_controller.go
@@ -195,13 +195,13 @@ func (r *WorkloadReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 	}
 
 	if requeueAt := workload.NeedsRequeueAtUpdate(&wl, r.clock); requeueAt != nil {
-		err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (*kueue.Workload, bool, error) {
+		err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (bool, error) {
 			if wl.Status.RequeueState == nil {
 				wl.Status.RequeueState = &kueue.RequeueState{}
 			}
 			log.V(2).Info("At least one admission check set a retry time", "requeueAt", requeueAt, "current", wl.Status.RequeueState.RequeueAt)
 			workload.SetRequeueState(&wl, *requeueAt, false)
-			return &wl, true, nil
+			return true, nil
 		})
 		return reconcile.Result{}, client.IgnoreNotFound(err)
 	}
@@ -286,11 +286,11 @@ func (r *WorkloadReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 				log.V(3).Info("Pending workload requeued after backoff")
 
 				// Clear RequeueAt since backoff has elapsed
-				err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (*kueue.Workload, bool, error) {
+				err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (bool, error) {
 					if wl.Status.RequeueState != nil {
 						wl.Status.RequeueState.RequeueAt = nil
 					}
-					return &wl, true, nil
+					return true, nil
 				})
 				if err != nil {
 					return ctrl.Result{}, client.IgnoreNotFound(err)
@@ -308,7 +308,7 @@ func (r *WorkloadReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 
 		var updated bool
 		var requeueAfter time.Duration
-		err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (*kueue.Workload, bool, error) {
+		err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (bool, error) {
 			if cond := apimeta.FindStatusCondition(wl.Status.Conditions, kueue.WorkloadRequeued); cond != nil && cond.Status == metav1.ConditionFalse {
 				switch cond.Reason {
 				case kueue.WorkloadDeactivated:
@@ -320,7 +320,7 @@ func (r *WorkloadReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 						requeueAfter = wl.Status.RequeueState.RequeueAt.Sub(r.clock.Now())
 					}
 					if requeueAfter > 0 {
-						return nil, updated, nil
+						return updated, nil
 					}
 					if wl.Status.RequeueState != nil {
 						wl.Status.RequeueState.RequeueAt = nil
@@ -329,7 +329,7 @@ func (r *WorkloadReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 					updated = true
 				}
 			}
-			return &wl, updated, nil
+			return updated, nil
 		})
 
 		if requeueAfter > 0 {
@@ -352,33 +352,35 @@ func (r *WorkloadReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 			updated = true
 			evicted = true
 		}
-		wlOrig := wl.DeepCopy()
-		if dtCond != nil {
-			apimeta.RemoveStatusCondition(&wl.Status.Conditions, kueue.WorkloadDeactivationTarget)
-		}
 		if wl.Status.RequeueState != nil {
-			if features.Enabled(features.WorkloadRequestUseMergePatch) {
-				// When using merge patch, we can set the entire RequeueState to nil.
-				wl.Status.RequeueState = nil
-			} else {
-				// When using SSA, we must clear individual fields instead of setting to nil.
-				wl.Status.RequeueState.Count = nil
-				wl.Status.RequeueState.RequeueAt = nil
-			}
 			updated = true
 		}
-		if updated {
+		prepare := func() {
+			if dtCond != nil {
+				apimeta.RemoveStatusCondition(&wl.Status.Conditions, kueue.WorkloadDeactivationTarget)
+			}
+			if wl.Status.RequeueState != nil {
+				if features.Enabled(features.WorkloadRequestUseMergePatch) {
+					// When using a merge patch, we can set the entire RequeueState to nil.
+					wl.Status.RequeueState = nil
+				} else {
+					// When using SSA, we must clear individual fields instead of setting to nil.
+					wl.Status.RequeueState.Count = nil
+					wl.Status.RequeueState.RequeueAt = nil
+				}
+			}
+		}
+		if updated || wl.Status.RequeueState != nil {
 			if evicted {
-				if err := workload.Evict(ctx, r.client, r.recorder, wlOrig, reason, message, underlyingCause, r.clock, workload.WithCustomPrepare(func() (*kueue.Workload, error) {
-					return &wl, nil
-				})); err != nil {
+				if err := workload.Evict(ctx, r.client, r.recorder, &wl, reason, message, underlyingCause, r.clock, workload.WithCustomPrepare(prepare)); err != nil {
 					if !apierrors.IsNotFound(err) {
 						return ctrl.Result{}, fmt.Errorf("setting eviction: %w", err)
 					}
 				}
 			} else {
-				if err := workload.PatchAdmissionStatus(ctx, r.client, wlOrig, r.clock, func() (*kueue.Workload, bool, error) {
-					return &wl, true, nil
+				if err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (bool, error) {
+					prepare()
+					return true, nil
 				}); err != nil {
 					if !apierrors.IsNotFound(err) {
 						return ctrl.Result{}, fmt.Errorf("updating workload: %w", err)
@@ -398,8 +400,8 @@ func (r *WorkloadReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 	lqExists := err == nil
 	lqActive := ptr.Deref(lq.Spec.StopPolicy, kueue.None) == kueue.None
 	if lqExists && lqActive && isDisabledRequeuedByLocalQueueStopped(&wl) {
-		return ctrl.Result{}, client.IgnoreNotFound(workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (*kueue.Workload, bool, error) {
-			return &wl, workload.SetRequeuedCondition(&wl, kueue.WorkloadLocalQueueRestarted, "The LocalQueue was restarted after being stopped", true), nil
+		return ctrl.Result{}, client.IgnoreNotFound(workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (bool, error) {
+			return workload.SetRequeuedCondition(&wl, kueue.WorkloadLocalQueueRestarted, "The LocalQueue was restarted after being stopped", true), nil
 		}))
 	}
 
@@ -412,8 +414,8 @@ func (r *WorkloadReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 		}
 		// If stopped cluster queue is started we need to set the WorkloadRequeued condition to true.
 		if isDisabledRequeuedByClusterQueueStopped(&wl) && ptr.Deref(cq.Spec.StopPolicy, kueue.None) == kueue.None {
-			return ctrl.Result{}, client.IgnoreNotFound(workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (*kueue.Workload, bool, error) {
-				return &wl, workload.SetRequeuedCondition(&wl, kueue.WorkloadClusterQueueRestarted, "The ClusterQueue was restarted after being stopped", true), nil
+			return ctrl.Result{}, client.IgnoreNotFound(workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (bool, error) {
+				return workload.SetRequeuedCondition(&wl, kueue.WorkloadClusterQueueRestarted, "The ClusterQueue was restarted after being stopped", true), nil
 			}))
 		}
 		if updated, err := r.reconcileSyncAdmissionChecks(ctx, &wl, &cq); updated || err != nil {
@@ -425,9 +427,9 @@ func (r *WorkloadReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 	// false before the workloads eviction.
 	if !workload.IsAdmitted(&wl) {
 		var updated bool
-		if err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (*kueue.Workload, bool, error) {
+		if err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (bool, error) {
 			updated = workload.SyncAdmittedCondition(&wl, r.clock.Now())
-			return &wl, updated, nil
+			return updated, nil
 		}); err != nil {
 			return ctrl.Result{}, client.IgnoreNotFound(err)
 		}
@@ -490,29 +492,29 @@ func (r *WorkloadReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
 	switch {
 	case !lqExists:
 		log.V(3).Info("Workload is inadmissible because of missing LocalQueue", "localQueue", klog.KRef(wl.Namespace, string(wl.Spec.QueueName)))
-		if err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (*kueue.Workload, bool, error) {
-			return &wl, workload.UnsetQuotaReservationWithCondition(&wl, kueue.WorkloadInadmissible, fmt.Sprintf("LocalQueue %s doesn't exist", wl.Spec.QueueName), r.clock.Now()), nil
+		if err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (bool, error) {
+			return workload.UnsetQuotaReservationWithCondition(&wl, kueue.WorkloadInadmissible, fmt.Sprintf("LocalQueue %s doesn't exist", wl.Spec.QueueName), r.clock.Now()), nil
 		}); err != nil {
 			return ctrl.Result{}, client.IgnoreNotFound(err)
 		}
 	case !lqActive:
 		log.V(3).Info("Workload is inadmissible because of stopped LocalQueue", "localQueue", klog.KRef(wl.Namespace, string(wl.Spec.QueueName)))
-		if err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (*kueue.Workload, bool, error) {
-			return &wl, workload.UnsetQuotaReservationWithCondition(&wl, kueue.WorkloadInadmissible, fmt.Sprintf("LocalQueue %s is inactive", wl.Spec.QueueName), r.clock.Now()), nil
+		if err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (bool, error) {
+			return workload.UnsetQuotaReservationWithCondition(&wl, kueue.WorkloadInadmissible, fmt.Sprintf("LocalQueue %s is inactive", wl.Spec.QueueName), r.clock.Now()), nil
 		}); err != nil {
 			return ctrl.Result{}, client.IgnoreNotFound(err)
 		}
 	case !cqOk:
 		log.V(3).Info("Workload is inadmissible because of missing ClusterQueue", "clusterQueue", klog.KRef("", string(cqName)))
-		if err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (*kueue.Workload, bool, error) {
-			return &wl, workload.UnsetQuotaReservationWithCondition(&wl, kueue.WorkloadInadmissible, fmt.Sprintf("ClusterQueue %s doesn't exist", cqName), r.clock.Now()), nil
+		if err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (bool, error) {
+			return workload.UnsetQuotaReservationWithCondition(&wl, kueue.WorkloadInadmissible, fmt.Sprintf("ClusterQueue %s doesn't exist", cqName), r.clock.Now()), nil
 		}); err != nil {
 			return ctrl.Result{}, client.IgnoreNotFound(err)
 		}
 	case !r.cache.ClusterQueueActive(cqName):
 		log.V(3).Info("Workload is inadmissible because ClusterQueue is inactive", "clusterQueue", klog.KRef("", string(cqName)))
-		if err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (*kueue.Workload, bool, error) {
-			return &wl, workload.UnsetQuotaReservationWithCondition(&wl, kueue.WorkloadInadmissible, fmt.Sprintf("ClusterQueue %s is inactive", cqName), r.clock.Now()), nil
+		if err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (bool, error) {
+			return workload.UnsetQuotaReservationWithCondition(&wl, kueue.WorkloadInadmissible, fmt.Sprintf("ClusterQueue %s is inactive", cqName), r.clock.Now()), nil
 		}); err != nil {
 			return ctrl.Result{}, client.IgnoreNotFound(err)
 		}
@@ -550,13 +552,13 @@ func (r *WorkloadReconciler) reconcileMaxExecutionTime(ctx context.Context, wl *
 	}
 
 	if !apimeta.IsStatusConditionTrue(wl.Status.Conditions, kueue.WorkloadDeactivationTarget) {
-		err := workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (*kueue.Workload, bool, error) {
+		err := workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (bool, error) {
 			updated := workload.SetDeactivationTarget(wl, kueue.WorkloadMaximumExecutionTimeExceeded, "exceeding the maximum execution time")
 			if wl.Status.AccumulatedPastExecutionTimeSeconds != nil {
 				wl.Status.AccumulatedPastExecutionTimeSeconds = nil
 				updated = true
 			}
-			return wl, updated, nil
+			return updated, nil
 		})
 		if err != nil {
 			return 0, err
@@ -579,8 +581,8 @@ func (r *WorkloadReconciler) reconcileCheckBasedEviction(ctx context.Context, wl
 		for _, check := range workload.RejectedChecks(wl) {
 			rejectedCheckNames = append(rejectedCheckNames, check.Name)
 		}
-		err := workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (*kueue.Workload, bool, error) {
-			return wl, workload.SetDeactivationTarget(wl, kueue.WorkloadEvictedByAdmissionCheck, fmt.Sprintf("Admission check(s): %v, were rejected", stringsutils.Join(rejectedCheckNames, ","))), nil
+		err := workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (bool, error) {
+			return workload.SetDeactivationTarget(wl, kueue.WorkloadEvictedByAdmissionCheck, fmt.Sprintf("Admission check(s): %v, were rejected", stringsutils.Join(rejectedCheckNames, ","))), nil
 		})
 		if err != nil {
 			return false, err
@@ -631,15 +633,15 @@ func (r *WorkloadReconciler) reconcileOnLocalQueueActiveState(ctx context.Contex
 
 	if !lqExists || !lq.DeletionTimestamp.IsZero() {
 		log.V(3).Info("Workload is inadmissible because the LocalQueue is terminating or missing", "localQueue", klog.KRef("", string(wl.Spec.QueueName)))
-		return true, workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (*kueue.Workload, bool, error) {
-			return wl, workload.UnsetQuotaReservationWithCondition(wl, kueue.WorkloadInadmissible, fmt.Sprintf("LocalQueue %s is terminating or missing", wl.Spec.QueueName), r.clock.Now()), nil
+		return true, workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (bool, error) {
+			return workload.UnsetQuotaReservationWithCondition(wl, kueue.WorkloadInadmissible, fmt.Sprintf("LocalQueue %s is terminating or missing", wl.Spec.QueueName), r.clock.Now()), nil
 		})
 	}
 
 	if queueStopPolicy != kueue.None {
 		log.V(3).Info("Workload is inadmissible because the LocalQueue is stopped", "localQueue", klog.KRef("", string(wl.Spec.QueueName)))
-		return true, workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (*kueue.Workload, bool, error) {
-			return wl, workload.UnsetQuotaReservationWithCondition(wl, kueue.WorkloadInadmissible, fmt.Sprintf("LocalQueue %s is stopped", wl.Spec.QueueName), r.clock.Now()), nil
+		return true, workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (bool, error) {
+			return workload.UnsetQuotaReservationWithCondition(wl, kueue.WorkloadInadmissible, fmt.Sprintf("LocalQueue %s is stopped", wl.Spec.QueueName), r.clock.Now()), nil
 		})
 	}
 
@@ -673,15 +675,15 @@ func (r *WorkloadReconciler) reconcileOnClusterQueueActiveState(ctx context.Cont
 
 	if !cqExists || !cq.DeletionTimestamp.IsZero() {
 		log.V(3).Info("Workload is inadmissible because the ClusterQueue is terminating or missing", "clusterQueue", klog.KRef("", string(cqName)))
-		return true, workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (*kueue.Workload, bool, error) {
-			return wl, workload.UnsetQuotaReservationWithCondition(wl, kueue.WorkloadInadmissible, fmt.Sprintf("ClusterQueue %s is terminating or missing", cqName), r.clock.Now()), nil
+		return true, workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (bool, error) {
+			return workload.UnsetQuotaReservationWithCondition(wl, kueue.WorkloadInadmissible, fmt.Sprintf("ClusterQueue %s is terminating or missing", cqName), r.clock.Now()), nil
 		})
 	}
 
 	if queueStopPolicy != kueue.None {
 		log.V(3).Info("Workload is inadmissible because the ClusterQueue is stopped", "clusterQueue", klog.KRef("", string(cqName)))
-		return true, workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (*kueue.Workload, bool, error) {
-			return wl, workload.UnsetQuotaReservationWithCondition(wl, kueue.WorkloadInadmissible, fmt.Sprintf("ClusterQueue %s is stopped", cqName), r.clock.Now()), nil
+		return true, workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (bool, error) {
+			return workload.UnsetQuotaReservationWithCondition(wl, kueue.WorkloadInadmissible, fmt.Sprintf("ClusterQueue %s is stopped", cqName), r.clock.Now()), nil
 		})
 	}
 
@@ -748,9 +750,8 @@ func (r *WorkloadReconciler) reconcileNotReadyTimeout(ctx context.Context, req c
 	// Increments a re-queueing count and update a time to be re-queued.
 	log.V(2).Info("Start the eviction of the workload due to exceeding the PodsReady timeout")
 	message := fmt.Sprintf("Exceeded the PodsReady timeout %s", req.String())
-	err = workload.Evict(ctx, r.client, r.recorder, wl, kueue.WorkloadEvictedByPodsReadyTimeout, message, underlyingCause, r.clock, workload.WithCustomPrepare(func() (*kueue.Workload, error) {
+	err = workload.Evict(ctx, r.client, r.recorder, wl, kueue.WorkloadEvictedByPodsReadyTimeout, message, underlyingCause, r.clock, workload.WithCustomPrepare(func() {
 		workload.UpdateRequeueState(wl, r.waitForPodsReady.requeuingBackoffBaseSeconds, int32(r.waitForPodsReady.requeuingBackoffMaxDuration.Seconds()), r.clock)
-		return wl, nil
 	}))
 
 	return 0, err
@@ -763,8 +764,8 @@ func (r *WorkloadReconciler) triggerDeactivation(ctx context.Context, wl *kueue.
 	requeueState := ptr.Deref(wl.Status.RequeueState, kueue.RequeueState{})
 	// If requeuingBackoffLimitCount equals to null, the workloads is repeatedly and endless re-queued.
 	if r.waitForPodsReady.requeuingBackoffLimitCount != nil && ptr.Deref(requeueState.Count, 0)+1 > *r.waitForPodsReady.requeuingBackoffLimitCount {
-		if err := workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (*kueue.Workload, bool, error) {
-			return wl, workload.SetDeactivationTarget(wl, kueue.WorkloadRequeuingLimitExceeded, "exceeding the maximum number of re-queuing retries"), nil
+		if err := workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (bool, error) {
+			return workload.SetDeactivationTarget(wl, kueue.WorkloadRequeuingLimitExceeded, "exceeding the maximum number of re-queuing retries"), nil
 		}); err != nil {
 			return false, err
 		}
diff --git a/pkg/controller/jobframework/integrationmanager.go b/pkg/controller/jobframework/integrationmanager.go
index 154f3c555..9d509aa87 100644
--- a/pkg/controller/jobframework/integrationmanager.go
+++ b/pkg/controller/jobframework/integrationmanager.go
@@ -82,6 +82,7 @@ type IntegrationCallbacks struct {
 	// The job's MultiKueue adapter (optional)
 	MultiKueueAdapter MultiKueueAdapter
 	// The list of integration that need to be enabled along with the current one.
+	//
 	// Deprecated: Use ImplicitlyEnabledFrameworkNames instead.
 	DependencyList []string
 	// The list of integrations implicitly enabled as dependencies of the integration.
diff --git a/pkg/controller/jobframework/reconciler.go b/pkg/controller/jobframework/reconciler.go
index fbc7c0af5..15aca6b34 100644
--- a/pkg/controller/jobframework/reconciler.go
+++ b/pkg/controller/jobframework/reconciler.go
@@ -21,7 +21,6 @@ import (
 	"errors"
 	"fmt"
 	"strings"
-	"testing"
 	"time"
 
 	"github.com/go-logr/logr"
@@ -210,9 +209,7 @@ func WithCache(c *schdcache.Cache) Option {
 }
 
 // WithClock sets the clock of the reconciler.
-// It default to system's clock and should only
-// be changed in testing.
-func WithClock(_ testing.TB, c clock.Clock) Option {
+func WithClock(c clock.Clock) Option {
 	return func(o *Options) {
 		o.Clock = c
 	}
@@ -363,6 +360,21 @@ func (r *JobReconciler) ReconcileGenericJob(ctx context.Context, req ctrl.Reques
 		}
 	}
 
+	// when manageJobsWithoutQueueName is enabled, standalone jobs without queue names
+	// are still not managed if they don't match the namespace selector.
+	if r.manageJobsWithoutQueueName && QueueName(job) == "" {
+		ns := corev1.Namespace{}
+		err := r.client.Get(ctx, client.ObjectKey{Name: job.Object().GetNamespace()}, &ns)
+		if err != nil {
+			log.Error(err, "failed to get job namespace")
+			return ctrl.Result{}, err
+		}
+		if !r.managedJobsNamespaceSelector.Matches(labels.Set(ns.GetLabels())) {
+			log.V(3).Info("namespace selector does not match, ignoring the job", "namespace", ns.Name)
+			return ctrl.Result{}, nil
+		}
+	}
+
 	// if this is a non-toplevel job, suspend the job if its ancestor's workload is not found or not admitted.
 	if !isTopLevelJob {
 		_, _, finished := job.Finished(ctx)
@@ -371,9 +383,9 @@ func (r *JobReconciler) ReconcileGenericJob(ctx context.Context, req ctrl.Reques
 				log.Error(err, "couldn't get an ancestor job workload")
 				return ctrl.Result{}, err
 			} else if ancestorWorkload == nil || !workload.IsAdmitted(ancestorWorkload) {
-				if err := clientutil.Patch(ctx, r.client, object, func() (client.Object, bool, error) {
+				if err := clientutil.Patch(ctx, r.client, object, func() (bool, error) {
 					job.Suspend()
-					return object, true, nil
+					return true, nil
 				}); err != nil {
 					log.Error(err, "suspending child job failed")
 					return ctrl.Result{}, err
@@ -384,21 +396,6 @@ func (r *JobReconciler) ReconcileGenericJob(ctx context.Context, req ctrl.Reques
 		return ctrl.Result{}, nil
 	}
 
-	// when manageJobsWithoutQueueName is enabled, standalone jobs without queue names
-	// are still not managed if they don't match the namespace selector.
-	if r.manageJobsWithoutQueueName && QueueName(job) == "" {
-		ns := corev1.Namespace{}
-		err := r.client.Get(ctx, client.ObjectKey{Name: job.Object().GetNamespace()}, &ns)
-		if err != nil {
-			log.Error(err, "failed to get job namespace")
-			return ctrl.Result{}, err
-		}
-		if !r.managedJobsNamespaceSelector.Matches(labels.Set(ns.GetLabels())) {
-			log.V(3).Info("namespace selector does not match, ignoring the job", "namespace", ns.Name)
-			return ctrl.Result{}, nil
-		}
-	}
-
 	log.V(2).Info("Reconciling Job")
 
 	// 1. Attempt to retrieve an existing workload (if any) for this job.
@@ -458,7 +455,7 @@ func (r *JobReconciler) ReconcileGenericJob(ctx context.Context, req ctrl.Reques
 			if !success {
 				reason = kueue.WorkloadFinishedReasonFailed
 			}
-			err := workload.Finish(ctx, r.client, wl, reason, message, constants.JobControllerName, r.clock)
+			err := workload.Finish(ctx, r.client, wl, reason, message, r.clock)
 			if err != nil && !apierrors.IsNotFound(err) {
 				return ctrl.Result{}, err
 			}
@@ -554,14 +551,14 @@ func (r *JobReconciler) ReconcileGenericJob(ctx context.Context, req ctrl.Reques
 		if workload.HasQuotaReservation(wl) {
 			if !job.IsActive() {
 				log.V(6).Info("The job is no longer active, clear the workloads admission")
-				err := workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (*kueue.Workload, bool, error) {
+				err := workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (bool, error) {
 					// The requeued condition status set to true only on EvictedByPreemption
 					setRequeued := (evCond.Reason == kueue.WorkloadEvictedByPreemption) || (evCond.Reason == kueue.WorkloadEvictedDueToNodeFailures)
 					updated := workload.SetRequeuedCondition(wl, evCond.Reason, evCond.Message, setRequeued)
 					if workload.UnsetQuotaReservationWithCondition(wl, "Pending", evCond.Message, r.clock.Now()) {
 						updated = true
 					}
-					return wl, updated, nil
+					return updated, nil
 				})
 				if err != nil {
 					return ctrl.Result{}, fmt.Errorf("clearing admission: %w", err)
@@ -585,7 +582,7 @@ func (r *JobReconciler) ReconcileGenericJob(ctx context.Context, req ctrl.Reques
 				log.Error(err, "Unsuspending job")
 				if podset.IsPermanent(err) {
 					// Mark the workload as finished with failure since the is no point to retry.
-					errUpdateStatus := workload.Finish(ctx, r.client, wl, FailedToStartFinishedReason, err.Error(), constants.JobControllerName, r.clock)
+					errUpdateStatus := workload.Finish(ctx, r.client, wl, FailedToStartFinishedReason, err.Error(), r.clock)
 					if errUpdateStatus != nil {
 						log.Error(errUpdateStatus, "Updating workload status, on start failure", "err", err)
 					}
@@ -1024,7 +1021,7 @@ func (r *JobReconciler) ensurePrebuiltWorkloadInSync(ctx context.Context, wl *ku
 		}
 		// mark the workload as finished
 		msg := "The prebuilt workload is out of sync with its user job"
-		return false, workload.Finish(ctx, r.client, wl, kueue.WorkloadFinishedReasonOutOfSync, msg, constants.JobControllerName, r.clock)
+		return false, workload.Finish(ctx, r.client, wl, kueue.WorkloadFinishedReasonOutOfSync, msg, r.clock)
 	}
 	return true, nil
 }
@@ -1126,8 +1123,8 @@ func (r *JobReconciler) startJob(ctx context.Context, job GenericJob, object cli
 			return err
 		}
 	} else {
-		if err := clientutil.Patch(ctx, r.client, object, func() (client.Object, bool, error) {
-			return object, true, job.RunWithPodSetsInfo(ctx, info)
+		if err := clientutil.Patch(ctx, r.client, object, func() (bool, error) {
+			return true, job.RunWithPodSetsInfo(ctx, info)
 		}); err != nil {
 			return err
 		}
@@ -1170,12 +1167,12 @@ func (r *JobReconciler) stopJob(ctx context.Context, job GenericJob, wl *kueue.W
 		return nil
 	}
 
-	if err := clientutil.Patch(ctx, r.client, object, func() (client.Object, bool, error) {
+	if err := clientutil.Patch(ctx, r.client, object, func() (bool, error) {
 		job.Suspend()
 		if info != nil {
 			job.RestorePodSetsInfo(info)
 		}
-		return object, true, nil
+		return true, nil
 	}); err != nil {
 		return err
 	}
diff --git a/pkg/controller/jobs/appwrapper/appwrapper_multikueue_adapter.go b/pkg/controller/jobs/appwrapper/appwrapper_multikueue_adapter.go
index e71097e18..2dddce39f 100644
--- a/pkg/controller/jobs/appwrapper/appwrapper_multikueue_adapter.go
+++ b/pkg/controller/jobs/appwrapper/appwrapper_multikueue_adapter.go
@@ -63,9 +63,9 @@ func (b *multiKueueAdapter) SyncJob(ctx context.Context, localClient client.Clie
 			log.V(2).Info("Skipping the sync since the local appwrapper is still suspended")
 			return nil
 		}
-		return clientutil.PatchStatus(ctx, localClient, &localAppWrapper, func() (client.Object, bool, error) {
+		return clientutil.PatchStatus(ctx, localClient, &localAppWrapper, func() (bool, error) {
 			localAppWrapper.Status = remoteAppWrapper.Status
-			return &localAppWrapper, true, nil
+			return true, nil
 		})
 	}
 
diff --git a/pkg/controller/jobs/job/job_controller.go b/pkg/controller/jobs/job/job_controller.go
index a2dcf8c33..8eba63803 100644
--- a/pkg/controller/jobs/job/job_controller.go
+++ b/pkg/controller/jobs/job/job_controller.go
@@ -167,14 +167,14 @@ func (j *Job) Stop(ctx context.Context, c client.Client, podSetsInfo []podset.Po
 	stoppedNow := false
 
 	if !j.IsSuspended() {
-		if err := clientutil.Patch(ctx, c, object, func() (client.Object, bool, error) {
+		if err := clientutil.Patch(ctx, c, object, func() (bool, error) {
 			j.Suspend()
 			if j.Annotations == nil {
 				j.Annotations = map[string]string{}
 			}
 			// We are using annotation to be sure that all updates finished successfully.
 			j.Annotations[StoppingAnnotation] = "true"
-			return object, true, nil
+			return true, nil
 		}); err != nil {
 			return false, fmt.Errorf("suspend: %w", err)
 		}
@@ -183,18 +183,18 @@ func (j *Job) Stop(ctx context.Context, c client.Client, podSetsInfo []podset.Po
 
 	// Reset start time if necessary, so we can update the scheduling directives.
 	if j.Status.StartTime != nil {
-		if err := clientutil.PatchStatus(ctx, c, object, func() (client.Object, bool, error) {
+		if err := clientutil.PatchStatus(ctx, c, object, func() (bool, error) {
 			j.Status.StartTime = nil
-			return object, true, nil
+			return true, nil
 		}); err != nil {
 			return stoppedNow, fmt.Errorf("reset status: %w", err)
 		}
 	}
 
-	if err := clientutil.Patch(ctx, c, object, func() (client.Object, bool, error) {
+	if err := clientutil.Patch(ctx, c, object, func() (bool, error) {
 		j.RestorePodSetsInfo(podSetsInfo)
 		delete(j.Annotations, StoppingAnnotation)
-		return object, true, nil
+		return true, nil
 	}); err != nil {
 		return false, fmt.Errorf("restore info: %w", err)
 	}
diff --git a/pkg/controller/jobs/job/job_multikueue_adapter.go b/pkg/controller/jobs/job/job_multikueue_adapter.go
index 31741432b..bb7a0b330 100644
--- a/pkg/controller/jobs/job/job_multikueue_adapter.go
+++ b/pkg/controller/jobs/job/job_multikueue_adapter.go
@@ -69,9 +69,9 @@ func (b *multiKueueAdapter) SyncJob(ctx context.Context, localClient client.Clie
 				log.V(2).Info("Skipping the sync since the local job is still suspended")
 				return nil
 			}
-			return clientutil.PatchStatus(ctx, localClient, &localJob, func() (client.Object, bool, error) {
+			return clientutil.PatchStatus(ctx, localClient, &localJob, func() (bool, error) {
 				localJob.Status = remoteJob.Status
-				return &localJob, true, nil
+				return true, nil
 			})
 		}
 		remoteFinished := false
@@ -82,9 +82,9 @@ func (b *multiKueueAdapter) SyncJob(ctx context.Context, localClient client.Clie
 			}
 		}
 		if remoteFinished {
-			return clientutil.PatchStatus(ctx, localClient, &localJob, func() (client.Object, bool, error) {
+			return clientutil.PatchStatus(ctx, localClient, &localJob, func() (bool, error) {
 				localJob.Status = remoteJob.Status
-				return &localJob, true, nil
+				return true, nil
 			})
 		}
 
@@ -113,7 +113,7 @@ func (b *multiKueueAdapter) SyncJob(ctx context.Context, localClient client.Clie
 			}
 
 			// Update remote job's workload slice name and parallelism if needed.
-			if err := clientutil.Patch(ctx, remoteClient, &remoteJob, func() (client.Object, bool, error) {
+			if err := clientutil.Patch(ctx, remoteClient, &remoteJob, func() (bool, error) {
 				// Update workload name label.
 				labelsChanged := false
 				if remoteJob.Labels == nil {
@@ -128,7 +128,7 @@ func (b *multiKueueAdapter) SyncJob(ctx context.Context, localClient client.Clie
 
 				// Update parallelism.
 				remoteJob.Spec.Parallelism = localJob.Spec.Parallelism
-				return &remoteJob, oldParallelism != newParallelism || labelsChanged, nil
+				return oldParallelism != newParallelism || labelsChanged, nil
 			}); err != nil {
 				return fmt.Errorf("failed to patch remote job: %w", err)
 			}
diff --git a/pkg/controller/jobs/jobset/jobset_multikueue_adapter.go b/pkg/controller/jobs/jobset/jobset_multikueue_adapter.go
index 9f987b757..e8b274ee9 100644
--- a/pkg/controller/jobs/jobset/jobset_multikueue_adapter.go
+++ b/pkg/controller/jobs/jobset/jobset_multikueue_adapter.go
@@ -64,9 +64,9 @@ func (b *multiKueueAdapter) SyncJob(ctx context.Context, localClient client.Clie
 			return nil
 		}
 
-		return clientutil.PatchStatus(ctx, localClient, &localJob, func() (client.Object, bool, error) {
+		return clientutil.PatchStatus(ctx, localClient, &localJob, func() (bool, error) {
 			localJob.Status = remoteJob.Status
-			return &localJob, true, nil
+			return true, nil
 		})
 	}
 
diff --git a/pkg/controller/jobs/kubeflow/kubeflowjob/kubeflowjob_multikueue_adapter.go b/pkg/controller/jobs/kubeflow/kubeflowjob/kubeflowjob_multikueue_adapter.go
index a1f52a65b..855fc6fd9 100644
--- a/pkg/controller/jobs/kubeflow/kubeflowjob/kubeflowjob_multikueue_adapter.go
+++ b/pkg/controller/jobs/kubeflow/kubeflowjob/kubeflowjob_multikueue_adapter.go
@@ -121,10 +121,10 @@ func (a adapter[PtrT, T]) SyncJob(
 			return nil
 		}
 
-		return clientutil.PatchStatus(ctx, localClient, localJob, func() (client.Object, bool, error) {
+		return clientutil.PatchStatus(ctx, localClient, localJob, func() (bool, error) {
 			// if the remote exists, just copy the status
 			a.copyStatus(localJob, remoteJob)
-			return localJob, true, nil
+			return true, nil
 		})
 	}
 
diff --git a/pkg/controller/jobs/leaderworkerset/leaderworkerset_pod_reconciler.go b/pkg/controller/jobs/leaderworkerset/leaderworkerset_pod_reconciler.go
index 34d7e32f5..e29f7c462 100644
--- a/pkg/controller/jobs/leaderworkerset/leaderworkerset_pod_reconciler.go
+++ b/pkg/controller/jobs/leaderworkerset/leaderworkerset_pod_reconciler.go
@@ -72,7 +72,7 @@ func (r *PodReconciler) Reconcile(ctx context.Context, req reconcile.Request) (r
 	log.V(2).Info("Reconcile LeaderWorkerSet Pod")
 
 	if utilpod.IsTerminated(pod) {
-		err = client.IgnoreNotFound(clientutil.Patch(ctx, r.client, pod, func() (client.Object, bool, error) {
+		err = client.IgnoreNotFound(clientutil.Patch(ctx, r.client, pod, func() (bool, error) {
 			removed := controllerutil.RemoveFinalizer(pod, podconstants.PodFinalizer)
 			if removed {
 				log.V(3).Info(
@@ -82,18 +82,18 @@ func (r *PodReconciler) Reconcile(ctx context.Context, req reconcile.Request) (r
 					"group", pod.Labels[podconstants.GroupNameLabel],
 				)
 			}
-			return pod, removed, nil
+			return removed, nil
 		}))
 	} else {
-		err = client.IgnoreNotFound(clientutil.Patch(ctx, r.client, pod, func() (client.Object, bool, error) {
+		err = client.IgnoreNotFound(clientutil.Patch(ctx, r.client, pod, func() (bool, error) {
 			updated, err := r.setDefault(ctx, pod)
 			if err != nil {
-				return nil, false, err
+				return false, err
 			}
 			if updated {
 				log.V(3).Info("Updating pod in group", "pod", klog.KObj(pod), "group", pod.Labels[podconstants.GroupNameLabel])
 			}
-			return pod, updated, nil
+			return updated, nil
 		}))
 	}
 
diff --git a/pkg/controller/jobs/mpijob/mpijob_multikueue_adapter.go b/pkg/controller/jobs/mpijob/mpijob_multikueue_adapter.go
index dddf11029..839cfbf90 100644
--- a/pkg/controller/jobs/mpijob/mpijob_multikueue_adapter.go
+++ b/pkg/controller/jobs/mpijob/mpijob_multikueue_adapter.go
@@ -64,9 +64,9 @@ func (b *multiKueueAdapter) SyncJob(ctx context.Context, localClient client.Clie
 			return nil
 		}
 
-		return clientutil.PatchStatus(ctx, localClient, &localJob, func() (client.Object, bool, error) {
+		return clientutil.PatchStatus(ctx, localClient, &localJob, func() (bool, error) {
 			localJob.Status = remoteJob.Status
-			return &localJob, true, nil
+			return true, nil
 		})
 	}
 
diff --git a/pkg/controller/jobs/pod/pod_controller.go b/pkg/controller/jobs/pod/pod_controller.go
index 622748917..1d83332c1 100644
--- a/pkg/controller/jobs/pod/pod_controller.go
+++ b/pkg/controller/jobs/pod/pod_controller.go
@@ -264,8 +264,8 @@ func (p *Pod) Run(ctx context.Context, c client.Client, podSetsInfo []podset.Pod
 			return nil
 		}
 
-		if err := clientutil.Patch(ctx, c, &p.pod, func() (client.Object, bool, error) {
-			return &p.pod, true, prepare(&p.pod, podSetsInfo[0])
+		if err := clientutil.Patch(ctx, c, &p.pod, func() (bool, error) {
+			return true, prepare(&p.pod, podSetsInfo[0])
 		}); err != nil {
 			return err
 		}
@@ -284,27 +284,27 @@ func (p *Pod) Run(ctx context.Context, c client.Client, podSetsInfo []podset.Pod
 			return nil
 		}
 
-		if err := clientutil.Patch(ctx, c, pod, func() (client.Object, bool, error) {
+		if err := clientutil.Patch(ctx, c, pod, func() (bool, error) {
 			roleHash, err := getRoleHash(*pod)
 			if err != nil {
-				return nil, false, err
+				return false, err
 			}
 
 			podSetIndex := slices.IndexFunc(podSetsInfo, func(info podset.PodSetInfo) bool {
 				return string(info.Name) == roleHash
 			})
 			if podSetIndex == -1 {
-				return nil, false, fmt.Errorf("%w: podSetInfo with the name '%s' is not found", podset.ErrInvalidPodsetInfo, roleHash)
+				return false, fmt.Errorf("%w: podSetInfo with the name '%s' is not found", podset.ErrInvalidPodsetInfo, roleHash)
 			}
 
 			err = prepare(pod, podSetsInfo[podSetIndex])
 			if err != nil {
-				return nil, false, err
+				return false, err
 			}
 
 			log.V(3).Info("Starting pod in group", "podInGroup", klog.KObj(pod))
 
-			return pod, true, nil
+			return true, nil
 		}); err != nil {
 			return err
 		}
@@ -554,8 +554,8 @@ func (p *Pod) Finalize(ctx context.Context, c client.Client) error {
 
 	return parallelize.Until(ctx, len(podsInGroup.Items), func(i int) error {
 		pod := &podsInGroup.Items[i]
-		return clientutil.Patch(ctx, c, pod, func() (client.Object, bool, error) {
-			return pod, controllerutil.RemoveFinalizer(pod, podconstants.PodFinalizer), nil
+		return clientutil.Patch(ctx, c, pod, func() (bool, error) {
+			return controllerutil.RemoveFinalizer(pod, podconstants.PodFinalizer), nil
 		}, clientutil.WithLoose())
 	})
 }
@@ -920,12 +920,12 @@ func (p *Pod) removeExcessPods(ctx context.Context, c client.Client, r record.Ev
 	// Finalize and delete the active pods created last
 	err := parallelize.Until(ctx, len(extraPods), func(i int) error {
 		pod := extraPods[i]
-		if err := clientutil.Patch(ctx, c, &pod, func() (client.Object, bool, error) {
+		if err := clientutil.Patch(ctx, c, &pod, func() (bool, error) {
 			removed := controllerutil.RemoveFinalizer(&pod, podconstants.PodFinalizer)
 			if removed {
 				log.V(3).Info("Finalizing excess pod in group", "excessPod", klog.KObj(&pod))
 			}
-			return &pod, removed, nil
+			return removed, nil
 		}, clientutil.WithLoose()); err != nil {
 			// We won't observe this cleanup in the event handler.
 			p.excessPodExpectations.ObservedUID(log, p.key, pod.UID)
@@ -962,12 +962,12 @@ func (p *Pod) finalizePods(ctx context.Context, c client.Client, extraPods []cor
 	err := parallelize.Until(ctx, len(extraPods), func(i int) error {
 		pod := extraPods[i]
 		var removed bool
-		if err := clientutil.Patch(ctx, c, &pod, func() (client.Object, bool, error) {
+		if err := clientutil.Patch(ctx, c, &pod, func() (bool, error) {
 			removed = controllerutil.RemoveFinalizer(&pod, podconstants.PodFinalizer)
 			if removed {
 				log.V(3).Info("Finalizing pod in group", "Pod", klog.KObj(&pod))
 			}
-			return &pod, removed, nil
+			return removed, nil
 		}, clientutil.WithLoose()); err != nil {
 			// We won't observe this cleanup in the event handler.
 			p.excessPodExpectations.ObservedUID(log, p.key, pod.UID)
diff --git a/pkg/controller/jobs/pod/pod_multikueue_adapter.go b/pkg/controller/jobs/pod/pod_multikueue_adapter.go
index a665abbb4..e1f5a5eca 100644
--- a/pkg/controller/jobs/pod/pod_multikueue_adapter.go
+++ b/pkg/controller/jobs/pod/pod_multikueue_adapter.go
@@ -167,9 +167,9 @@ func syncLocalPodWithRemote(
 		}
 
 		// Patch the status of the local pod to match the remote pod
-		return clientutil.PatchStatus(ctx, localClient, localPod, func() (client.Object, bool, error) {
+		return clientutil.PatchStatus(ctx, localClient, localPod, func() (bool, error) {
 			localPod.Status = remotePod.Status
-			return localPod, true, nil
+			return true, nil
 		})
 	}
 
diff --git a/pkg/controller/jobs/raycluster/raycluster_multikueue_adapter.go b/pkg/controller/jobs/raycluster/raycluster_multikueue_adapter.go
index ec4150f72..fc661a2a4 100644
--- a/pkg/controller/jobs/raycluster/raycluster_multikueue_adapter.go
+++ b/pkg/controller/jobs/raycluster/raycluster_multikueue_adapter.go
@@ -64,9 +64,9 @@ func (b *multiKueueAdapter) SyncJob(ctx context.Context, localClient client.Clie
 			return nil
 		}
 
-		return clientutil.PatchStatus(ctx, localClient, &localJob, func() (client.Object, bool, error) {
+		return clientutil.PatchStatus(ctx, localClient, &localJob, func() (bool, error) {
 			localJob.Status = remoteJob.Status
-			return &localJob, true, nil
+			return true, nil
 		})
 	}
 
diff --git a/pkg/controller/jobs/rayjob/rayjob_multikueue_adapter.go b/pkg/controller/jobs/rayjob/rayjob_multikueue_adapter.go
index 0d846b703..e72e51a49 100644
--- a/pkg/controller/jobs/rayjob/rayjob_multikueue_adapter.go
+++ b/pkg/controller/jobs/rayjob/rayjob_multikueue_adapter.go
@@ -63,9 +63,9 @@ func (b *multiKueueAdapter) SyncJob(ctx context.Context, localClient client.Clie
 			log.V(2).Info("Skipping the sync since the local job is still suspended")
 			return nil
 		}
-		return clientutil.PatchStatus(ctx, localClient, &localJob, func() (client.Object, bool, error) {
+		return clientutil.PatchStatus(ctx, localClient, &localJob, func() (bool, error) {
 			localJob.Status = remoteJob.Status
-			return &localJob, true, nil
+			return true, nil
 		})
 	}
 
diff --git a/pkg/controller/jobs/statefulset/statefulset_reconciler.go b/pkg/controller/jobs/statefulset/statefulset_reconciler.go
index 6d7d2a9b0..3087fc550 100644
--- a/pkg/controller/jobs/statefulset/statefulset_reconciler.go
+++ b/pkg/controller/jobs/statefulset/statefulset_reconciler.go
@@ -103,16 +103,16 @@ func (r *Reconciler) finalizePods(ctx context.Context, sts *appsv1.StatefulSet,
 
 func (r *Reconciler) finalizePod(ctx context.Context, sts *appsv1.StatefulSet, pod *corev1.Pod) error {
 	log := ctrl.LoggerFrom(ctx)
-	return client.IgnoreNotFound(clientutil.Patch(ctx, r.client, pod, func() (client.Object, bool, error) {
+	return client.IgnoreNotFound(clientutil.Patch(ctx, r.client, pod, func() (bool, error) {
 		if ungateAndFinalize(sts, pod) {
 			log.V(3).Info(
 				"Finalizing pod in group",
 				"pod", klog.KObj(pod),
 				"group", pod.Labels[podcontroller.GroupNameLabel],
 			)
-			return pod, true, nil
+			return true, nil
 		}
-		return pod, false, nil
+		return false, nil
 	}))
 }
 
diff --git a/pkg/controller/jobs/trainjob/trainjob_controller.go b/pkg/controller/jobs/trainjob/trainjob_controller.go
index bb2df2a94..f06290d47 100644
--- a/pkg/controller/jobs/trainjob/trainjob_controller.go
+++ b/pkg/controller/jobs/trainjob/trainjob_controller.go
@@ -297,11 +297,11 @@ func (t *TrainJob) Stop(ctx context.Context, c client.Client, podSetsInfo []pods
 		return false, errors.New("jobs are still active")
 	}
 
-	if err := clientutil.Patch(ctx, reconciler.client, t.Object(), func() (client.Object, bool, error) {
+	if err := clientutil.Patch(ctx, reconciler.client, t.Object(), func() (bool, error) {
 		if !t.RestorePodSetsInfo(podSetsInfo) {
-			return t.Object(), false, errors.New("error restoring info to the trainjob")
+			return false, errors.New("error restoring info to the trainjob")
 		}
-		return t.Object(), true, nil
+		return true, nil
 	}); err != nil {
 		return false, err
 	}
diff --git a/pkg/controller/jobs/trainjob/trainjob_multikueue_adapter.go b/pkg/controller/jobs/trainjob/trainjob_multikueue_adapter.go
index 5ac9db1de..ce77d08c6 100644
--- a/pkg/controller/jobs/trainjob/trainjob_multikueue_adapter.go
+++ b/pkg/controller/jobs/trainjob/trainjob_multikueue_adapter.go
@@ -64,9 +64,9 @@ func (b *multiKueueAdapter) SyncJob(ctx context.Context, localClient client.Clie
 			return nil
 		}
 
-		return clientutil.PatchStatus(ctx, localClient, &localJob, func() (client.Object, bool, error) {
+		return clientutil.PatchStatus(ctx, localClient, &localJob, func() (bool, error) {
 			localJob.Status = remoteJob.Status
-			return &localJob, true, nil
+			return true, nil
 		})
 	}
 
diff --git a/pkg/controller/tas/node_failure_controller.go b/pkg/controller/tas/node_failure_controller.go
index 5617685c8..165b0e972 100644
--- a/pkg/controller/tas/node_failure_controller.go
+++ b/pkg/controller/tas/node_failure_controller.go
@@ -342,11 +342,11 @@ func (r *nodeFailureReconciler) handleHealthyNode(ctx context.Context, nodeName
 
 func (r *nodeFailureReconciler) removeUnhealthyNodes(ctx context.Context, wl *kueue.Workload, nodeName string) error {
 	if workload.HasUnhealthyNode(wl, nodeName) {
-		return workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (*kueue.Workload, bool, error) {
+		return workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (bool, error) {
 			wl.Status.UnhealthyNodes = slices.DeleteFunc(wl.Status.UnhealthyNodes, func(n kueue.UnhealthyNode) bool {
 				return n.Name == nodeName
 			})
-			return wl, true, nil
+			return true, nil
 		})
 	}
 	return nil
@@ -354,9 +354,9 @@ func (r *nodeFailureReconciler) removeUnhealthyNodes(ctx context.Context, wl *ku
 
 func (r *nodeFailureReconciler) addUnhealthyNode(ctx context.Context, wl *kueue.Workload, nodeName string) error {
 	if !workload.HasUnhealthyNode(wl, nodeName) {
-		return workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (*kueue.Workload, bool, error) {
+		return workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (bool, error) {
 			wl.Status.UnhealthyNodes = append(wl.Status.UnhealthyNodes, kueue.UnhealthyNode{Name: nodeName})
-			return wl, true, nil
+			return true, nil
 		})
 	}
 	return nil
diff --git a/pkg/controller/tas/topology_ungater.go b/pkg/controller/tas/topology_ungater.go
index 16132c797..6d4dad1b8 100644
--- a/pkg/controller/tas/topology_ungater.go
+++ b/pkg/controller/tas/topology_ungater.go
@@ -238,14 +238,14 @@ func (r *topologyUngater) Reconcile(ctx context.Context, req reconcile.Request)
 	err := parallelize.Until(ctx, len(allToUngate), func(i int) error {
 		podWithUngateInfo := &allToUngate[i]
 		var ungated bool
-		e := utilclient.Patch(ctx, r.client, podWithUngateInfo.pod, func() (client.Object, bool, error) {
+		e := utilclient.Patch(ctx, r.client, podWithUngateInfo.pod, func() (bool, error) {
 			log.V(3).Info("ungating pod", "pod", klog.KObj(podWithUngateInfo.pod), "nodeLabels", podWithUngateInfo.nodeLabels)
 			ungated = utilpod.Ungate(podWithUngateInfo.pod, kueue.TopologySchedulingGate)
 			if podWithUngateInfo.pod.Spec.NodeSelector == nil {
 				podWithUngateInfo.pod.Spec.NodeSelector = make(map[string]string)
 			}
 			maps.Copy(podWithUngateInfo.pod.Spec.NodeSelector, podWithUngateInfo.nodeLabels)
-			return podWithUngateInfo.pod, true, nil
+			return true, nil
 		})
 		if e != nil {
 			// We won't observe this cleanup in the event handler.
diff --git a/pkg/controller/workloaddispatcher/incrementaldispatcher.go b/pkg/controller/workloaddispatcher/incrementaldispatcher.go
index 891de59de..7e8d1ed52 100644
--- a/pkg/controller/workloaddispatcher/incrementaldispatcher.go
+++ b/pkg/controller/workloaddispatcher/incrementaldispatcher.go
@@ -140,9 +140,9 @@ func (r *IncrementalDispatcherReconciler) nominateWorkers(ctx context.Context, w
 	}
 
 	nominatedWorkers := append(wl.Status.NominatedClusterNames, nextNominatedWorkers...)
-	if err = workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (*kueue.Workload, bool, error) {
+	if err = workload.PatchAdmissionStatus(ctx, r.client, wl, r.clock, func() (bool, error) {
 		wl.Status.NominatedClusterNames = nominatedWorkers
-		return wl, true, nil
+		return true, nil
 	}); err != nil {
 		log.V(2).Error(err, "Failed to patch nominated clusters")
 		return reconcile.Result{}, err
diff --git a/pkg/features/kube_features.go b/pkg/features/kube_features.go
index acfd21fa5..917925d36 100644
--- a/pkg/features/kube_features.go
+++ b/pkg/features/kube_features.go
@@ -161,6 +161,7 @@ const (
 	// kep: https://github.com/kubernetes-sigs/kueue/tree/main/keps/582-preempt-based-on-flavor-order
 	//
 	// In flavor fungibility, the preference whether to preempt or borrow is inferred from flavor fungibility policy.
+	//
 	// Deprecated: planned to be removed in v0.16.
 	FlavorFungibilityImplicitPreferenceDefault featuregate.Feature = "FlavorFungibilityImplicitPreferenceDefault"
 
@@ -201,6 +202,7 @@ const (
 	//
 	// Allow insecure kubeconfigs in MultiKueue setup.
 	// Requires careful consideration as it may lead to security issues.
+	//
 	// Deprecated: planned to be removed in 0.17
 	MultiKueueAllowInsecureKubeconfigs featuregate.Feature = "MultiKueueAllowInsecureKubeconfigs"
 
@@ -214,6 +216,12 @@ const (
 	// issue: https://github.com/kubernetes-sigs/kueue/issues/7597
 	// Do not remove job-name label from Workload PodTemplate object.
 	PropagateBatchJobLabelsToWorkload featuregate.Feature = "PropagateBatchJobLabelsToWorkload"
+
+	// owner: @hdp617
+	// kep: https://github.com/kubernetes-sigs/kueue/tree/main/keps/693-multikueue
+	//
+	// Enables ClusterProfile integration for MultiKueue.
+	MultiKueueClusterProfile featuregate.Feature = "MultiKueueClusterProfile"
 )
 
 func init() {
@@ -334,9 +342,14 @@ var defaultVersionedFeatureGates = map[featuregate.Feature]featuregate.Versioned
 	ReclaimablePods: {
 		{Version: version.MustParse("0.15"), Default: true, PreRelease: featuregate.Beta},
 	},
+	// PropagateBatchJobLabelsToWorkload is anabled from 0.13.10 and 0.14.5.
 	PropagateBatchJobLabelsToWorkload: {
 		{Version: version.MustParse("0.15"), Default: true, PreRelease: featuregate.Beta},
 	},
+
+	MultiKueueClusterProfile: {
+		{Version: version.MustParse("0.15"), Default: false, PreRelease: featuregate.Alpha},
+	},
 }
 
 func SetFeatureGateDuringTest(tb testing.TB, f featuregate.Feature, value bool) {
diff --git a/pkg/scheduler/preemption/preemption.go b/pkg/scheduler/preemption/preemption.go
index 625f63ce5..8112096a9 100644
--- a/pkg/scheduler/preemption/preemption.go
+++ b/pkg/scheduler/preemption/preemption.go
@@ -168,9 +168,8 @@ func (p *Preemptor) IssuePreemptions(ctx context.Context, preemptor *workload.In
 
 			message := preemptionMessage(preemptor.Obj, target.Reason, preemptorPath, preempteePath)
 			wlCopy := target.WorkloadInfo.Obj.DeepCopy()
-			err := workload.Evict(ctx, p.client, p.recorder, wlCopy, kueue.WorkloadEvictedByPreemption, message, "", p.clock, workload.WithCustomPrepare(func() (*kueue.Workload, error) {
+			err := workload.Evict(ctx, p.client, p.recorder, wlCopy, kueue.WorkloadEvictedByPreemption, message, "", p.clock, workload.WithCustomPrepare(func() {
 				workload.SetPreemptedCondition(wlCopy, p.clock.Now(), target.Reason, message)
-				return wlCopy, nil
 			}))
 			if err != nil {
 				errCh.SendErrorWithCancel(err, cancel)
diff --git a/pkg/scheduler/scheduler.go b/pkg/scheduler/scheduler.go
index 6767fa316..8eac6bd40 100644
--- a/pkg/scheduler/scheduler.go
+++ b/pkg/scheduler/scheduler.go
@@ -313,8 +313,8 @@ func (s *Scheduler) schedule(ctx context.Context) wait.SpeedSignal {
 			// Block admission until all currently admitted workloads are in
 			// PodsReady condition if the waitForPodsReady is enabled
 			wl := e.Obj.DeepCopy()
-			if err := workload.PatchAdmissionStatus(ctx, s.client, wl, s.clock, func() (*kueue.Workload, bool, error) {
-				return wl, workload.UnsetQuotaReservationWithCondition(wl, "Waiting", "waiting for all admitted workloads to be in PodsReady condition", s.clock.Now()), nil
+			if err := workload.PatchAdmissionStatus(ctx, s.client, wl, s.clock, func() (bool, error) {
+				return workload.UnsetQuotaReservationWithCondition(wl, "Waiting", "waiting for all admitted workloads to be in PodsReady condition", s.clock.Now()), nil
 			}, workload.WithLooseOnApply()); err != nil {
 				log.Error(err, "Could not update Workload status")
 			}
@@ -612,44 +612,28 @@ func updateAssignmentForTAS(snapshot *schdcache.Snapshot, cq *schdcache.ClusterQ
 // assuming it in the cache.
 func (s *Scheduler) admit(ctx context.Context, e *entry, cq *schdcache.ClusterQueueSnapshot) error {
 	log := ctrl.LoggerFrom(ctx)
-	newWorkload := e.Obj.DeepCopy()
-	origWorkload := e.Obj.DeepCopy()
 	admission := &kueue.Admission{
 		ClusterQueue:      e.ClusterQueue,
 		PodSetAssignments: e.assignment.ToAPI(),
 	}
 
-	workload.SetQuotaReservation(newWorkload, admission, s.clock)
-	if workload.HasAllChecks(newWorkload, workload.AdmissionChecksForWorkload(log, newWorkload, cq.AdmissionChecks, schdcache.AllFlavors(cq.ResourceGroups))) {
-		// sync Admitted, ignore the result since an API update is always done.
-		_ = workload.SyncAdmittedCondition(newWorkload, s.clock.Now())
-	}
-	if err := s.cache.AssumeWorkload(log, newWorkload); err != nil {
+	if err := s.assumeWorkload(log, e, cq, admission); err != nil {
 		return err
 	}
-	e.status = assumed
-	log.V(2).Info("Workload assumed in the cache")
-
-	if afs.Enabled(s.admissionFairSharing) {
-		s.updateEntryPenalty(log, e, add)
-
-		// Trigger LocalQueue reconciler to apply any pending penalties
-		s.queues.NotifyWorkloadUpdateWatchers(e.Obj, newWorkload)
-	}
-
-	if features.Enabled(features.TopologyAwareScheduling) && workload.HasUnhealthyNodes(e.Obj) {
-		log.V(5).Info("Clearing the topology assignment recovery field from the workload status after successful recovery")
-		newWorkload.Status.UnhealthyNodes = nil
-	}
 
+	newWorkload := e.Obj.DeepCopy()
 	s.admissionRoutineWrapper.Run(func() {
-		err := workload.PatchAdmissionStatus(ctx, s.client, origWorkload, s.clock, func() (*kueue.Workload, bool, error) {
-			return newWorkload, true, nil
+		err := workload.PatchAdmissionStatus(ctx, s.client, newWorkload, s.clock, func() (bool, error) {
+			s.prepareWorkload(log, newWorkload, cq, admission)
+			if features.Enabled(features.TopologyAwareScheduling) && workload.HasUnhealthyNodes(e.Obj) {
+				log.V(5).Info("Clearing the topology assignment recovery field from the workload status after successful recovery")
+				newWorkload.Status.UnhealthyNodes = nil
+			}
+			return true, nil
 		}, workload.WithLooseOnApply())
 		if err == nil {
 			// Record metrics and events for quota reservation and admission
 			s.recordWorkloadAdmissionMetrics(newWorkload, e.Obj, admission)
-
 			log.V(2).Info("Workload successfully admitted and assigned flavors", "assignments", admission.PodSetAssignments)
 			return
 		}
@@ -671,6 +655,32 @@ func (s *Scheduler) admit(ctx context.Context, e *entry, cq *schdcache.ClusterQu
 	return nil
 }
 
+func (s *Scheduler) prepareWorkload(log logr.Logger, wl *kueue.Workload, cq *schdcache.ClusterQueueSnapshot, admission *kueue.Admission) {
+	workload.SetQuotaReservation(wl, admission, s.clock)
+	if workload.HasAllChecks(wl, workload.AdmissionChecksForWorkload(log, wl, cq.AdmissionChecks, schdcache.AllFlavors(cq.ResourceGroups))) {
+		// sync Admitted, ignore the result since an API update is always done.
+		_ = workload.SyncAdmittedCondition(wl, s.clock.Now())
+	}
+}
+
+func (s *Scheduler) assumeWorkload(log logr.Logger, e *entry, cq *schdcache.ClusterQueueSnapshot, admission *kueue.Admission) error {
+	cacheWl := e.Obj.DeepCopy()
+	s.prepareWorkload(log, cacheWl, cq, admission)
+	if err := s.cache.AssumeWorkload(log, cacheWl); err != nil {
+		return err
+	}
+
+	e.status = assumed
+	log.V(2).Info("Workload assumed in the cache")
+
+	if afs.Enabled(s.admissionFairSharing) {
+		s.updateEntryPenalty(log, e, add)
+		// Trigger LocalQueue reconciler to apply any pending penalties
+		s.queues.NotifyWorkloadUpdateWatchers(e.Obj, cacheWl)
+	}
+	return nil
+}
+
 type entryOrdering struct {
 	entries          []entry
 	workloadOrdering workload.Ordering
@@ -779,12 +789,12 @@ func (s *Scheduler) requeueAndUpdate(ctx context.Context, e entry) {
 	log.V(2).Info("Workload re-queued", "workload", klog.KObj(e.Obj), "clusterQueue", klog.KRef("", string(e.ClusterQueue)), "queue", klog.KRef(e.Obj.Namespace, string(e.Obj.Spec.QueueName)), "requeueReason", e.requeueReason, "added", added, "status", e.status)
 	if e.status == notNominated || e.status == skipped {
 		wl := e.Obj.DeepCopy()
-		if err := workload.PatchAdmissionStatus(ctx, s.client, wl, s.clock, func() (*kueue.Workload, bool, error) {
+		if err := workload.PatchAdmissionStatus(ctx, s.client, wl, s.clock, func() (bool, error) {
 			updated := workload.UnsetQuotaReservationWithCondition(wl, "Pending", e.inadmissibleMsg, s.clock.Now())
 			if workload.PropagateResourceRequests(wl, &e.Info) {
 				updated = true
 			}
-			return wl, updated, nil
+			return updated, nil
 		}); err != nil {
 			log.Error(err, "Could not update Workload status")
 		}
diff --git a/pkg/util/client/client.go b/pkg/util/client/client.go
index 00003c1df..c6d39a868 100644
--- a/pkg/util/client/client.go
+++ b/pkg/util/client/client.go
@@ -22,6 +22,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
+// UpdateFunc is a function that modifies an object in-place.
+// It returns a bool indicating whether an update was made, and an error if any occurred.
+type UpdateFunc func() (bool, error)
+
 // PatchOption defines a functional option for customizing PatchOptions.
 // It follows the functional options pattern, allowing callers to configure
 // patch behavior at call sites without directly manipulating PatchOptions.
@@ -72,14 +76,6 @@ func WithLoose() PatchOption {
 	}
 }
 
-func patchCommon(obj client.Object, update func() (client.Object, bool, error), patchFunc func(patch client.Patch) error, options ...PatchOption) error {
-	opts := DefaultPatchOptions()
-	for _, opt := range options {
-		opt(opts)
-	}
-	return updateAndPatch(obj, *opts, update, patchFunc)
-}
-
 // Patch applies an update to a Kubernetes object using a patch-based workflow.
 //
 // The function first computes the "original" and "modified" states of the object
@@ -94,10 +90,9 @@ func patchCommon(obj client.Object, update func() (client.Object, bool, error),
 //
 // Example:
 //
-//	err := Patch(ctx, client, obj, func() (client.Object, bool, error) {
-//	    updated := obj.DeepCopyObject().(client.Object)
-//	    updated.SetLabels(map[string]string{"app": "demo"})
-//	    return updated, true, nil
+//	err := Patch(ctx, client, obj, func() (bool, error) {
+//	    obj.SetLabels(map[string]string{"app": "demo"})
+//	    return true, nil
 //	}, WithLoose())
 //	if err != nil {
 //	    log.Fatal(err)
@@ -107,7 +102,7 @@ func patchCommon(obj client.Object, update func() (client.Object, bool, error),
 //   - By default, patches are generated in "strict" mode (Strict=true).
 //     This clears the ResourceVersion field in the original object to ensure
 //     it is always included in the generated patch.
-func Patch(ctx context.Context, c client.Client, obj client.Object, update func() (client.Object, bool, error), options ...PatchOption) error {
+func Patch(ctx context.Context, c client.Client, obj client.Object, update UpdateFunc, options ...PatchOption) error {
 	return patchCommon(obj, update, func(patch client.Patch) error {
 		return c.Patch(ctx, obj, patch)
 	}, options...)
@@ -129,11 +124,9 @@ func Patch(ctx context.Context, c client.Client, obj client.Object, update func(
 //
 // Example:
 //
-//	err := PatchStatus(ctx, client, obj, func() (client.Object, bool, error) {
-//	    updated := obj.DeepCopyObject().(client.Object)
-//	    myObj := updated.(*myv1.MyCustomResource)
-//	    myObj.Status.Phase = "Ready"
-//	    return updated, true, nil
+//	err := PatchStatus(ctx, client, obj, func() (bool, error) {
+//	    obj.Status.Phase = "Ready"
+//	    return true, nil
 //	})
 //	if err != nil {
 //	    log.Fatal(err)
@@ -143,12 +136,37 @@ func Patch(ctx context.Context, c client.Client, obj client.Object, update func(
 //   - By default, patches are generated in "strict" mode (Strict=true).
 //     This clears the ResourceVersion field in the original object to ensure
 //     it is always included in the generated patch.
-func PatchStatus(ctx context.Context, c client.Client, obj client.Object, update func() (client.Object, bool, error), options ...PatchOption) error {
+func PatchStatus(ctx context.Context, c client.Client, obj client.Object, update UpdateFunc, options ...PatchOption) error {
 	return patchCommon(obj, update, func(patch client.Patch) error {
 		return c.Status().Patch(ctx, obj, patch)
 	}, options...)
 }
 
+// patchFunc is a function that applies the given client.Patch to a resource.
+// It returns an error if the patch could not be applied.
+type patchFunc func(patch client.Patch) error
+
+func patchCommon(obj client.Object, updateFn UpdateFunc, patchFn patchFunc, options ...PatchOption) error {
+	opts := DefaultPatchOptions()
+	for _, opt := range options {
+		opt(opts)
+	}
+	return executePatch(obj, opts, updateFn, patchFn)
+}
+
+func executePatch(obj client.Object, options *PatchOptions, update UpdateFunc, patchFn patchFunc) error {
+	objOriginal := getOriginalObject(obj, options)
+	updated, err := update()
+	if err != nil || !updated {
+		return err
+	}
+	patch, err := createPatch(objOriginal, obj)
+	if err != nil {
+		return err
+	}
+	return patchFn(patch)
+}
+
 // getOriginalObject creates and returns a deep copy of the given client.Object.
 // The copy represents the "original" state of the object before applying any
 // modifications. This is typically used when generating a patch.
@@ -156,8 +174,8 @@ func PatchStatus(ctx context.Context, c client.Client, obj client.Object, update
 // If PatchOptions.Strict is set to true, the function clears the
 // ResourceVersion field on the copied object. This ensures that the
 // ResourceVersion is included in the generated patch, enforcing stricter
-// version handling during patch application.
-func getOriginalObject(obj client.Object, options PatchOptions) client.Object {
+// version handling during the patch application.
+func getOriginalObject(obj client.Object, options *PatchOptions) client.Object {
 	objOriginal := obj.DeepCopyObject().(client.Object)
 	if options.Strict {
 		// Clearing ResourceVersion from the original object to make sure it is included in the generated patch.
@@ -166,19 +184,6 @@ func getOriginalObject(obj client.Object, options PatchOptions) client.Object {
 	return objOriginal
 }
 
-func updateAndPatch(obj client.Object, options PatchOptions, update func() (client.Object, bool, error), patchFn func(client.Patch) error) error {
-	objOriginal := getOriginalObject(obj, options)
-	objPatched, updated, err := update()
-	if err != nil || !updated {
-		return err
-	}
-	patch, err := createPatch(objOriginal, objPatched)
-	if err != nil {
-		return err
-	}
-	return patchFn(patch)
-}
-
 func createPatch(before, after client.Object) (client.Patch, error) {
 	patchBase := client.MergeFrom(before)
 	patchBytes, err := patchBase.Data(after)
diff --git a/pkg/workload/workload.go b/pkg/workload/workload.go
index 9ae185779..ad55a40d2 100644
--- a/pkg/workload/workload.go
+++ b/pkg/workload/workload.go
@@ -809,7 +809,7 @@ func HasTopologyAssignmentsPending(w *kueue.Workload) bool {
 	return false
 }
 
-func SetPreemptedCondition(w *kueue.Workload, now time.Time, reason string, message string) {
+func SetPreemptedCondition(w *kueue.Workload, now time.Time, reason string, message string) bool {
 	condition := metav1.Condition{
 		Type:               kueue.WorkloadPreempted,
 		Status:             metav1.ConditionTrue,
@@ -817,7 +817,7 @@ func SetPreemptedCondition(w *kueue.Workload, now time.Time, reason string, mess
 		Reason:             reason,
 		Message:            api.TruncateConditionMessage(message),
 	}
-	apimeta.SetStatusCondition(&w.Status.Conditions, condition)
+	return apimeta.SetStatusCondition(&w.Status.Conditions, condition)
 }
 
 func SetDeactivationTarget(w *kueue.Workload, reason string, message string) bool {
@@ -1023,7 +1023,7 @@ func WithLooseOnApply() PatchAdmissionStatusOption {
 // PatchAdmissionStatus updates the admission status of a workload.
 // If the WorkloadRequestUseMergePatch feature is enabled, it uses a Merge Patch with update function.
 // Otherwise, it runs the update function and, if updated, applies the SSA Patch status.
-func PatchAdmissionStatus(ctx context.Context, c client.Client, w *kueue.Workload, clk clock.Clock, update func() (*kueue.Workload, bool, error), options ...PatchAdmissionStatusOption) error {
+func PatchAdmissionStatus(ctx context.Context, c client.Client, w *kueue.Workload, clk clock.Clock, update func() (bool, error), options ...PatchAdmissionStatusOption) error {
 	opts := DefaultPatchAdmissionStatusOptions()
 	for _, opt := range options {
 		opt(opts)
@@ -1034,16 +1034,14 @@ func PatchAdmissionStatus(ctx context.Context, c client.Client, w *kueue.Workloa
 		if !opts.StrictPatch {
 			patchOptions = append(patchOptions, clientutil.WithLoose())
 		}
-		return clientutil.PatchStatus(ctx, c, w, func() (client.Object, bool, error) {
-			return update()
-		}, patchOptions...)
+		return clientutil.PatchStatus(ctx, c, w, update, patchOptions...)
 	}
-	wPatched, updated, err := update()
+	updated, err := update()
 	if err != nil || !updated {
 		return err
 	}
 
-	return ApplyAdmissionStatus(ctx, c, wPatched, opts.StrictApply, clk)
+	return ApplyAdmissionStatus(ctx, c, w, opts.StrictApply, clk)
 }
 
 type Ordering struct {
@@ -1281,7 +1279,7 @@ func AdmissionChecksForWorkload(log logr.Logger, wl *kueue.Workload, admissionCh
 type EvictOption func(*EvictOptions)
 
 type EvictOptions struct {
-	CustomPrepare func() (*kueue.Workload, error)
+	CustomPrepare func()
 }
 
 func DefaultEvictOptions() *EvictOptions {
@@ -1290,7 +1288,7 @@ func DefaultEvictOptions() *EvictOptions {
 	}
 }
 
-func WithCustomPrepare(customPrepare func() (*kueue.Workload, error)) EvictOption {
+func WithCustomPrepare(customPrepare func()) EvictOption {
 	return func(o *EvictOptions) {
 		if customPrepare != nil {
 			o.CustomPrepare = customPrepare
@@ -1304,28 +1302,27 @@ func Evict(ctx context.Context, c client.Client, recorder record.EventRecorder,
 		opt(opts)
 	}
 
-	// if there is no customPrepare, wl and wlOrig are equal
-	wlOrig := wl.DeepCopy()
-	if opts.CustomPrepare != nil {
-		var err error
-		wl, err = opts.CustomPrepare()
-		if err != nil || wl == nil {
-			return err
+	var (
+		hadAdmission              = wl.Status.Admission != nil
+		reportWorkloadEvictedOnce bool
+	)
+
+	if err := PatchAdmissionStatus(ctx, c, wl, clock, func() (bool, error) {
+		if opts.CustomPrepare != nil {
+			opts.CustomPrepare()
 		}
-	}
 
-	evictionReason := reason
-	if reason == kueue.WorkloadDeactivated && underlyingCause != "" {
-		evictionReason = ReasonWithCause(evictionReason, string(underlyingCause))
-	}
-	prepareForEviction(wl, clock.Now(), evictionReason, msg)
-	reportWorkloadEvictedOnce := workloadEvictionStateInc(wl, reason, underlyingCause)
-	if err := PatchAdmissionStatus(ctx, c, wlOrig, clock, func() (*kueue.Workload, bool, error) {
-		return wl, true, nil
+		evictionReason := reason
+		if reason == kueue.WorkloadDeactivated && underlyingCause != "" {
+			evictionReason = ReasonWithCause(evictionReason, string(underlyingCause))
+		}
+		prepareForEviction(wl, clock.Now(), evictionReason, msg)
+		reportWorkloadEvictedOnce = workloadEvictionStateInc(wl, reason, underlyingCause)
+		return true, nil
 	}); err != nil {
 		return err
 	}
-	if wlOrig.Status.Admission == nil {
+	if !hadAdmission {
 		// This is an extra safeguard for access to `wl.Status.Admission`.
 		// This function is expected to be called only for workload which have
 		// Admission.
@@ -1340,17 +1337,15 @@ func Evict(ctx context.Context, c client.Client, recorder record.EventRecorder,
 	return nil
 }
 
-func Finish(ctx context.Context, c client.Client, wl *kueue.Workload, reason, msg, managerPrefix string, clock clock.Clock) error {
+func Finish(ctx context.Context, c client.Client, wl *kueue.Workload, reason, msg string, clock clock.Clock) error {
 	if features.Enabled(features.WorkloadRequestUseMergePatch) {
-		return clientutil.PatchStatus(ctx, c, wl, func() (client.Object, bool, error) {
-			update := SetFinishedCondition(wl, clock.Now(), reason, msg)
-			return wl, update, nil
+		return clientutil.PatchStatus(ctx, c, wl, func() (bool, error) {
+			return SetFinishedCondition(wl, clock.Now(), reason, msg), nil
 		})
 	} else {
-		newWl := BaseSSAWorkload(wl, true)
+		newWl := PrepareWorkloadPatch(wl, true, clock)
 		SetFinishedCondition(newWl, clock.Now(), reason, msg)
-		fieldOwner := client.FieldOwner(managerPrefix + "-" + kueue.WorkloadFinished)
-		return c.Status().Patch(ctx, newWl, client.Apply, fieldOwner, client.ForceOwnership)
+		return c.Status().Patch(ctx, newWl, client.Apply, client.FieldOwner(constants.AdmissionName), client.ForceOwnership)
 	}
 }
 
diff --git a/pkg/workloadslicing/workloadslicing.go b/pkg/workloadslicing/workloadslicing.go
index 268b7406b..a3d5b7d1e 100644
--- a/pkg/workloadslicing/workloadslicing.go
+++ b/pkg/workloadslicing/workloadslicing.go
@@ -104,7 +104,7 @@ func Finish(ctx context.Context, clnt client.Client, clk clock.Clock, workloadSl
 	if apimeta.IsStatusConditionTrue(workloadSlice.Status.Conditions, kueue.WorkloadFinished) {
 		return nil
 	}
-	if err := workload.Finish(ctx, clnt, workloadSlice, reason, message, "", clk); err != nil {
+	if err := workload.Finish(ctx, clnt, workloadSlice, reason, message, clk); err != nil {
 		return fmt.Errorf("failed to patch workload slice status: %w", err)
 	}
 	return nil
@@ -275,8 +275,8 @@ func StartWorkloadSlicePods(ctx context.Context, clnt client.Client, object clie
 		return fmt.Errorf("failed to list job pods: %w", err)
 	}
 	for i := range list.Items {
-		if err := clientutil.Patch(ctx, clnt, &list.Items[i], func() (client.Object, bool, error) {
-			return &list.Items[i], pod.Ungate(&list.Items[i], kueue.ElasticJobSchedulingGate), nil
+		if err := clientutil.Patch(ctx, clnt, &list.Items[i], func() (bool, error) {
+			return pod.Ungate(&list.Items[i], kueue.ElasticJobSchedulingGate), nil
 		}); err != nil {
 			return fmt.Errorf("failed to patch pod: %w", err)
 		}
diff --git a/site/content/en/docs/installation/_index.md b/site/content/en/docs/installation/_index.md
index 8457507ec..947fabc13 100644
--- a/site/content/en/docs/installation/_index.md
+++ b/site/content/en/docs/installation/_index.md
@@ -318,9 +318,13 @@ spec:
 | `SanitizePodSets`                             | `true`  | Beta  | 0.13  |       |
 | `MultiKueueAllowInsecureKubeconfigs`          | `false` | Alpha | 0.13  |       |
 | `ReclaimablePods`                             | `true`  | Beta  | 0.15  |       |
+| `MultiKueueAdaptersForCustomJobs`             | `false` | Alpha | 0.14  | 0.14  |
+| `MultiKueueAdaptersForCustomJobs`             | `true`  | Beta  | 0.15  |       |
+| `PropagateBatchJobLabelsToWorkload`           | `true`  | Beta  | 0.15  |       |
 
 {{% alert title="Note" color="primary" %}}
 The SanitizePodSets and MultiKueueAllowInsecureKubeconfigs features are available starting from versions 0.13.8 and 0.14.3.
+The PropagateBatchJobLabelsToWorkload feature is available starting from versions 0.13.10 and 0.14.5.
 {{% /alert %}}
 
 ### Feature gates for graduated or deprecated features
diff --git a/site/content/en/docs/reference/kueue-config.v1beta1.md b/site/content/en/docs/reference/kueue-config.v1beta1.md
index 3f0e2025f..b69c10cd0 100644
--- a/site/content/en/docs/reference/kueue-config.v1beta1.md
+++ b/site/content/en/docs/reference/kueue-config.v1beta1.md
@@ -487,8 +487,8 @@ the expected format is <code>Kind.version.group.com</code>.</p>
 <a href="#config-kueue-x-k8s-io-v1beta1-PodIntegrationOptions"><code>PodIntegrationOptions</code></a>
 </td>
 <td>
-   <p>PodOptions defines kueue controller behaviour for pod objects
-Deprecated: This field will be removed on v1beta2, use ManagedJobsNamespaceSelector
+   <p>PodOptions defines kueue controller behaviour for pod objects</p>
+<p>Deprecated: This field will be removed on v1beta2, use ManagedJobsNamespaceSelector
 (https://kueue.sigs.k8s.io/docs/tasks/run/plain_pods/)
 instead.</p>
 </td>
diff --git a/site/content/en/docs/reference/kueue-config.v1beta2.md b/site/content/en/docs/reference/kueue-config.v1beta2.md
index 40391b9ad..bd5ea5e8f 100644
--- a/site/content/en/docs/reference/kueue-config.v1beta2.md
+++ b/site/content/en/docs/reference/kueue-config.v1beta2.md
@@ -85,6 +85,66 @@ connection.</p>
 </tbody>
 </table>
 
+## `ClusterProfileConfig`     {#config-kueue-x-k8s-io-v1beta2-ClusterProfileConfig}
+    
+
+**Appears in:**
+
+- [MultiKueue](#config-kueue-x-k8s-io-v1beta2-MultiKueue)
+
+
+<p>ClusterProfileConfig defines configuration for using the ClusterProfile API in MultiKueue.</p>
+
+
+<table class="table">
+<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
+<tbody>
+    
+  
+<tr><td><code>credentialsProviders</code> <B>[Required]</B><br/>
+<a href="#config-kueue-x-k8s-io-v1beta2-ClusterProfileCredentialsProvider"><code>[]ClusterProfileCredentialsProvider</code></a>
+</td>
+<td>
+   <p>CredentialsProviders defines a list of providers to obtain credentials of worker clusters
+using the ClusterProfile API.</p>
+</td>
+</tr>
+</tbody>
+</table>
+
+## `ClusterProfileCredentialsProvider`     {#config-kueue-x-k8s-io-v1beta2-ClusterProfileCredentialsProvider}
+    
+
+**Appears in:**
+
+- [ClusterProfileConfig](#config-kueue-x-k8s-io-v1beta2-ClusterProfileConfig)
+
+
+<p>ClusterProfileCredentialsProvider defines a credentials provider in the ClusterProfile API.</p>
+
+
+<table class="table">
+<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
+<tbody>
+    
+  
+<tr><td><code>name</code> <B>[Required]</B><br/>
+<code>string</code>
+</td>
+<td>
+   <p>Name is the name of the provider.</p>
+</td>
+</tr>
+<tr><td><code>execConfig</code> <B>[Required]</B><br/>
+<code>k8s.io/client-go/tools/clientcmd/api.ExecConfig</code>
+</td>
+<td>
+   <p>ExecConfig is the exec configuration to obtain credentials.</p>
+</td>
+</tr>
+</tbody>
+</table>
+
 ## `ControllerConfigurationSpec`     {#config-kueue-x-k8s-io-v1beta2-ControllerConfigurationSpec}
     
 
@@ -575,6 +635,13 @@ by the generic MultiKueue adapter. Each entry defines how to handle a specific
 GroupVersionKind (GVK) for MultiKueue operations.</p>
 </td>
 </tr>
+<tr><td><code>clusterProfileConfig</code><br/>
+<a href="#config-kueue-x-k8s-io-v1beta2-ClusterProfileConfig"><code>ClusterProfileConfig</code></a>
+</td>
+<td>
+   <p>ClusterProfileConfig defines configuration for using the ClusterProfile API.</p>
+</td>
+</tr>
 </tbody>
 </table>
 
diff --git a/site/content/en/docs/reference/kueue.v1beta1.md b/site/content/en/docs/reference/kueue.v1beta1.md
index 7f56da799..15eab11bd 100644
--- a/site/content/en/docs/reference/kueue.v1beta1.md
+++ b/site/content/en/docs/reference/kueue.v1beta1.md
@@ -503,8 +503,8 @@ not necessarily a Kubernetes Pod or Deployment name. Cannot be empty.</p>
 <td>
    <p>retryDelayMinutes specifies how long to keep the workload suspended after
 a failed check (after it transitioned to False). When the delay period has passed, the check
-state goes to &quot;Unknown&quot;. The default is 15 min.
-Deprecated: retryDelayMinutes has already been deprecated since v0.8 and will be removed in v1beta2.</p>
+state goes to &quot;Unknown&quot;. The default is 15 min.</p>
+<p>Deprecated: retryDelayMinutes has already been deprecated since v0.8 and will be removed in v1beta2.</p>
 </td>
 </tr>
 <tr><td><code>parameters</code><br/>
@@ -1197,8 +1197,8 @@ clusterQueue and haven't finished yet.</p>
 </td>
 <td>
    <p>pendingWorkloadsStatus contains the information exposed about the current
-status of the pending workloads in the cluster queue.
-Deprecated: This field is no longer effective since v0.14.0, which means Kueue no longer stores and updates information.
+status of the pending workloads in the cluster queue.</p>
+<p>Deprecated: This field is no longer effective since v0.14.0, which means Kueue no longer stores and updates information.
 You can migrate to VisibilityOnDemand
 (https://kueue.sigs.k8s.io/docs/tasks/manage/monitor_pending_workloads/pending_workloads_on_demand/)
 instead.</p>
@@ -1887,8 +1887,8 @@ workloads assigned to this LocalQueue.</p>
 <a href="#kueue-x-k8s-io-v1beta1-LocalQueueFlavorStatus"><code>[]LocalQueueFlavorStatus</code></a>
 </td>
 <td>
-   <p>flavors lists all currently available ResourceFlavors in specified ClusterQueue.
-Deprecated: Flavors is deprecated and marked for removal in v1beta2.</p>
+   <p>flavors lists all currently available ResourceFlavors in specified ClusterQueue.</p>
+<p>Deprecated: Flavors is deprecated and marked for removal in v1beta2.</p>
 </td>
 </tr>
 <tr><td><code>fairSharing</code><br/>
diff --git a/site/content/en/docs/reference/kueue.v1beta2.md b/site/content/en/docs/reference/kueue.v1beta2.md
index e09c130ce..d2ffb7a9f 100644
--- a/site/content/en/docs/reference/kueue.v1beta2.md
+++ b/site/content/en/docs/reference/kueue.v1beta2.md
@@ -816,6 +816,37 @@ policy can be preempted by the borrowing workload.</p>
 
 
 
+## `ClusterProfileReference`     {#kueue-x-k8s-io-v1beta2-ClusterProfileReference}
+    
+
+**Appears in:**
+
+- [MultiKueueClusterSpec](#kueue-x-k8s-io-v1beta2-MultiKueueClusterSpec)
+
+
+
+<table class="table">
+<thead><tr><th width="30%">Field</th><th>Description</th></tr></thead>
+<tbody>
+    
+  
+<tr><td><code>name</code> <B>[Required]</B><br/>
+<code>string</code>
+</td>
+<td>
+   <p>name of the ClusterProfile.</p>
+</td>
+</tr>
+<tr><td><code>namespace</code> <B>[Required]</B><br/>
+<code>string</code>
+</td>
+<td>
+   <p>namespace of the ClusterProfile.</p>
+</td>
+</tr>
+</tbody>
+</table>
+
 ## `ClusterQueuePreemption`     {#kueue-x-k8s-io-v1beta2-ClusterQueuePreemption}
     
 
@@ -1766,13 +1797,20 @@ workloads assigned to this LocalQueue.</p>
 <tbody>
     
   
-<tr><td><code>kubeConfig,omitempty,omitzero</code> <B>[Required]</B><br/>
+<tr><td><code>kubeConfig,omitempty,omitzero</code><br/>
 <a href="#kueue-x-k8s-io-v1beta2-KubeConfig"><code>KubeConfig</code></a>
 </td>
 <td>
    <p>kubeConfig is information on how to connect to the cluster.</p>
 </td>
 </tr>
+<tr><td><code>clusterProfile</code><br/>
+<a href="#kueue-x-k8s-io-v1beta2-ClusterProfileReference"><code>ClusterProfileReference</code></a>
+</td>
+<td>
+   <p>clusterProfile is the reference to the ClusterProfile object used to connect to the cluster.</p>
+</td>
+</tr>
 </tbody>
 </table>
 
diff --git a/site/content/en/docs/tasks/dev/setup_multikueue_tas.md b/site/content/en/docs/tasks/dev/setup_multikueue_tas.md
new file mode 100644
index 000000000..3f28f20e8
--- /dev/null
+++ b/site/content/en/docs/tasks/dev/setup_multikueue_tas.md
@@ -0,0 +1,274 @@
+---
+title: "Setup MultiKueue with Topology-Aware Scheduling"
+date: 2025-11-17
+weight: 5
+description: >
+  Configure MultiKueue with Topology-Aware Scheduling for local development and testing.
+---
+
+This tutorial explains how you can configure a manager cluster and worker clusters to run jobs with [Topology-Aware Scheduling (TAS)](/docs/tasks/run/topology_aware_scheduling/) in a MultiKueue environment. We also outline the automated steps using Kind for local testing.
+
+Check the concepts section for a [MultiKueue overview](/docs/concepts/multikueue/) and [Topology-Aware Scheduling overview](/docs/concepts/topology_aware_scheduling/).
+
+{{% alert title="Note" color="primary" %}}
+MultiKueue with Topology-Aware Scheduling is available since Kueue v0.15.0.
+{{% /alert %}}
+
+## Automated Setup
+
+For a quick setup, download and run the setup script:
+
+```bash
+git clone https://github.com/kubernetes-sigs/kueue.git
+cd kueue/examples/multikueue/dev
+./setup-kind-multikueue-tas.sh
+```
+
+Alternatively, follow the manual steps below.
+
+## Step 1: Create Kind Clusters
+
+Create three Kind clusters (manager and two workers):
+
+```bash
+# Manager cluster
+cat <<EOF | kind create cluster --name manager --config=-
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+- role: control-plane
+- role: worker
+  labels:
+    instance-type: on-demand
+    cloud.provider.com/node-group: tas-node
+EOF
+
+# Worker 1 cluster
+cat <<EOF | kind create cluster --name worker1 --config=-
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+- role: control-plane
+- role: worker
+  labels:
+    instance-type: on-demand
+    cloud.provider.com/node-group: tas-node
+EOF
+
+# Worker 2 cluster
+cat <<EOF | kind create cluster --name worker2 --config=-
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+- role: control-plane
+- role: worker
+  labels:
+    instance-type: on-demand
+    cloud.provider.com/node-group: tas-node
+EOF
+```
+
+{{% alert title="Note" color="primary" %}}
+This setup uses hostname-level topology (`kubernetes.io/hostname`). The `cloud.provider.com/node-group` label is used by the ResourceFlavor for node selection.
+{{% /alert %}}
+
+Verify all clusters are created:
+
+```bash
+kind get clusters
+# Expected output:
+# manager
+# worker1
+# worker2
+```
+
+## Step 2: Install Kueue on All Clusters
+
+```bash
+KUEUE_VERSION=v0.15.0
+kubectl --context kind-manager apply --server-side -f https://github.com/kubernetes-sigs/kueue/releases/download/${KUEUE_VERSION}/manifests.yaml
+kubectl --context kind-worker1 apply --server-side -f https://github.com/kubernetes-sigs/kueue/releases/download/${KUEUE_VERSION}/manifests.yaml
+kubectl --context kind-worker2 apply --server-side -f https://github.com/kubernetes-sigs/kueue/releases/download/${KUEUE_VERSION}/manifests.yaml
+
+for ctx in kind-manager kind-worker1 kind-worker2; do
+  kubectl --context $ctx wait --for=condition=available --timeout=300s deployment/kueue-controller-manager -n kueue-system
+done
+```
+
+## Step 3: Configure Manager for Kind
+
+Enable the feature gate for insecure kubeconfigs and configure integrations:
+
+```bash
+# Enable feature gate (required for Kind clusters with insecure-skip-tls-verify)
+kubectl --context kind-manager patch deployment kueue-controller-manager -n kueue-system --type='json' \
+  -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--feature-gates=MultiKueueAllowInsecureKubeconfigs=true"}]'
+
+# Configure to use only batch/job integration
+cat > /tmp/kueue-integrations-patch.yaml <<'EOF'
+data:
+  controller_manager_config.yaml: |
+    apiVersion: config.kueue.x-k8s.io/v1beta2
+    kind: Configuration
+    health:
+      healthProbeBindAddress: :8081
+    metrics:
+      bindAddress: :8443
+    webhook:
+      port: 9443
+    leaderElection:
+      leaderElect: true
+      resourceName: c1f6bfd2.kueue.x-k8s.io
+    controller:
+      groupKindConcurrency:
+        Job.batch: 5
+        Pod: 5
+        Workload.kueue.x-k8s.io: 5
+        LocalQueue.kueue.x-k8s.io: 1
+        Cohort.kueue.x-k8s.io: 1
+        ClusterQueue.kueue.x-k8s.io: 1
+        ResourceFlavor.kueue.x-k8s.io: 1
+    clientConnection:
+      qps: 50
+      burst: 100
+    integrations:
+      frameworks:
+      - "batch/job"
+EOF
+kubectl --context kind-manager patch configmap kueue-manager-config -n kueue-system --patch-file=/tmp/kueue-integrations-patch.yaml
+
+# Restart controller to apply changes
+kubectl --context kind-manager rollout restart deployment/kueue-controller-manager -n kueue-system
+kubectl --context kind-manager rollout status deployment/kueue-controller-manager -n kueue-system --timeout=180s
+```
+
+## Step 4: Configure Worker Clusters
+
+Apply the worker configuration with TAS:
+
+{{< include "examples/multikueue/tas/worker-setup.yaml" "yaml" >}}
+
+```bash
+kubectl --context kind-worker1 apply -f examples/multikueue/tas/worker-setup.yaml
+kubectl --context kind-worker2 apply -f examples/multikueue/tas/worker-setup.yaml
+```
+
+Create ServiceAccounts and kubeconfigs for MultiKueue on both workers:
+
+```bash
+for cluster in worker1 worker2; do
+  # Create ServiceAccount
+  kubectl --context kind-${cluster} create sa multikueue-sa -n kueue-system
+
+  # Create ClusterRoles
+  kubectl --context kind-${cluster} create clusterrole multikueue-role \
+    --verb=create,delete,get,list,watch \
+    --resource=jobs.batch,workloads.kueue.x-k8s.io,pods
+
+  kubectl --context kind-${cluster} create clusterrole multikueue-role-status \
+    --verb=get,patch,update \
+    --resource=jobs.batch/status,workloads.kueue.x-k8s.io/status,pods/status
+
+  # Create ClusterRoleBindings
+  kubectl --context kind-${cluster} create clusterrolebinding multikueue-crb \
+    --clusterrole=multikueue-role \
+    --serviceaccount=kueue-system:multikueue-sa
+
+  kubectl --context kind-${cluster} create clusterrolebinding multikueue-crb-status \
+    --clusterrole=multikueue-role-status \
+    --serviceaccount=kueue-system:multikueue-sa
+
+  # Create token and kubeconfig
+  TOKEN=$(kubectl --context kind-${cluster} create token multikueue-sa -n kueue-system --duration=24h)
+
+  cat > ${cluster}.kubeconfig <<EOF
+apiVersion: v1
+kind: Config
+clusters:
+- cluster:
+    insecure-skip-tls-verify: true
+    server: https://${cluster}-control-plane:6443
+  name: ${cluster}
+contexts:
+- context:
+    cluster: ${cluster}
+    user: multikueue-sa
+  name: ${cluster}
+current-context: ${cluster}
+users:
+- name: multikueue-sa
+  user:
+    token: ${TOKEN}
+EOF
+done
+```
+
+## Step 5: Configure Manager Cluster
+
+Create secrets and apply configuration:
+
+```bash
+kubectl --context kind-manager create secret generic worker1-secret -n kueue-system --from-file=kubeconfig=worker1.kubeconfig
+kubectl --context kind-manager create secret generic worker2-secret -n kueue-system --from-file=kubeconfig=worker2.kubeconfig
+```
+
+{{< include "examples/multikueue/tas/manager-setup.yaml" "yaml" >}}
+
+```bash
+kubectl --context kind-manager apply -f examples/multikueue/tas/manager-setup.yaml
+```
+
+## Step 6: Validate the Setup
+
+Verify that all components are active:
+
+```bash
+kubectl --context kind-manager get clusterqueue,admissioncheck,multikueuecluster
+```
+
+Expected output:
+
+```
+NAME                                        COHORT   PENDING WORKLOADS
+clusterqueue.kueue.x-k8s.io/cluster-queue            0
+
+NAME                                          AGE
+admissioncheck.kueue.x-k8s.io/multikueue-ac   5m
+
+NAME                                       CONNECTED   AGE
+multikueuecluster.kueue.x-k8s.io/worker1   True        5m
+multikueuecluster.kueue.x-k8s.io/worker2   True        5m
+```
+
+## Step 7: Submit a TAS Job
+
+Submit a sample job that requires topology-aware scheduling:
+
+{{< include "examples/multikueue/dev/sample-tas-job.yaml" "yaml" >}}
+
+```bash
+kubectl --context kind-manager apply -f examples/multikueue/dev/sample-tas-job.yaml
+kubectl --context kind-manager get workloads -n default
+```
+
+Expected output showing the workload was admitted and delegated to a worker cluster:
+
+```
+NAME               QUEUE        RESERVED IN   ADMITTED   AGE
+tas-sample-job     user-queue   worker1       True       5s
+implicit-tas-job   user-queue   worker2       True       5s
+```
+
+
+## Cleanup
+
+Delete the Kind clusters:
+
+```bash
+kind delete clusters manager worker1 worker2
+```
+
+## Next Steps
+
+- Learn more about [Topology-Aware Scheduling](/docs/concepts/topology_aware_scheduling/)
+- Explore [MultiKueue concepts](/docs/concepts/multikueue/)
diff --git a/site/content/en/docs/tasks/manage/setup_multikueue.md b/site/content/en/docs/tasks/manage/setup_multikueue.md
index abb94c173..c5be18d50 100644
--- a/site/content/en/docs/tasks/manage/setup_multikueue.md
+++ b/site/content/en/docs/tasks/manage/setup_multikueue.md
@@ -109,6 +109,20 @@ AC - Active: True Reason: Active Message: The admission check is active
 MC - Active: True Reason: Active Message: Connected
 ```
 
+### Create a sample setup with TAS
+
+To enable Topology-Aware Scheduling (TAS) in a MultiKueue setup, configure the worker clusters with topology levels and the manager cluster with delayed topology requests.
+
+Worker cluster configuration:
+
+{{< include "examples/multikueue/tas/worker-setup.yaml" "yaml" >}}
+
+Manager cluster configuration:
+
+{{< include "examples/multikueue/tas/manager-setup.yaml" "yaml" >}}
+
+For a complete setup guide including local development with Kind, see the [Setup MultiKueue with Topology-Aware Scheduling](/docs/tasks/dev/setup_multikueue_tas/) guide.
+
 ## (Optional) Setup MultiKueue with Open Cluster Management
 
 [Open Cluster Management (OCM)](https://open-cluster-management.io/) is a community-driven project focused on multicluster and multicloud scenarios for Kubernetes apps.
diff --git a/site/static/examples/multikueue/dev/manager-kind-config.yaml b/site/static/examples/multikueue/dev/manager-kind-config.yaml
new file mode 100644
index 000000000..8f03cf1ed
--- /dev/null
+++ b/site/static/examples/multikueue/dev/manager-kind-config.yaml
@@ -0,0 +1,8 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+- role: control-plane
+- role: worker
+  labels:
+    instance-type: on-demand
+    cloud.provider.com/node-group: tas-node
diff --git a/site/static/examples/multikueue/dev/sample-tas-job.yaml b/site/static/examples/multikueue/dev/sample-tas-job.yaml
new file mode 100644
index 000000000..9dc60eef4
--- /dev/null
+++ b/site/static/examples/multikueue/dev/sample-tas-job.yaml
@@ -0,0 +1,56 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: tas-sample-job
+  namespace: default
+  labels:
+    kueue.x-k8s.io/queue-name: user-queue
+spec:
+  parallelism: 2
+  completions: 2
+  suspend: true
+  template:
+    metadata:
+      annotations:
+        kueue.x-k8s.io/podset-required-topology: kubernetes.io/hostname
+    spec:
+      restartPolicy: Never
+      containers:
+      - name: sample-container
+        image: registry.k8s.io/e2e-test-images/agnhost:2.40
+        args: ["pause"]
+        resources:
+          requests:
+            cpu: "1"
+            memory: "1Gi"
+          limits:
+            cpu: "1"
+            memory: "1Gi"
+      terminationGracePeriodSeconds: 5
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: implicit-tas-job
+  namespace: default
+  labels:
+    kueue.x-k8s.io/queue-name: user-queue
+spec:
+  parallelism: 3
+  completions: 3
+  suspend: true
+  template:
+    spec:
+      restartPolicy: Never
+      containers:
+      - name: sample-container
+        image: registry.k8s.io/e2e-test-images/agnhost:2.40
+        args: ["pause"]
+        resources:
+          requests:
+            cpu: "500m"
+            memory: "512Mi"
+          limits:
+            cpu: "500m"
+            memory: "512Mi"
+      terminationGracePeriodSeconds: 5
diff --git a/site/static/examples/multikueue/dev/setup-kind-multikueue-tas.sh b/site/static/examples/multikueue/dev/setup-kind-multikueue-tas.sh
new file mode 100755
index 000000000..182f6b409
--- /dev/null
+++ b/site/static/examples/multikueue/dev/setup-kind-multikueue-tas.sh
@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+
+# Copyright The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUEUE_VERSION="${KUEUE_VERSION:-v0.15.0}"
+USE_MAIN_BRANCH="${USE_MAIN_BRANCH:-false}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WORKER_CLUSTERS="worker1 worker2"
+
+# Parse command line flags
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --main)
+            USE_MAIN_BRANCH=true
+            shift
+            ;;
+        --version)
+            KUEUE_VERSION="$2"
+            shift 2
+            ;;
+        *)
+            echo "Unknown option: $1"
+            echo "Usage: $0 [--main] [--version VERSION]"
+            echo "  --main           Use main branch instead of released version"
+            echo "  --version        Specify Kueue version (default: v0.15.0)"
+            exit 1
+            ;;
+    esac
+done
+
+echo "========================================"
+echo "MultiKueue + TAS Setup"
+echo "========================================"
+
+# Create Kind clusters
+echo "[1/5] Creating Kind clusters..."
+if kind get clusters 2>/dev/null | grep -q "^manager$"; then
+    echo "Cluster manager already exists, skipping..."
+else
+    echo "Creating cluster: manager"
+    kind create cluster --name manager --config="${SCRIPT_DIR}/manager-kind-config.yaml"
+fi
+
+for cluster in ${WORKER_CLUSTERS}; do
+    if kind get clusters 2>/dev/null | grep -q "^${cluster}$"; then
+        echo "Cluster ${cluster} already exists, skipping..."
+    else
+        echo "Creating cluster: ${cluster}"
+        kind create cluster --name "${cluster}" --config="${SCRIPT_DIR}/worker-kind-config.yaml"
+    fi
+done
+
+kubectl config use-context kind-manager
+
+# Install Kueue
+if [ "$USE_MAIN_BRANCH" = "true" ]; then
+    echo "[2/5] Installing Kueue from main branch..."
+    KUEUE_APPLY_FLAGS="-k github.com/kubernetes-sigs/kueue/config/default?ref=main"
+else
+    echo "[2/5] Installing Kueue ${KUEUE_VERSION}..."
+    KUEUE_APPLY_FLAGS="-f https://github.com/kubernetes-sigs/kueue/releases/download/${KUEUE_VERSION}/manifests.yaml"
+fi
+
+for cluster in manager ${WORKER_CLUSTERS}; do
+    # shellcheck disable=SC2086
+    kubectl --context "kind-${cluster}" apply --server-side ${KUEUE_APPLY_FLAGS}
+    kubectl --context "kind-${cluster}" wait --for=condition=available --timeout=300s deployment/kueue-controller-manager -n kueue-system
+done
+
+# Configure manager for Kind clusters
+kubectl --context kind-manager patch deployment kueue-controller-manager -n kueue-system --type='json' \
+  -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--feature-gates=MultiKueueAllowInsecureKubeconfigs=true"}]'
+
+cat > /tmp/kueue-integrations-patch.yaml <<'EOF'
+data:
+  controller_manager_config.yaml: |
+    apiVersion: config.kueue.x-k8s.io/v1beta2
+    kind: Configuration
+    health:
+      healthProbeBindAddress: :8081
+    metrics:
+      bindAddress: :8443
+    webhook:
+      port: 9443
+    leaderElection:
+      leaderElect: true
+      resourceName: c1f6bfd2.kueue.x-k8s.io
+    controller:
+      groupKindConcurrency:
+        Job.batch: 5
+        Pod: 5
+        Workload.kueue.x-k8s.io: 5
+        LocalQueue.kueue.x-k8s.io: 1
+        Cohort.kueue.x-k8s.io: 1
+        ClusterQueue.kueue.x-k8s.io: 1
+        ResourceFlavor.kueue.x-k8s.io: 1
+    clientConnection:
+      qps: 50
+      burst: 100
+    integrations:
+      frameworks:
+      - "batch/job"
+EOF
+kubectl --context kind-manager patch configmap kueue-manager-config -n kueue-system --patch-file=/tmp/kueue-integrations-patch.yaml
+kubectl --context kind-manager rollout restart deployment/kueue-controller-manager -n kueue-system
+kubectl --context kind-manager rollout status deployment/kueue-controller-manager -n kueue-system --timeout=180s
+
+# Configure workers
+echo "[3/5] Configuring worker clusters..."
+for cluster in ${WORKER_CLUSTERS}; do
+    kubectl --context "kind-${cluster}" apply -f "${SCRIPT_DIR}/../tas/worker-setup.yaml"
+done
+
+# Create worker kubeconfigs
+echo "[4/5] Creating worker kubeconfigs..."
+for cluster in ${WORKER_CLUSTERS}; do
+    # Create ServiceAccount
+    kubectl --context "kind-${cluster}" create sa multikueue-sa -n kueue-system 2>/dev/null || true
+
+    # Create ClusterRole for Jobs
+    kubectl --context "kind-${cluster}" create clusterrole multikueue-role \
+      --verb=create,delete,get,list,watch \
+      --resource=jobs.batch,workloads.kueue.x-k8s.io,pods 2>/dev/null || true
+
+    kubectl --context "kind-${cluster}" create clusterrole multikueue-role-status \
+      --verb=get,patch,update \
+      --resource=jobs.batch/status,workloads.kueue.x-k8s.io/status,pods/status 2>/dev/null || true
+
+    # Create ClusterRoleBindings
+    kubectl --context "kind-${cluster}" create clusterrolebinding multikueue-crb \
+      --clusterrole=multikueue-role \
+      --serviceaccount=kueue-system:multikueue-sa 2>/dev/null || true
+
+    kubectl --context "kind-${cluster}" create clusterrolebinding multikueue-crb-status \
+      --clusterrole=multikueue-role-status \
+      --serviceaccount=kueue-system:multikueue-sa 2>/dev/null || true
+
+    # Create token
+    TOKEN=$(kubectl --context "kind-${cluster}" create token multikueue-sa -n kueue-system --duration=24h)
+
+    # Create kubeconfig with insecure-skip-tls-verify for Kind clusters
+    cat > "${SCRIPT_DIR}/${cluster}.kubeconfig" <<EOF
+apiVersion: v1
+kind: Config
+clusters:
+- cluster:
+    insecure-skip-tls-verify: true
+    server: https://${cluster}-control-plane:6443
+  name: ${cluster}
+contexts:
+- context:
+    cluster: ${cluster}
+    user: multikueue-sa
+  name: ${cluster}
+current-context: ${cluster}
+users:
+- name: multikueue-sa
+  user:
+    token: ${TOKEN}
+EOF
+done
+
+# Configure manager
+echo "[5/5] Configuring manager cluster..."
+for cluster in ${WORKER_CLUSTERS}; do
+    kubectl --context kind-manager create secret generic "${cluster}-secret" -n kueue-system --from-file=kubeconfig="${SCRIPT_DIR}/${cluster}.kubeconfig" --dry-run=client -o yaml | kubectl --context kind-manager apply -f -
+done
+kubectl --context kind-manager apply -f "${SCRIPT_DIR}/../tas/manager-setup.yaml"
+
+echo ""
+echo "========================================"
+echo "✓ Setup Complete"
+echo "========================================"
+echo ""
+echo "Submit sample job:"
+echo "  kubectl --context kind-manager apply -f ${SCRIPT_DIR}/sample-tas-job.yaml"
+echo ""
+echo "Monitor workloads:"
+echo "  kubectl --context kind-manager get workloads -n default -w"
+echo ""
+echo "Cleanup:"
+echo "  kind delete clusters manager ${WORKER_CLUSTERS}"
diff --git a/site/static/examples/multikueue/dev/worker-kind-config.yaml b/site/static/examples/multikueue/dev/worker-kind-config.yaml
new file mode 100644
index 000000000..8f03cf1ed
--- /dev/null
+++ b/site/static/examples/multikueue/dev/worker-kind-config.yaml
@@ -0,0 +1,8 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+- role: control-plane
+- role: worker
+  labels:
+    instance-type: on-demand
+    cloud.provider.com/node-group: tas-node
diff --git a/site/static/examples/multikueue/tas/manager-setup.yaml b/site/static/examples/multikueue/tas/manager-setup.yaml
new file mode 100644
index 000000000..45f08ebc8
--- /dev/null
+++ b/site/static/examples/multikueue/tas/manager-setup.yaml
@@ -0,0 +1,81 @@
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: Topology
+metadata:
+  name: default
+spec:
+  levels:
+  - nodeLabel: kubernetes.io/hostname
+---
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: ResourceFlavor
+metadata:
+  name: tas-flavor
+spec:
+  nodeLabels:
+    cloud.provider.com/node-group: tas-node
+  topologyName: default
+---
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: MultiKueueConfig
+metadata:
+  name: multikueue-config
+spec:
+  clusters:
+  - worker1
+  - worker2
+---
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: AdmissionCheck
+metadata:
+  name: multikueue-ac
+spec:
+  controllerName: kueue.x-k8s.io/multikueue
+  parameters:
+    apiGroup: kueue.x-k8s.io
+    kind: MultiKueueConfig
+    name: multikueue-config
+---
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: MultiKueueCluster
+metadata:
+  name: worker1
+spec:
+  kubeConfig:
+    locationType: Secret
+    location: worker1-secret
+---
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: MultiKueueCluster
+metadata:
+  name: worker2
+spec:
+  kubeConfig:
+    locationType: Secret
+    location: worker2-secret
+---
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: ClusterQueue
+metadata:
+  name: cluster-queue
+spec:
+  namespaceSelector: {}
+  resourceGroups:
+  - coveredResources: ["cpu", "memory"]
+    flavors:
+    - name: tas-flavor
+      resources:
+      - name: cpu
+        nominalQuota: 16
+      - name: memory
+        nominalQuota: 32Gi
+  admissionChecksStrategy:
+    admissionChecks:
+    - name: multikueue-ac
+---
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: LocalQueue
+metadata:
+  namespace: default
+  name: user-queue
+spec:
+  clusterQueue: cluster-queue
diff --git a/site/static/examples/multikueue/tas/worker-setup.yaml b/site/static/examples/multikueue/tas/worker-setup.yaml
new file mode 100644
index 000000000..599b81267
--- /dev/null
+++ b/site/static/examples/multikueue/tas/worker-setup.yaml
@@ -0,0 +1,40 @@
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: Topology
+metadata:
+  name: default
+spec:
+  levels:
+  - nodeLabel: kubernetes.io/hostname
+---
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: ResourceFlavor
+metadata:
+  name: tas-flavor
+spec:
+  nodeLabels:
+    cloud.provider.com/node-group: tas-node
+  topologyName: default
+---
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: ClusterQueue
+metadata:
+  name: worker-cluster-queue
+spec:
+  namespaceSelector: {}
+  resourceGroups:
+  - coveredResources: ["cpu", "memory"]
+    flavors:
+    - name: tas-flavor
+      resources:
+      - name: cpu
+        nominalQuota: 8
+      - name: memory
+        nominalQuota: 16Gi
+---
+apiVersion: kueue.x-k8s.io/v1beta2
+kind: LocalQueue
+metadata:
+  namespace: default
+  name: user-queue
+spec:
+  clusterQueue: worker-cluster-queue
diff --git a/vendor/modules.txt b/vendor/modules.txt
index fc02a8b7b..5d8d0836d 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1582,6 +1582,10 @@ sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/client
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/client/metrics
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client/pkg/common/metrics
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client/proto/client
+# sigs.k8s.io/cluster-inventory-api v0.0.0-20251028164203-2e3fabb46733
+## explicit; go 1.24.0
+sigs.k8s.io/cluster-inventory-api/apis/v1alpha1
+sigs.k8s.io/cluster-inventory-api/pkg/credentials
 # sigs.k8s.io/controller-runtime v0.22.4
 ## explicit; go 1.24.0
 sigs.k8s.io/controller-runtime
diff --git a/vendor/sigs.k8s.io/cluster-inventory-api/LICENSE b/vendor/sigs.k8s.io/cluster-inventory-api/LICENSE
new file mode 100644
index 000000000..8dada3eda
--- /dev/null
+++ b/vendor/sigs.k8s.io/cluster-inventory-api/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/sigs.k8s.io/cluster-inventory-api/apis/v1alpha1/clusterprofile_types.go b/vendor/sigs.k8s.io/cluster-inventory-api/apis/v1alpha1/clusterprofile_types.go
new file mode 100644
index 000000000..8dcd4e661
--- /dev/null
+++ b/vendor/sigs.k8s.io/cluster-inventory-api/apis/v1alpha1/clusterprofile_types.go
@@ -0,0 +1,182 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	clientcmdv1 "k8s.io/client-go/tools/clientcmd/api/v1"
+)
+
+// ClusterProfileSpec defines the desired state of ClusterProfile.
+type ClusterProfileSpec struct {
+	// DisplayName defines a human-readable name of the ClusterProfile
+	// +optional
+	DisplayName string `json:"displayName,omitempty"`
+
+	// ClusterManager defines which cluster manager owns this ClusterProfile resource
+	// +required
+	ClusterManager ClusterManager `json:"clusterManager"`
+}
+
+// ClusterManager defines which cluster manager owns this ClusterProfile resource.
+// A cluster manager is a system that centralizes the administration, coordination,
+// and operation of multiple clusters across various infrastructures.
+// Examples of cluster managers include Open Cluster Management, AZ Fleet, Karmada, and Clusternet.
+//
+// This field is immutable.
+// It's recommended that each cluster manager instance should set a different values to this field.
+// In addition, it's recommended that a predefined label with key "x-k8s.io/cluster-manager"
+// should be added by the cluster manager upon creation. See constant LabelClusterManagerKey.
+// The value of the label should be the same as the name of the cluster manager.
+// The purpose of this label is to make filter clusters from different cluster managers easier.
+//
+// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ClusterManager is immutable"
+type ClusterManager struct {
+	// Name defines the name of the cluster manager
+	// +required
+	Name string `json:"name"`
+}
+
+// ClusterProfileStatus defines the observed state of ClusterProfile.
+type ClusterProfileStatus struct {
+	// Conditions contains the different condition statuses for this cluster.
+	// +optional
+	Conditions []metav1.Condition `json:"conditions"`
+
+	// Version defines the version information of the cluster.
+	// +optional
+	Version ClusterVersion `json:"version,omitempty"`
+
+	// Properties defines cluster characteristics through a list of Property objects.
+	// Each Property can be one of:
+	// 1. A ClusterProperty resource (as defined in KEP-2149)
+	// 2. Custom information from cluster manager implementations
+	// Property names support both:
+	// - Standard names from ClusterProperty resources
+	// - Custom names defined by cluster managers
+	// +optional
+	Properties []Property `json:"properties,omitempty"`
+
+	// CredentialProviders is a list of cluster access providers that can provide access
+	// information for clusters.
+	// Deprecated: Use AccessProviders instead. If both AccessProviders and CredentialProviders are provided, both are used. In case they specify a provider with the same name, the one in AccessProviders is preferred.
+	// +optional
+	// +deprecated
+	CredentialProviders []CredentialProvider `json:"credentialProviders,omitempty"`
+
+	// AccessProviders is a list of cluster access providers that can provide access
+	// information for clusters.
+	// +optional
+	AccessProviders []AccessProvider `json:"accessProviders,omitempty"`
+}
+
+// AccessProvider defines how to access the cluster.
+// It contains the name of the provider name and the cluster connection details.
+// The name is used to identify different access info types, such as "kubeconfig" or "oidc".
+// The Cluster field contains the actual cluster connection details, such as server address,
+// certificate authority data, and authentication information.
+type AccessProvider struct {
+	Name    string              `json:"name"`
+	Cluster clientcmdv1.Cluster `json:"cluster,omitempty"`
+}
+
+type CredentialProvider = AccessProvider
+
+// ClusterVersion represents version information about the cluster.
+type ClusterVersion struct {
+	// Kubernetes is the kubernetes version of the cluster.
+	// +optional
+	Kubernetes string `json:"kubernetes,omitempty"`
+}
+
+// Property defines the data structure to represent a property of a cluster.
+// It contains a name/value pair and the last observed time of the property on the cluster.
+// This property can store various configurable details and metrics of a cluster,
+// which may include information such as the entry point of the cluster, types of nodes, location, etc. according to KEP 4322.
+type Property struct {
+	// Name is the name of a property resource on cluster. It's a well-known
+	// or customized name to identify the property.
+	// +kubebuilder:validation:MaxLength=253
+	// +kubebuilder:validation:MinLength=1
+	// +required
+	Name string `json:"name"`
+
+	// Value is a property-dependent string
+	// +kubebuilder:validation:MaxLength=1024
+	// +kubebuilder:validation:MinLength=1
+	// +required
+	Value string `json:"value"`
+
+	// LastObservedTime is the last time the property was observed on the corresponding cluster.
+	// The value is the timestamp when the property was observed not the time when the property was updated in the cluster-profile.
+	// +kubebuilder:validation:Type=string
+	// +kubebuilder:validation:Format=date-time
+	// +optional
+	LastObservedTime metav1.Time `json:"lastObservedTime,omitempty"`
+}
+
+// Predefined healthy conditions indicate the cluster is in a good state or not.
+// The condition and states conforms to metav1.Condition format.
+// States are True/False/Unknown.
+const (
+	// ClusterConditionControlPlaneHealthy means the controlplane of the cluster is in a healthy state.
+	// If the control plane is not healthy, then the status condition will be "False".
+	ClusterConditionControlPlaneHealthy string = "ControlPlaneHealthy"
+)
+
+const (
+	// LabelClusterManagerKey is used to indicate the name of the cluster manager that a ClusterProfile belongs to.
+	// The value of the label MUST be the same as the name of the cluster manager.
+	// The purpose of this label is to make filter clusters from different cluster managers easier.
+	LabelClusterManagerKey = "x-k8s.io/cluster-manager"
+
+	// LabelClusterSetKey is used on a namespace to indicate the clusterset that a ClusterProfile belongs to.
+	// If a cluster inventory represents a ClusterSet,
+	// all its ClusterProfile objects MUST be part of the same clusterSet and namespace must be used as the grouping mechanism.
+	// The namespace MUST have LabelClusterSet and the value as the name of the clusterSet.
+	LabelClusterSetKey = "multicluster.x-k8s.io/clusterset"
+)
+
+//+genclient
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+//+kubebuilder:resource:scope=Namespaced
+
+// ClusterProfile represents a single cluster in a multi-cluster deployment.
+type ClusterProfile struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// +required
+	Spec ClusterProfileSpec `json:"spec"`
+
+	// +optional
+	Status ClusterProfileStatus `json:"status,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// ClusterProfileList contains a list of ClusterProfile.
+type ClusterProfileList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ClusterProfile `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&ClusterProfile{}, &ClusterProfileList{})
+}
diff --git a/vendor/sigs.k8s.io/cluster-inventory-api/apis/v1alpha1/groupversion_info.go b/vendor/sigs.k8s.io/cluster-inventory-api/apis/v1alpha1/groupversion_info.go
new file mode 100644
index 000000000..de212402e
--- /dev/null
+++ b/vendor/sigs.k8s.io/cluster-inventory-api/apis/v1alpha1/groupversion_info.go
@@ -0,0 +1,82 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1alpha1 contains API Schema definitions for the multicluster.x-k8s.io v1alpha1 API group
+// +kubebuilder:object:generate=true
+// +groupName=multicluster.x-k8s.io
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+const (
+	// Group is the API group.
+	Group = "multicluster.x-k8s.io"
+	// Version is the API version.
+	Version = "v1alpha1"
+	// Kind is the resource kind.
+	Kind     = "ClusterProfile"
+	resource = "clusterprofiles"
+)
+
+var (
+	// GroupVersion is group version used to register these objects
+	GroupVersion = schema.GroupVersion{Group: Group, Version: Version}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+
+	// SchemeGroupVersion generated code relies on this name
+	// Deprecated
+	SchemeGroupVersion = GroupVersion
+
+	// SchemeGroupVersionKind is the group, version and kind for the ClusterProfile CR.
+	SchemeGroupVersionKind = schema.GroupVersionKind{
+		Group:   Group,
+		Version: Version,
+		Kind:    Kind,
+	}
+
+	// SchemeGroupVersionResource is the group, version and resource for the ClusterProfile CR.
+	SchemeGroupVersionResource = schema.GroupVersionResource{
+		Group:    Group,
+		Version:  Version,
+		Resource: resource,
+	}
+
+	// AddToScheme adds the types in this group-version to the given scheme.
+	AddToScheme = SchemeBuilder.AddToScheme
+)
+
+// Resource generated code relies on this being here, but it logically belongs to the group
+// DEPRECATED
+func Resource(resource string) schema.GroupResource {
+	return schema.GroupResource{Group: GroupVersion.Group, Resource: resource}
+}
+
+// Adds the list of known types to api.Scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(GroupVersion,
+		&ClusterProfile{},
+		&ClusterProfileList{},
+	)
+	metav1.AddToGroupVersion(scheme, GroupVersion)
+	return nil
+}
diff --git a/vendor/sigs.k8s.io/cluster-inventory-api/apis/v1alpha1/zz_generated.deepcopy.go b/vendor/sigs.k8s.io/cluster-inventory-api/apis/v1alpha1/zz_generated.deepcopy.go
new file mode 100644
index 000000000..339bd565b
--- /dev/null
+++ b/vendor/sigs.k8s.io/cluster-inventory-api/apis/v1alpha1/zz_generated.deepcopy.go
@@ -0,0 +1,207 @@
+//go:build !ignore_autogenerated
+
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AccessProvider) DeepCopyInto(out *AccessProvider) {
+	*out = *in
+	in.Cluster.DeepCopyInto(&out.Cluster)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AccessProvider.
+func (in *AccessProvider) DeepCopy() *AccessProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(AccessProvider)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterManager) DeepCopyInto(out *ClusterManager) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterManager.
+func (in *ClusterManager) DeepCopy() *ClusterManager {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterManager)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterProfile) DeepCopyInto(out *ClusterProfile) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	out.Spec = in.Spec
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProfile.
+func (in *ClusterProfile) DeepCopy() *ClusterProfile {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterProfile)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterProfile) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterProfileList) DeepCopyInto(out *ClusterProfileList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ClusterProfile, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProfileList.
+func (in *ClusterProfileList) DeepCopy() *ClusterProfileList {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterProfileList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ClusterProfileList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterProfileSpec) DeepCopyInto(out *ClusterProfileSpec) {
+	*out = *in
+	out.ClusterManager = in.ClusterManager
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProfileSpec.
+func (in *ClusterProfileSpec) DeepCopy() *ClusterProfileSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterProfileSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterProfileStatus) DeepCopyInto(out *ClusterProfileStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	out.Version = in.Version
+	if in.Properties != nil {
+		in, out := &in.Properties, &out.Properties
+		*out = make([]Property, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.CredentialProviders != nil {
+		in, out := &in.CredentialProviders, &out.CredentialProviders
+		*out = make([]CredentialProvider, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.AccessProviders != nil {
+		in, out := &in.AccessProviders, &out.AccessProviders
+		*out = make([]AccessProvider, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProfileStatus.
+func (in *ClusterProfileStatus) DeepCopy() *ClusterProfileStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterProfileStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterVersion) DeepCopyInto(out *ClusterVersion) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterVersion.
+func (in *ClusterVersion) DeepCopy() *ClusterVersion {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterVersion)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Property) DeepCopyInto(out *Property) {
+	*out = *in
+	in.LastObservedTime.DeepCopyInto(&out.LastObservedTime)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Property.
+func (in *Property) DeepCopy() *Property {
+	if in == nil {
+		return nil
+	}
+	out := new(Property)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/vendor/sigs.k8s.io/cluster-inventory-api/pkg/credentials/config.go b/vendor/sigs.k8s.io/cluster-inventory-api/pkg/credentials/config.go
new file mode 100644
index 000000000..84b2623d3
--- /dev/null
+++ b/vendor/sigs.k8s.io/cluster-inventory-api/pkg/credentials/config.go
@@ -0,0 +1,140 @@
+package credentials
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"net/http"
+	"net/url"
+	"os"
+
+	"k8s.io/client-go/rest"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+	clientcmdlatest "k8s.io/client-go/tools/clientcmd/api/latest"
+	"k8s.io/klog/v2"
+	"sigs.k8s.io/cluster-inventory-api/apis/v1alpha1"
+)
+
+// client.authentication.k8s.io/exec is a reserved extension key defined by the Kubernetes
+// client authentication API (SIG Auth), not by the ClusterProfile API.
+// Reference:
+// https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster
+const clusterExtensionKey = "client.authentication.k8s.io/exec"
+
+type Provider struct {
+	Name       string                   `json:"name"`
+	ExecConfig *clientcmdapi.ExecConfig `json:"execConfig"`
+}
+
+type CredentialsProvider struct {
+	Providers []Provider `json:"providers"`
+}
+
+func New(providers []Provider) *CredentialsProvider {
+	return &CredentialsProvider{
+		Providers: providers,
+	}
+}
+
+// SetupProviderFileFlag defines the -clusterprofile-provider-file command-line flag and returns a pointer
+// to the string that will hold the path. flag.Parse() must still be called manually by the caller
+func SetupProviderFileFlag() *string {
+	return flag.String("clusterprofile-provider-file", "clusterprofile-provider-file.json", "Path to the JSON configuration file")
+}
+
+func NewFromFile(path string) (*CredentialsProvider, error) {
+	// 1. Read the file's content
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read credentials file: %w", err)
+	}
+
+	// 2. Create a new Providers instance and unmarshal the data into it
+	var providers CredentialsProvider
+	if err := json.Unmarshal(data, &providers); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal credential proviers: %w", err)
+	}
+
+	// 3. Return the populated credentials
+	return &providers, nil
+}
+
+// BuildConfigFromCP builds a rest.Config from the given ClusterProfile
+func (cp *CredentialsProvider) BuildConfigFromCP(clusterprofile *v1alpha1.ClusterProfile) (*rest.Config, error) {
+	// 1. obtain the correct clusterAccessor from the CP
+	clusterAccessor := cp.getClusterAccessorFromClusterProfile(clusterprofile)
+	if clusterAccessor == nil {
+		return nil, fmt.Errorf("no matching cluster accessor found for cluster profile %q", clusterprofile.Name)
+	}
+
+	// 2. Get Exec Config
+	execConfig := cp.getExecConfigFromConfig(clusterAccessor.Name)
+	if execConfig == nil {
+		return nil, fmt.Errorf("no exec credentials found for provider %q", clusterAccessor.Name)
+	}
+
+	// 3. build resulting rest.Config
+	config := &rest.Config{
+		Host: clusterAccessor.Cluster.Server,
+		TLSClientConfig: rest.TLSClientConfig{
+			CAData: clusterAccessor.Cluster.CertificateAuthorityData,
+		},
+		Proxy: func(request *http.Request) (*url.URL, error) {
+			if clusterAccessor.Cluster.ProxyURL == "" {
+				return nil, nil
+			}
+			return url.Parse(clusterAccessor.Cluster.ProxyURL)
+		},
+	}
+
+	config.ExecProvider = &clientcmdapi.ExecConfig{
+		APIVersion:         execConfig.APIVersion,
+		Command:            execConfig.Command,
+		Args:               execConfig.Args,
+		Env:                execConfig.Env,
+		InteractiveMode:    "Never",
+		ProvideClusterInfo: execConfig.ProvideClusterInfo,
+	}
+
+	// Propagate reserved extension into ExecCredential.Spec.Cluster.Config if present
+	internalCluster := clientcmdapi.NewCluster()
+	if err := clientcmdlatest.Scheme.Convert(&clusterAccessor.Cluster, internalCluster, nil); err != nil {
+		return nil, fmt.Errorf("failed to convert v1 Cluster to internal: %w", err)
+	}
+	config.ExecProvider.Config = internalCluster.Extensions[clusterExtensionKey]
+
+	return config, nil
+}
+
+func (cp *CredentialsProvider) getExecConfigFromConfig(providerName string) *clientcmdapi.ExecConfig {
+	for _, provider := range cp.Providers {
+		if provider.Name == providerName {
+			return provider.ExecConfig
+		}
+	}
+	return nil
+}
+
+// getClusterAccessorFromClusterProfile returns the first AccessProvider from the ClusterProfile
+// that matches one of the supported provider types in the CredentialsProvider
+func (cp *CredentialsProvider) getClusterAccessorFromClusterProfile(cluster *v1alpha1.ClusterProfile) *v1alpha1.AccessProvider {
+	accessProviderTypes := map[string]*v1alpha1.AccessProvider{}
+
+	// to keep backward compatibility, we first check the CredentialProviders field
+	for _, accessProvider := range cluster.Status.CredentialProviders {
+		accessProviderTypes[accessProvider.Name] = accessProvider.DeepCopy()
+		klog.Warningf("ClusterProfile %q uses deprecated field CredentialProviders %q; please migrate to AccessProviders", cluster.Name, accessProvider.Name)
+	}
+
+	for _, accessProvider := range cluster.Status.AccessProviders {
+		accessProviderTypes[accessProvider.Name] = accessProvider.DeepCopy()
+	}
+
+	// we return the first access provider that the CredentialsProvider supports.
+	for _, providerType := range cp.Providers {
+		if accessor, found := accessProviderTypes[providerType.Name]; found {
+			return accessor
+		}
+	}
+	return nil
+}



Test patch:
diff --git a/pkg/controller/admissionchecks/multikueue/indexer_test.go b/pkg/controller/admissionchecks/multikueue/indexer_test.go
index de13218d7..c4ec56054 100644
--- a/pkg/controller/admissionchecks/multikueue/indexer_test.go
+++ b/pkg/controller/admissionchecks/multikueue/indexer_test.go
@@ -25,12 +25,14 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	inventoryv1alpha1 "sigs.k8s.io/cluster-inventory-api/apis/v1alpha1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	kueue "sigs.k8s.io/kueue/apis/kueue/v1beta2"
 	"sigs.k8s.io/kueue/pkg/controller/core/indexer"
 	"sigs.k8s.io/kueue/pkg/controller/jobframework"
+	"sigs.k8s.io/kueue/pkg/features"
 	"sigs.k8s.io/kueue/pkg/util/slices"
 	utiltesting "sigs.k8s.io/kueue/pkg/util/testing"
 	utiltestingapi "sigs.k8s.io/kueue/pkg/util/testing/v1beta2"
@@ -44,7 +46,7 @@ func getClientBuilder(ctx context.Context) *fake.ClientBuilder {
 	scheme := runtime.NewScheme()
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 	utilruntime.Must(kueue.AddToScheme(scheme))
-	utilruntime.Must(kueue.AddToScheme(scheme))
+	utilruntime.Must(inventoryv1alpha1.AddToScheme(scheme))
 
 	utilruntime.Must(jobframework.ForEachIntegration(func(_ string, cb jobframework.IntegrationCallbacks) error {
 		if cb.MultiKueueAdapter != nil && cb.AddToScheme != nil {
@@ -117,6 +119,65 @@ func TestListMultiKueueClustersUsingKubeConfig(t *testing.T) {
 	}
 }
 
+func TestListMultiKueueClustersUsingClusterProfile(t *testing.T) {
+	features.SetFeatureGateDuringTest(t, features.MultiKueueClusterProfile, true)
+	cases := map[string]struct {
+		clusters      []*kueue.MultiKueueCluster
+		filter        client.ListOption
+		wantListError error
+		wantList      []string
+	}{
+		"no clusters": {
+			filter: client.MatchingFields{UsingClusterProfiles: TestNamespace + "/ns1/clusterprofile1"},
+		},
+		"single cluster, single match": {
+			clusters: []*kueue.MultiKueueCluster{
+				utiltestingapi.MakeMultiKueueCluster("cluster1").ClusterProfile("clusterprofile1", "ns1").Obj(),
+			},
+			filter:   client.MatchingFields{UsingClusterProfiles: TestNamespace + "/ns1/clusterprofile1"},
+			wantList: []string{"cluster1"},
+		},
+		"single cluster, no match": {
+			clusters: []*kueue.MultiKueueCluster{
+				utiltestingapi.MakeMultiKueueCluster("cluster2").ClusterProfile("clusterprofile2", "ns2").Obj(),
+			},
+			filter: client.MatchingFields{UsingClusterProfiles: TestNamespace + "/ns1/clusterprofile1"},
+		},
+		"multiple clusters, single match": {
+			clusters: []*kueue.MultiKueueCluster{
+				utiltestingapi.MakeMultiKueueCluster("cluster1").ClusterProfile("clusterprofile1", "ns1").Obj(),
+				utiltestingapi.MakeMultiKueueCluster("cluster2").ClusterProfile("clusterprofile2", "ns2").Obj(),
+			},
+			filter:   client.MatchingFields{UsingClusterProfiles: TestNamespace + "/ns1/clusterprofile1"},
+			wantList: []string{"cluster1"},
+		},
+	}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			ctx, _ := utiltesting.ContextWithLog(t)
+			builder := getClientBuilder(ctx)
+			k8sclient := builder.Build()
+			for _, req := range tc.clusters {
+				if err := k8sclient.Create(ctx, req); err != nil {
+					t.Fatalf("Unable to create %q cluster: %v", client.ObjectKeyFromObject(req), err)
+				}
+			}
+
+			lst := &kueue.MultiKueueClusterList{}
+
+			gotListErr := k8sclient.List(ctx, lst, tc.filter)
+			if diff := cmp.Diff(tc.wantListError, gotListErr); diff != "" {
+				t.Errorf("unexpected list error (-want/+got):\n%s", diff)
+			}
+
+			gotList := slices.Map(lst.Items, func(mkc *kueue.MultiKueueCluster) string { return mkc.Name })
+			if diff := cmp.Diff(tc.wantList, gotList, cmpopts.EquateEmpty(), cmpopts.SortSlices(func(a, b string) bool { return a < b })); diff != "" {
+				t.Errorf("unexpected list (-want/+got):\n%s", diff)
+			}
+		})
+	}
+}
+
 func TestListMultiKueueConfigsUsingMultiKueueClusters(t *testing.T) {
 	cases := map[string]struct {
 		configs       []*kueue.MultiKueueConfig
diff --git a/pkg/controller/admissionchecks/multikueue/multikueuecluster_test.go b/pkg/controller/admissionchecks/multikueue/multikueuecluster_test.go
index 8481b77ae..cc2ef911b 100644
--- a/pkg/controller/admissionchecks/multikueue/multikueuecluster_test.go
+++ b/pkg/controller/admissionchecks/multikueue/multikueuecluster_test.go
@@ -34,9 +34,11 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
 	"k8s.io/utils/ptr"
+	inventoryv1alpha1 "sigs.k8s.io/cluster-inventory-api/apis/v1alpha1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
@@ -57,8 +59,9 @@ var (
 	errCannotWatch   = errors.New("client cannot watch")
 )
 
-func fakeClientBuilder(ctx context.Context) func([]byte, client.Options) (client.WithWatch, error) {
-	return func(kubeconfig []byte, _ client.Options) (client.WithWatch, error) {
+func fakeClientBuilder(ctx context.Context) func(*clientConfig, client.Options) (client.WithWatch, error) {
+	return func(config *clientConfig, _ client.Options) (client.WithWatch, error) {
+		kubeconfig := config.Kubeconfig
 		if strings.Contains(string(kubeconfig), "invalid") {
 			return nil, errInvalidConfig
 		}
@@ -75,11 +78,11 @@ func fakeClientBuilder(ctx context.Context) func([]byte, client.Options) (client
 	}
 }
 
-func newTestClient(ctx context.Context, config string, watchCancel func()) *remoteClient {
+func newTestClient(ctx context.Context, kubeconfig []byte, restConfig *rest.Config, watchCancel func()) *remoteClient {
 	b := getClientBuilder(ctx)
 	localClient := b.Build()
 	ret := &remoteClient{
-		kubeconfig:  []byte(config),
+		config:      &clientConfig{Kubeconfig: kubeconfig, RestConfig: restConfig},
 		localClient: localClient,
 		watchCancel: watchCancel,
 
@@ -106,6 +109,37 @@ func makeTestSecret(name string, kubeconfig string) corev1.Secret {
 	}
 }
 
+type testClusterProfileCreds struct {
+	supportedProviders map[string]bool
+}
+
+func (t *testClusterProfileCreds) BuildConfigFromCP(clusterprofile *inventoryv1alpha1.ClusterProfile) (*rest.Config, error) {
+	for _, provider := range clusterprofile.Status.CredentialProviders {
+		if t.supportedProviders[provider.Name] {
+			return &rest.Config{
+				Host: clusterprofile.Name,
+			}, nil
+		}
+	}
+	return nil, errors.New("unsupported credential provider")
+}
+
+func makeTestClusterProfile(name string, providerName string) inventoryv1alpha1.ClusterProfile {
+	return inventoryv1alpha1.ClusterProfile{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: TestNamespace,
+		},
+		Status: inventoryv1alpha1.ClusterProfileStatus{
+			CredentialProviders: []inventoryv1alpha1.CredentialProvider{
+				{
+					Name: providerName,
+				},
+			},
+		},
+	}
+}
+
 func kubeconfigBase(user string) *utiltesting.TestKubeconfigWrapper {
 	return utiltesting.NewTestKubeConfigWrapper().
 		Cluster("test", "https://10.10.10.10", []byte{'-', '-', '-', '-', '-'}).
@@ -135,10 +169,12 @@ func TestUpdateConfig(t *testing.T) {
 	validKubeconfigLocation := filepath.Join(t.TempDir(), "worker1KubeConfig")
 
 	cases := map[string]struct {
-		reconcileFor  string
-		remoteClients map[string]*remoteClient
-		clusters      []kueue.MultiKueueCluster
-		secrets       []corev1.Secret
+		reconcileFor    string
+		remoteClients   map[string]*remoteClient
+		clusters        []kueue.MultiKueueCluster
+		secrets         []corev1.Secret
+		clusterprofiles []inventoryv1alpha1.ClusterProfile
+		cpCreds         clusterProfileCreds
 
 		wantRemoteClients      map[string]*remoteClient
 		wantClusters           []kueue.MultiKueueCluster
@@ -166,9 +202,7 @@ func TestUpdateConfig(t *testing.T) {
 					Obj(),
 			},
 			wantRemoteClients: map[string]*remoteClient{
-				"worker1": {
-					kubeconfig: []byte(testKubeconfig("worker1")),
-				},
+				"worker1": newTestClient(ctx, []byte(testKubeconfig("worker1")), nil, nil),
 			},
 		},
 		"update client with valid secret config": {
@@ -183,7 +217,7 @@ func TestUpdateConfig(t *testing.T) {
 				makeTestSecret("worker1", testKubeconfig("worker1")),
 			},
 			remoteClients: map[string]*remoteClient{
-				"worker1": newTestClient(ctx, "worker1 old kubeconfig", cancelCalled),
+				"worker1": newTestClient(ctx, []byte(testKubeconfig("worker1 old kubeconfig")), nil, cancelCalled),
 			},
 			wantClusters: []kueue.MultiKueueCluster{
 				*utiltestingapi.MakeMultiKueueCluster("worker1").
@@ -194,7 +228,9 @@ func TestUpdateConfig(t *testing.T) {
 			},
 			wantRemoteClients: map[string]*remoteClient{
 				"worker1": {
-					kubeconfig: []byte(testKubeconfig("worker1")),
+					config: &clientConfig{
+						Kubeconfig: []byte(testKubeconfig("worker1")),
+					},
 				},
 			},
 			wantCancelCalled: 1,
@@ -208,7 +244,7 @@ func TestUpdateConfig(t *testing.T) {
 					Obj(),
 			},
 			remoteClients: map[string]*remoteClient{
-				"worker1": newTestClient(ctx, testKubeconfig("worker1_old"), cancelCalled),
+				"worker1": newTestClient(ctx, []byte(testKubeconfig("worker1 old kubeconfig")), nil, cancelCalled),
 			},
 			wantClusters: []kueue.MultiKueueCluster{
 				*utiltestingapi.MakeMultiKueueCluster("worker1").
@@ -218,9 +254,7 @@ func TestUpdateConfig(t *testing.T) {
 					Obj(),
 			},
 			wantRemoteClients: map[string]*remoteClient{
-				"worker1": {
-					kubeconfig: []byte(testKubeconfig("worker1")),
-				},
+				"worker1": newTestClient(ctx, []byte(testKubeconfig("worker1")), nil, nil),
 			},
 			wantCancelCalled: 1,
 		},
@@ -236,10 +270,10 @@ func TestUpdateConfig(t *testing.T) {
 				makeTestSecret("worker1", testKubeconfig("invalid")),
 			},
 			remoteClients: map[string]*remoteClient{
-				"worker1": newTestClient(ctx, "worker1 old kubeconfig", cancelCalled),
+				"worker1": newTestClient(ctx, []byte("worker1 old kubeconfig"), nil, cancelCalled),
 			},
 			wantRemoteClients: map[string]*remoteClient{
-				"worker1": newTestClient(ctx, testKubeconfig("invalid"), nil),
+				"worker1": newTestClient(ctx, []byte(testKubeconfig("invalid")), nil, nil),
 			},
 			wantClusters: []kueue.MultiKueueCluster{
 				*utiltestingapi.MakeMultiKueueCluster("worker1").
@@ -259,16 +293,17 @@ func TestUpdateConfig(t *testing.T) {
 					Obj(),
 			},
 			remoteClients: map[string]*remoteClient{
-				"worker1": newTestClient(ctx, "worker1 old kubeconfig", cancelCalled),
+				"worker1": newTestClient(ctx, []byte("worker1 old kubeconfig"), nil, cancelCalled),
 			},
 			wantClusters: []kueue.MultiKueueCluster{
 				*utiltestingapi.MakeMultiKueueCluster("worker1").
 					KubeConfig(kueue.PathLocationType, "").
-					Active(metav1.ConditionFalse, "BadConfig", "open : no such file or directory", 1).
+					Active(metav1.ConditionFalse, "BadKubeConfig", "load client config failed: open : no such file or directory", 1).
 					Generation(1).
 					Obj(),
 			},
 			wantCancelCalled: 1,
+			wantErr:          fmt.Errorf("failed to load client config, reason: BadKubeConfig, error: %w", errors.New("open : no such file or directory")),
 		},
 		"missing cluster is removed": {
 			reconcileFor: "worker2",
@@ -279,8 +314,8 @@ func TestUpdateConfig(t *testing.T) {
 					Obj(),
 			},
 			remoteClients: map[string]*remoteClient{
-				"worker1": newTestClient(ctx, "worker1 kubeconfig", cancelCalled),
-				"worker2": newTestClient(ctx, "worker2 kubeconfig", cancelCalled),
+				"worker1": newTestClient(ctx, []byte("worker1 kubeconfig"), nil, cancelCalled),
+				"worker2": newTestClient(ctx, []byte("worker2 kubeconfig"), nil, cancelCalled),
 			},
 			wantClusters: []kueue.MultiKueueCluster{
 				*utiltestingapi.MakeMultiKueueCluster("worker1").
@@ -290,7 +325,9 @@ func TestUpdateConfig(t *testing.T) {
 			},
 			wantRemoteClients: map[string]*remoteClient{
 				"worker1": {
-					kubeconfig: []byte("worker1 kubeconfig"),
+					config: &clientConfig{
+						Kubeconfig: []byte("worker1 kubeconfig"),
+					},
 				},
 			},
 			wantCancelCalled: 1,
@@ -307,10 +344,10 @@ func TestUpdateConfig(t *testing.T) {
 				makeTestSecret("worker1", testKubeconfig("nowatch")),
 			},
 			remoteClients: map[string]*remoteClient{
-				"worker1": newTestClient(ctx, "worker1 old kubeconfig", cancelCalled),
+				"worker1": newTestClient(ctx, []byte("worker1 old kubeconfig"), nil, cancelCalled),
 			},
 			wantRemoteClients: map[string]*remoteClient{
-				"worker1": setReconnectState(newTestClient(ctx, testKubeconfig("nowatch"), nil), 1),
+				"worker1": setReconnectState(newTestClient(ctx, []byte(testKubeconfig("nowatch")), nil, nil), 1),
 			},
 			wantClusters: []kueue.MultiKueueCluster{
 				*utiltestingapi.MakeMultiKueueCluster("worker1").
@@ -335,10 +372,10 @@ func TestUpdateConfig(t *testing.T) {
 				makeTestSecret("worker1", testKubeconfig("nowatch")),
 			},
 			remoteClients: map[string]*remoteClient{
-				"worker1": setReconnectState(newTestClient(ctx, testKubeconfig("nowatch"), cancelCalled), 2),
+				"worker1": setReconnectState(newTestClient(ctx, []byte(testKubeconfig("nowatch")), nil, cancelCalled), 2),
 			},
 			wantRemoteClients: map[string]*remoteClient{
-				"worker1": setReconnectState(newTestClient(ctx, testKubeconfig("nowatch"), nil), 3),
+				"worker1": setReconnectState(newTestClient(ctx, []byte(testKubeconfig("nowatch")), nil, nil), 3),
 			},
 			wantClusters: []kueue.MultiKueueCluster{
 				*utiltestingapi.MakeMultiKueueCluster("worker1").
@@ -363,10 +400,10 @@ func TestUpdateConfig(t *testing.T) {
 				makeTestSecret("worker1", testKubeconfig("good_user")),
 			},
 			remoteClients: map[string]*remoteClient{
-				"worker1": setReconnectState(newTestClient(ctx, testKubeconfig("nowatch"), cancelCalled), 5),
+				"worker1": setReconnectState(newTestClient(ctx, []byte(testKubeconfig("nowatch")), nil, cancelCalled), 5),
 			},
 			wantRemoteClients: map[string]*remoteClient{
-				"worker1": newTestClient(ctx, testKubeconfig("good_user"), nil),
+				"worker1": newTestClient(ctx, []byte(testKubeconfig("good_user")), nil, nil),
 			},
 			wantClusters: []kueue.MultiKueueCluster{
 				*utiltestingapi.MakeMultiKueueCluster("worker1").
@@ -390,10 +427,10 @@ func TestUpdateConfig(t *testing.T) {
 				makeTestSecret("worker1", testKubeconfig("invalid")),
 			},
 			remoteClients: map[string]*remoteClient{
-				"worker1": setReconnectState(newTestClient(ctx, "nowatch", cancelCalled), 5),
+				"worker1": setReconnectState(newTestClient(ctx, []byte("nowatch"), nil, cancelCalled), 5),
 			},
 			wantRemoteClients: map[string]*remoteClient{
-				"worker1": newTestClient(ctx, testKubeconfig("invalid"), nil),
+				"worker1": newTestClient(ctx, []byte(testKubeconfig("invalid")), nil, nil),
 			},
 			wantClusters: []kueue.MultiKueueCluster{
 				*utiltestingapi.MakeMultiKueueCluster("worker1").
@@ -418,11 +455,11 @@ func TestUpdateConfig(t *testing.T) {
 			wantClusters: []kueue.MultiKueueCluster{
 				*utiltestingapi.MakeMultiKueueCluster("worker1").
 					KubeConfig(kueue.SecretLocationType, "worker1").
-					Active(metav1.ConditionFalse, "InsecureKubeConfig", "insecure kubeconfig: tokenFile is not allowed", 1).
+					Active(metav1.ConditionFalse, "InsecureKubeConfig", "load client config failed: tokenFile is not allowed", 1).
 					Generation(1).
 					Obj(),
 			},
-			wantErr: fmt.Errorf("validating kubeconfig failed: %w", errors.New("tokenFile is not allowed")),
+			wantErr: fmt.Errorf("failed to load client config, reason: InsecureKubeConfig, error: %w", errors.New("tokenFile is not allowed")),
 		},
 		"remove client with invalid kubeconfig": {
 			reconcileFor: "worker1",
@@ -436,18 +473,18 @@ func TestUpdateConfig(t *testing.T) {
 				makeTestSecret("worker1", testKubeconfigInsecure("worker1", ptr.To("/path/to/tokenfile"))),
 			},
 			remoteClients: map[string]*remoteClient{
-				"worker1": newTestClient(ctx, "worker1 old kubeconfig", cancelCalled),
+				"worker1": newTestClient(ctx, []byte("worker1 old kubeconfig"), nil, cancelCalled),
 			},
 			wantClusters: []kueue.MultiKueueCluster{
 				*utiltestingapi.MakeMultiKueueCluster("worker1").
 					KubeConfig(kueue.SecretLocationType, "worker1").
-					Active(metav1.ConditionFalse, "InsecureKubeConfig", "insecure kubeconfig: tokenFile is not allowed", 1).
+					Active(metav1.ConditionFalse, "InsecureKubeConfig", "load client config failed: tokenFile is not allowed", 1).
 					Generation(1).
 					Obj(),
 			},
 			wantRemoteClients: map[string]*remoteClient{},
 			wantCancelCalled:  1,
-			wantErr:           fmt.Errorf("validating kubeconfig failed: %w", errors.New("tokenFile is not allowed")),
+			wantErr:           fmt.Errorf("failed to load client config, reason: InsecureKubeConfig, error: %w", errors.New("tokenFile is not allowed")),
 		},
 		"skip insecure kubeconfig validation": {
 			reconcileFor: "worker1",
@@ -469,11 +506,114 @@ func TestUpdateConfig(t *testing.T) {
 			},
 			wantRemoteClients: map[string]*remoteClient{
 				"worker1": {
-					kubeconfig: []byte(testKubeconfigInsecure("worker1", ptr.To("/path/to/tokenfile"))),
+					config: &clientConfig{
+						Kubeconfig: []byte(testKubeconfigInsecure("worker1", ptr.To("/path/to/tokenfile"))),
+					},
 				},
 			},
 			skipInsecureKubeconfig: true,
 		},
+		"use cluster profile": {
+			reconcileFor: "worker1",
+			clusters: []kueue.MultiKueueCluster{
+				*utiltestingapi.MakeMultiKueueCluster("worker1").
+					ClusterProfile("worker1", TestNamespace).
+					Generation(1).
+					Obj(),
+			},
+			secrets: []corev1.Secret{},
+			clusterprofiles: []inventoryv1alpha1.ClusterProfile{
+				makeTestClusterProfile("worker1", "credentialProvider1"),
+			},
+			cpCreds: &testClusterProfileCreds{
+				supportedProviders: map[string]bool{
+					"credentialProvider1": true,
+				},
+			},
+			wantClusters: []kueue.MultiKueueCluster{
+				*utiltestingapi.MakeMultiKueueCluster("worker1").
+					ClusterProfile("worker1", TestNamespace).
+					Active(metav1.ConditionTrue, "Active", "Connected", 1).
+					Generation(1).
+					Obj(),
+			},
+			wantRemoteClients: map[string]*remoteClient{
+				"worker1": {
+					config: &clientConfig{
+						RestConfig: &rest.Config{Host: "worker1"},
+					},
+				},
+			},
+		},
+		"unsupported credential provider": {
+			reconcileFor: "worker1",
+			clusters: []kueue.MultiKueueCluster{
+				*utiltestingapi.MakeMultiKueueCluster("worker1").
+					ClusterProfile("worker1", TestNamespace).
+					Generation(1).
+					Obj(),
+			},
+			secrets: []corev1.Secret{},
+			clusterprofiles: []inventoryv1alpha1.ClusterProfile{
+				makeTestClusterProfile("worker1", "credentialProvider1"),
+			},
+			cpCreds: &testClusterProfileCreds{
+				supportedProviders: map[string]bool{},
+			},
+			wantClusters: []kueue.MultiKueueCluster{
+				*utiltestingapi.MakeMultiKueueCluster("worker1").
+					ClusterProfile("worker1", TestNamespace).
+					Active(metav1.ConditionFalse, "BadClusterProfile", "load client config failed: unsupported credential provider", 1).
+					Generation(1).
+					Obj(),
+			},
+			wantErr: fmt.Errorf("failed to load client config, reason: BadClusterProfile, error: %w", errors.New("unsupported credential provider")),
+		},
+		"cluster profile not found": {
+			reconcileFor: "worker1",
+			clusters: []kueue.MultiKueueCluster{
+				*utiltestingapi.MakeMultiKueueCluster("worker1").
+					ClusterProfile("worker1", TestNamespace).
+					Generation(1).
+					Obj(),
+			},
+			secrets: []corev1.Secret{},
+			clusterprofiles: []inventoryv1alpha1.ClusterProfile{
+				makeTestClusterProfile("worker2", "credentialProvider2"),
+			},
+			cpCreds: &testClusterProfileCreds{
+				supportedProviders: map[string]bool{},
+			},
+			wantClusters: []kueue.MultiKueueCluster{
+				*utiltestingapi.MakeMultiKueueCluster("worker1").
+					ClusterProfile("worker1", TestNamespace).
+					Active(metav1.ConditionFalse, "BadClusterProfile", "load client config failed: clusterprofiles.multicluster.x-k8s.io \"worker1\" not found", 1).
+					Generation(1).
+					Obj(),
+			},
+			wantErr: fmt.Errorf("failed to load client config, reason: BadClusterProfile, error: %w", errors.New(`clusterprofiles.multicluster.x-k8s.io "worker1" not found`)),
+		},
+		"cluster profile feature gate disabled": {
+			reconcileFor: "worker1",
+			clusters: []kueue.MultiKueueCluster{
+				*utiltestingapi.MakeMultiKueueCluster("worker1").
+					ClusterProfile("worker1", TestNamespace).
+					Generation(1).
+					Obj(),
+			},
+			secrets: []corev1.Secret{},
+			cpCreds: &testClusterProfileCreds{
+				supportedProviders: map[string]bool{},
+			},
+			wantClusters: []kueue.MultiKueueCluster{
+				*utiltestingapi.MakeMultiKueueCluster("worker1").
+					ClusterProfile("worker1", TestNamespace).
+					Active(metav1.ConditionFalse, "MultiKueueClusterProfileFeatureDisabled", "load client config failed: MultiKueueClusterProfile feature gate is disabled", 1).
+					Generation(1).
+					Obj(),
+			},
+			wantErr: fmt.Errorf("failed to load client config, reason: MultiKueueClusterProfileFeatureDisabled, error: %w", errors.New("MultiKueueClusterProfile feature gate is disabled")),
+		},
 	}
 
 	for name, tc := range cases {
@@ -482,11 +622,12 @@ func TestUpdateConfig(t *testing.T) {
 			builder := getClientBuilder(ctx)
 			builder = builder.WithLists(&kueue.MultiKueueClusterList{Items: tc.clusters})
 			builder = builder.WithLists(&corev1.SecretList{Items: tc.secrets})
+			builder = builder.WithLists(&inventoryv1alpha1.ClusterProfileList{Items: tc.clusterprofiles})
 			builder = builder.WithStatusSubresource(slices.Map(tc.clusters, func(c *kueue.MultiKueueCluster) client.Object { return c })...)
 			c := builder.Build()
 
 			adapters, _ := jobframework.GetMultiKueueAdapters(sets.New("batch/job"))
-			reconciler := newClustersReconciler(c, TestNamespace, 0, defaultOrigin, nil, adapters)
+			reconciler := newClustersReconciler(c, TestNamespace, 0, defaultOrigin, nil, adapters, tc.cpCreds)
 
 			reconciler.rootContext = ctx
 
@@ -499,8 +640,12 @@ func TestUpdateConfig(t *testing.T) {
 				features.SetFeatureGateDuringTest(t, features.MultiKueueAllowInsecureKubeconfigs, true)
 			}
 
+			if len(tc.clusterprofiles) > 0 {
+				features.SetFeatureGateDuringTest(t, features.MultiKueueClusterProfile, true)
+			}
+
 			// Create test kubeconfig file for path location type
-			if tc.clusters != nil && tc.clusters[0].Spec.KubeConfig.LocationType == kueue.PathLocationType && tc.clusters[0].Spec.KubeConfig.Location != "" {
+			if tc.clusters != nil && tc.clusters[0].Spec.KubeConfig != nil && tc.clusters[0].Spec.KubeConfig.LocationType == kueue.PathLocationType && tc.clusters[0].Spec.KubeConfig.Location != "" {
 				kubeconfigBytes := testKubeconfig("worker1")
 				if err := os.WriteFile(tc.clusters[0].Spec.KubeConfig.Location, []byte(kubeconfigBytes), 0666); err != nil {
 					t.Errorf("Failed to create test file (%s): %v", tc.clusters[0].Spec.KubeConfig.Location, err)
@@ -543,7 +688,16 @@ func TestUpdateConfig(t *testing.T) {
 					if a.failedConnAttempts != b.failedConnAttempts {
 						return false
 					}
-					return string(a.kubeconfig) == string(b.kubeconfig)
+					if a.config == nil || b.config == nil {
+						return a.config == b.config
+					}
+					if string(a.config.Kubeconfig) != string(b.config.Kubeconfig) {
+						return false
+					}
+					if cmp.Diff(a.config.RestConfig, b.config.RestConfig) != "" {
+						return false
+					}
+					return true
 				})); diff != "" {
 				t.Errorf("unexpected controllers (-want/+got):\n%s", diff)
 			}
diff --git a/pkg/controller/admissionchecks/multikueue/workload_test.go b/pkg/controller/admissionchecks/multikueue/workload_test.go
index d23208c85..853add3ff 100644
--- a/pkg/controller/admissionchecks/multikueue/workload_test.go
+++ b/pkg/controller/admissionchecks/multikueue/workload_test.go
@@ -1473,7 +1473,7 @@ func TestWlReconcile(t *testing.T) {
 
 			managerClient := managerBuilder.Build()
 			adapters, _ := jobframework.GetMultiKueueAdapters(sets.New("batch/job"))
-			cRec := newClustersReconciler(managerClient, TestNamespace, 0, defaultOrigin, nil, adapters)
+			cRec := newClustersReconciler(managerClient, TestNamespace, 0, defaultOrigin, nil, adapters, nil)
 
 			worker1Builder := getClientBuilder(ctx)
 			worker1Builder = worker1Builder.WithLists(&kueue.WorkloadList{Items: tc.worker1Workloads}, &batchv1.JobList{Items: tc.worker1Jobs})
diff --git a/pkg/controller/jobframework/reconciler_test.go b/pkg/controller/jobframework/reconciler_test.go
index 1562177ae..30a7167ed 100644
--- a/pkg/controller/jobframework/reconciler_test.go
+++ b/pkg/controller/jobframework/reconciler_test.go
@@ -670,7 +670,7 @@ func TestProcessOptions(t *testing.T) {
 				WithWaitForPodsReady(&configapi.WaitForPodsReady{}),
 				WithKubeServerVersion(&kubeversion.ServerVersionFetcher{}),
 				WithLabelKeysToCopy([]string{"toCopyKey"}),
-				WithClock(t, fakeClock),
+				WithClock(fakeClock),
 			},
 			wantOpts: Options{
 				ManageJobsWithoutQueueName: true,
@@ -830,7 +830,7 @@ func TestReconcileGenericJobWithWaitForPodsReady(t *testing.T) {
 
 			fakeClock := testingclock.NewFakeClock(testStartTime)
 			options := []Option{
-				WithClock(nil, fakeClock),
+				WithClock(fakeClock),
 				WithWaitForPodsReady(&configapi.WaitForPodsReady{}),
 			}
 			recorder := &utiltesting.EventRecorder{}
diff --git a/pkg/controller/jobs/job/job_controller_test.go b/pkg/controller/jobs/job/job_controller_test.go
index f8e56261a..f9c016b20 100644
--- a/pkg/controller/jobs/job/job_controller_test.go
+++ b/pkg/controller/jobs/job/job_controller_test.go
@@ -3934,7 +3934,7 @@ func TestReconciler(t *testing.T) {
 					}
 				}
 				recorder := &utiltesting.EventRecorder{}
-				reconciler, err := NewReconciler(ctx, kClient, indexer, recorder, append(tc.reconcilerOptions, jobframework.WithClock(t, fakeClock))...)
+				reconciler, err := NewReconciler(ctx, kClient, indexer, recorder, append(tc.reconcilerOptions, jobframework.WithClock(fakeClock))...)
 				if err != nil {
 					t.Errorf("Error creating the reconciler: %v", err)
 				}
diff --git a/pkg/controller/jobs/pod/pod_controller_test.go b/pkg/controller/jobs/pod/pod_controller_test.go
index 54da64418..6e0fc057c 100644
--- a/pkg/controller/jobs/pod/pod_controller_test.go
+++ b/pkg/controller/jobs/pod/pod_controller_test.go
@@ -5620,7 +5620,7 @@ func TestReconciler(t *testing.T) {
 					}
 				}
 				recorder := &utiltesting.EventRecorder{}
-				reconciler, err := NewReconciler(ctx, kClient, indexer, recorder, append(tc.reconcilerOptions, jobframework.WithClock(t, fakeClock))...)
+				reconciler, err := NewReconciler(ctx, kClient, indexer, recorder, append(tc.reconcilerOptions, jobframework.WithClock(fakeClock))...)
 				if err != nil {
 					t.Errorf("Error creating the reconciler: %v", err)
 				}
@@ -5970,7 +5970,7 @@ func TestReconciler_DeletePodAfterTransientErrorsOnUpdateOrDeleteOps(t *testing.
 	}
 
 	recorder := record.NewBroadcaster().NewRecorder(kClient.Scheme(), corev1.EventSource{Component: "test"})
-	reconciler, err := NewReconciler(ctx, kClient, indexer, recorder, jobframework.WithClock(t, fakeClock))
+	reconciler, err := NewReconciler(ctx, kClient, indexer, recorder, jobframework.WithClock(fakeClock))
 	if err != nil {
 		t.Errorf("Error creating the reconciler: %v", err)
 	}
diff --git a/pkg/controller/jobs/raycluster/raycluster_controller_test.go b/pkg/controller/jobs/raycluster/raycluster_controller_test.go
index 1321f8a4d..5f7e837bd 100644
--- a/pkg/controller/jobs/raycluster/raycluster_controller_test.go
+++ b/pkg/controller/jobs/raycluster/raycluster_controller_test.go
@@ -707,7 +707,7 @@ func TestReconciler(t *testing.T) {
 					}
 				}
 				recorder := record.NewBroadcaster().NewRecorder(kClient.Scheme(), corev1.EventSource{Component: "test"})
-				reconciler, err := NewReconciler(ctx, kClient, indexer, recorder, append(tc.reconcilerOptions, jobframework.WithClock(t, fakeClock))...)
+				reconciler, err := NewReconciler(ctx, kClient, indexer, recorder, append(tc.reconcilerOptions, jobframework.WithClock(fakeClock))...)
 				if err != nil {
 					t.Errorf("Error creating the reconciler: %v", err)
 				}
diff --git a/pkg/util/client/client_test.go b/pkg/util/client/client_test.go
index 7cb8e2506..83555a55d 100644
--- a/pkg/util/client/client_test.go
+++ b/pkg/util/client/client_test.go
@@ -22,13 +22,27 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	batchv1 "k8s.io/api/batch/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	utiltesting "sigs.k8s.io/kueue/pkg/util/testing"
 )
 
+var (
+	errTestNotFound = apierrors.NewNotFound(
+		schema.GroupResource{Group: "batch", Resource: "jobs"},
+		"test",
+	)
+	errTestConflict = apierrors.NewConflict(
+		schema.GroupResource{Group: "batch", Resource: "jobs"},
+		"test",
+		errors.New("object was modified"),
+	)
+)
+
 // newObject creates and returns a new *batchv1.Job initialized with the given
 // resourceVersion and default metadata (Namespace="default", Name="test").
 //
@@ -53,14 +67,12 @@ func newObject(resourceVersion string, opts ...func(*batchv1.Job)) *batchv1.Job
 
 func TestPatch(t *testing.T) {
 	type args struct {
-		// context: initialized in t.Run().
-		// client: initialized in t.Run().
-		obj     client.Object
-		update  func() (client.Object, bool, error)
+		obj     *batchv1.Job
+		update  func(job *batchv1.Job) UpdateFunc
 		options []PatchOption
 	}
 	type want struct {
-		err bool
+		err error
 		obj client.Object // To assert patched object.
 	}
 	// clientObject is used to initialize test Client in t.Run().
@@ -72,49 +84,49 @@ func TestPatch(t *testing.T) {
 	}{
 		"Strict_OutdatedLocalObject": {
 			args: args{
-				obj: newObject("1"), // outdated local object results in patch error.
-				update: func() (client.Object, bool, error) {
-					obj := newObject("1")
-					obj.Spec.Suspend = ptr.To(true)
-					return obj, true, nil
+				obj: newObject("1"), // outdated local object.
+				update: func(job *batchv1.Job) UpdateFunc {
+					return func() (bool, error) {
+						job.Spec.Suspend = ptr.To(true)
+						return true, nil
+					}
 				},
 			},
 			want: want{
-				err: true,           // object was modified error.
-				obj: newObject("2"), // unchanged.
+				err: errTestConflict,
+				obj: newObject("2"),
 			},
 		},
 		"Strict_CurrentLocalObject": {
 			args: args{
 				obj: newObject("2"),
-				update: func() (client.Object, bool, error) {
-					obj := newObject("2")
-					obj.Spec.Suspend = ptr.To(true)
-					obj.Status.Active = 1
-					return obj, true, nil
+				update: func(job *batchv1.Job) UpdateFunc {
+					return func() (bool, error) {
+						job.Spec.Suspend = ptr.To(true)
+						job.Status.Active = 1
+						return true, nil
+					}
 				},
 			},
 			want: want{
-				obj: newObject("3", // post-patch incremented resource version.
-					func(job *batchv1.Job) {
-						// Change to Spec is applied; Status change is ignored because Patch updates meta and spec only.
-						job.Spec.Suspend = ptr.To(true)
-					}),
+				obj: newObject("3", func(job *batchv1.Job) {
+					// Change to Spec is applied; Status change is ignored because Patch updates meta and spec only.
+					job.Spec.Suspend = ptr.To(true)
+				}),
 			},
 		},
 		"NotStrict_OutdatedLocalObject": {
 			args: args{
 				obj: newObject("1"), // outdated local object.
-				update: func() (client.Object, bool, error) {
-					obj := newObject("1")
-					obj.Spec.Suspend = ptr.To(true)
-					return obj, true, nil
+				update: func(job *batchv1.Job) UpdateFunc {
+					return func() (bool, error) {
+						job.Spec.Suspend = ptr.To(true)
+						return true, nil
+					}
 				},
 				options: []PatchOption{WithLoose()},
 			},
 			want: want{
-				// Unlike "Strict" version - this update is successful since the resource version is not
-				// included in the patch.
 				obj: newObject("3", func(job *batchv1.Job) {
 					job.Spec.Suspend = ptr.To(true)
 				}),
@@ -123,10 +135,11 @@ func TestPatch(t *testing.T) {
 		"NotStrict_CurrentLocalObject": {
 			args: args{
 				obj: newObject("2"),
-				update: func() (client.Object, bool, error) {
-					obj := newObject("2")
-					obj.Spec.Suspend = ptr.To(true)
-					return obj, true, nil
+				update: func(job *batchv1.Job) UpdateFunc {
+					return func() (bool, error) {
+						job.Spec.Suspend = ptr.To(true)
+						return true, nil
+					}
 				},
 				options: []PatchOption{WithLoose()},
 			},
@@ -137,12 +150,12 @@ func TestPatch(t *testing.T) {
 			},
 		},
 		"NoChanges": {
-			// Modeled after "Strict_OutdatedLocalObject"; however since we are returning
-			// updated: false - it makes no difference if the local object is outdated.
 			args: args{
-				obj: newObject("1"), // outdated local object results in patch error.
-				update: func() (client.Object, bool, error) {
-					return newObject("1"), false, nil
+				obj: newObject("1"), // outdated local object.
+				update: func(job *batchv1.Job) UpdateFunc {
+					return func() (bool, error) {
+						return false, nil
+					}
 				},
 			},
 			want: want{
@@ -152,12 +165,14 @@ func TestPatch(t *testing.T) {
 		"Error": {
 			args: args{
 				obj: newObject("2"),
-				update: func() (client.Object, bool, error) {
-					return newObject("2"), true, errors.New("test-error")
+				update: func(job *batchv1.Job) UpdateFunc {
+					return func() (bool, error) {
+						return false, errTestNotFound
+					}
 				},
 			},
 			want: want{
-				err: true,
+				err: errTestNotFound,
 				obj: newObject("2"),
 			},
 		},
@@ -166,8 +181,9 @@ func TestPatch(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			ctx, _ := utiltesting.ContextWithLog(t)
 			clnt := utiltesting.NewClientBuilder().WithObjects(clientObject).Build()
-			if err := Patch(ctx, clnt, tt.args.obj, tt.args.update, tt.args.options...); (err != nil) != tt.want.err {
-				t.Errorf("Patch() error = %v, wantErr %v", err, tt.want.err)
+			err := Patch(ctx, clnt, tt.args.obj, tt.args.update(tt.args.obj), tt.args.options...)
+			if diff := cmp.Diff(tt.want.err, err); diff != "" {
+				t.Errorf("unexpected error (-want/+got):\n%s", diff)
 			}
 			if err := clnt.Get(ctx, client.ObjectKeyFromObject(tt.args.obj), tt.args.obj); err != nil {
 				t.Fatalf("Patch() unexpected error getting object: %v", err)
@@ -181,14 +197,12 @@ func TestPatch(t *testing.T) {
 
 func TestPatchStatus(t *testing.T) {
 	type args struct {
-		// context: initialized in t.Run().
-		// client: initialized in t.Run().
-		obj     client.Object
-		update  func() (client.Object, bool, error)
+		obj     *batchv1.Job
+		update  func(job *batchv1.Job) UpdateFunc
 		options []PatchOption
 	}
 	type want struct {
-		err bool
+		err error
 		obj client.Object // To assert patched object.
 	}
 	// clientObject is used to initialize test Client in t.Run().
@@ -201,39 +215,44 @@ func TestPatchStatus(t *testing.T) {
 		"Strict_OutdatedLocalObject": {
 			args: args{
 				obj: newObject("1"), // outdated local object results in patch error.
-				update: func() (client.Object, bool, error) {
-					return newObject("1"), true, nil
+				update: func(job *batchv1.Job) UpdateFunc {
+					return func() (bool, error) {
+						job.Status.Active = 1
+						return true, nil
+					}
 				},
 			},
 			want: want{
-				err: true,           // object was modified error.
-				obj: newObject("2"), // unchanged.
+				err: errTestConflict,
+				obj: newObject("2"),
 			},
 		},
 		"Strict_CurrentLocalObject": {
 			args: args{
 				obj: newObject("2"),
-				update: func() (client.Object, bool, error) {
-					obj := newObject("2")
-					obj.Status.Active = 1
-					obj.Spec.Suspend = ptr.To(true)
-					return obj, true, nil
+				update: func(job *batchv1.Job) UpdateFunc {
+					return func() (bool, error) {
+						job.Status.Active = 1
+						job.Spec.Suspend = ptr.To(true)
+						return true, nil
+					}
 				},
 			},
 			want: want{
 				obj: newObject("3", func(job *batchv1.Job) {
 					// Change to Status is applied; Spec change is ignored because Patch updates status only.
 					job.Status.Active = 1
-				}), // incremented.
+				}),
 			},
 		},
 		"NotStrict_OutdatedLocalObject": {
 			args: args{
 				obj: newObject("1"), // outdated local object.
-				update: func() (client.Object, bool, error) {
-					obj := newObject("1")
-					obj.Status.Active = 1
-					return obj, true, nil
+				update: func(job *batchv1.Job) UpdateFunc {
+					return func() (bool, error) {
+						job.Status.Active = 1
+						return true, nil
+					}
 				},
 				options: []PatchOption{WithLoose()},
 			},
@@ -246,10 +265,11 @@ func TestPatchStatus(t *testing.T) {
 		"NotStrict_CurrentLocalObject": {
 			args: args{
 				obj: newObject("2"),
-				update: func() (client.Object, bool, error) {
-					obj := newObject("2")
-					obj.Status.Active = 1
-					return obj, true, nil
+				update: func(job *batchv1.Job) UpdateFunc {
+					return func() (bool, error) {
+						job.Status.Active = 1
+						return true, nil
+					}
 				},
 				options: []PatchOption{WithLoose()},
 			},
@@ -260,12 +280,12 @@ func TestPatchStatus(t *testing.T) {
 			},
 		},
 		"NoChanges": {
-			// Modeled after "Strict_OutdatedLocalObject"; however since we are returning
-			// false - it makes no difference if the local object is outdated.
 			args: args{
-				obj: newObject("1"), // outdated local object results in patch error.
-				update: func() (client.Object, bool, error) {
-					return newObject("1"), false, nil
+				obj: newObject("1"), // outdated local object.
+				update: func(job *batchv1.Job) UpdateFunc {
+					return func() (bool, error) {
+						return false, nil
+					}
 				},
 			},
 			want: want{
@@ -275,14 +295,15 @@ func TestPatchStatus(t *testing.T) {
 		"Error": {
 			args: args{
 				obj: newObject("2"),
-				update: func() (client.Object, bool, error) {
-					obj := newObject("2")
-					obj.Status.Active = 1
-					return obj, true, errors.New("test-error")
+				update: func(job *batchv1.Job) UpdateFunc {
+					return func() (bool, error) {
+						job.Status.Active = 1
+						return true, errTestNotFound
+					}
 				},
 			},
 			want: want{
-				err: true,
+				err: errTestNotFound,
 				obj: newObject("2"),
 			},
 		},
@@ -291,8 +312,9 @@ func TestPatchStatus(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			ctx, _ := utiltesting.ContextWithLog(t)
 			clnt := utiltesting.NewClientBuilder().WithObjects(clientObject).Build()
-			if err := PatchStatus(ctx, clnt, tt.args.obj, tt.args.update, tt.args.options...); (err != nil) != tt.want.err {
-				t.Errorf("Patch() error = %v, wantErr %v", err, tt.want.err)
+			err := PatchStatus(ctx, clnt, tt.args.obj, tt.args.update(tt.args.obj), tt.args.options...)
+			if diff := cmp.Diff(tt.want.err, err); diff != "" {
+				t.Errorf("unexpected error (-want/+got):\n%s", diff)
 			}
 			if err := clnt.Get(ctx, client.ObjectKeyFromObject(tt.args.obj), tt.args.obj); err != nil {
 				t.Fatalf("Patch() unexpected error getting object: %v", err)
diff --git a/pkg/util/testing/v1beta2/wrappers.go b/pkg/util/testing/v1beta2/wrappers.go
index 53e1c3a56..3a35f2528 100644
--- a/pkg/util/testing/v1beta2/wrappers.go
+++ b/pkg/util/testing/v1beta2/wrappers.go
@@ -1441,13 +1441,21 @@ func (mkc *MultiKueueClusterWrapper) Obj() *kueue.MultiKueueCluster {
 }
 
 func (mkc *MultiKueueClusterWrapper) KubeConfig(locationType kueue.LocationType, location string) *MultiKueueClusterWrapper {
-	mkc.Spec.KubeConfig = kueue.KubeConfig{
+	mkc.Spec.KubeConfig = &kueue.KubeConfig{
 		Location:     location,
 		LocationType: locationType,
 	}
 	return mkc
 }
 
+func (mkc *MultiKueueClusterWrapper) ClusterProfile(name string, namespace string) *MultiKueueClusterWrapper {
+	mkc.Spec.ClusterProfile = &kueue.ClusterProfileReference{
+		Name:      name,
+		Namespace: namespace,
+	}
+	return mkc
+}
+
 func (mkc *MultiKueueClusterWrapper) Active(state metav1.ConditionStatus, reason, message string, generation int64) *MultiKueueClusterWrapper {
 	cond := metav1.Condition{
 		Type:               kueue.MultiKueueClusterActive,
diff --git a/pkg/workload/workload_test.go b/pkg/workload/workload_test.go
index db014d45a..7bc5d1af6 100644
--- a/pkg/workload/workload_test.go
+++ b/pkg/workload/workload_test.go
@@ -1652,16 +1652,10 @@ func TestPatchAdmissionStatus(t *testing.T) {
 					cl = utiltesting.NewFakeClient(wl)
 				}
 				called := false
-				gotErr := PatchAdmissionStatus(
-					ctx,
-					cl,
-					wl,
-					fakeClock,
-					func() (*kueue.Workload, bool, error) {
-						called = true
-						return wl, tc.patchCall.updated, tc.patchCall.err
-					},
-				)
+				gotErr := PatchAdmissionStatus(ctx, cl, wl, fakeClock, func() (bool, error) {
+					called = true
+					return tc.patchCall.updated, tc.patchCall.err
+				})
 				if diff := cmp.Diff(tc.wantErr, gotErr, cmpopts.EquateErrors()); diff != "" {
 					t.Errorf("Unexpected error (-want/+got)\n%s", diff)
 				}
diff --git a/test/e2e/customconfigs/managejobswithoutqueuename_test.go b/test/e2e/customconfigs/managejobswithoutqueuename_test.go
index 2250a9efe..6dc6bdf6b 100644
--- a/test/e2e/customconfigs/managejobswithoutqueuename_test.go
+++ b/test/e2e/customconfigs/managejobswithoutqueuename_test.go
@@ -23,6 +23,7 @@ import (
 	appsv1 "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/utils/ptr"
 	"k8s.io/utils/strings/slices"
@@ -88,6 +89,79 @@ var _ = ginkgo.Describe("ManageJobsWithoutQueueName", ginkgo.Ordered, func() {
 		util.ExpectAllPodsInNamespaceDeleted(ctx, k8sClient, ns)
 	})
 
+	ginkgo.When("manageJobsWithoutQueueName=true and ManagedJobsNamespaceSelectorAlwaysRespected=false", func() {
+		ginkgo.BeforeEach(func() {
+			util.UpdateKueueConfiguration(ctx, k8sClient, defaultKueueCfg, kindClusterName, func(cfg *config.Configuration) {
+				cfg.ManageJobsWithoutQueueName = true
+				cfg.FeatureGates = map[string]bool{string(features.ManagedJobsNamespaceSelectorAlwaysRespected): false}
+				cfg.ManagedJobsNamespaceSelector = &metav1.LabelSelector{
+					MatchExpressions: []metav1.LabelSelectorRequirement{
+						{
+							Key:      "kubernetes.io/metadata.name",
+							Operator: metav1.LabelSelectorOpNotIn,
+							Values:   []string{ns.Name, "kueue-system", "kube-system"},
+						},
+					},
+				}
+			})
+		})
+		ginkgo.AfterEach(func() {
+			util.UpdateKueueConfiguration(ctx, k8sClient, defaultKueueCfg, kindClusterName, func(cfg *config.Configuration) {
+				cfg.ManageJobsWithoutQueueName = true
+			})
+		})
+
+		ginkgo.It("should not suspend Jobs from unmanaged JobSet", func() {
+			var newJobSet *v1alpha2.JobSet
+
+			ginkgo.By("creating a JobSet", func() {
+				newJobSet = testingjobset.MakeJobSet("job-set", ns.Name).
+					Suspend(false).
+					ReplicatedJobs(
+						testingjobset.ReplicatedJobRequirements{
+							Name:        "test-job-1",
+							Replicas:    1,
+							Parallelism: 1,
+							Completions: 1,
+							Image:       "busybox",
+							Args:        []string{"sleep", "2s"},
+						},
+						testingjobset.ReplicatedJobRequirements{
+							Name:        "test-job-2",
+							Replicas:    1,
+							Parallelism: 1,
+							Completions: 1,
+							Image:       "busybox",
+							Args:        []string{"sleep", "2s"},
+						},
+					).Obj()
+				util.MustCreate(ctx, k8sClient, newJobSet)
+			})
+
+			ginkgo.By("verifying that the jobs are not suspended", func() {
+				gomega.Eventually(func(g gomega.Gomega) {
+					jobs := &batchv1.JobList{}
+					g.Expect(k8sClient.List(ctx, jobs, client.InNamespace(ns.Name))).To(gomega.Succeed())
+					g.Expect(jobs.Items).To(gomega.HaveLen(2))
+					for _, job := range jobs.Items {
+						g.Expect(job.Spec.Suspend).To(gomega.HaveValue(gomega.BeFalse()))
+						for _, job := range jobs.Items {
+							g.Expect(job.Status.Active).To(gomega.Equal(int32(1)))
+						}
+					}
+				}, util.LongTimeout, util.Interval).Should(gomega.Succeed())
+			})
+
+			ginkgo.By("verifying that the jobset is completed", func() {
+				gomega.Eventually(func(g gomega.Gomega) {
+					createjobset := &v1alpha2.JobSet{}
+					g.Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(newJobSet), createjobset)).To(gomega.Succeed())
+					g.Expect(createjobset.Status.TerminalState).To(gomega.Equal(string(v1alpha2.JobSetCompleted)))
+				}, util.LongTimeout, util.Interval).Should(gomega.Succeed())
+			})
+		})
+	})
+
 	ginkgo.When("manageJobsWithoutQueueName=true and LocalQueueDefaulting=false", func() {
 		ginkgo.It("should suspend a job", func() {
 			var testJob, createdJob *batchv1.Job
diff --git a/test/e2e/tas/suite_test.go b/test/e2e/tas/suite_test.go
index 14feef4d3..eed0c3608 100644
--- a/test/e2e/tas/suite_test.go
+++ b/test/e2e/tas/suite_test.go
@@ -80,10 +80,10 @@ var _ = ginkgo.BeforeSuite(func() {
 		gomega.Eventually(func(g gomega.Gomega) {
 			node := &corev1.Node{}
 			g.Expect(k8sClient.Get(ctx, client.ObjectKey{Name: n.Name}, node)).To(gomega.Succeed())
-			err := clientutil.PatchStatus(ctx, k8sClient, node, func() (client.Object, bool, error) {
+			err := clientutil.PatchStatus(ctx, k8sClient, node, func() (bool, error) {
 				node.Status.Capacity[extraResource] = resource.MustParse("1")
 				node.Status.Allocatable[extraResource] = resource.MustParse("1")
-				return node, true, nil
+				return true, nil
 			})
 			g.Expect(err).NotTo(gomega.HaveOccurred())
 		}, util.Timeout, util.Interval).Should(gomega.Succeed())
diff --git a/test/e2e/tas/trainjob_test.go b/test/e2e/tas/trainjob_test.go
index 5501014bb..3c9cf3f89 100644
--- a/test/e2e/tas/trainjob_test.go
+++ b/test/e2e/tas/trainjob_test.go
@@ -117,7 +117,7 @@ var _ = ginkgo.Describe("TopologyAwareScheduling for TrainJob", func() {
 			util.MustCreate(ctx, k8sClient, trainingRuntime)
 			util.MustCreate(ctx, k8sClient, trainjob)
 
-			ginkgo.By("JobSet is unsuspended", func() {
+			ginkgo.By("TrainJob is unsuspended", func() {
 				gomega.Eventually(func(g gomega.Gomega) {
 					g.Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(trainjob), trainjob)).To(gomega.Succeed())
 					g.Expect(trainjob.Spec.Suspend).Should(gomega.Equal(ptr.To(false)))
diff --git a/test/integration/multikueue/dispatcher_test.go b/test/integration/multikueue/dispatcher_test.go
index 231e36a55..79c19c532 100644
--- a/test/integration/multikueue/dispatcher_test.go
+++ b/test/integration/multikueue/dispatcher_test.go
@@ -215,13 +215,13 @@ var _ = ginkgo.Describe("MultiKueueDispatcherIncremental", ginkgo.Ordered, ginkg
 		ginkgo.By("setting the check conditions for eviction", func() {
 			gomega.Eventually(func(g gomega.Gomega) {
 				g.Expect(managerTestCluster.client.Get(managerTestCluster.ctx, wlLookupKey, createdWorkload)).To(gomega.Succeed())
-				g.Expect(workload.PatchAdmissionStatus(managerTestCluster.ctx, managerTestCluster.client, createdWorkload, util.RealClock, func() (*kueue.Workload, bool, error) {
+				g.Expect(workload.PatchAdmissionStatus(managerTestCluster.ctx, managerTestCluster.client, createdWorkload, util.RealClock, func() (bool, error) {
 					acs := kueue.AdmissionCheckState{
 						Name:    kueue.AdmissionCheckReference(multiKueueAC.Name),
 						State:   kueue.CheckStateRejected,
 						Message: "check rejected",
 					}
-					return createdWorkload, workload.SetAdmissionCheckState(&createdWorkload.Status.AdmissionChecks, acs, util.RealClock), nil
+					return workload.SetAdmissionCheckState(&createdWorkload.Status.AdmissionChecks, acs, util.RealClock), nil
 				})).To(gomega.Succeed())
 			}, util.Timeout, util.Interval).Should(gomega.Succeed())
 		})
@@ -388,9 +388,9 @@ var _ = ginkgo.Describe("MultiKueueDispatcherExternal", ginkgo.Ordered, ginkgo.C
 			gomega.Eventually(func(g gomega.Gomega) {
 				managerWl := &kueue.Workload{}
 				g.Expect(managerTestCluster.client.Get(managerTestCluster.ctx, wlLookupKey, managerWl)).To(gomega.Succeed())
-				g.Expect(workload.PatchAdmissionStatus(managerTestCluster.ctx, managerTestCluster.client, managerWl, util.RealClock, func() (*kueue.Workload, bool, error) {
+				g.Expect(workload.PatchAdmissionStatus(managerTestCluster.ctx, managerTestCluster.client, managerWl, util.RealClock, func() (bool, error) {
 					managerWl.Status.NominatedClusterNames = []string{workerCluster2.Name}
-					return managerWl, true, nil
+					return true, nil
 				})).To(gomega.Succeed())
 			}, util.Timeout, util.Interval).Should(gomega.Succeed())
 		})
@@ -418,9 +418,9 @@ var _ = ginkgo.Describe("MultiKueueDispatcherExternal", ginkgo.Ordered, ginkgo.C
 			managerWl := &kueue.Workload{}
 			gomega.Eventually(func(g gomega.Gomega) {
 				g.Expect(managerTestCluster.client.Get(managerTestCluster.ctx, wlLookupKey, managerWl)).To(gomega.Succeed())
-				g.Expect(workload.PatchAdmissionStatus(managerTestCluster.ctx, managerTestCluster.client, managerWl, util.RealClock, func() (*kueue.Workload, bool, error) {
+				g.Expect(workload.PatchAdmissionStatus(managerTestCluster.ctx, managerTestCluster.client, managerWl, util.RealClock, func() (bool, error) {
 					managerWl.Status.NominatedClusterNames = []string{workerCluster1.Name, workerCluster2.Name}
-					return managerWl, true, nil
+					return true, nil
 				})).To(gomega.Succeed())
 			}, util.Timeout, util.Interval).Should(gomega.Succeed())
 		})
@@ -460,13 +460,13 @@ var _ = ginkgo.Describe("MultiKueueDispatcherExternal", ginkgo.Ordered, ginkgo.C
 		ginkgo.By("setting the check conditions for eviction", func() {
 			gomega.Eventually(func(g gomega.Gomega) {
 				g.Expect(managerTestCluster.client.Get(managerTestCluster.ctx, wlLookupKey, createdWorkload)).To(gomega.Succeed())
-				g.Expect(workload.PatchAdmissionStatus(managerTestCluster.ctx, managerTestCluster.client, createdWorkload, util.RealClock, func() (*kueue.Workload, bool, error) {
+				g.Expect(workload.PatchAdmissionStatus(managerTestCluster.ctx, managerTestCluster.client, createdWorkload, util.RealClock, func() (bool, error) {
 					acs := kueue.AdmissionCheckState{
 						Name:    kueue.AdmissionCheckReference(multiKueueAC.Name),
 						State:   kueue.CheckStateRejected,
 						Message: "check rejected",
 					}
-					return createdWorkload, workload.SetAdmissionCheckState(&createdWorkload.Status.AdmissionChecks, acs, util.RealClock), nil
+					return workload.SetAdmissionCheckState(&createdWorkload.Status.AdmissionChecks, acs, util.RealClock), nil
 				})).To(gomega.Succeed())
 			}, util.Timeout, util.Interval).Should(gomega.Succeed())
 		})
@@ -677,9 +677,9 @@ var _ = ginkgo.Describe("MultiKueueDispatcherAllAtOnce", ginkgo.Ordered, ginkgo.
 		ginkgo.By("Resetting ClusterName field in the manager", func() {
 			gomega.Eventually(func(g gomega.Gomega) {
 				g.Expect(managerTestCluster.client.Get(managerTestCluster.ctx, wlLookupKey, createdWorkload)).To(gomega.Succeed())
-				g.Expect(workload.PatchAdmissionStatus(managerTestCluster.ctx, managerTestCluster.client, createdWorkload, util.RealClock, func() (*kueue.Workload, bool, error) {
+				g.Expect(workload.PatchAdmissionStatus(managerTestCluster.ctx, managerTestCluster.client, createdWorkload, util.RealClock, func() (bool, error) {
 					createdWorkload.Status.ClusterName = nil
-					return createdWorkload, true, nil
+					return true, nil
 				})).To(gomega.Succeed())
 			}, util.Timeout, util.Interval).Should(gomega.Succeed())
 		})
diff --git a/test/integration/multikueue/external_job_test.go b/test/integration/multikueue/external_job_test.go
index b24cb0bf8..383180adc 100644
--- a/test/integration/multikueue/external_job_test.go
+++ b/test/integration/multikueue/external_job_test.go
@@ -386,7 +386,7 @@ var _ = ginkgo.Describe("MultiKueue", ginkgo.Ordered, ginkgo.ContinueOnFailure,
 					g.Expect(activeCondition).To(gomega.BeComparableTo(&metav1.Condition{
 						Type:   kueue.MultiKueueClusterActive,
 						Status: metav1.ConditionFalse,
-						Reason: "BadConfig",
+						Reason: "BadKubeConfig",
 					}, util.IgnoreConditionMessage, util.IgnoreConditionTimestampsAndObservedGeneration))
 				}, util.Timeout, util.Interval).Should(gomega.Succeed())
 			})
@@ -425,7 +425,7 @@ var _ = ginkgo.Describe("MultiKueue", ginkgo.Ordered, ginkgo.ContinueOnFailure,
 					g.Expect(activeCondition).To(gomega.BeComparableTo(&metav1.Condition{
 						Type:   kueue.MultiKueueClusterActive,
 						Status: metav1.ConditionFalse,
-						Reason: "BadConfig",
+						Reason: "BadKubeConfig",
 					}, util.IgnoreConditionMessage, util.IgnoreConditionTimestampsAndObservedGeneration))
 				}, util.Timeout, util.Interval).Should(gomega.Succeed())
 			})
diff --git a/test/integration/multikueue/jobs_test.go b/test/integration/multikueue/jobs_test.go
index 3f1d31c11..a1aadd77c 100644
--- a/test/integration/multikueue/jobs_test.go
+++ b/test/integration/multikueue/jobs_test.go
@@ -1266,7 +1266,7 @@ var _ = ginkgo.Describe("MultiKueue", ginkgo.Ordered, ginkgo.ContinueOnFailure,
 				g.Expect(activeCondition).To(gomega.BeComparableTo(&metav1.Condition{
 					Type:   kueue.MultiKueueClusterActive,
 					Status: metav1.ConditionFalse,
-					Reason: "BadConfig",
+					Reason: "BadKubeConfig",
 				}, util.IgnoreConditionMessage, util.IgnoreConditionTimestampsAndObservedGeneration))
 			}, util.Timeout, util.Interval).Should(gomega.Succeed())
 		})
@@ -1295,7 +1295,7 @@ var _ = ginkgo.Describe("MultiKueue", ginkgo.Ordered, ginkgo.ContinueOnFailure,
 				g.Expect(activeCondition).To(gomega.BeComparableTo(&metav1.Condition{
 					Type:   kueue.MultiKueueClusterActive,
 					Status: metav1.ConditionFalse,
-					Reason: "BadConfig",
+					Reason: "BadKubeConfig",
 				}, util.IgnoreConditionMessage, util.IgnoreConditionTimestampsAndObservedGeneration))
 			}, util.Timeout, util.Interval).Should(gomega.Succeed())
 		})
@@ -1428,7 +1428,7 @@ var _ = ginkgo.Describe("MultiKueue", ginkgo.Ordered, ginkgo.ContinueOnFailure,
 				g.Expect(activeCondition).To(gomega.BeComparableTo(&metav1.Condition{
 					Type:   kueue.MultiKueueClusterActive,
 					Status: metav1.ConditionFalse,
-					Reason: "BadConfig",
+					Reason: "BadKubeConfig",
 				}, util.IgnoreConditionMessage, util.IgnoreConditionTimestampsAndObservedGeneration))
 				disconnectedTime = activeCondition.LastTransitionTime.Time
 			}, util.Timeout, util.Interval).Should(gomega.Succeed())
diff --git a/test/integration/multikueue/setup_test.go b/test/integration/multikueue/setup_test.go
index 567415aee..cc11dad19 100644
--- a/test/integration/multikueue/setup_test.go
+++ b/test/integration/multikueue/setup_test.go
@@ -234,8 +234,8 @@ var _ = ginkgo.Describe("MultiKueue", ginkgo.Ordered, ginkgo.ContinueOnFailure,
 					g.Expect(updatedCluster.Status.Conditions).To(gomega.ContainElement(gomega.BeComparableTo(metav1.Condition{
 						Type:    kueue.MultiKueueClusterActive,
 						Status:  metav1.ConditionFalse,
-						Reason:  "BadConfig",
-						Message: `Secret "testing-secret" not found`,
+						Reason:  "BadKubeConfig",
+						Message: `load client config failed: Secret "testing-secret" not found`,
 					}, util.IgnoreConditionTimestampsAndObservedGeneration)))
 				}, util.Timeout, util.Interval).Should(gomega.Succeed())
 			})
@@ -363,8 +363,8 @@ var _ = ginkgo.Describe("MultiKueue", ginkgo.Ordered, ginkgo.ContinueOnFailure,
 					g.Expect(updatedCluster.Status.Conditions).To(gomega.ContainElement(gomega.BeComparableTo(metav1.Condition{
 						Type:    kueue.MultiKueueClusterActive,
 						Status:  metav1.ConditionFalse,
-						Reason:  "BadConfig",
-						Message: fmt.Sprintf("open %s: no such file or directory", fsKubeConfig),
+						Reason:  "BadKubeConfig",
+						Message: fmt.Sprintf("load client config failed: open %s: no such file or directory", fsKubeConfig),
 					}, util.IgnoreConditionTimestampsAndObservedGeneration)))
 				}, util.Timeout, util.Interval).Should(gomega.Succeed())
 			})
@@ -478,7 +478,7 @@ var _ = ginkgo.Describe("MultiKueue", ginkgo.Ordered, ginkgo.ContinueOnFailure,
 						Type:    kueue.MultiKueueClusterActive,
 						Status:  metav1.ConditionFalse,
 						Reason:  "InsecureKubeConfig",
-						Message: "insecure kubeconfig: certificate-authority file paths are not allowed, use certificate-authority-data for cluster default-cluster",
+						Message: "load client config failed: certificate-authority file paths are not allowed, use certificate-authority-data for cluster default-cluster",
 					}, util.IgnoreConditionTimestampsAndObservedGeneration)))
 				}, util.Timeout, util.Interval).Should(gomega.Succeed())
 			})
@@ -590,7 +590,7 @@ var _ = ginkgo.Describe("MultiKueue", ginkgo.Ordered, ginkgo.ContinueOnFailure,
 						Type:    kueue.MultiKueueClusterActive,
 						Status:  metav1.ConditionFalse,
 						Reason:  "InsecureKubeConfig",
-						Message: "insecure kubeconfig: tokenFile is not allowed",
+						Message: "load client config failed: tokenFile is not allowed",
 					}, util.IgnoreConditionTimestampsAndObservedGeneration)))
 				}, util.Timeout, util.Interval).Should(gomega.Succeed())
 			})
@@ -780,7 +780,7 @@ var _ = ginkgo.Describe("MultiKueue", ginkgo.Ordered, ginkgo.ContinueOnFailure,
 						Type:    kueue.MultiKueueClusterActive,
 						Status:  metav1.ConditionFalse,
 						Reason:  "InsecureKubeConfig",
-						Message: "insecure kubeconfig: certificate-authority file paths are not allowed, use certificate-authority-data for cluster default-cluster",
+						Message: "load client config failed: certificate-authority file paths are not allowed, use certificate-authority-data for cluster default-cluster",
 					}, util.IgnoreConditionTimestampsAndObservedGeneration)))
 				}, util.Timeout, util.Interval).Should(gomega.Succeed())
 
diff --git a/test/integration/singlecluster/controller/core/workload_controller_test.go b/test/integration/singlecluster/controller/core/workload_controller_test.go
index 0f2f5be83..09f20ac9b 100644
--- a/test/integration/singlecluster/controller/core/workload_controller_test.go
+++ b/test/integration/singlecluster/controller/core/workload_controller_test.go
@@ -505,8 +505,8 @@ var _ = ginkgo.Describe("Workload controller", ginkgo.Ordered, ginkgo.ContinueOn
 			ginkgo.By("evicting the workload, the accumulated admission time is updated", func() {
 				gomega.Eventually(func(g gomega.Gomega) {
 					g.Expect(k8sClient.Get(ctx, key, wl)).To(gomega.Succeed())
-					g.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, wl, util.RealClock, func() (*kueue.Workload, bool, error) {
-						return wl, workload.SetEvictedCondition(wl, util.RealClock.Now(), "ByTest", "by test"), nil
+					g.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, wl, util.RealClock, func() (bool, error) {
+						return workload.SetEvictedCondition(wl, util.RealClock.Now(), "ByTest", "by test"), nil
 					})).Should(gomega.Succeed())
 				}, util.Timeout, util.Interval).Should(gomega.Succeed())
 				util.FinishEvictionForWorkloads(ctx, k8sClient, wl)
diff --git a/test/integration/singlecluster/controller/jobs/job/job_controller_test.go b/test/integration/singlecluster/controller/jobs/job/job_controller_test.go
index 5a3bee0f6..732b220cc 100644
--- a/test/integration/singlecluster/controller/jobs/job/job_controller_test.go
+++ b/test/integration/singlecluster/controller/jobs/job/job_controller_test.go
@@ -2387,10 +2387,8 @@ var _ = ginkgo.Describe("Interacting with scheduler", ginkgo.Ordered, ginkgo.Con
 				Name:      workloadjob.GetWorkloadNameForJob(lowJob.Name, lowJob.UID),
 				Namespace: ns.Name,
 			}
-			ginkgo.By("Fetching the created low priority workload", func() {
-				gomega.Eventually(func(g gomega.Gomega) {
-					g.Expect(k8sClient.Get(ctx, lowWlLookupKey, createdLowWorkload)).Should(gomega.Succeed())
-				}, util.Timeout, util.Interval).Should(gomega.Succeed())
+			ginkgo.By("Verifying the created low priority workload is quota reserved", func() {
+				util.ExpectWorkloadsToHaveQuotaReservationByKey(ctx, k8sClient, clusterQueue.Name, lowWlLookupKey)
 			})
 
 			ginkgo.By("Setting ready for admission checks in low priority workload", func() {
@@ -2433,10 +2431,8 @@ var _ = ginkgo.Describe("Interacting with scheduler", ginkgo.Ordered, ginkgo.Con
 				Name:      workloadjob.GetWorkloadNameForJob(highJob.Name, highJob.UID),
 				Namespace: ns.Name,
 			}
-			ginkgo.By("Fetching the created high priority workload", func() {
-				gomega.Eventually(func(g gomega.Gomega) {
-					g.Expect(k8sClient.Get(ctx, highWlLookupKey, createdHighWorkload)).Should(gomega.Succeed())
-				}, util.Timeout, util.Interval).Should(gomega.Succeed())
+			ginkgo.By("Verifying the created high priority workload is quota reserved", func() {
+				util.ExpectWorkloadsToHaveQuotaReservationByKey(ctx, k8sClient, clusterQueue.Name, highWlLookupKey)
 			})
 
 			ginkgo.By("Setting ready for admission checks in high priority workload", func() {
@@ -3553,7 +3549,7 @@ var _ = ginkgo.Describe("Job with elastic jobs via workload-slices support", gin
 			g.Expect(k8sClient.List(ctx, workloads, client.InNamespace(testJob.Namespace))).Should(gomega.Succeed())
 			g.Expect(workloads.Items).Should(gomega.HaveLen(1))
 			testJobWorkload = &workloads.Items[0]
-			util.ExpectWorkloadsToBeAdmitted(ctx, k8sClient, testJobWorkload)
+			g.Expect(workload.IsAdmitted(testJobWorkload)).Should(gomega.BeTrue())
 		}, util.Timeout, util.Interval).Should(gomega.Succeed())
 
 		ginkgo.By("the job is unsuspended")
@@ -3591,10 +3587,10 @@ var _ = ginkgo.Describe("Job with elastic jobs via workload-slices support", gin
 			workloads := &kueue.WorkloadList{}
 			g.Expect(k8sClient.List(ctx, workloads, client.InNamespace(testJob.Namespace))).Should(gomega.Succeed())
 			g.Expect(workloads.Items).Should(gomega.HaveLen(1))
-			util.ExpectWorkloadsToBeAdmitted(ctx, k8sClient, testJobWorkload)
 			g.Expect(workloads.Items[0].Spec.PodSets[0].Count).Should(gomega.BeEquivalentTo(int32(1)))
 			g.Expect(workloads.Items[0].UID).Should(gomega.BeEquivalentTo(testJobWorkload.UID))
 			testJobWorkload = &workloads.Items[0]
+			g.Expect(workload.IsAdmitted(testJobWorkload)).Should(gomega.BeTrue())
 		}, util.Timeout, util.Interval).Should(gomega.Succeed())
 
 		ginkgo.By("increasing the job's parallelism to emulate scale-up operation")
@@ -3623,7 +3619,7 @@ var _ = ginkgo.Describe("Job with elastic jobs via workload-slices support", gin
 					g.Expect(workload.IsFinished(&workloads.Items[i])).Should(gomega.BeTrue())
 					continue
 				}
-				util.ExpectWorkloadsToBeAdmitted(ctx, k8sClient, testJobWorkload)
+				g.Expect(workload.IsAdmitted(&workloads.Items[i])).Should(gomega.BeTrue())
 			}
 		}, util.Timeout, util.Interval).Should(gomega.Succeed())
 	})
@@ -3651,7 +3647,7 @@ var _ = ginkgo.Describe("Job with elastic jobs via workload-slices support", gin
 			g.Expect(k8sClient.List(ctx, workloads, client.InNamespace(testJobA.Namespace))).Should(gomega.Succeed())
 			g.Expect(workloads.Items).Should(gomega.HaveLen(1))
 			testJobAWorkload = &workloads.Items[0]
-			util.ExpectWorkloadsToBeAdmitted(ctx, k8sClient, testJobAWorkload)
+			g.Expect(workload.IsAdmitted(testJobAWorkload)).Should(gomega.BeTrue())
 		}, util.Timeout, util.Interval).Should(gomega.Succeed())
 
 		ginkgo.By("the job-a is unsuspended")
@@ -3683,7 +3679,7 @@ var _ = ginkgo.Describe("Job with elastic jobs via workload-slices support", gin
 			g.Expect(k8sClient.List(ctx, workloads, client.InNamespace(testJobA.Namespace), client.MatchingLabels{constants.JobUIDLabel: string(testJobB.UID)})).Should(gomega.Succeed())
 			g.Expect(workloads.Items).Should(gomega.HaveLen(1))
 			testJobBWorkload = &workloads.Items[0]
-			util.ExpectWorkloadsToBePending(ctx, k8sClient, testJobBWorkload)
+			g.Expect(testJobBWorkload.Status.Conditions).Should(utiltesting.HaveConditionStatusFalseAndReason(kueue.WorkloadQuotaReserved, "Pending"))
 		}, util.Timeout, util.Interval).Should(gomega.Succeed())
 
 		ginkgo.By("scale-down job-a to make room for job-b")
@@ -3695,7 +3691,7 @@ var _ = ginkgo.Describe("Job with elastic jobs via workload-slices support", gin
 		ginkgo.By("admitting the job-b workload")
 		gomega.Eventually(func(g gomega.Gomega) {
 			g.Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(testJobBWorkload), testJobBWorkload)).Should(gomega.Succeed())
-			util.ExpectWorkloadsToBeAdmitted(ctx, k8sClient, testJobBWorkload)
+			g.Expect(workload.IsAdmitted(testJobBWorkload)).Should(gomega.BeTrue())
 		}, util.Timeout, util.Interval).Should(gomega.Succeed())
 
 		ginkgo.By("the job-b is unsuspended")
diff --git a/test/integration/singlecluster/controller/jobs/pod/pod_controller_test.go b/test/integration/singlecluster/controller/jobs/pod/pod_controller_test.go
index d4d2da19a..e4f2d694c 100644
--- a/test/integration/singlecluster/controller/jobs/pod/pod_controller_test.go
+++ b/test/integration/singlecluster/controller/jobs/pod/pod_controller_test.go
@@ -833,8 +833,8 @@ var _ = ginkgo.Describe("Pod controller", ginkgo.Ordered, ginkgo.ContinueOnFailu
 					createdWorkload := &kueue.Workload{}
 					gomega.Eventually(func(g gomega.Gomega) {
 						g.Expect(k8sClient.Get(ctx, wlLookupKey, createdWorkload)).Should(gomega.Succeed())
-						g.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, createdWorkload, util.RealClock, func() (*kueue.Workload, bool, error) {
-							return createdWorkload, workload.SetEvictedCondition(createdWorkload, util.RealClock.Now(), "ByTest", "by test"), nil
+						g.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, createdWorkload, util.RealClock, func() (bool, error) {
+							return workload.SetEvictedCondition(createdWorkload, util.RealClock.Now(), "ByTest", "by test"), nil
 						})).Should(gomega.Succeed())
 					}, util.Timeout, util.Interval).Should(gomega.Succeed())
 
@@ -1426,8 +1426,8 @@ var _ = ginkgo.Describe("Pod controller", ginkgo.Ordered, ginkgo.ContinueOnFailu
 				ginkgo.By("setting evicted condition to true", func() {
 					gomega.Eventually(func(g gomega.Gomega) {
 						g.Expect(k8sClient.Get(ctx, wlKey, wl)).Should(gomega.Succeed())
-						g.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, wl, util.RealClock, func() (*kueue.Workload, bool, error) {
-							return wl, workload.SetEvictedCondition(wl, util.RealClock.Now(), kueue.WorkloadEvictedByPreemption, "By test"), nil
+						g.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, wl, util.RealClock, func() (bool, error) {
+							return workload.SetEvictedCondition(wl, util.RealClock.Now(), kueue.WorkloadEvictedByPreemption, "By test"), nil
 						})).Should(gomega.Succeed())
 					}, util.Timeout, util.Interval).Should(gomega.Succeed())
 				})
diff --git a/test/integration/singlecluster/scheduler/podsready/scheduler_test.go b/test/integration/singlecluster/scheduler/podsready/scheduler_test.go
index 266ac0671..b916ae44f 100644
--- a/test/integration/singlecluster/scheduler/podsready/scheduler_test.go
+++ b/test/integration/singlecluster/scheduler/podsready/scheduler_test.go
@@ -328,8 +328,8 @@ var _ = ginkgo.Describe("SchedulerWithWaitForPodsReady", func() {
 				g.Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(prodWl), prodWl)).Should(gomega.Succeed())
 				g.Expect(workload.IsActive(prodWl)).Should(gomega.BeFalse())
 				g.Expect(prodWl.Status.RequeueState).Should(gomega.BeNil())
-				g.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, prodWl, util.RealClock, func() (*kueue.Workload, bool, error) {
-					return prodWl, workload.SetRequeuedCondition(prodWl, kueue.WorkloadDeactivated, "by test", false), nil
+				g.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, prodWl, util.RealClock, func() (bool, error) {
+					return workload.SetRequeuedCondition(prodWl, kueue.WorkloadDeactivated, "by test", false), nil
 				})).Should(gomega.Succeed())
 			}, util.Timeout, util.Interval).Should(gomega.Succeed())
 			util.FinishEvictionForWorkloads(ctx, k8sClient, prodWl)
diff --git a/test/integration/singlecluster/scheduler/preemption_test.go b/test/integration/singlecluster/scheduler/preemption_test.go
index 4ddf02cc7..2fd3cc088 100644
--- a/test/integration/singlecluster/scheduler/preemption_test.go
+++ b/test/integration/singlecluster/scheduler/preemption_test.go
@@ -1069,7 +1069,7 @@ var _ = ginkgo.Describe("Preemption", func() {
 			util.ExpectWorkloadsToBePreempted(ctx, k8sClient, lowWl)
 			util.FinishEvictionForWorkloads(ctx, k8sClient, lowWl)
 			util.ExpectWorkloadToFinish(ctx, k8sClient, client.ObjectKeyFromObject(highWl))
-			util.ExpectWorkloadsToHaveQuotaReservation(ctx, k8sClient, cq.Name, highWl)
+			util.ExpectWorkloadsToHaveQuotaReservation(ctx, k8sClient, cq.Name, highWlScaledUp)
 
 			ginkgo.By("Scale down a high priority workload")
 			gomega.Eventually(func(g gomega.Gomega) {
diff --git a/test/integration/singlecluster/webhook/core/workload_test.go b/test/integration/singlecluster/webhook/core/workload_test.go
index 86994368e..f536e9abe 100644
--- a/test/integration/singlecluster/webhook/core/workload_test.go
+++ b/test/integration/singlecluster/webhook/core/workload_test.go
@@ -365,8 +365,8 @@ var _ = ginkgo.Describe("Workload validating webhook", ginkgo.Ordered, func() {
 
 			gomega.Eventually(func(g gomega.Gomega) {
 				g.Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(wl), wl)).To(gomega.Succeed())
-				err := workload.PatchAdmissionStatus(ctx, k8sClient, wl, util.RealClock, func() (*kueue.Workload, bool, error) {
-					return wl, workload.SetQuotaReservation(wl, a, util.RealClock), nil
+				err := workload.PatchAdmissionStatus(ctx, k8sClient, wl, util.RealClock, func() (bool, error) {
+					return workload.SetQuotaReservation(wl, a, util.RealClock), nil
 				})
 				g.Expect(err).Should(matcher)
 			}, util.Timeout, util.Interval).Should(gomega.Succeed())
diff --git a/test/performance/scheduler/runner/controller/controller.go b/test/performance/scheduler/runner/controller/controller.go
index e8a4827a4..b4d91d545 100644
--- a/test/performance/scheduler/runner/controller/controller.go
+++ b/test/performance/scheduler/runner/controller/controller.go
@@ -117,8 +117,8 @@ func (r *reconciler) Reconcile(ctx context.Context, req reconcile.Request) (reco
 	// this should only:
 	// 1. finish the workloads eviction
 	if apimeta.IsStatusConditionTrue(wl.Status.Conditions, kueue.WorkloadEvicted) {
-		err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (*kueue.Workload, bool, error) {
-			return &wl, workload.UnsetQuotaReservationWithCondition(&wl, "Pending", "Evicted by the test runner", time.Now()), nil
+		err := workload.PatchAdmissionStatus(ctx, r.client, &wl, r.clock, func() (bool, error) {
+			return workload.UnsetQuotaReservationWithCondition(&wl, "Pending", "Evicted by the test runner", time.Now()), nil
 		})
 		if err == nil {
 			log.V(5).Info("Finish eviction")
diff --git a/test/util/constants.go b/test/util/constants.go
index 889937604..d39f0eb51 100644
--- a/test/util/constants.go
+++ b/test/util/constants.go
@@ -67,6 +67,7 @@ var (
 	AppWrapperCrds           = filepath.Join(GetProjectBaseDir(), "dep-crds", "appwrapper-crds")
 	RayOperatorCrds          = filepath.Join(GetProjectBaseDir(), "dep-crds", "ray-operator-crds")
 	WebhookPath              = filepath.Join(GetProjectBaseDir(), "config", "components", "webhook")
+	ClusterProfileCrds       = filepath.Join(GetProjectBaseDir(), "dep-crds", "clusterprofile")
 )
 
 var (
diff --git a/test/util/util.go b/test/util/util.go
index 675f768ac..f00edc217 100644
--- a/test/util/util.go
+++ b/test/util/util.go
@@ -295,16 +295,26 @@ func FinishWorkloads(ctx context.Context, k8sClient client.Client, workloads ...
 }
 
 func ExpectWorkloadsToHaveQuotaReservation(ctx context.Context, k8sClient client.Client, cqName string, wls ...*kueue.Workload) {
-	gomega.EventuallyWithOffset(1, func(g gomega.Gomega) {
+	ginkgo.GinkgoHelper()
+	wlKeys := make([]client.ObjectKey, len(wls))
+	for index, wl := range wls {
+		wlKeys[index] = client.ObjectKeyFromObject(wl)
+	}
+	ExpectWorkloadsToHaveQuotaReservationByKey(ctx, k8sClient, cqName, wlKeys...)
+}
+
+func ExpectWorkloadsToHaveQuotaReservationByKey(ctx context.Context, k8sClient client.Client, cqName string, wlKeys ...client.ObjectKey) {
+	ginkgo.GinkgoHelper()
+	gomega.Eventually(func(g gomega.Gomega) {
 		admitted := 0
 		var updatedWorkload kueue.Workload
-		for _, wl := range wls {
-			g.Expect(k8sClient.Get(ctx, client.ObjectKeyFromObject(wl), &updatedWorkload)).To(gomega.Succeed())
+		for _, wlKey := range wlKeys {
+			g.Expect(k8sClient.Get(ctx, wlKey, &updatedWorkload)).To(gomega.Succeed())
 			if workload.HasQuotaReservation(&updatedWorkload) && string(updatedWorkload.Status.Admission.ClusterQueue) == cqName {
 				admitted++
 			}
 		}
-		g.Expect(admitted).Should(gomega.Equal(len(wls)), "Not enough workloads were admitted")
+		g.Expect(admitted).Should(gomega.Equal(len(wlKeys)), "Not enough workloads were admitted")
 	}, Timeout, Interval).Should(gomega.Succeed())
 }
 
@@ -428,8 +438,8 @@ func SetRequeuedConditionWithPodsReadyTimeout(ctx context.Context, k8sClient cli
 	gomega.EventuallyWithOffset(1, func(g gomega.Gomega) {
 		var wl kueue.Workload
 		g.Expect(k8sClient.Get(ctx, wlKey, &wl)).Should(gomega.Succeed())
-		g.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, &wl, RealClock, func() (*kueue.Workload, bool, error) {
-			return &wl, workload.SetRequeuedCondition(&wl, kueue.WorkloadEvictedByPodsReadyTimeout, fmt.Sprintf("Exceeded the PodsReady timeout %s", klog.KObj(&wl).String()), false), nil
+		g.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, &wl, RealClock, func() (bool, error) {
+			return workload.SetRequeuedCondition(&wl, kueue.WorkloadEvictedByPodsReadyTimeout, fmt.Sprintf("Exceeded the PodsReady timeout %s", klog.KObj(&wl).String()), false), nil
 		})).Should(gomega.Succeed())
 	}, Timeout, Interval).Should(gomega.Succeed())
 }
@@ -808,14 +818,14 @@ func SetQuotaReservation(ctx context.Context, k8sClient client.Client, wlKey cli
 	gomega.EventuallyWithOffset(1, func(g gomega.Gomega) {
 		updatedWl := &kueue.Workload{}
 		g.ExpectWithOffset(1, k8sClient.Get(ctx, wlKey, updatedWl)).To(gomega.Succeed())
-		g.ExpectWithOffset(1, workload.PatchAdmissionStatus(ctx, k8sClient, updatedWl, clk, func() (*kueue.Workload, bool, error) {
+		g.ExpectWithOffset(1, workload.PatchAdmissionStatus(ctx, k8sClient, updatedWl, clk, func() (bool, error) {
 			var updated bool
 			if admission == nil {
 				updated = workload.UnsetQuotaReservationWithCondition(updatedWl, "EvictedByTest", "Evicted By Test", clk.Now())
 			} else {
 				updated = workload.SetQuotaReservation(updatedWl, admission, clk)
 			}
-			return updatedWl, updated, nil
+			return updated, nil
 		})).To(gomega.Succeed())
 	}, Timeout, Interval).Should(gomega.Succeed())
 }
@@ -828,8 +838,8 @@ func SyncAdmittedConditionForWorkloads(ctx context.Context, k8sClient client.Cli
 	for _, wl := range wls {
 		gomega.EventuallyWithOffset(1, func(g gomega.Gomega) {
 			g.ExpectWithOffset(1, k8sClient.Get(ctx, client.ObjectKeyFromObject(wl), &updatedWorkload)).To(gomega.Succeed())
-			g.ExpectWithOffset(1, workload.PatchAdmissionStatus(ctx, k8sClient, &updatedWorkload, RealClock, func() (*kueue.Workload, bool, error) {
-				return &updatedWorkload, workload.SyncAdmittedCondition(&updatedWorkload, time.Now()), nil
+			g.ExpectWithOffset(1, workload.PatchAdmissionStatus(ctx, k8sClient, &updatedWorkload, RealClock, func() (bool, error) {
+				return workload.SyncAdmittedCondition(&updatedWorkload, time.Now()), nil
 			})).To(gomega.Succeed())
 		}, Timeout, Interval).Should(gomega.Succeed())
 	}
@@ -854,8 +864,8 @@ func FinishEvictionForWorkloads(ctx context.Context, k8sClient client.Client, wl
 			var updatedWorkload kueue.Workload
 			g.Expect(k8sClient.Get(ctx, key, &updatedWorkload)).Should(gomega.Succeed())
 			if apimeta.IsStatusConditionTrue(updatedWorkload.Status.Conditions, kueue.WorkloadQuotaReserved) {
-				g.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, &updatedWorkload, RealClock, func() (*kueue.Workload, bool, error) {
-					return &updatedWorkload, workload.UnsetQuotaReservationWithCondition(&updatedWorkload, "Pending", "By test", time.Now()), nil
+				g.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, &updatedWorkload, RealClock, func() (bool, error) {
+					return workload.UnsetQuotaReservationWithCondition(&updatedWorkload, "Pending", "By test", time.Now()), nil
 				}),
 				).Should(gomega.Succeed(), fmt.Sprintf("Unable to unset quota reservation for %q", key))
 			}
diff --git a/test/util/util_scheduling.go b/test/util/util_scheduling.go
index 2ab6ea68b..5c2cb58a5 100644
--- a/test/util/util_scheduling.go
+++ b/test/util/util_scheduling.go
@@ -55,8 +55,8 @@ func finishEvictionsOfAnyWorkloadsInCq(ctx context.Context, k8sClient client.Cli
 		evicted := meta.IsStatusConditionTrue(wl.Status.Conditions, kueue.WorkloadEvicted)
 		quotaReserved := meta.IsStatusConditionTrue(wl.Status.Conditions, kueue.WorkloadQuotaReserved)
 		if evicted && quotaReserved {
-			gomega.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, &wl, RealClock, func() (*kueue.Workload, bool, error) {
-				return &wl, workload.UnsetQuotaReservationWithCondition(&wl, "Pending", "Eviction finished by test", time.Now()), nil
+			gomega.Expect(workload.PatchAdmissionStatus(ctx, k8sClient, &wl, RealClock, func() (bool, error) {
+				return workload.UnsetQuotaReservationWithCondition(&wl, "Pending", "Eviction finished by test", time.Now()), nil
 			}),
 			).To(gomega.Succeed())
 			finished.Insert(wl.UID)