diff --git a/.ci-operator.yaml b/.ci-operator.yaml
deleted file mode 100644
index b5bc53713..000000000
--- a/.ci-operator.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-build_root_image:
-  namespace: ci
-  name: kcp-dev-build-root
-  tag: "1.18"
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
deleted file mode 100644
index 1779e7450..000000000
--- a/.github/dependabot.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-version: 2
-updates:
-# Maintain dependencies for GitHub Actions
-- package-ecosystem: "github-actions"
-  directory: "/"
-  schedule:
-    interval: "daily"
\ No newline at end of file
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 3bd2dc946..6f8ae05be 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,21 +1,13 @@
 <!--
-Thanks for creating a pull request!
 
-If this is your first time, please make sure to review CONTRIBUTING.MD.
+⚠️ This is an automatically published staged repository for kcp. ⚠️
 
-Please copy the appropriate `:text:` or icon to the beginning of your PR title:
+Contributions, including issues and pull requests, should be made to the main kcp repository:
+https://github.com/kcp-dev/kcp
 
-:sparkles: ✨ feature
-:bug: 🐛 bug fix
-:book: 📖 docs
-:memo: 📝 proposal
-:warning: ⚠️ breaking change
-:seedling: 🌱 other/misc
-:question: ❓ requires manual review/categorization
+This repository is read-only for importing, and not used for direct contributions.  
 
--->
-## Summary
-
-## Related issue(s)
+See the monorepo structure document for more details:
+https://docs.kcp.io/kcp/main/contributing/monorepo/
 
-Fixes #
+-->
diff --git a/.github/workflows/pr-verifier.yaml b/.github/workflows/pr-verifier.yaml
deleted file mode 100644
index 5d152c258..000000000
--- a/.github/workflows/pr-verifier.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: PR Verifier
-
-on:
-  # NB: using `pull_request_target` runs this in the context of
-  # the base repository, so it has permission to upload to the checks API.
-  # This means changes won't kick in to this file until merged onto the
-  # main branch.
-  pull_request_target:
-    types: [opened, edited, reopened, synchronize]
-
-jobs:
-  verify:
-    name: verify PR contents
-    permissions:
-      checks: write
-      pull-requests: read
-    runs-on: ubuntu-latest
-    steps:
-    - name: Verifier action
-      id: verifier
-      uses: kubernetes-sigs/kubebuilder-release-tools@v0.3.0
-      with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.golangci.yaml b/.golangci.yaml
deleted file mode 100644
index 4c0f7cbad..000000000
--- a/.golangci.yaml
+++ /dev/null
@@ -1,139 +0,0 @@
-run:
-  timeout: 10m
-  allow-parallel-runners: true
-  skip-files:
-  - '.+_expansion\.go'
-
-linters:
-  disable-all: true
-  enable:
-  - asasalint
-  - asciicheck
-  - bidichk
-  - bodyclose
-  - containedctx
-  - depguard
-  - dupword
-  - durationcheck
-  - errcheck
-  - errchkjson
-  - exportloopref
-  - gocritic
-  - godot
-  - gofmt
-  - goprintffuncname
-  - gosec
-  - gosimple
-  - govet
-  - importas
-  - ineffassign
-  - misspell
-  - nilerr
-  - noctx
-  - nolintlint
-  - nosprintfhostport
-  - prealloc
-  - revive
-  - staticcheck
-  - unconvert
-  - unused
-  - usestdlibvars
-  - whitespace
-  # TODO(vincepri): Figure out if we want to enable or remove the following linters:
-  # - predeclared
-  # - goconst
-
-linters-settings:
-  misspell:
-    ignore-words:
-    - creater
-  goconst:
-    ignore-tests: true
-  nolintlint:
-    allow-unused: false
-    allow-leading-space: false
-    require-specific: true
-  revive:
-    revive:
-    rules:
-    - name: context-keys-type
-    - name: error-return
-    - name: error-strings
-    - name: error-naming
-    - name: if-return
-    - name: increment-decrement
-    - name: var-declaration
-    - name: package-comments
-    - name: range
-    - name: receiver-naming
-    - name: time-naming
-    - name: errorf
-    - name: superfluous-else
-    - name: unreachable-code
-    - name: bool-literal-in-expr
-    - name: constant-logical-expr
-    # TODO(vincepri): Figure out if we want to enable
-    # the following rules, or remove them completely, they're a bit noisy.
-    # - name: context-as-argument
-    # - name: var-naming
-    # - name: exported
-    # - name: unexported-return
-    # - name: blank-imports
-    # - name: indent-error-flow # I think @ncdc prefers explicit else statements, remove?
-    # - name: redefines-builtin-id
-    # - name: dot-imports
-  gosec:
-    excludes:
-    - G307 # Deferring unsafe method "Close" on type "\*os.File"
-    - G108 # Profiling endpoint is automatically exposed on /debug/pprof
-    # TODO(vincepri): The following should be looked at and removed in future iterations.
-    - G401 # Use of weak cryptographic primitive (replace sha1 usage)
-    - G505 # crypto/sha1: weak cryptographic primitive
-    - G402 # TLS MinVersion too low (set MinVersion in TLSClientConfig)
-    - G404 # Use of weak random number generator (use crypto/rand)
-    - G101 # Potential hardcoded credentials (returns false positives)
-    - G306 # Expect WriteFile permissions to be 0600 or less
-  gocritic:
-    enabled-tags:
-    - diagnostic
-    - experimental
-    - performance
-    disabled-checks:
-    - appendAssign
-    - dupImport # https://github.com/go-critic/go-critic/issues/845
-    - evalOrder
-    - ifElseChain
-    - octalLiteral
-    - regexpSimplify
-    - sloppyReassign
-    - truncateCmp
-    - typeDefFirst
-    - unnamedResult
-    - unnecessaryDefer
-    - whyNoLint
-    - wrapperFunc
-    - unnecessaryBlock
-    - rangeValCopy
-    - hugeParam
-    - commentedOutCode
-    # TODO(vincepri): potentially enable the following?
-    - emptyStringTest
-    - singleCaseSwitch
-    - nestingReduce
-    - filepathJoin
-    - tooManyResultsChecker
-
-issues:
-  max-same-issues: 0
-  max-issues-per-linter: 0
-  exclude-rules:
-  - linters:
-    - unparam
-    text: always receives
-  - linters:
-    - gosec
-    path: _test\.go
-    text: "G112: Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server"
-  - linters:
-    - gosec
-    path: test/e2e/*
diff --git a/Makefile b/Makefile
index 18a2684bf..43de53cf4 100644
--- a/Makefile
+++ b/Makefile
@@ -15,48 +15,27 @@
 # We need bash for some conditional logic below.
 SHELL := /usr/bin/env bash -e
 
-GO_INSTALL = ./hack/go-install.sh
+KCP_ROOT_DIR ?= $(abspath ../../../../..)
+
+GO_INSTALL = $(KCP_ROOT_DIR)/hack/go-install.sh
 
 TOOLS_DIR=hack/tools
-TOOLS_GOBIN_DIR := $(abspath $(TOOLS_DIR))
-GOBIN_DIR=$(abspath ./bin )
+TOOLS_GOBIN_DIR := $(KCP_ROOT_DIR)/$(TOOLS_DIR)
+GOBIN_DIR=$(abspath ./bin)
 PATH := $(GOBIN_DIR):$(TOOLS_GOBIN_DIR):$(PATH)
-TMPDIR := $(shell mktemp -d)
-
-CODE_GENERATOR_VER := v2.0.1
-CODE_GENERATOR_BIN := code-generator
-CODE_GENERATOR := $(TOOLS_DIR)/$(CODE_GENERATOR_BIN)-$(CODE_GENERATOR_VER)
-export CODE_GENERATOR # so hack scripts can use it
-
-$(CODE_GENERATOR):
-	GOBIN=$(TOOLS_GOBIN_DIR) $(GO_INSTALL) github.com/kcp-dev/code-generator/v2 $(CODE_GENERATOR_BIN) $(CODE_GENERATOR_VER)
-
-OPENSHIFT_GOIMPORTS_VER := c72f1dc2e3aacfa00aece3391d938c9bc734e791
-OPENSHIFT_GOIMPORTS_BIN := openshift-goimports
-OPENSHIFT_GOIMPORTS := $(TOOLS_DIR)/$(OPENSHIFT_GOIMPORTS_BIN)-$(OPENSHIFT_GOIMPORTS_VER)
-export OPENSHIFT_GOIMPORTS # so hack scripts can use it
-
-$(OPENSHIFT_GOIMPORTS):
-	GOBIN=$(TOOLS_GOBIN_DIR) $(GO_INSTALL) github.com/openshift-eng/openshift-goimports $(OPENSHIFT_GOIMPORTS_BIN) $(OPENSHIFT_GOIMPORTS_VER)
-
-imports: $(OPENSHIFT_GOIMPORTS)
-	$(OPENSHIFT_GOIMPORTS) -m github.com/kcp-dev/client-go
-.PHONY: imports
 
-GOLANGCI_LINT_VER := v1.50.1
+GOLANGCI_LINT_VER := v2.1.6
 GOLANGCI_LINT_BIN := golangci-lint
-GOLANGCI_LINT := $(TOOLS_DIR)/$(GOLANGCI_LINT_BIN)-$(GOLANGCI_LINT_VER)
+GOLANGCI_LINT := $(TOOLS_GOBIN_DIR)/$(GOLANGCI_LINT_BIN)-$(GOLANGCI_LINT_VER)
+GOLANGCI_LINT_FLAGS ?=
 
 $(GOLANGCI_LINT):
-	GOBIN=$(TOOLS_GOBIN_DIR) $(GO_INSTALL) github.com/golangci/golangci-lint/cmd/golangci-lint $(GOLANGCI_LINT_BIN) $(GOLANGCI_LINT_VER)
-
-lint: $(GOLANGCI_LINT)
-	$(GOLANGCI_LINT) run --timeout=10m ./...
+	GOBIN=$(TOOLS_GOBIN_DIR) $(GO_INSTALL) github.com/golangci/golangci-lint/v2/cmd/golangci-lint $(GOLANGCI_LINT_BIN) $(GOLANGCI_LINT_VER)
 
-tools: $(CODE_GENERATOR) $(OPENSHIFT_GOIMPORTS) $(GOLANGCI_LINT)
+tools: $(CODE_GENERATOR)
 .PHONY: tools
 
-codegen: $(CODE_GENERATOR)
+codegen:
 	go mod download
 	./hack/update-codegen.sh
 	$(MAKE) imports
@@ -73,3 +52,20 @@ verify-codegen:
 		echo "You need to run 'make codegen' to update generated files and commit them"; \
 		exit 1; \
 	fi
+
+.PHONY: verify
+verify: verify-codegen
+
+.PHONY: clean-generated
+clean-generated:
+	grep --exclude Makefile -l -e 'Code generated by [a-z-]*. DO NOT EDIT.' -r . | xargs rm -f
+	find . -type d -empty -delete
+
+.PHONY: imports
+imports: WHAT ?=
+imports: $(GOLANGCI_LINT)
+	if [ -n "$(WHAT)" ]; then \
+	  $(GOLANGCI_LINT) fmt --enable gci -c $(KCP_ROOT_DIR)/.golangci.yaml $(WHAT); \
+	else \
+	  $(GOLANGCI_LINT) fmt --enable gci -c $(KCP_ROOT_DIR)/.golangci.yaml ; \
+	fi;
diff --git a/OWNERS b/OWNERS
index 5e951a5e8..a006efb26 100644
--- a/OWNERS
+++ b/OWNERS
@@ -1,11 +1,9 @@
 approvers:
-- davidfestal
-- ncdc
-- stevekuznetsov
+- mjudeikis
 - sttts
 options: {}
 reviewers:
-- davidfestal
-- ncdc
-- stevekuznetsov
+- mjudeikis
+- embik
+- xrstf
 - sttts
diff --git a/README.md b/README.md
index b75c1e8fa..93ef47472 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,7 @@
+> ⚠️ **This is an automatically published staged repository for kcp**.   
+> Contributions, including issues and pull requests, should be made to the main kcp repository: [https://github.com/kcp-dev/kcp](https://github.com/kcp-dev/kcp).  
+> This repository is read-only for importing, and not used for direct contributions.  
+> See the [monorepo structure document](https://docs.kcp.io/kcp/main/contributing/monorepo/) for more details.
+
 # client-go
 Golang libraries for multi-cluster-aware Kubernetes clients, listers and informers.
diff --git a/apiextensions/client/clientset.go b/apiextensions/client/clientset.go
new file mode 100644
index 000000000..7e241b00e
--- /dev/null
+++ b/apiextensions/client/clientset.go
@@ -0,0 +1,155 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package client
+
+import (
+	fmt "fmt"
+	http "net/http"
+
+	client "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
+	discovery "k8s.io/client-go/discovery"
+	rest "k8s.io/client-go/rest"
+	flowcontrol "k8s.io/client-go/util/flowcontrol"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	apiextensionsv1 "github.com/kcp-dev/client-go/apiextensions/client/typed/apiextensions/v1"
+	apiextensionsv1beta1 "github.com/kcp-dev/client-go/apiextensions/client/typed/apiextensions/v1beta1"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+type ClusterInterface interface {
+	Cluster(logicalcluster.Path) client.Interface
+	Discovery() discovery.DiscoveryInterface
+	ApiextensionsV1() apiextensionsv1.ApiextensionsV1ClusterInterface
+	ApiextensionsV1beta1() apiextensionsv1beta1.ApiextensionsV1beta1ClusterInterface
+}
+
+// ClusterClientset contains the cluster clients for groups.
+type ClusterClientset struct {
+	*discovery.DiscoveryClient
+	clientCache          kcpclient.Cache[*client.Clientset]
+	apiextensionsV1      *apiextensionsv1.ApiextensionsV1ClusterClient
+	apiextensionsV1beta1 *apiextensionsv1beta1.ApiextensionsV1beta1ClusterClient
+}
+
+// Discovery retrieves the DiscoveryClient.
+func (c *ClusterClientset) Discovery() discovery.DiscoveryInterface {
+	if c == nil {
+		return nil
+	}
+	return c.DiscoveryClient
+}
+
+// ApiextensionsV1 retrieves the ApiextensionsV1ClusterClient.
+func (c *ClusterClientset) ApiextensionsV1() apiextensionsv1.ApiextensionsV1ClusterInterface {
+	return c.apiextensionsV1
+}
+
+// ApiextensionsV1beta1 retrieves the ApiextensionsV1beta1ClusterClient.
+func (c *ClusterClientset) ApiextensionsV1beta1() apiextensionsv1beta1.ApiextensionsV1beta1ClusterInterface {
+	return c.apiextensionsV1beta1
+}
+
+// Cluster scopes this clientset to one cluster.
+func (c *ClusterClientset) Cluster(clusterPath logicalcluster.Path) client.Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return c.clientCache.ClusterOrDie(clusterPath)
+}
+
+// NewForConfig creates a new ClusterClientset for the given config.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ClusterClientset, error) {
+	configShallowCopy := *c
+
+	if configShallowCopy.UserAgent == "" {
+		configShallowCopy.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	// share the transport between all clients
+	httpClient, err := rest.HTTPClientFor(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+
+// NewForConfigAndClient creates a new ClusterClientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*ClusterClientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		if configShallowCopy.Burst <= 0 {
+			return nil, fmt.Errorf("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
+		}
+		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+
+	cache := kcpclient.NewCache(c, httpClient, &kcpclient.Constructor[*client.Clientset]{
+		NewForConfigAndClient: client.NewForConfigAndClient,
+	})
+	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
+		return nil, err
+	}
+
+	var cs ClusterClientset
+	cs.clientCache = cache
+	var err error
+	cs.apiextensionsV1, err = apiextensionsv1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	cs.apiextensionsV1beta1, err = apiextensionsv1beta1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	return &cs, nil
+}
+
+// NewForConfigOrDie creates a new ClusterClientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ClusterClientset {
+	cs, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return cs
+}
+
+// New creates a new ClusterClientset for the given RESTClient.
+func New(c *rest.Config) *ClusterClientset {
+	var cs ClusterClientset
+	cs.apiextensionsV1 = apiextensionsv1.NewForConfigOrDie(c)
+	cs.apiextensionsV1beta1 = apiextensionsv1beta1.NewForConfigOrDie(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c)
+	return &cs
+}
diff --git a/apiextensions/client/fake/clientset.go b/apiextensions/client/fake/clientset.go
new file mode 100644
index 000000000..e4f6ec365
--- /dev/null
+++ b/apiextensions/client/fake/clientset.go
@@ -0,0 +1,152 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	applyconfiguration "k8s.io/apiextensions-apiserver/pkg/client/applyconfiguration"
+	clientset "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
+	apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1beta1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/discovery"
+
+	kcpclientset "github.com/kcp-dev/client-go/apiextensions/client"
+	kcpclientscheme "github.com/kcp-dev/client-go/apiextensions/client/scheme"
+	kcpapiextensionsv1 "github.com/kcp-dev/client-go/apiextensions/client/typed/apiextensions/v1"
+	kcpfakeapiextensionsv1 "github.com/kcp-dev/client-go/apiextensions/client/typed/apiextensions/v1/fake"
+	kcpapiextensionsv1beta1 "github.com/kcp-dev/client-go/apiextensions/client/typed/apiextensions/v1beta1"
+	kcpfakeapiextensionsv1beta1 "github.com/kcp-dev/client-go/apiextensions/client/typed/apiextensions/v1beta1/fake"
+	kcpfakediscovery "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/discovery/fake"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// NewSimpleClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any field management, validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+//
+// DEPRECATED: NewClientset replaces this with support for field management, which significantly improves
+// server side apply testing. NewClientset is only available when apply configurations are generated (e.g.
+// via --with-applyconfig).
+func NewSimpleClientset(objects ...runtime.Object) *ClusterClientset {
+	o := kcptesting.NewObjectTracker(kcpclientscheme.Scheme, kcpclientscheme.Codecs.UniversalDecoder())
+	o.AddAll(objects...)
+
+	cs := &ClusterClientset{Fake: kcptesting.Fake{}, tracker: o}
+	cs.discovery = &kcpfakediscovery.FakeDiscovery{Fake: &cs.Fake, ClusterPath: logicalcluster.Wildcard}
+	cs.AddReactor("*", "*", kcptesting.ObjectReaction(o))
+	cs.AddWatchReactor("*", kcptesting.WatchReaction(o))
+
+	return cs
+}
+
+// ClusterClientset contains the clients for groups.
+type ClusterClientset struct {
+	kcptesting.Fake
+	discovery *kcpfakediscovery.FakeDiscovery
+	tracker   kcptesting.ObjectTracker
+}
+
+var _ kcpclientset.ClusterInterface = (*ClusterClientset)(nil)
+
+// Discovery retrieves the DiscoveryClient
+func (c *ClusterClientset) Discovery() discovery.DiscoveryInterface {
+	return c.discovery
+}
+
+func (c *ClusterClientset) Tracker() kcptesting.ObjectTracker {
+	return c.tracker
+}
+
+// Cluster scopes this clientset to one cluster.
+func (c *ClusterClientset) Cluster(clusterPath logicalcluster.Path) clientset.Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return &Clientset{
+		Fake:        &c.Fake,
+		discovery:   &kcpfakediscovery.FakeDiscovery{Fake: &c.Fake, ClusterPath: clusterPath},
+		tracker:     c.tracker.Cluster(clusterPath),
+		clusterPath: clusterPath,
+	}
+}
+
+// ApiextensionsV1 retrieves the ApiextensionsV1ClusterClient
+func (c *ClusterClientset) ApiextensionsV1() kcpapiextensionsv1.ApiextensionsV1ClusterInterface {
+	return &kcpfakeapiextensionsv1.ApiextensionsV1ClusterClient{Fake: &c.Fake}
+}
+
+// ApiextensionsV1beta1 retrieves the ApiextensionsV1beta1ClusterClient
+func (c *ClusterClientset) ApiextensionsV1beta1() kcpapiextensionsv1beta1.ApiextensionsV1beta1ClusterInterface {
+	return &kcpfakeapiextensionsv1beta1.ApiextensionsV1beta1ClusterClient{Fake: &c.Fake}
+}
+
+// Clientset implements clientset.Interface. Meant to be embedded into a
+// struct to get a default implementation. This makes faking out just the method
+// you want to test easier.
+type Clientset struct {
+	*kcptesting.Fake
+	discovery   *kcpfakediscovery.FakeDiscovery
+	tracker     kcptesting.ScopedObjectTracker
+	clusterPath logicalcluster.Path
+}
+
+var (
+	_ clientset.Interface         = &Clientset{}
+	_ kcptesting.FakeScopedClient = &Clientset{}
+)
+
+func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+	return c.discovery
+}
+
+func (c *Clientset) Tracker() kcptesting.ScopedObjectTracker {
+	return c.tracker
+}
+
+// NewClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewClientset(objects ...runtime.Object) *ClusterClientset {
+	o := kcptesting.NewFieldManagedObjectTracker(
+		kcpclientscheme.Scheme,
+		kcpclientscheme.Codecs.UniversalDecoder(),
+		applyconfiguration.NewTypeConverter(kcpclientscheme.Scheme),
+	)
+	o.AddAll(objects...)
+
+	cs := &ClusterClientset{Fake: kcptesting.Fake{}, tracker: o}
+	cs.discovery = &kcpfakediscovery.FakeDiscovery{Fake: &cs.Fake, ClusterPath: logicalcluster.Wildcard}
+	cs.AddReactor("*", "*", kcptesting.ObjectReaction(o))
+	cs.AddWatchReactor("*", kcptesting.WatchReaction(o))
+
+	return cs
+}
+
+// ApiextensionsV1 retrieves the ApiextensionsV1Client
+func (c *Clientset) ApiextensionsV1() apiextensionsv1.ApiextensionsV1Interface {
+	return &kcpfakeapiextensionsv1.ApiextensionsV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+}
+
+// ApiextensionsV1beta1 retrieves the ApiextensionsV1beta1Client
+func (c *Clientset) ApiextensionsV1beta1() apiextensionsv1beta1.ApiextensionsV1beta1Interface {
+	return &kcpfakeapiextensionsv1beta1.ApiextensionsV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+}
diff --git a/apiextensions/client/fake/doc.go b/apiextensions/client/fake/doc.go
new file mode 100644
index 000000000..05690c918
--- /dev/null
+++ b/apiextensions/client/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated fake clientset.
+package fake
diff --git a/apiextensions/client/fake/register.go b/apiextensions/client/fake/register.go
new file mode 100644
index 000000000..a32f519f8
--- /dev/null
+++ b/apiextensions/client/fake/register.go
@@ -0,0 +1,58 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+var scheme = runtime.NewScheme()
+var codecs = serializer.NewCodecFactory(scheme)
+
+var localSchemeBuilder = runtime.SchemeBuilder{
+	apiextensionsv1.AddToScheme,
+	apiextensionsv1beta1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(scheme))
+}
diff --git a/apiextensions/client/scheme/doc.go b/apiextensions/client/scheme/doc.go
new file mode 100644
index 000000000..65ba12554
--- /dev/null
+++ b/apiextensions/client/scheme/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package contains the scheme of the automatically generated clientset.
+package scheme
diff --git a/apiextensions/client/scheme/register.go b/apiextensions/client/scheme/register.go
new file mode 100644
index 000000000..fec99fff5
--- /dev/null
+++ b/apiextensions/client/scheme/register.go
@@ -0,0 +1,58 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package scheme
+
+import (
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+var Scheme = runtime.NewScheme()
+var Codecs = serializer.NewCodecFactory(Scheme)
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+var localSchemeBuilder = runtime.SchemeBuilder{
+	apiextensionsv1.AddToScheme,
+	apiextensionsv1beta1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(Scheme))
+}
diff --git a/apiextensions/client/typed/apiextensions/v1/apiextensions_client.go b/apiextensions/client/typed/apiextensions/v1/apiextensions_client.go
new file mode 100644
index 000000000..81c45b2df
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1/apiextensions_client.go
@@ -0,0 +1,103 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	apisapiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
+	rest "k8s.io/client-go/rest"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/apiextensions/client/scheme"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+type ApiextensionsV1ClusterInterface interface {
+	ApiextensionsV1ClusterScoper
+	CustomResourceDefinitionsClusterGetter
+}
+
+type ApiextensionsV1ClusterScoper interface {
+	Cluster(logicalcluster.Path) apiextensionsv1.ApiextensionsV1Interface
+}
+
+// ApiextensionsV1ClusterClient is used to interact with features provided by the apiextensions.k8s.io group.
+type ApiextensionsV1ClusterClient struct {
+	clientCache kcpclient.Cache[*apiextensionsv1.ApiextensionsV1Client]
+}
+
+func (c *ApiextensionsV1ClusterClient) Cluster(clusterPath logicalcluster.Path) apiextensionsv1.ApiextensionsV1Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return c.clientCache.ClusterOrDie(clusterPath)
+}
+
+func (c *ApiextensionsV1ClusterClient) CustomResourceDefinitions() CustomResourceDefinitionClusterInterface {
+	return &customResourceDefinitionsClusterInterface{clientCache: c.clientCache}
+}
+
+// NewForConfig creates a new ApiextensionsV1ClusterClient for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ApiextensionsV1ClusterClient, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ApiextensionsV1ClusterClient for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ApiextensionsV1ClusterClient, error) {
+	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*apiextensionsv1.ApiextensionsV1Client]{
+		NewForConfigAndClient: apiextensionsv1.NewForConfigAndClient,
+	})
+	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
+		return nil, err
+	}
+
+	return &ApiextensionsV1ClusterClient{clientCache: cache}, nil
+}
+
+// NewForConfigOrDie creates a new ApiextensionsV1ClusterClient for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ApiextensionsV1ClusterClient {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apisapiextensionsv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/apiextensions/client/typed/apiextensions/v1/customresourcedefinition.go b/apiextensions/client/typed/apiextensions/v1/customresourcedefinition.go
new file mode 100644
index 000000000..bf70bddd0
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1/customresourcedefinition.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	apisapiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// CustomResourceDefinitionsClusterGetter has a method to return a CustomResourceDefinitionClusterInterface.
+// A group's cluster client should implement this interface.
+type CustomResourceDefinitionsClusterGetter interface {
+	CustomResourceDefinitions() CustomResourceDefinitionClusterInterface
+}
+
+// CustomResourceDefinitionClusterInterface can operate on CustomResourceDefinitions across all clusters,
+// or scope down to one cluster and return a apiextensionsv1.CustomResourceDefinitionInterface.
+type CustomResourceDefinitionClusterInterface interface {
+	Cluster(logicalcluster.Path) apiextensionsv1.CustomResourceDefinitionInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apisapiextensionsv1.CustomResourceDefinitionList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	CustomResourceDefinitionClusterExpansion
+}
+
+type customResourceDefinitionsClusterInterface struct {
+	clientCache kcpclient.Cache[*apiextensionsv1.ApiextensionsV1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *customResourceDefinitionsClusterInterface) Cluster(clusterPath logicalcluster.Path) apiextensionsv1.CustomResourceDefinitionInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).CustomResourceDefinitions()
+}
+
+// List returns the entire collection of all CustomResourceDefinitions across all clusters.
+func (c *customResourceDefinitionsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apisapiextensionsv1.CustomResourceDefinitionList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CustomResourceDefinitions().List(ctx, opts)
+}
+
+// Watch begins to watch all CustomResourceDefinitions across all clusters.
+func (c *customResourceDefinitionsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CustomResourceDefinitions().Watch(ctx, opts)
+}
diff --git a/apiextensions/client/typed/apiextensions/v1/doc.go b/apiextensions/client/typed/apiextensions/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/apiextensions/client/typed/apiextensions/v1/fake/apiextensions_client.go b/apiextensions/client/typed/apiextensions/v1/fake/apiextensions_client.go
new file mode 100644
index 000000000..2a6eb8d22
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1/fake/apiextensions_client.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
+	rest "k8s.io/client-go/rest"
+
+	kcpapiextensionsv1 "github.com/kcp-dev/client-go/apiextensions/client/typed/apiextensions/v1"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+var _ kcpapiextensionsv1.ApiextensionsV1ClusterInterface = (*ApiextensionsV1ClusterClient)(nil)
+
+type ApiextensionsV1ClusterClient struct {
+	*kcptesting.Fake
+}
+
+func (c *ApiextensionsV1ClusterClient) Cluster(clusterPath logicalcluster.Path) apiextensionsv1.ApiextensionsV1Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return &ApiextensionsV1Client{Fake: c.Fake, ClusterPath: clusterPath}
+}
+
+func (c *ApiextensionsV1ClusterClient) CustomResourceDefinitions() kcpapiextensionsv1.CustomResourceDefinitionClusterInterface {
+	return newFakeCustomResourceDefinitionClusterClient(c)
+}
+
+type ApiextensionsV1Client struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (c *ApiextensionsV1Client) CustomResourceDefinitions() apiextensionsv1.CustomResourceDefinitionInterface {
+	return newFakeCustomResourceDefinitionClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ApiextensionsV1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/apiextensions/client/typed/apiextensions/v1/fake/customresourcedefinition.go b/apiextensions/client/typed/apiextensions/v1/fake/customresourcedefinition.go
new file mode 100644
index 000000000..6039c8378
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1/fake/customresourcedefinition.go
@@ -0,0 +1,94 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	v1 "k8s.io/apiextensions-apiserver/pkg/client/applyconfiguration/apiextensions/v1"
+	typedapiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
+
+	typedkcpapiextensionsv1 "github.com/kcp-dev/client-go/apiextensions/client/typed/apiextensions/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// customResourceDefinitionClusterClient implements CustomResourceDefinitionClusterInterface
+type customResourceDefinitionClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*apiextensionsv1.CustomResourceDefinition, *apiextensionsv1.CustomResourceDefinitionList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeCustomResourceDefinitionClusterClient(fake *ApiextensionsV1ClusterClient) typedkcpapiextensionsv1.CustomResourceDefinitionClusterInterface {
+	return &customResourceDefinitionClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*apiextensionsv1.CustomResourceDefinition, *apiextensionsv1.CustomResourceDefinitionList](
+			fake.Fake,
+			apiextensionsv1.SchemeGroupVersion.WithResource("customresourcedefinitions"),
+			apiextensionsv1.SchemeGroupVersion.WithKind("CustomResourceDefinition"),
+			func() *apiextensionsv1.CustomResourceDefinition { return &apiextensionsv1.CustomResourceDefinition{} },
+			func() *apiextensionsv1.CustomResourceDefinitionList {
+				return &apiextensionsv1.CustomResourceDefinitionList{}
+			},
+			func(dst, src *apiextensionsv1.CustomResourceDefinitionList) { dst.ListMeta = src.ListMeta },
+			func(list *apiextensionsv1.CustomResourceDefinitionList) []*apiextensionsv1.CustomResourceDefinition {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *apiextensionsv1.CustomResourceDefinitionList, items []*apiextensionsv1.CustomResourceDefinition) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *customResourceDefinitionClusterClient) Cluster(cluster logicalcluster.Path) typedapiextensionsv1.CustomResourceDefinitionInterface {
+	return newFakeCustomResourceDefinitionClient(c.Fake, cluster)
+}
+
+// customResourceDefinitionScopedClient implements CustomResourceDefinitionInterface
+type customResourceDefinitionScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*apiextensionsv1.CustomResourceDefinition, *apiextensionsv1.CustomResourceDefinitionList, *v1.CustomResourceDefinitionApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeCustomResourceDefinitionClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedapiextensionsv1.CustomResourceDefinitionInterface {
+	return &customResourceDefinitionScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*apiextensionsv1.CustomResourceDefinition, *apiextensionsv1.CustomResourceDefinitionList, *v1.CustomResourceDefinitionApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			apiextensionsv1.SchemeGroupVersion.WithResource("customresourcedefinitions"),
+			apiextensionsv1.SchemeGroupVersion.WithKind("CustomResourceDefinition"),
+			func() *apiextensionsv1.CustomResourceDefinition { return &apiextensionsv1.CustomResourceDefinition{} },
+			func() *apiextensionsv1.CustomResourceDefinitionList {
+				return &apiextensionsv1.CustomResourceDefinitionList{}
+			},
+			func(dst, src *apiextensionsv1.CustomResourceDefinitionList) { dst.ListMeta = src.ListMeta },
+			func(list *apiextensionsv1.CustomResourceDefinitionList) []*apiextensionsv1.CustomResourceDefinition {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *apiextensionsv1.CustomResourceDefinitionList, items []*apiextensionsv1.CustomResourceDefinition) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/apiextensions/client/typed/apiextensions/v1/fake/doc.go b/apiextensions/client/typed/apiextensions/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/apiextensions/client/typed/apiextensions/v1/generated_expansion.go b/apiextensions/client/typed/apiextensions/v1/generated_expansion.go
new file mode 100644
index 000000000..102216e14
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type CustomResourceDefinitionClusterExpansion interface{}
diff --git a/apiextensions/client/typed/apiextensions/v1beta1/apiextensions_client.go b/apiextensions/client/typed/apiextensions/v1beta1/apiextensions_client.go
new file mode 100644
index 000000000..bf685ee29
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1beta1/apiextensions_client.go
@@ -0,0 +1,103 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	http "net/http"
+
+	apisapiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1beta1"
+	rest "k8s.io/client-go/rest"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/apiextensions/client/scheme"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+type ApiextensionsV1beta1ClusterInterface interface {
+	ApiextensionsV1beta1ClusterScoper
+	CustomResourceDefinitionsClusterGetter
+}
+
+type ApiextensionsV1beta1ClusterScoper interface {
+	Cluster(logicalcluster.Path) apiextensionsv1beta1.ApiextensionsV1beta1Interface
+}
+
+// ApiextensionsV1beta1ClusterClient is used to interact with features provided by the apiextensions.k8s.io group.
+type ApiextensionsV1beta1ClusterClient struct {
+	clientCache kcpclient.Cache[*apiextensionsv1beta1.ApiextensionsV1beta1Client]
+}
+
+func (c *ApiextensionsV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) apiextensionsv1beta1.ApiextensionsV1beta1Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return c.clientCache.ClusterOrDie(clusterPath)
+}
+
+func (c *ApiextensionsV1beta1ClusterClient) CustomResourceDefinitions() CustomResourceDefinitionClusterInterface {
+	return &customResourceDefinitionsClusterInterface{clientCache: c.clientCache}
+}
+
+// NewForConfig creates a new ApiextensionsV1beta1ClusterClient for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ApiextensionsV1beta1ClusterClient, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ApiextensionsV1beta1ClusterClient for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ApiextensionsV1beta1ClusterClient, error) {
+	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*apiextensionsv1beta1.ApiextensionsV1beta1Client]{
+		NewForConfigAndClient: apiextensionsv1beta1.NewForConfigAndClient,
+	})
+	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
+		return nil, err
+	}
+
+	return &ApiextensionsV1beta1ClusterClient{clientCache: cache}, nil
+}
+
+// NewForConfigOrDie creates a new ApiextensionsV1beta1ClusterClient for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ApiextensionsV1beta1ClusterClient {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apisapiextensionsv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/apiextensions/client/typed/apiextensions/v1beta1/customresourcedefinition.go b/apiextensions/client/typed/apiextensions/v1beta1/customresourcedefinition.go
new file mode 100644
index 000000000..514994e61
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1beta1/customresourcedefinition.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	apisapiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// CustomResourceDefinitionsClusterGetter has a method to return a CustomResourceDefinitionClusterInterface.
+// A group's cluster client should implement this interface.
+type CustomResourceDefinitionsClusterGetter interface {
+	CustomResourceDefinitions() CustomResourceDefinitionClusterInterface
+}
+
+// CustomResourceDefinitionClusterInterface can operate on CustomResourceDefinitions across all clusters,
+// or scope down to one cluster and return a apiextensionsv1beta1.CustomResourceDefinitionInterface.
+type CustomResourceDefinitionClusterInterface interface {
+	Cluster(logicalcluster.Path) apiextensionsv1beta1.CustomResourceDefinitionInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apisapiextensionsv1beta1.CustomResourceDefinitionList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	CustomResourceDefinitionClusterExpansion
+}
+
+type customResourceDefinitionsClusterInterface struct {
+	clientCache kcpclient.Cache[*apiextensionsv1beta1.ApiextensionsV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *customResourceDefinitionsClusterInterface) Cluster(clusterPath logicalcluster.Path) apiextensionsv1beta1.CustomResourceDefinitionInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).CustomResourceDefinitions()
+}
+
+// List returns the entire collection of all CustomResourceDefinitions across all clusters.
+func (c *customResourceDefinitionsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apisapiextensionsv1beta1.CustomResourceDefinitionList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CustomResourceDefinitions().List(ctx, opts)
+}
+
+// Watch begins to watch all CustomResourceDefinitions across all clusters.
+func (c *customResourceDefinitionsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CustomResourceDefinitions().Watch(ctx, opts)
+}
diff --git a/apiextensions/client/typed/apiextensions/v1beta1/doc.go b/apiextensions/client/typed/apiextensions/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/apiextensions/client/typed/apiextensions/v1beta1/fake/apiextensions_client.go b/apiextensions/client/typed/apiextensions/v1beta1/fake/apiextensions_client.go
new file mode 100644
index 000000000..820116ce3
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1beta1/fake/apiextensions_client.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1beta1"
+	rest "k8s.io/client-go/rest"
+
+	kcpapiextensionsv1beta1 "github.com/kcp-dev/client-go/apiextensions/client/typed/apiextensions/v1beta1"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+var _ kcpapiextensionsv1beta1.ApiextensionsV1beta1ClusterInterface = (*ApiextensionsV1beta1ClusterClient)(nil)
+
+type ApiextensionsV1beta1ClusterClient struct {
+	*kcptesting.Fake
+}
+
+func (c *ApiextensionsV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) apiextensionsv1beta1.ApiextensionsV1beta1Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return &ApiextensionsV1beta1Client{Fake: c.Fake, ClusterPath: clusterPath}
+}
+
+func (c *ApiextensionsV1beta1ClusterClient) CustomResourceDefinitions() kcpapiextensionsv1beta1.CustomResourceDefinitionClusterInterface {
+	return newFakeCustomResourceDefinitionClusterClient(c)
+}
+
+type ApiextensionsV1beta1Client struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (c *ApiextensionsV1beta1Client) CustomResourceDefinitions() apiextensionsv1beta1.CustomResourceDefinitionInterface {
+	return newFakeCustomResourceDefinitionClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ApiextensionsV1beta1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/apiextensions/client/typed/apiextensions/v1beta1/fake/customresourcedefinition.go b/apiextensions/client/typed/apiextensions/v1beta1/fake/customresourcedefinition.go
new file mode 100644
index 000000000..fa9f9f473
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1beta1/fake/customresourcedefinition.go
@@ -0,0 +1,98 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	v1beta1 "k8s.io/apiextensions-apiserver/pkg/client/applyconfiguration/apiextensions/v1beta1"
+	typedapiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1beta1"
+
+	typedkcpapiextensionsv1beta1 "github.com/kcp-dev/client-go/apiextensions/client/typed/apiextensions/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// customResourceDefinitionClusterClient implements CustomResourceDefinitionClusterInterface
+type customResourceDefinitionClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*apiextensionsv1beta1.CustomResourceDefinition, *apiextensionsv1beta1.CustomResourceDefinitionList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeCustomResourceDefinitionClusterClient(fake *ApiextensionsV1beta1ClusterClient) typedkcpapiextensionsv1beta1.CustomResourceDefinitionClusterInterface {
+	return &customResourceDefinitionClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*apiextensionsv1beta1.CustomResourceDefinition, *apiextensionsv1beta1.CustomResourceDefinitionList](
+			fake.Fake,
+			apiextensionsv1beta1.SchemeGroupVersion.WithResource("customresourcedefinitions"),
+			apiextensionsv1beta1.SchemeGroupVersion.WithKind("CustomResourceDefinition"),
+			func() *apiextensionsv1beta1.CustomResourceDefinition {
+				return &apiextensionsv1beta1.CustomResourceDefinition{}
+			},
+			func() *apiextensionsv1beta1.CustomResourceDefinitionList {
+				return &apiextensionsv1beta1.CustomResourceDefinitionList{}
+			},
+			func(dst, src *apiextensionsv1beta1.CustomResourceDefinitionList) { dst.ListMeta = src.ListMeta },
+			func(list *apiextensionsv1beta1.CustomResourceDefinitionList) []*apiextensionsv1beta1.CustomResourceDefinition {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *apiextensionsv1beta1.CustomResourceDefinitionList, items []*apiextensionsv1beta1.CustomResourceDefinition) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *customResourceDefinitionClusterClient) Cluster(cluster logicalcluster.Path) typedapiextensionsv1beta1.CustomResourceDefinitionInterface {
+	return newFakeCustomResourceDefinitionClient(c.Fake, cluster)
+}
+
+// customResourceDefinitionScopedClient implements CustomResourceDefinitionInterface
+type customResourceDefinitionScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*apiextensionsv1beta1.CustomResourceDefinition, *apiextensionsv1beta1.CustomResourceDefinitionList, *v1beta1.CustomResourceDefinitionApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeCustomResourceDefinitionClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedapiextensionsv1beta1.CustomResourceDefinitionInterface {
+	return &customResourceDefinitionScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*apiextensionsv1beta1.CustomResourceDefinition, *apiextensionsv1beta1.CustomResourceDefinitionList, *v1beta1.CustomResourceDefinitionApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			apiextensionsv1beta1.SchemeGroupVersion.WithResource("customresourcedefinitions"),
+			apiextensionsv1beta1.SchemeGroupVersion.WithKind("CustomResourceDefinition"),
+			func() *apiextensionsv1beta1.CustomResourceDefinition {
+				return &apiextensionsv1beta1.CustomResourceDefinition{}
+			},
+			func() *apiextensionsv1beta1.CustomResourceDefinitionList {
+				return &apiextensionsv1beta1.CustomResourceDefinitionList{}
+			},
+			func(dst, src *apiextensionsv1beta1.CustomResourceDefinitionList) { dst.ListMeta = src.ListMeta },
+			func(list *apiextensionsv1beta1.CustomResourceDefinitionList) []*apiextensionsv1beta1.CustomResourceDefinition {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *apiextensionsv1beta1.CustomResourceDefinitionList, items []*apiextensionsv1beta1.CustomResourceDefinition) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/apiextensions/client/typed/apiextensions/v1beta1/fake/doc.go b/apiextensions/client/typed/apiextensions/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/apiextensions/client/typed/apiextensions/v1beta1/generated_expansion.go b/apiextensions/client/typed/apiextensions/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..532b20e8b
--- /dev/null
+++ b/apiextensions/client/typed/apiextensions/v1beta1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type CustomResourceDefinitionClusterExpansion interface{}
diff --git a/apiextensions/informers/apiextensions/interface.go b/apiextensions/informers/apiextensions/interface.go
new file mode 100644
index 000000000..e77008e3a
--- /dev/null
+++ b/apiextensions/informers/apiextensions/interface.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package apiextensions
+
+import (
+	kcpv1 "github.com/kcp-dev/client-go/apiextensions/informers/apiextensions/v1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/apiextensions/informers/apiextensions/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/apiextensions/informers/internalinterfaces"
+)
+
+// ClusterInterface provides access to each of this group's versions.
+type ClusterInterface interface {
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
+}
+
+type group struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new ClusterInterface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
+	return &group{factory: f, tweakListOptions: tweakListOptions}
+}
+
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
+}
+
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
+}
diff --git a/apiextensions/informers/apiextensions/v1/customresourcedefinition.go b/apiextensions/informers/apiextensions/v1/customresourcedefinition.go
new file mode 100644
index 000000000..f24500a56
--- /dev/null
+++ b/apiextensions/informers/apiextensions/v1/customresourcedefinition.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	apisapiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/informers/externalversions/apiextensions/v1"
+	listersapiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/listers/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpclient "github.com/kcp-dev/client-go/apiextensions/client"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/apiextensions/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/apiextensions/listers/apiextensions/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// CustomResourceDefinitionClusterInformer provides access to a shared informer and lister for
+// CustomResourceDefinitions.
+type CustomResourceDefinitionClusterInformer interface {
+	Cluster(logicalcluster.Name) apiextensionsv1.CustomResourceDefinitionInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) apiextensionsv1.CustomResourceDefinitionInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1.CustomResourceDefinitionClusterLister
+}
+
+type customResourceDefinitionClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewCustomResourceDefinitionClusterInformer constructs a new informer for CustomResourceDefinition type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewCustomResourceDefinitionClusterInformer(client kcpclient.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredCustomResourceDefinitionClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredCustomResourceDefinitionClusterInformer constructs a new informer for CustomResourceDefinition type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredCustomResourceDefinitionClusterInformer(client kcpclient.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ApiextensionsV1().CustomResourceDefinitions().List(context.Background(), options)
+			},
+			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ApiextensionsV1().CustomResourceDefinitions().Watch(context.Background(), options)
+			},
+		},
+		&apisapiextensionsv1.CustomResourceDefinition{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *customResourceDefinitionClusterInformer) defaultInformer(client kcpclient.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredCustomResourceDefinitionClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *customResourceDefinitionClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apisapiextensionsv1.CustomResourceDefinition{}, i.defaultInformer)
+}
+
+func (i *customResourceDefinitionClusterInformer) Lister() kcpv1.CustomResourceDefinitionClusterLister {
+	return kcpv1.NewCustomResourceDefinitionClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *customResourceDefinitionClusterInformer) Cluster(clusterName logicalcluster.Name) apiextensionsv1.CustomResourceDefinitionInformer {
+	return &customResourceDefinitionInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *customResourceDefinitionClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) apiextensionsv1.CustomResourceDefinitionInformer {
+	return &customResourceDefinitionInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type customResourceDefinitionInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersapiextensionsv1.CustomResourceDefinitionLister
+}
+
+func (i *customResourceDefinitionInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *customResourceDefinitionInformer) Lister() listersapiextensionsv1.CustomResourceDefinitionLister {
+	return i.lister
+}
diff --git a/apiextensions/informers/apiextensions/v1/interface.go b/apiextensions/informers/apiextensions/v1/interface.go
new file mode 100644
index 000000000..e6bec9ea0
--- /dev/null
+++ b/apiextensions/informers/apiextensions/v1/interface.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/apiextensions/informers/internalinterfaces"
+)
+
+type ClusterInterface interface {
+	// CustomResourceDefinitions returns a CustomResourceDefinitionClusterInformer.
+	CustomResourceDefinitions() CustomResourceDefinitionClusterInformer
+}
+
+type version struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
+	return &version{factory: f, tweakListOptions: tweakListOptions}
+}
+
+// CustomResourceDefinitions returns a CustomResourceDefinitionClusterInformer.
+func (v *version) CustomResourceDefinitions() CustomResourceDefinitionClusterInformer {
+	return &customResourceDefinitionClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/apiextensions/informers/apiextensions/v1beta1/customresourcedefinition.go b/apiextensions/informers/apiextensions/v1beta1/customresourcedefinition.go
new file mode 100644
index 000000000..92a3c333a
--- /dev/null
+++ b/apiextensions/informers/apiextensions/v1beta1/customresourcedefinition.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apisapiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/client/informers/externalversions/apiextensions/v1beta1"
+	listersapiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/client/listers/apiextensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpclient "github.com/kcp-dev/client-go/apiextensions/client"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/apiextensions/informers/internalinterfaces"
+	kcpv1beta1 "github.com/kcp-dev/client-go/apiextensions/listers/apiextensions/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// CustomResourceDefinitionClusterInformer provides access to a shared informer and lister for
+// CustomResourceDefinitions.
+type CustomResourceDefinitionClusterInformer interface {
+	Cluster(logicalcluster.Name) apiextensionsv1beta1.CustomResourceDefinitionInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) apiextensionsv1beta1.CustomResourceDefinitionInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta1.CustomResourceDefinitionClusterLister
+}
+
+type customResourceDefinitionClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewCustomResourceDefinitionClusterInformer constructs a new informer for CustomResourceDefinition type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewCustomResourceDefinitionClusterInformer(client kcpclient.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredCustomResourceDefinitionClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredCustomResourceDefinitionClusterInformer constructs a new informer for CustomResourceDefinition type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredCustomResourceDefinitionClusterInformer(client kcpclient.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ApiextensionsV1beta1().CustomResourceDefinitions().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ApiextensionsV1beta1().CustomResourceDefinitions().Watch(context.Background(), options)
+			},
+		},
+		&apisapiextensionsv1beta1.CustomResourceDefinition{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *customResourceDefinitionClusterInformer) defaultInformer(client kcpclient.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredCustomResourceDefinitionClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *customResourceDefinitionClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apisapiextensionsv1beta1.CustomResourceDefinition{}, i.defaultInformer)
+}
+
+func (i *customResourceDefinitionClusterInformer) Lister() kcpv1beta1.CustomResourceDefinitionClusterLister {
+	return kcpv1beta1.NewCustomResourceDefinitionClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *customResourceDefinitionClusterInformer) Cluster(clusterName logicalcluster.Name) apiextensionsv1beta1.CustomResourceDefinitionInformer {
+	return &customResourceDefinitionInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *customResourceDefinitionClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) apiextensionsv1beta1.CustomResourceDefinitionInformer {
+	return &customResourceDefinitionInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type customResourceDefinitionInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersapiextensionsv1beta1.CustomResourceDefinitionLister
+}
+
+func (i *customResourceDefinitionInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *customResourceDefinitionInformer) Lister() listersapiextensionsv1beta1.CustomResourceDefinitionLister {
+	return i.lister
+}
diff --git a/apiextensions/informers/apiextensions/v1beta1/interface.go b/apiextensions/informers/apiextensions/v1beta1/interface.go
new file mode 100644
index 000000000..51f181585
--- /dev/null
+++ b/apiextensions/informers/apiextensions/v1beta1/interface.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/apiextensions/informers/internalinterfaces"
+)
+
+type ClusterInterface interface {
+	// CustomResourceDefinitions returns a CustomResourceDefinitionClusterInformer.
+	CustomResourceDefinitions() CustomResourceDefinitionClusterInformer
+}
+
+type version struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
+	return &version{factory: f, tweakListOptions: tweakListOptions}
+}
+
+// CustomResourceDefinitions returns a CustomResourceDefinitionClusterInformer.
+func (v *version) CustomResourceDefinitions() CustomResourceDefinitionClusterInformer {
+	return &customResourceDefinitionClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/apiextensions/informers/factory.go b/apiextensions/informers/factory.go
new file mode 100644
index 000000000..19dbd16f8
--- /dev/null
+++ b/apiextensions/informers/factory.go
@@ -0,0 +1,307 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package informers
+
+import (
+	reflect "reflect"
+	sync "sync"
+	time "time"
+
+	externalversions "k8s.io/apiextensions-apiserver/pkg/client/informers/externalversions"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpclient "github.com/kcp-dev/client-go/apiextensions/client"
+	kcpapiextensions "github.com/kcp-dev/client-go/apiextensions/informers/apiextensions"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/apiextensions/informers/internalinterfaces"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// SharedInformerOption defines the functional option type for SharedInformerFactory.
+type SharedInformerOption func(*SharedInformerOptions) *SharedInformerOptions
+
+type SharedInformerOptions struct {
+	customResync     map[reflect.Type]time.Duration
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+	transform        cache.TransformFunc
+	namespace        string
+}
+
+type sharedInformerFactory struct {
+	client           kcpclient.ClusterInterface
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+	lock             sync.Mutex
+	defaultResync    time.Duration
+	customResync     map[reflect.Type]time.Duration
+	transform        cache.TransformFunc
+
+	informers map[reflect.Type]kcpcache.ScopeableSharedIndexInformer
+	// startedInformers is used for tracking which informers have been started.
+	// This allows Start() to be called multiple times safely.
+	startedInformers map[reflect.Type]bool
+	// wg tracks how many goroutines were started.
+	wg sync.WaitGroup
+	// shuttingDown is true when Shutdown has been called. It may still be running
+	// because it needs to wait for goroutines.
+	shuttingDown bool
+}
+
+// WithCustomResyncConfig sets a custom resync period for the specified informer types.
+func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption {
+	return func(opts *SharedInformerOptions) *SharedInformerOptions {
+		for k, v := range resyncConfig {
+			opts.customResync[reflect.TypeOf(k)] = v
+		}
+		return opts
+	}
+}
+
+// WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
+func WithTweakListOptions(tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) SharedInformerOption {
+	return func(opts *SharedInformerOptions) *SharedInformerOptions {
+		opts.tweakListOptions = tweakListOptions
+		return opts
+	}
+}
+
+// WithTransform sets a transform on all informers.
+func WithTransform(transform cache.TransformFunc) SharedInformerOption {
+	return func(opts *SharedInformerOptions) *SharedInformerOptions {
+		opts.transform = transform
+		return opts
+	}
+}
+
+// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
+func NewSharedInformerFactory(client kcpclient.ClusterInterface, defaultResync time.Duration) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync)
+}
+
+// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
+// Listers obtained via this SharedInformerFactory will be subject to the same filters
+// as specified here.
+// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
+func NewFilteredSharedInformerFactory(client kcpclient.ClusterInterface, defaultResync time.Duration, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithTweakListOptions(tweakListOptions))
+}
+
+// NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
+func NewSharedInformerFactoryWithOptions(client kcpclient.ClusterInterface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
+	factory := &sharedInformerFactory{
+		client:           client,
+		defaultResync:    defaultResync,
+		informers:        make(map[reflect.Type]kcpcache.ScopeableSharedIndexInformer),
+		startedInformers: make(map[reflect.Type]bool),
+		customResync:     make(map[reflect.Type]time.Duration),
+	}
+
+	opts := &SharedInformerOptions{
+		customResync: make(map[reflect.Type]time.Duration),
+	}
+
+	// Apply all options
+	for _, opt := range options {
+		opts = opt(opts)
+	}
+
+	// Forward options to the factory
+	factory.customResync = opts.customResync
+	factory.tweakListOptions = opts.tweakListOptions
+	factory.transform = opts.transform
+
+	return factory
+}
+
+func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	if f.shuttingDown {
+		return
+	}
+
+	for informerType, informer := range f.informers {
+		if !f.startedInformers[informerType] {
+			f.wg.Add(1)
+			// We need a new variable in each loop iteration,
+			// otherwise the goroutine would use the loop variable
+			// and that keeps changing.
+			informer := informer
+			go func() {
+				defer f.wg.Done()
+				informer.Run(stopCh)
+			}()
+			f.startedInformers[informerType] = true
+		}
+	}
+}
+
+func (f *sharedInformerFactory) Shutdown() {
+	f.lock.Lock()
+	f.shuttingDown = true
+	f.lock.Unlock()
+
+	// Will return immediately if there is nothing to wait for.
+	f.wg.Wait()
+}
+
+func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
+	informers := func() map[reflect.Type]kcpcache.ScopeableSharedIndexInformer {
+		f.lock.Lock()
+		defer f.lock.Unlock()
+
+		informers := map[reflect.Type]kcpcache.ScopeableSharedIndexInformer{}
+		for informerType, informer := range f.informers {
+			if f.startedInformers[informerType] {
+				informers[informerType] = informer
+			}
+		}
+		return informers
+	}()
+
+	res := map[reflect.Type]bool{}
+	for informType, informer := range informers {
+		res[informType] = cache.WaitForCacheSync(stopCh, informer.HasSynced)
+	}
+
+	return res
+}
+
+// InformerFor returns the ScopeableSharedIndexInformer for obj using an internal client.
+func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc kcpinternalinterfaces.NewInformerFunc) kcpcache.ScopeableSharedIndexInformer {
+	f.lock.Lock()
+	defer f.lock.Unlock()
+
+	informerType := reflect.TypeOf(obj)
+	informer, exists := f.informers[informerType]
+	if exists {
+		return informer
+	}
+
+	resyncPeriod, exists := f.customResync[informerType]
+	if !exists {
+		resyncPeriod = f.defaultResync
+	}
+
+	informer = newFunc(f.client, resyncPeriod)
+	informer.SetTransform(f.transform)
+	f.informers[informerType] = informer
+
+	return informer
+}
+
+type ScopedDynamicSharedInformerFactory interface {
+	// ForResource gives generic access to a shared informer of the matching type.
+	ForResource(resource schema.GroupVersionResource) (externalversions.GenericInformer, error)
+
+	// Start initializes all requested informers. They are handled in goroutines
+	// which run until the stop channel gets closed.
+	Start(stopCh <-chan struct{})
+}
+
+// SharedInformerFactory provides shared informers for resources in all known
+// API group versions.
+//
+// It is typically used like this:
+//
+//	ctx, cancel := context.Background()
+//	defer cancel()
+//	factory := NewSharedInformerFactory(client, resyncPeriod)
+//	defer factory.WaitForStop()    // Returns immediately if nothing was started.
+//	genericInformer := factory.ForResource(resource)
+//	typedInformer := factory.SomeAPIGroup().V1().SomeType()
+//	factory.Start(ctx.Done())      // Start processing these informers.
+//	synced := factory.WaitForCacheSync(ctx.Done())
+//	for v, ok := range synced {
+//	    if !ok {
+//	        fmt.Fprintf(os.Stderr, "caches failed to sync: %v", v)
+//	        return
+//	    }
+//	}
+//
+//	// Creating informers can also be created after Start, but then
+//	// Start must be called again:
+//	anotherGenericInformer := factory.ForResource(resource)
+//	factory.Start(ctx.Done())
+type SharedInformerFactory interface {
+	kcpinternalinterfaces.SharedInformerFactory
+
+	Cluster(logicalcluster.Name) ScopedDynamicSharedInformerFactory
+
+	// Start initializes all requested informers. They are handled in goroutines
+	// which run until the stop channel gets closed.
+	// Warning: Start does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	Start(stopCh <-chan struct{})
+
+	// Shutdown marks a factory as shutting down. At that point no new
+	// informers can be started anymore and Start will return without
+	// doing anything.
+	//
+	// In addition, Shutdown blocks until all goroutines have terminated. For that
+	// to happen, the close channel(s) that they were started with must be closed,
+	// either before Shutdown gets called or while it is waiting.
+	//
+	// Shutdown may be called multiple times, even concurrently. All such calls will
+	// block until all goroutines have terminated.
+	Shutdown()
+
+	// WaitForCacheSync blocks until all started informers' caches were synced
+	// or the stop channel gets closed.
+	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
+
+	// ForResource gives generic access to a shared informer of the matching type.
+	ForResource(resource schema.GroupVersionResource) (GenericClusterInformer, error)
+
+	// InformerFor returns the SharedIndexInformer for obj using an internal
+	// client.
+	InformerFor(obj runtime.Object, newFunc kcpinternalinterfaces.NewInformerFunc) kcpcache.ScopeableSharedIndexInformer
+
+	Apiextensions() kcpapiextensions.ClusterInterface
+}
+
+func (f *sharedInformerFactory) Apiextensions() kcpapiextensions.ClusterInterface {
+	return kcpapiextensions.New(f, f.tweakListOptions)
+}
+
+func (f *sharedInformerFactory) Cluster(clusterName logicalcluster.Name) ScopedDynamicSharedInformerFactory {
+	return &scopedDynamicSharedInformerFactory{
+		sharedInformerFactory: f,
+		clusterName:           clusterName,
+	}
+}
+
+type scopedDynamicSharedInformerFactory struct {
+	*sharedInformerFactory
+	clusterName logicalcluster.Name
+}
+
+func (f *scopedDynamicSharedInformerFactory) ForResource(resource schema.GroupVersionResource) (externalversions.GenericInformer, error) {
+	clusterInformer, err := f.sharedInformerFactory.ForResource(resource)
+	if err != nil {
+		return nil, err
+	}
+	return clusterInformer.Cluster(f.clusterName), nil
+}
+
+func (f *scopedDynamicSharedInformerFactory) Start(stopCh <-chan struct{}) {
+	f.sharedInformerFactory.Start(stopCh)
+}
diff --git a/apiextensions/informers/generic.go b/apiextensions/informers/generic.go
new file mode 100644
index 000000000..db911ff0e
--- /dev/null
+++ b/apiextensions/informers/generic.go
@@ -0,0 +1,104 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package informers
+
+import (
+	context "context"
+	fmt "fmt"
+
+	v1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	v1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	externalversions "k8s.io/apiextensions-apiserver/pkg/client/informers/externalversions"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+type GenericClusterInformer interface {
+	Cluster(logicalcluster.Name) externalversions.GenericInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) externalversions.GenericInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpcache.GenericClusterLister
+}
+
+type genericClusterInformer struct {
+	informer kcpcache.ScopeableSharedIndexInformer
+	resource schema.GroupResource
+}
+
+// Informer returns the SharedIndexInformer.
+func (i *genericClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.informer
+}
+
+// Lister returns the GenericLister.
+func (i *genericClusterInformer) Lister() kcpcache.GenericClusterLister {
+	return kcpcache.NewGenericClusterLister(i.Informer().GetIndexer(), i.resource)
+}
+
+// Cluster scopes to a GenericInformer.
+func (i *genericClusterInformer) Cluster(clusterName logicalcluster.Name) externalversions.GenericInformer {
+	return &genericInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().ByCluster(clusterName),
+	}
+}
+
+// ClusterWithContext scopes to a GenericInformer and unregisters all
+// handles registered through it once the provided context is canceled.
+func (i *genericClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) externalversions.GenericInformer {
+	return &genericInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().ByCluster(clusterName),
+	}
+}
+
+type genericInformer struct {
+	informer cache.SharedIndexInformer
+	lister   cache.GenericLister
+}
+
+// Informer returns the SharedIndexInformer.
+func (i *genericInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+// Lister returns the GenericLister.
+func (i *genericInformer) Lister() cache.GenericLister {
+	return i.lister
+}
+
+// ForResource gives generic access to a shared informer of the matching type
+// TODO extend this to unknown resources with a client pool
+func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericClusterInformer, error) {
+	switch resource {
+	// Group=apiextensions.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithResource("customresourcedefinitions"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apiextensions().V1().CustomResourceDefinitions().Informer()}, nil
+
+		// Group=apiextensions.k8s.io, Version=v1beta1
+	case v1beta1.SchemeGroupVersion.WithResource("customresourcedefinitions"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apiextensions().V1beta1().CustomResourceDefinitions().Informer()}, nil
+
+	}
+
+	return nil, fmt.Errorf("no informer found for %v", resource)
+}
diff --git a/apiextensions/informers/internalinterfaces/factory_interfaces.go b/apiextensions/informers/internalinterfaces/factory_interfaces.go
new file mode 100644
index 000000000..76f8442b2
--- /dev/null
+++ b/apiextensions/informers/internalinterfaces/factory_interfaces.go
@@ -0,0 +1,41 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package internalinterfaces
+
+import (
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpclient "github.com/kcp-dev/client-go/apiextensions/client"
+)
+
+// TweakListOptionsFunc is a function that transforms a v1.ListOptions.
+type TweakListOptionsFunc func(*v1.ListOptions)
+
+// NewInformerFunc takes kcpclient.ClusterInterface and time.Duration to return a kcpcache.ScopeableSharedIndexInformer.
+type NewInformerFunc func(kcpclient.ClusterInterface, time.Duration) kcpcache.ScopeableSharedIndexInformer
+
+// SharedInformerFactory a small interface to allow for adding an informer without an import cycle.
+type SharedInformerFactory interface {
+	Start(stopCh <-chan struct{})
+	InformerFor(obj runtime.Object, newFunc NewInformerFunc) kcpcache.ScopeableSharedIndexInformer
+}
diff --git a/apiextensions/listers/apiextensions/v1/customresourcedefinition.go b/apiextensions/listers/apiextensions/v1/customresourcedefinition.go
new file mode 100644
index 000000000..54764c8cd
--- /dev/null
+++ b/apiextensions/listers/apiextensions/v1/customresourcedefinition.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	listersapiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/listers/apiextensions/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// CustomResourceDefinitionClusterLister helps list CustomResourceDefinitions across all workspaces,
+// or scope down to a CustomResourceDefinitionLister for one workspace.
+// All objects returned here must be treated as read-only.
+type CustomResourceDefinitionClusterLister interface {
+	// List lists all CustomResourceDefinitions in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*apiextensionsv1.CustomResourceDefinition, err error)
+	// Cluster returns a lister that can list and get CustomResourceDefinitions in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersapiextensionsv1.CustomResourceDefinitionLister
+	CustomResourceDefinitionClusterListerExpansion
+}
+
+// customResourceDefinitionClusterLister implements the CustomResourceDefinitionClusterLister interface.
+type customResourceDefinitionClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*apiextensionsv1.CustomResourceDefinition]
+}
+
+var _ CustomResourceDefinitionClusterLister = new(customResourceDefinitionClusterLister)
+
+// NewCustomResourceDefinitionClusterLister returns a new CustomResourceDefinitionClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewCustomResourceDefinitionClusterLister(indexer cache.Indexer) CustomResourceDefinitionClusterLister {
+	return &customResourceDefinitionClusterLister{
+		kcplisters.NewCluster[*apiextensionsv1.CustomResourceDefinition](indexer, apiextensionsv1.Resource("customresourcedefinition")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get CustomResourceDefinitions.
+func (l *customResourceDefinitionClusterLister) Cluster(clusterName logicalcluster.Name) listersapiextensionsv1.CustomResourceDefinitionLister {
+	return &customResourceDefinitionLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// customResourceDefinitionLister can list all CustomResourceDefinitions inside a workspace
+// or scope down to a listersapiextensionsv1.CustomResourceDefinitionNamespaceLister for one namespace.
+type customResourceDefinitionLister struct {
+	kcplisters.ResourceIndexer[*apiextensionsv1.CustomResourceDefinition]
+}
+
+var _ listersapiextensionsv1.CustomResourceDefinitionLister = new(customResourceDefinitionLister)
+
+// NewCustomResourceDefinitionLister returns a new CustomResourceDefinitionLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewCustomResourceDefinitionLister(indexer cache.Indexer) listersapiextensionsv1.CustomResourceDefinitionLister {
+	return &customResourceDefinitionLister{
+		kcplisters.New[*apiextensionsv1.CustomResourceDefinition](indexer, apiextensionsv1.Resource("customresourcedefinition")),
+	}
+}
+
+// customResourceDefinitionScopedLister can list all CustomResourceDefinitions inside a workspace
+// or scope down to a listersapiextensionsv1.CustomResourceDefinitionNamespaceLister.
+type customResourceDefinitionScopedLister struct {
+	kcplisters.ResourceIndexer[*apiextensionsv1.CustomResourceDefinition]
+}
diff --git a/apiextensions/listers/apiextensions/v1/expansion_generated.go b/apiextensions/listers/apiextensions/v1/expansion_generated.go
new file mode 100644
index 000000000..d3093c867
--- /dev/null
+++ b/apiextensions/listers/apiextensions/v1/expansion_generated.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
+
+// CustomResourceDefinitionClusterListerExpansion allows custom methods to be added to
+// CustomResourceDefinitionClusterLister.
+type CustomResourceDefinitionClusterListerExpansion interface{}
diff --git a/apiextensions/listers/apiextensions/v1beta1/customresourcedefinition.go b/apiextensions/listers/apiextensions/v1beta1/customresourcedefinition.go
new file mode 100644
index 000000000..3e010f526
--- /dev/null
+++ b/apiextensions/listers/apiextensions/v1beta1/customresourcedefinition.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
+	listersapiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/client/listers/apiextensions/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// CustomResourceDefinitionClusterLister helps list CustomResourceDefinitions across all workspaces,
+// or scope down to a CustomResourceDefinitionLister for one workspace.
+// All objects returned here must be treated as read-only.
+type CustomResourceDefinitionClusterLister interface {
+	// List lists all CustomResourceDefinitions in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*apiextensionsv1beta1.CustomResourceDefinition, err error)
+	// Cluster returns a lister that can list and get CustomResourceDefinitions in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersapiextensionsv1beta1.CustomResourceDefinitionLister
+	CustomResourceDefinitionClusterListerExpansion
+}
+
+// customResourceDefinitionClusterLister implements the CustomResourceDefinitionClusterLister interface.
+type customResourceDefinitionClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*apiextensionsv1beta1.CustomResourceDefinition]
+}
+
+var _ CustomResourceDefinitionClusterLister = new(customResourceDefinitionClusterLister)
+
+// NewCustomResourceDefinitionClusterLister returns a new CustomResourceDefinitionClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewCustomResourceDefinitionClusterLister(indexer cache.Indexer) CustomResourceDefinitionClusterLister {
+	return &customResourceDefinitionClusterLister{
+		kcplisters.NewCluster[*apiextensionsv1beta1.CustomResourceDefinition](indexer, apiextensionsv1beta1.Resource("customresourcedefinition")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get CustomResourceDefinitions.
+func (l *customResourceDefinitionClusterLister) Cluster(clusterName logicalcluster.Name) listersapiextensionsv1beta1.CustomResourceDefinitionLister {
+	return &customResourceDefinitionLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// customResourceDefinitionLister can list all CustomResourceDefinitions inside a workspace
+// or scope down to a listersapiextensionsv1beta1.CustomResourceDefinitionNamespaceLister for one namespace.
+type customResourceDefinitionLister struct {
+	kcplisters.ResourceIndexer[*apiextensionsv1beta1.CustomResourceDefinition]
+}
+
+var _ listersapiextensionsv1beta1.CustomResourceDefinitionLister = new(customResourceDefinitionLister)
+
+// NewCustomResourceDefinitionLister returns a new CustomResourceDefinitionLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewCustomResourceDefinitionLister(indexer cache.Indexer) listersapiextensionsv1beta1.CustomResourceDefinitionLister {
+	return &customResourceDefinitionLister{
+		kcplisters.New[*apiextensionsv1beta1.CustomResourceDefinition](indexer, apiextensionsv1beta1.Resource("customresourcedefinition")),
+	}
+}
+
+// customResourceDefinitionScopedLister can list all CustomResourceDefinitions inside a workspace
+// or scope down to a listersapiextensionsv1beta1.CustomResourceDefinitionNamespaceLister.
+type customResourceDefinitionScopedLister struct {
+	kcplisters.ResourceIndexer[*apiextensionsv1beta1.CustomResourceDefinition]
+}
diff --git a/apiextensions/listers/apiextensions/v1beta1/expansion_generated.go b/apiextensions/listers/apiextensions/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..757943d6c
--- /dev/null
+++ b/apiextensions/listers/apiextensions/v1beta1/expansion_generated.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+// CustomResourceDefinitionClusterListerExpansion allows custom methods to be added to
+// CustomResourceDefinitionClusterLister.
+type CustomResourceDefinitionClusterListerExpansion interface{}
diff --git a/dependencies.go b/dependencies.go
index afc5a3553..683cb1180 100644
--- a/dependencies.go
+++ b/dependencies.go
@@ -18,9 +18,11 @@ package main
 
 import (
 	_ "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	_ "github.com/kcp-dev/code-generator/v3/cmd/cluster-client-gen/generators"
 	_ "github.com/kcp-dev/logicalcluster/v3"
-
 	_ "k8s.io/api/core/v1"
+	_ "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	_ "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/validation"
 	_ "k8s.io/apimachinery/pkg/labels"
 	_ "k8s.io/client-go/listers/core/v1"
 )
diff --git a/discovery/clientset.go b/discovery/clientset.go
index a4ab68216..9d08f6546 100644
--- a/discovery/clientset.go
+++ b/discovery/clientset.go
@@ -20,12 +20,12 @@ import (
 	"fmt"
 	"net/http"
 
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	"k8s.io/client-go/discovery"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/util/flowcontrol"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ DiscoveryClusterInterface = (*ClusterClientset)(nil)
diff --git a/discovery/interface.go b/discovery/interface.go
index 002b010cc..ddf418e6a 100644
--- a/discovery/interface.go
+++ b/discovery/interface.go
@@ -17,9 +17,9 @@ limitations under the License.
 package discovery
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	"k8s.io/client-go/discovery"
+
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 type DiscoveryClusterInterface interface {
diff --git a/dynamic/clientset.go b/dynamic/clientset.go
index dc5dadfa2..733ec8ded 100644
--- a/dynamic/clientset.go
+++ b/dynamic/clientset.go
@@ -21,9 +21,6 @@ import (
 	"fmt"
 	"net/http"
 
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -32,7 +29,9 @@ import (
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/util/flowcontrol"
 
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	thirdpartydynamic "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/dynamic"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ ClusterInterface = (*ClusterClientset)(nil)
diff --git a/dynamic/dynamicinformer/informer.go b/dynamic/dynamicinformer/informer.go
index c8c746404..937012883 100644
--- a/dynamic/dynamicinformer/informer.go
+++ b/dynamic/dynamicinformer/informer.go
@@ -21,10 +21,6 @@ import (
 	"sync"
 	"time"
 
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	thirdpartyinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -34,9 +30,12 @@ import (
 	upstreaminformers "k8s.io/client-go/informers"
 	"k8s.io/client-go/tools/cache"
 
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	thirdpartyinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
 	kcpdynamic "github.com/kcp-dev/client-go/dynamic"
 	kcpdynamiclisters "github.com/kcp-dev/client-go/dynamic/dynamiclister"
 	kcpinformers "github.com/kcp-dev/client-go/informers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // NewDynamicSharedInformerFactory constructs a new instance of dynamicSharedInformerFactory for all namespaces.
@@ -165,8 +164,12 @@ func (d *dynamicClusterInformer) Lister() kcpcache.GenericClusterLister {
 }
 
 func (d *dynamicClusterInformer) Cluster(clusterName logicalcluster.Name) upstreaminformers.GenericInformer {
+	return d.ClusterWithContext(context.Background(), clusterName)
+}
+
+func (d *dynamicClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) upstreaminformers.GenericInformer {
 	return &dynamicInformer{
-		informer: d.Informer().Cluster(clusterName),
+		informer: d.Informer().ClusterWithContext(ctx, clusterName),
 		lister:   d.Lister().ByCluster(clusterName),
 	}
 }
diff --git a/dynamic/dynamiclister/interface.go b/dynamic/dynamiclister/interface.go
index 9d07a361a..0ffe4e96a 100644
--- a/dynamic/dynamiclister/interface.go
+++ b/dynamic/dynamiclister/interface.go
@@ -17,11 +17,11 @@ limitations under the License.
 package dynamiclister
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/dynamic/dynamiclister"
+
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ClusterLister can list resources across all workspaces, or scope down to a Lister for one workspace.
diff --git a/dynamic/dynamiclister/lister.go b/dynamic/dynamiclister/lister.go
index c9000fddb..8902a1c96 100644
--- a/dynamic/dynamiclister/lister.go
+++ b/dynamic/dynamiclister/lister.go
@@ -17,9 +17,6 @@ limitations under the License.
 package dynamiclister
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -27,6 +24,9 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/dynamic/dynamiclister"
 	"k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // New returns a new ClusterLister.
diff --git a/dynamic/dynamiclister/shim.go b/dynamic/dynamiclister/shim.go
index a967112d3..9dfbc22db 100644
--- a/dynamic/dynamiclister/shim.go
+++ b/dynamic/dynamiclister/shim.go
@@ -17,13 +17,13 @@ limitations under the License.
 package dynamiclister
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/dynamic/dynamiclister"
 	"k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // NewRuntimeObjectShim returns a new shim for ClusterLister.
diff --git a/dynamic/interface.go b/dynamic/interface.go
index c1061b835..729121638 100644
--- a/dynamic/interface.go
+++ b/dynamic/interface.go
@@ -19,13 +19,13 @@ package dynamic
 import (
 	"context"
 
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/client-go/dynamic"
+
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 type ClusterInterface interface {
diff --git a/go.mod b/go.mod
index 2874d1414..99828a38e 100644
--- a/go.mod
+++ b/go.mod
@@ -1,50 +1,91 @@
 module github.com/kcp-dev/client-go
 
-go 1.19
+go 1.24.0
 
 require (
-	github.com/evanphx/json-patch v4.12.0+incompatible
-	github.com/google/gnostic v0.5.7-v3refs
-	github.com/kcp-dev/apimachinery/v2 v2.0.0-alpha.0.0.20230316194741-cdd788144662
-	github.com/kcp-dev/logicalcluster/v3 v3.0.4
-	k8s.io/api v0.26.2
-	k8s.io/apimachinery v0.26.2
-	k8s.io/client-go v0.26.2
-	k8s.io/klog/v2 v2.80.1
+	github.com/google/gnostic-models v0.6.9
+	github.com/kcp-dev/apimachinery/v2 v2.28.1-0.20251017134924-175b5bf68c05
+	github.com/kcp-dev/code-generator/v3 v3.28.1-0.20251017134924-c023ef289dfc
+	github.com/kcp-dev/logicalcluster/v3 v3.0.5
+	gopkg.in/evanphx/json-patch.v4 v4.12.0
+	k8s.io/api v0.33.3
+	k8s.io/apiextensions-apiserver v0.33.3
+	k8s.io/apimachinery v0.33.3
+	k8s.io/client-go v0.33.3
+	k8s.io/klog/v2 v2.130.1
+	sigs.k8s.io/structured-merge-diff/v4 v4.6.0
+	sigs.k8s.io/yaml v1.4.0
 )
 
 require (
-	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
-	github.com/go-logr/logr v1.2.3 // indirect
-	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/jsonreference v0.20.0 // indirect
-	github.com/go-openapi/swag v0.19.14 // indirect
+	cel.dev/expr v0.19.1 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/blang/semver/v4 v4.0.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
-	github.com/google/gofuzz v1.1.0 // indirect
+	github.com/google/cel-go v0.23.2 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/mailru/easyjson v0.7.6 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	golang.org/x/net v0.7.0 // indirect
-	golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b // indirect
-	golang.org/x/sys v0.5.0 // indirect
-	golang.org/x/term v0.5.0 // indirect
-	golang.org/x/text v0.7.0 // indirect
-	golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	github.com/prometheus/client_golang v1.22.0 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/spf13/cobra v1.9.1 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/stoewer/go-strcase v1.3.0 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
+	go.opentelemetry.io/otel v1.33.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 // indirect
+	go.opentelemetry.io/otel/metric v1.33.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.33.0 // indirect
+	go.opentelemetry.io/otel/trace v1.33.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.4.0 // indirect
+	golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 // indirect
+	golang.org/x/mod v0.24.0 // indirect
+	golang.org/x/net v0.40.0 // indirect
+	golang.org/x/oauth2 v0.29.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/term v0.32.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	golang.org/x/tools v0.33.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/grpc v1.69.2 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect
-	k8s.io/utils v0.0.0-20221107191617-1a15be271d1d // indirect
-	sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
-	sigs.k8s.io/yaml v1.3.0 // indirect
+	k8s.io/apiserver v0.33.3 // indirect
+	k8s.io/code-generator v0.33.3 // indirect
+	k8s.io/component-base v0.33.3 // indirect
+	k8s.io/gengo/v2 v2.0.0-20250513215321-e3bc6f1e78b4 // indirect
+	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
+	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
+	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
 )
diff --git a/go.sum b/go.sum
index f162530d8..04ebd386b 100644
--- a/go.sum
+++ b/go.sum
@@ -1,157 +1,89 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+cel.dev/expr v0.19.1 h1:NciYrtDRIR0lNCnH1LFJegdjspNx9fI59O7TWcua/W4=
+cel.dev/expr v0.19.1/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
+github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
+github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
+github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
+github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
-github.com/emicklei/go-restful/v3 v3.9.0 h1:XwGDlfxEnQZzuopoqxwSEllNcCOM9DhhFyhFIIGKwxE=
-github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
-github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
-github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
-github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonreference v0.20.0 h1:MYlu0sBgChmCfJxxUKZ8g1cPWFOB37YSZqewK7OKeyA=
-github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo=
-github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
-github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng=
-github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/emicklei/go-restful/v3 v3.12.1 h1:PJMDIM/ak7btuL8Ex0iYET9hxM3CI2sjZtzpL63nKAU=
+github.com/emicklei/go-restful/v3 v3.12.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/gnostic v0.5.7-v3refs h1:FhTMOKj2VhjpouxvWJAV1TL304uMlb9zcDqkl6cEI54=
-github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
+github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+github.com/google/cel-go v0.23.2 h1:UdEe3CvQh3Nv+E/j9r1Y//WO0K0cSyD7/y0bzyLIMI4=
+github.com/google/cel-go v0.23.2/go.mod h1:52Pb6QsDbC5kvgxvZhiL9QX1oZEkcUF/ZqaPx1J5Wwo=
+github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw=
+github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
-github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/uuid v1.1.2 h1:EVhdT+1Kseyi1/pUmXKaFxYsDNy9RQYkMWRH68J/W7Y=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 h1:TmHmbvxPmaegwhDubVz0lICL0J5Ka2vwTzhoePEXsGE=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0/go.mod h1:qztMSjm835F2bXf+5HKAPIS5qsmQDqZna/PgVt4rWtI=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/kcp-dev/apimachinery/v2 v2.0.0-alpha.0.0.20230316191847-bf339f5f182b h1:9Cie1jjhL69evhYHjQGkOvXZGS2MmUH42j52cmWblIk=
-github.com/kcp-dev/apimachinery/v2 v2.0.0-alpha.0.0.20230316191847-bf339f5f182b/go.mod h1:fRQhHYtVPX/caTBSDUh7Lx+Zoy9uDkvtz77O8zJTiRw=
-github.com/kcp-dev/apimachinery/v2 v2.0.0-alpha.0.0.20230316194741-cdd788144662 h1:hkO1BsomYCGNJ3W4/7azsQ2CyRORDdDfpMwOBWKIl8k=
-github.com/kcp-dev/apimachinery/v2 v2.0.0-alpha.0.0.20230316194741-cdd788144662/go.mod h1:fRQhHYtVPX/caTBSDUh7Lx+Zoy9uDkvtz77O8zJTiRw=
-github.com/kcp-dev/logicalcluster/v3 v3.0.4 h1:q7KngML/QM7sWl8aVzmfZF0TPMnBwYNxsPKfwUvvBvU=
-github.com/kcp-dev/logicalcluster/v3 v3.0.4/go.mod h1:EWBUBxdr49fUB1cLMO4nOdBWmYifLbP1LfoL20KkXYY=
+github.com/kcp-dev/apimachinery/v2 v2.28.1-0.20251017134924-175b5bf68c05 h1:OXlSH4pLrEN0t5EbxBSGKu+GbnVvmTyuYoDZzc3r09o=
+github.com/kcp-dev/apimachinery/v2 v2.28.1-0.20251017134924-175b5bf68c05/go.mod h1:rF1jfvUfPjFXs+HV/LN1BtPzAz1bfjJOwVa+hAVfroQ=
+github.com/kcp-dev/code-generator/v3 v3.28.1-0.20251017134924-c023ef289dfc h1:eUnj8Mt1YfvRNys4VRJe3hQaTYq0pwQ3Nd6vP8/9xBk=
+github.com/kcp-dev/code-generator/v3 v3.28.1-0.20251017134924-c023ef289dfc/go.mod h1:PZBfAWJtztxgGCiIjH+txB7aZbMBUOCN5HFms7h7CwE=
+github.com/kcp-dev/logicalcluster/v3 v3.0.5 h1:JbYakokb+5Uinz09oTXomSUJVQsqfxEvU4RyHUYxHOU=
+github.com/kcp-dev/logicalcluster/v3 v3.0.5/go.mod h1:EWBUBxdr49fUB1cLMO4nOdBWmYifLbP1LfoL20KkXYY=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA=
-github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -159,327 +91,174 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/onsi/ginkgo/v2 v2.4.0 h1:+Ig9nvqgS5OBSACXNk15PLdp0U9XPYROt9CFzVdFGIs=
-github.com/onsi/gomega v1.23.0 h1:/oxKu9c2HVap+F3PfKort2Hw5DEU+HGlW8n+tguWsys=
+github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
+github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
+github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
+github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
+github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
+github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.etcd.io/etcd/api/v3 v3.5.21 h1:A6O2/JDb3tvHhiIz3xf9nJ7REHvtEFJJ3veW3FbCnS8=
+go.etcd.io/etcd/api/v3 v3.5.21/go.mod h1:c3aH5wcvXv/9dqIw2Y810LDXJfhSYdHQ0vxmP3CCHVY=
+go.etcd.io/etcd/client/pkg/v3 v3.5.21 h1:lPBu71Y7osQmzlflM9OfeIV2JlmpBjqBNlLtcoBqUTc=
+go.etcd.io/etcd/client/pkg/v3 v3.5.21/go.mod h1:BgqT/IXPjK9NkeSDjbzwsHySX3yIle2+ndz28nVsjUs=
+go.etcd.io/etcd/client/v3 v3.5.21 h1:T6b1Ow6fNjOLOtM0xSoKNQt1ASPCLWrF9XMHcH9pEyY=
+go.etcd.io/etcd/client/v3 v3.5.21/go.mod h1:mFYy67IOqmbRf/kRUvsHixzo3iG+1OF2W2+jVIQRAnU=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0 h1:PS8wXpbyaDJQ2VDHHncMe9Vct0Zn1fEjpsjrLxGJoSc=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0/go.mod h1:HDBUsEjOuRC0EzKZ1bSaRGZWUBAzo+MhAcUUORSr4D0=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
+go.opentelemetry.io/otel v1.33.0 h1:/FerN9bax5LoK51X/sI0SVYrjSE0/yUL7DpxW4K3FWw=
+go.opentelemetry.io/otel v1.33.0/go.mod h1:SUUkR6csvUQl+yjReHu5uM3EtVV7MBm5FHKRlNx4I8I=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 h1:Vh5HayB/0HHfOQA7Ctx69E/Y/DcQSMPpKANYVMQ7fBA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0/go.mod h1:cpgtDBaqD/6ok/UG0jT15/uKjAY8mRA53diogHBg3UI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 h1:5pojmb1U1AogINhN3SurB+zm/nIcusopeBNp42f45QM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0/go.mod h1:57gTHJSE5S1tqg+EKsLPlTWhpHMsWlVmer+LA926XiA=
+go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5WtEnklQ=
+go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
+go.opentelemetry.io/otel/sdk v1.33.0 h1:iax7M131HuAm9QkZotNHEfstof92xM+N8sr3uHXc2IM=
+go.opentelemetry.io/otel/sdk v1.33.0/go.mod h1:A1Q5oi7/9XaMlIWzPSxLRWOI8nG3FnzHJNbiENQuihM=
+go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4JjxTeYusH7zMc=
+go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
+go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
+go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
+go.opentelemetry.io/proto/otlp v1.4.0 h1:TA9WRvW6zMwP+Ssb6fLoUIuirti1gGbP28GcKG1jgeg=
+go.opentelemetry.io/proto/otlp v1.4.0/go.mod h1:PPBWZIP98o2ElSqI35IHfu7hIhSwvc5N38Jw8pXuGFY=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 h1:yqrTHse8TCMW1M1ZCP+VAR/l0kKxwaAIqN/il7x4voA=
+golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8/go.mod h1:tujkw807nyEEAamNbDrEGzRav+ilXA7PCRAd6xsmwiU=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b h1:clP8eMhB30EHdc0bd2Twtq6kgU7yl5ub2cQLSdrv1Dg=
-golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
+golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
+golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
+golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0 h1:n2a8QNdAb0sZNpU9R1ALUXBbY+w51fCQDN+7EdxNBsY=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
+golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
-golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
+golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
+golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
+golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
+golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 h1:CkkIfIt50+lT6NHAVoRYEyAvQGFM7xEwXUUywFvEb3Q=
+google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
+google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-k8s.io/api v0.26.2 h1:dM3cinp3PGB6asOySalOZxEG4CZ0IAdJsrYZXE/ovGQ=
-k8s.io/api v0.26.2/go.mod h1:1kjMQsFE+QHPfskEcVNgL3+Hp88B80uj0QtSOlj8itU=
-k8s.io/apimachinery v0.26.2 h1:da1u3D5wfR5u2RpLhE/ZtZS2P7QvDgLZTi9wrNZl/tQ=
-k8s.io/apimachinery v0.26.2/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I=
-k8s.io/client-go v0.26.2 h1:s1WkVujHX3kTp4Zn4yGNFK+dlDXy1bAAkIl+cFAiuYI=
-k8s.io/client-go v0.26.2/go.mod h1:u5EjOuSyBa09yqqyY7m3abZeovO/7D/WehVVlZ2qcqU=
-k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4=
-k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E=
-k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
-k8s.io/utils v0.0.0-20221107191617-1a15be271d1d h1:0Smp/HP1OH4Rvhe+4B8nWGERtlqAGSftbSbbmm45oFs=
-k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k=
-sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
-sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
-sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
+k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
+k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
+k8s.io/apiextensions-apiserver v0.33.3 h1:qmOcAHN6DjfD0v9kxL5udB27SRP6SG/MTopmge3MwEs=
+k8s.io/apiextensions-apiserver v0.33.3/go.mod h1:oROuctgo27mUsyp9+Obahos6CWcMISSAPzQ77CAQGz8=
+k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
+k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
+k8s.io/apiserver v0.33.3 h1:Wv0hGc+QFdMJB4ZSiHrCgN3zL3QRatu56+rpccKC3J4=
+k8s.io/apiserver v0.33.3/go.mod h1:05632ifFEe6TxwjdAIrwINHWE2hLwyADFk5mBsQa15E=
+k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
+k8s.io/client-go v0.33.3/go.mod h1:luqKBQggEf3shbxHY4uVENAxrDISLOarxpTKMiUuujg=
+k8s.io/code-generator v0.33.3 h1:6+34LhYkIuQ/yn/E3qlpVqjQaP8smzCu4NE1A8b0LWs=
+k8s.io/code-generator v0.33.3/go.mod h1:6Y02+HQJYgNphv9z3wJB5w+sjYDIEBQW7sh62PkufvA=
+k8s.io/component-base v0.33.3 h1:mlAuyJqyPlKZM7FyaoM/LcunZaaY353RXiOd2+B5tGA=
+k8s.io/component-base v0.33.3/go.mod h1:ktBVsBzkI3imDuxYXmVxZ2zxJnYTZ4HAsVj9iF09qp4=
+k8s.io/gengo/v2 v2.0.0-20250513215321-e3bc6f1e78b4 h1:iicENHE63xPBlGQeany8LqrH40Wh/48QhMRI/mGVsqA=
+k8s.io/gengo/v2 v2.0.0-20250513215321-e3bc6f1e78b4/go.mod h1:EJykeLsmFC60UQbYJezXkEsG2FLrt0GPNkU5iK5GWxU=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=
+k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
+sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v4 v4.6.0 h1:IUA9nvMmnKWcj5jl84xn+T5MnlZKThmUW1TdblaLVAc=
+sigs.k8s.io/structured-merge-diff/v4 v4.6.0/go.mod h1:dDy58f92j70zLsuZVuUX5Wp9vtxXpaZnkPGWeqDfCps=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
diff --git a/hack/boilerplate/boilerplate.Dockerfile.txt b/hack/boilerplate/boilerplate.Dockerfile.txt
deleted file mode 100644
index 16845c7fe..000000000
--- a/hack/boilerplate/boilerplate.Dockerfile.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright YEAR The KCP Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
diff --git a/hack/boilerplate/boilerplate.Makefile.txt b/hack/boilerplate/boilerplate.Makefile.txt
deleted file mode 100644
index 16845c7fe..000000000
--- a/hack/boilerplate/boilerplate.Makefile.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright YEAR The KCP Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
diff --git a/hack/boilerplate/boilerplate.py.txt b/hack/boilerplate/boilerplate.py.txt
deleted file mode 100644
index 16845c7fe..000000000
--- a/hack/boilerplate/boilerplate.py.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright YEAR The KCP Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
diff --git a/hack/boilerplate/boilerplate.sh.txt b/hack/boilerplate/boilerplate.sh.txt
deleted file mode 100644
index 16845c7fe..000000000
--- a/hack/boilerplate/boilerplate.sh.txt
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright YEAR The KCP Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
diff --git a/hack/go-install.sh b/hack/go-install.sh
deleted file mode 100755
index 1b1bcb361..000000000
--- a/hack/go-install.sh
+++ /dev/null
@@ -1,62 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright 2022 The KCP Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Originally copied from
-# https://github.com/kubernetes-sigs/cluster-api-provider-gcp/blob/c26a68b23e9317323d5d37660fe9d29b3d2ff40c/scripts/go_install.sh
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-if [[ -z "${1:-}" ]]; then
-  echo "must provide module as first parameter"
-  exit 1
-fi
-
-if [[ -z "${2:-}" ]]; then
-  echo "must provide binary name as second parameter"
-  exit 1
-fi
-
-if [[ -z "${3:-}" ]]; then
-  echo "must provide version as third parameter"
-  exit 1
-fi
-
-if [[ -z "${GOBIN:-}" ]]; then
-  echo "GOBIN is not set. Must set GOBIN to install the bin in a specified directory."
-  exit 1
-fi
-
-mkdir -p "${GOBIN}"
-
-tmp_dir=$(mktemp -d -t goinstall_XXXXXXXXXX)
-function clean {
-  rm -rf "${tmp_dir}"
-}
-trap clean EXIT
-
-rm "${GOBIN}/${2}"* > /dev/null 2>&1 || true
-
-cd "${tmp_dir}"
-
-# create a new module in the tmp directory
-go mod init fake/mod
-
-# install the golang module specified as the first argument
-go install -tags tools "${1}@${3}"
-mv "${GOBIN}/${2}" "${GOBIN}/${2}-${3}"
-ln -sf "${GOBIN}/${2}-${3}" "${GOBIN}/${2}"
\ No newline at end of file
diff --git a/hack/populate-copies.sh b/hack/populate-copies.sh
index 315db134d..7471f8639 100755
--- a/hack/populate-copies.sh
+++ b/hack/populate-copies.sh
@@ -17,6 +17,7 @@
 set -o errexit
 set -o nounset
 set -o pipefail
+set -o xtrace
 
 # This script populates our third_party directory, along with any other files we're
 # wholesale copying from the upstream k8s.io/client-go repository. All files retain
@@ -24,42 +25,59 @@ set -o pipefail
 
 source_dir="$( go list -m -json k8s.io/client-go | jq --raw-output .Dir )"
 
-sink_dir="./third_party/k8s.io/client-go/dynamic/"
-mkdir -p "${sink_dir}"
-for file in scheme simple; do
-  cp "${source_dir}/dynamic/${file}.go" "${sink_dir}"
-done
+update_copy() {
+    local upstream_file="$1"
+    if [[ ! -f "$upstream_file" ]]; then
+        echo "Upstream file $upstream_file does not exist, skipping"
+        return
+    fi
+    local local_file="$2"
+    shift 2
+    # TODO could look into making this a go command and then use the AST
+    # to make intelligent transformations.
+    # E.g. the types are somewhat deterministic from `fakeX` to `scopedX`
+    # On the other hand that is a lot of work to save a few seconds once
+    # every few months.
+    sed \
+        -e '/Copyright .* The Kubernetes Authors./a \
+Modifications Copyright YEAR The KCP Authors.' \
+        "$@" \
+        "$upstream_file" > "$local_file"
+}
 
-sink_dir="./third_party/k8s.io/client-go/tools/cache"
-mkdir -p "${sink_dir}"
-cp "${source_dir}/tools/cache/mutation_cache.go" "${sink_dir}/mutation_cache.go"
 
-sink_dir="./third_party/k8s.io/client-go/testing/"
-mkdir -p "${sink_dir}"
-for file in actions fake fixture interface; do
-  cp "${source_dir}/testing/${file}.go" "${sink_dir}"
-done
+update_third_party() {
+    for third_party in $(find third_party/k8s.io/client-go -type f); do
+        update_copy \
+            "$source_dir/${third_party##third_party/k8s.io/client-go/}" \
+            "$third_party" \
+            -e 's#"k8s.io/client-go/testing"#kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"#' \
+            -e 's# testing\.#kcptesting.#' \
+            -e 's#*testing\.#*kcptesting.#'
 
-sink_dir="./third_party/k8s.io/client-go/discovery/fake"
-mkdir -p "${sink_dir}"
-cp "${source_dir}/discovery/fake/discovery.go" "${sink_dir}"
+    done
+}
 
-sink_dir="./third_party/k8s.io/client-go/metadata/fake"
-mkdir -p "${sink_dir}"
-cp "${source_dir}/metadata/fake/simple.go" "${sink_dir}"
+update_expansion() {
+    local upstream_file="$1"
+    shift 1
+    if [[ ! -f "$upstream_file" ]]; then
+        echo "Upstream file $upstream_file does not exist, skipping"
+        return
+    fi
+    local local_equivalent="${upstream_file##$source_dir/}"
+    update_copy "$upstream_file" "$local_equivalent" "$@"
+}
 
-sink_dir="./third_party/k8s.io/client-go/dynamic/fake"
-mkdir -p "${sink_dir}"
-cp "${source_dir}/dynamic/fake/simple.go" "${sink_dir}"
+update_expansions() {
+    for expansion in $(find "${source_dir}/listers" -type f -name '*_expansion.go'); do
+        update_expansion "$expansion"
+    done
+    for expansion in $(find "${source_dir}/kubernetes" -type f -name 'fake_*_expansion.go'); do
+        update_expansion "$expansion" \
+            -e 's#"k8s.io/client-go/testing"#"github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"#'
+    done
+}
 
-for expansion in $( find "${source_dir}/listers" -type f -name '*_expansion.go' ); do
-  sink="./${expansion##"${source_dir}/"}"
-  mkdir -p "$( dirname "${sink}" )"
-  cp "${expansion}" "${sink}"
-done
-
-for expansion in $( find "${source_dir}/kubernetes" -type f -name 'fake_*_expansion.go' ); do
-  sink="./${expansion##"${source_dir}/"}"
-  mkdir -p "$( dirname "${sink}" )"
-  cp "${expansion}" "${sink}"
-done
\ No newline at end of file
+update_third_party
+update_expansions
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index 9c2f6b8da..200e1dea8 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -19,14 +19,38 @@ set -o nounset
 set -o pipefail
 set -o xtrace
 
-if [[ -z "${MAKELEVEL:-}" ]]; then
-    echo 'You must invoke this script via make'
-    exit 1
-fi
+CODEGEN_PKG="$(go list -f '{{.Dir}}' -m k8s.io/code-generator)"
+source "$CODEGEN_PKG/kube_codegen.sh"
 
-${CODE_GENERATOR} \
-  "client:externalOnly=true,standalone=true,outputPackagePath=github.com/kcp-dev/client-go,name=kubernetes,apiPackagePath=k8s.io/api,singleClusterClientPackagePath=k8s.io/client-go/kubernetes,singleClusterApplyConfigurationsPackagePath=k8s.io/client-go/applyconfigurations,headerFile=./hack/boilerplate/boilerplate.go.txt" \
-  "lister:apiPackagePath=k8s.io/api,singleClusterListerPackagePath=k8s.io/client-go/listers,headerFile=./hack/boilerplate/boilerplate.go.txt" \
-  "informer:clientsetName=kubernetes,externalOnly=true,standalone=true,outputPackagePath=github.com/kcp-dev/client-go,apiPackagePath=k8s.io/api,singleClusterClientPackagePath=k8s.io/client-go/kubernetes, singleClusterListerPackagePath=k8s.io/client-go/listers,singleClusterInformerPackagePath=k8s.io/client-go/informers,headerFile=./hack/boilerplate/boilerplate.go.txt" \
-  "paths=$( go list -m -json k8s.io/api | jq --raw-output .Dir )/..." \
-  "output:dir=./"
+CLUSTER_CODEGEN_PKG="$(go list -f '{{.Dir}}' -m github.com/kcp-dev/code-generator/v3)"
+source "$CLUSTER_CODEGEN_PKG/cluster_codegen.sh"
+
+make clean-generated
+
+cluster::codegen::gen_client \
+    --boilerplate ./hack/boilerplate/boilerplate.go.txt \
+    --with-watch \
+    --output-dir . \
+    --output-pkg github.com/kcp-dev/client-go \
+    --versioned-clientset-dir kubernetes \
+    --versioned-clientset-pkg github.com/kcp-dev/client-go/kubernetes \
+    --single-cluster-versioned-clientset-pkg k8s.io/client-go/kubernetes \
+    --single-cluster-applyconfigurations-pkg k8s.io/client-go/applyconfigurations \
+    --single-cluster-informers-pkg k8s.io/client-go/informers \
+    --single-cluster-listers-pkg k8s.io/client-go/listers \
+    --exclude-group-versions "imagepolicy/v1alpha1" \
+    --plural-exceptions "Endpoints:Endpoints" \
+    "$(go list -m -json k8s.io/api | jq --raw-output .Dir)"
+
+cluster::codegen::gen_client \
+    --boilerplate ./hack/boilerplate/boilerplate.go.txt \
+    --output-dir apiextensions \
+    --output-pkg github.com/kcp-dev/client-go/apiextensions \
+    --with-watch \
+    --versioned-clientset-pkg github.com/kcp-dev/client-go/apiextensions/client \
+    --versioned-clientset-dir apiextensions/client \
+    --single-cluster-versioned-clientset-pkg k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset \
+    --single-cluster-applyconfigurations-pkg k8s.io/apiextensions-apiserver/pkg/client/applyconfiguration \
+    --single-cluster-informers-pkg k8s.io/apiextensions-apiserver/pkg/client/informers/externalversions \
+    --single-cluster-listers-pkg k8s.io/apiextensions-apiserver/pkg/client/listers \
+    "$(go list -m -json k8s.io/apiextensions-apiserver | jq --raw-output .Dir)/pkg/apis"
diff --git a/informers/admissionregistration/interface.go b/informers/admissionregistration/interface.go
index 3aa2c4c5e..bd62b673e 100644
--- a/informers/admissionregistration/interface.go
+++ b/informers/admissionregistration/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,47 +14,48 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package admissionregistration
 
 import (
-	"github.com/kcp-dev/client-go/informers/admissionregistration/v1"
-	"github.com/kcp-dev/client-go/informers/admissionregistration/v1alpha1"
-	"github.com/kcp-dev/client-go/informers/admissionregistration/v1beta1"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/admissionregistration/v1"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/informers/admissionregistration/v1alpha1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/admissionregistration/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1alpha1 provides access to the shared informers in V1alpha1.
-	V1alpha1() v1alpha1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() kcpv1alpha1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V1alpha1 returns a new v1alpha1.ClusterInterface.
-func (g *group) V1alpha1() v1alpha1.ClusterInterface {
-	return v1alpha1.New(g.factory, g.tweakListOptions)
+// V1alpha1 returns a new kcpv1alpha1.ClusterInterface.
+func (g *group) V1alpha1() kcpv1alpha1.ClusterInterface {
+	return kcpv1alpha1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/admissionregistration/v1/interface.go b/informers/admissionregistration/v1/interface.go
index 9ca728c5f..b99bed489 100644
--- a/informers/admissionregistration/v1/interface.go
+++ b/informers/admissionregistration/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,37 +14,51 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// ValidatingWebhookConfigurations returns a ValidatingWebhookConfigurationClusterInformer
-	ValidatingWebhookConfigurations() ValidatingWebhookConfigurationClusterInformer
-	// MutatingWebhookConfigurations returns a MutatingWebhookConfigurationClusterInformer
+	// MutatingWebhookConfigurations returns a MutatingWebhookConfigurationClusterInformer.
 	MutatingWebhookConfigurations() MutatingWebhookConfigurationClusterInformer
+	// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyClusterInformer.
+	ValidatingAdmissionPolicies() ValidatingAdmissionPolicyClusterInformer
+	// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingClusterInformer.
+	ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingClusterInformer
+	// ValidatingWebhookConfigurations returns a ValidatingWebhookConfigurationClusterInformer.
+	ValidatingWebhookConfigurations() ValidatingWebhookConfigurationClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// ValidatingWebhookConfigurations returns a ValidatingWebhookConfigurationClusterInformer
-func (v *version) ValidatingWebhookConfigurations() ValidatingWebhookConfigurationClusterInformer {
-	return &validatingWebhookConfigurationClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// MutatingWebhookConfigurations returns a MutatingWebhookConfigurationClusterInformer
+// MutatingWebhookConfigurations returns a MutatingWebhookConfigurationClusterInformer.
 func (v *version) MutatingWebhookConfigurations() MutatingWebhookConfigurationClusterInformer {
 	return &mutatingWebhookConfigurationClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyClusterInformer.
+func (v *version) ValidatingAdmissionPolicies() ValidatingAdmissionPolicyClusterInformer {
+	return &validatingAdmissionPolicyClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingClusterInformer.
+func (v *version) ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingClusterInformer {
+	return &validatingAdmissionPolicyBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ValidatingWebhookConfigurations returns a ValidatingWebhookConfigurationClusterInformer.
+func (v *version) ValidatingWebhookConfigurations() ValidatingWebhookConfigurationClusterInformer {
+	return &validatingWebhookConfigurationClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/admissionregistration/v1/mutatingwebhookconfiguration.go b/informers/admissionregistration/v1/mutatingwebhookconfiguration.go
index 63974b194..ae2f4a766 100644
--- a/informers/admissionregistration/v1/mutatingwebhookconfiguration.go
+++ b/informers/admissionregistration/v1/mutatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiadmissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1 "k8s.io/client-go/informers/admissionregistration/v1"
+	listersadmissionregistrationv1 "k8s.io/client-go/listers/admissionregistration/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamadmissionregistrationv1informers "k8s.io/client-go/informers/admissionregistration/v1"
-	upstreamadmissionregistrationv1listers "k8s.io/client-go/listers/admissionregistration/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	admissionregistrationv1listers "github.com/kcp-dev/client-go/listers/admissionregistration/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/admissionregistration/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // MutatingWebhookConfigurationClusterInformer provides access to a shared informer and lister for
 // MutatingWebhookConfigurations.
 type MutatingWebhookConfigurationClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamadmissionregistrationv1informers.MutatingWebhookConfigurationInformer
+	Cluster(logicalcluster.Name) admissionregistrationv1.MutatingWebhookConfigurationInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) admissionregistrationv1.MutatingWebhookConfigurationInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() admissionregistrationv1listers.MutatingWebhookConfigurationClusterLister
+	Lister() kcpv1.MutatingWebhookConfigurationClusterLister
 }
 
 type mutatingWebhookConfigurationClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewMutatingWebhookConfigurationClusterInformer constructs a new informer for MutatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewMutatingWebhookConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewMutatingWebhookConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredMutatingWebhookConfigurationClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredMutatingWebhookConfigurationClusterInformer constructs a new informer for MutatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredMutatingWebhookConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredMutatingWebhookConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AdmissionregistrationV1().MutatingWebhookConfigurations().List(context.TODO(), options)
+				return client.AdmissionregistrationV1().MutatingWebhookConfigurations().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AdmissionregistrationV1().MutatingWebhookConfigurations().Watch(context.TODO(), options)
+				return client.AdmissionregistrationV1().MutatingWebhookConfigurations().Watch(context.Background(), options)
 			},
 		},
-		&admissionregistrationv1.MutatingWebhookConfiguration{},
+		&apiadmissionregistrationv1.MutatingWebhookConfiguration{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *mutatingWebhookConfigurationClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *mutatingWebhookConfigurationClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredMutatingWebhookConfigurationClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *mutatingWebhookConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiadmissionregistrationv1.MutatingWebhookConfiguration{}, i.defaultInformer)
 }
 
-func (f *mutatingWebhookConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&admissionregistrationv1.MutatingWebhookConfiguration{}, f.defaultInformer)
+func (i *mutatingWebhookConfigurationClusterInformer) Lister() kcpv1.MutatingWebhookConfigurationClusterLister {
+	return kcpv1.NewMutatingWebhookConfigurationClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *mutatingWebhookConfigurationClusterInformer) Lister() admissionregistrationv1listers.MutatingWebhookConfigurationClusterLister {
-	return admissionregistrationv1listers.NewMutatingWebhookConfigurationClusterLister(f.Informer().GetIndexer())
+func (i *mutatingWebhookConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) admissionregistrationv1.MutatingWebhookConfigurationInformer {
+	return &mutatingWebhookConfigurationInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *mutatingWebhookConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamadmissionregistrationv1informers.MutatingWebhookConfigurationInformer {
+func (i *mutatingWebhookConfigurationClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) admissionregistrationv1.MutatingWebhookConfigurationInformer {
 	return &mutatingWebhookConfigurationInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type mutatingWebhookConfigurationInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamadmissionregistrationv1listers.MutatingWebhookConfigurationLister
+	lister   listersadmissionregistrationv1.MutatingWebhookConfigurationLister
 }
 
-func (f *mutatingWebhookConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *mutatingWebhookConfigurationInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *mutatingWebhookConfigurationInformer) Lister() upstreamadmissionregistrationv1listers.MutatingWebhookConfigurationLister {
-	return f.lister
+func (i *mutatingWebhookConfigurationInformer) Lister() listersadmissionregistrationv1.MutatingWebhookConfigurationLister {
+	return i.lister
 }
diff --git a/informers/admissionregistration/v1/validatingadmissionpolicy.go b/informers/admissionregistration/v1/validatingadmissionpolicy.go
new file mode 100644
index 000000000..26ccc2df0
--- /dev/null
+++ b/informers/admissionregistration/v1/validatingadmissionpolicy.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	apiadmissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1 "k8s.io/client-go/informers/admissionregistration/v1"
+	listersadmissionregistrationv1 "k8s.io/client-go/listers/admissionregistration/v1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/admissionregistration/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ValidatingAdmissionPolicyClusterInformer provides access to a shared informer and lister for
+// ValidatingAdmissionPolicies.
+type ValidatingAdmissionPolicyClusterInformer interface {
+	Cluster(logicalcluster.Name) admissionregistrationv1.ValidatingAdmissionPolicyInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) admissionregistrationv1.ValidatingAdmissionPolicyInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1.ValidatingAdmissionPolicyClusterLister
+}
+
+type validatingAdmissionPolicyClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewValidatingAdmissionPolicyClusterInformer constructs a new informer for ValidatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewValidatingAdmissionPolicyClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredValidatingAdmissionPolicyClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredValidatingAdmissionPolicyClusterInformer constructs a new informer for ValidatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredValidatingAdmissionPolicyClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AdmissionregistrationV1().ValidatingAdmissionPolicies().List(context.Background(), options)
+			},
+			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AdmissionregistrationV1().ValidatingAdmissionPolicies().Watch(context.Background(), options)
+			},
+		},
+		&apiadmissionregistrationv1.ValidatingAdmissionPolicy{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *validatingAdmissionPolicyClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredValidatingAdmissionPolicyClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *validatingAdmissionPolicyClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiadmissionregistrationv1.ValidatingAdmissionPolicy{}, i.defaultInformer)
+}
+
+func (i *validatingAdmissionPolicyClusterInformer) Lister() kcpv1.ValidatingAdmissionPolicyClusterLister {
+	return kcpv1.NewValidatingAdmissionPolicyClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *validatingAdmissionPolicyClusterInformer) Cluster(clusterName logicalcluster.Name) admissionregistrationv1.ValidatingAdmissionPolicyInformer {
+	return &validatingAdmissionPolicyInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *validatingAdmissionPolicyClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) admissionregistrationv1.ValidatingAdmissionPolicyInformer {
+	return &validatingAdmissionPolicyInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type validatingAdmissionPolicyInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersadmissionregistrationv1.ValidatingAdmissionPolicyLister
+}
+
+func (i *validatingAdmissionPolicyInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *validatingAdmissionPolicyInformer) Lister() listersadmissionregistrationv1.ValidatingAdmissionPolicyLister {
+	return i.lister
+}
diff --git a/informers/admissionregistration/v1/validatingadmissionpolicybinding.go b/informers/admissionregistration/v1/validatingadmissionpolicybinding.go
new file mode 100644
index 000000000..d15b955df
--- /dev/null
+++ b/informers/admissionregistration/v1/validatingadmissionpolicybinding.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	apiadmissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1 "k8s.io/client-go/informers/admissionregistration/v1"
+	listersadmissionregistrationv1 "k8s.io/client-go/listers/admissionregistration/v1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/admissionregistration/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ValidatingAdmissionPolicyBindingClusterInformer provides access to a shared informer and lister for
+// ValidatingAdmissionPolicyBindings.
+type ValidatingAdmissionPolicyBindingClusterInformer interface {
+	Cluster(logicalcluster.Name) admissionregistrationv1.ValidatingAdmissionPolicyBindingInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) admissionregistrationv1.ValidatingAdmissionPolicyBindingInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1.ValidatingAdmissionPolicyBindingClusterLister
+}
+
+type validatingAdmissionPolicyBindingClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewValidatingAdmissionPolicyBindingClusterInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewValidatingAdmissionPolicyBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredValidatingAdmissionPolicyBindingClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredValidatingAdmissionPolicyBindingClusterInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredValidatingAdmissionPolicyBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AdmissionregistrationV1().ValidatingAdmissionPolicyBindings().List(context.Background(), options)
+			},
+			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AdmissionregistrationV1().ValidatingAdmissionPolicyBindings().Watch(context.Background(), options)
+			},
+		},
+		&apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *validatingAdmissionPolicyBindingClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredValidatingAdmissionPolicyBindingClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *validatingAdmissionPolicyBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiadmissionregistrationv1.ValidatingAdmissionPolicyBinding{}, i.defaultInformer)
+}
+
+func (i *validatingAdmissionPolicyBindingClusterInformer) Lister() kcpv1.ValidatingAdmissionPolicyBindingClusterLister {
+	return kcpv1.NewValidatingAdmissionPolicyBindingClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *validatingAdmissionPolicyBindingClusterInformer) Cluster(clusterName logicalcluster.Name) admissionregistrationv1.ValidatingAdmissionPolicyBindingInformer {
+	return &validatingAdmissionPolicyBindingInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *validatingAdmissionPolicyBindingClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) admissionregistrationv1.ValidatingAdmissionPolicyBindingInformer {
+	return &validatingAdmissionPolicyBindingInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type validatingAdmissionPolicyBindingInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersadmissionregistrationv1.ValidatingAdmissionPolicyBindingLister
+}
+
+func (i *validatingAdmissionPolicyBindingInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *validatingAdmissionPolicyBindingInformer) Lister() listersadmissionregistrationv1.ValidatingAdmissionPolicyBindingLister {
+	return i.lister
+}
diff --git a/informers/admissionregistration/v1/validatingwebhookconfiguration.go b/informers/admissionregistration/v1/validatingwebhookconfiguration.go
index 59bf0a311..a0ee9d162 100644
--- a/informers/admissionregistration/v1/validatingwebhookconfiguration.go
+++ b/informers/admissionregistration/v1/validatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiadmissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1 "k8s.io/client-go/informers/admissionregistration/v1"
+	listersadmissionregistrationv1 "k8s.io/client-go/listers/admissionregistration/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamadmissionregistrationv1informers "k8s.io/client-go/informers/admissionregistration/v1"
-	upstreamadmissionregistrationv1listers "k8s.io/client-go/listers/admissionregistration/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	admissionregistrationv1listers "github.com/kcp-dev/client-go/listers/admissionregistration/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/admissionregistration/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ValidatingWebhookConfigurationClusterInformer provides access to a shared informer and lister for
 // ValidatingWebhookConfigurations.
 type ValidatingWebhookConfigurationClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamadmissionregistrationv1informers.ValidatingWebhookConfigurationInformer
+	Cluster(logicalcluster.Name) admissionregistrationv1.ValidatingWebhookConfigurationInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) admissionregistrationv1.ValidatingWebhookConfigurationInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() admissionregistrationv1listers.ValidatingWebhookConfigurationClusterLister
+	Lister() kcpv1.ValidatingWebhookConfigurationClusterLister
 }
 
 type validatingWebhookConfigurationClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewValidatingWebhookConfigurationClusterInformer constructs a new informer for ValidatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewValidatingWebhookConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewValidatingWebhookConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredValidatingWebhookConfigurationClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredValidatingWebhookConfigurationClusterInformer constructs a new informer for ValidatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredValidatingWebhookConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredValidatingWebhookConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AdmissionregistrationV1().ValidatingWebhookConfigurations().List(context.TODO(), options)
+				return client.AdmissionregistrationV1().ValidatingWebhookConfigurations().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AdmissionregistrationV1().ValidatingWebhookConfigurations().Watch(context.TODO(), options)
+				return client.AdmissionregistrationV1().ValidatingWebhookConfigurations().Watch(context.Background(), options)
 			},
 		},
-		&admissionregistrationv1.ValidatingWebhookConfiguration{},
+		&apiadmissionregistrationv1.ValidatingWebhookConfiguration{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *validatingWebhookConfigurationClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *validatingWebhookConfigurationClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredValidatingWebhookConfigurationClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *validatingWebhookConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiadmissionregistrationv1.ValidatingWebhookConfiguration{}, i.defaultInformer)
 }
 
-func (f *validatingWebhookConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&admissionregistrationv1.ValidatingWebhookConfiguration{}, f.defaultInformer)
+func (i *validatingWebhookConfigurationClusterInformer) Lister() kcpv1.ValidatingWebhookConfigurationClusterLister {
+	return kcpv1.NewValidatingWebhookConfigurationClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *validatingWebhookConfigurationClusterInformer) Lister() admissionregistrationv1listers.ValidatingWebhookConfigurationClusterLister {
-	return admissionregistrationv1listers.NewValidatingWebhookConfigurationClusterLister(f.Informer().GetIndexer())
+func (i *validatingWebhookConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) admissionregistrationv1.ValidatingWebhookConfigurationInformer {
+	return &validatingWebhookConfigurationInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *validatingWebhookConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamadmissionregistrationv1informers.ValidatingWebhookConfigurationInformer {
+func (i *validatingWebhookConfigurationClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) admissionregistrationv1.ValidatingWebhookConfigurationInformer {
 	return &validatingWebhookConfigurationInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type validatingWebhookConfigurationInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamadmissionregistrationv1listers.ValidatingWebhookConfigurationLister
+	lister   listersadmissionregistrationv1.ValidatingWebhookConfigurationLister
 }
 
-func (f *validatingWebhookConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *validatingWebhookConfigurationInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *validatingWebhookConfigurationInformer) Lister() upstreamadmissionregistrationv1listers.ValidatingWebhookConfigurationLister {
-	return f.lister
+func (i *validatingWebhookConfigurationInformer) Lister() listersadmissionregistrationv1.ValidatingWebhookConfigurationLister {
+	return i.lister
 }
diff --git a/informers/admissionregistration/v1alpha1/interface.go b/informers/admissionregistration/v1alpha1/interface.go
index 34be82c73..4ef5057e0 100644
--- a/informers/admissionregistration/v1alpha1/interface.go
+++ b/informers/admissionregistration/v1alpha1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,37 +14,51 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyClusterInformer
+	// MutatingAdmissionPolicies returns a MutatingAdmissionPolicyClusterInformer.
+	MutatingAdmissionPolicies() MutatingAdmissionPolicyClusterInformer
+	// MutatingAdmissionPolicyBindings returns a MutatingAdmissionPolicyBindingClusterInformer.
+	MutatingAdmissionPolicyBindings() MutatingAdmissionPolicyBindingClusterInformer
+	// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyClusterInformer.
 	ValidatingAdmissionPolicies() ValidatingAdmissionPolicyClusterInformer
-	// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingClusterInformer
+	// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingClusterInformer.
 	ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyClusterInformer
+// MutatingAdmissionPolicies returns a MutatingAdmissionPolicyClusterInformer.
+func (v *version) MutatingAdmissionPolicies() MutatingAdmissionPolicyClusterInformer {
+	return &mutatingAdmissionPolicyClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// MutatingAdmissionPolicyBindings returns a MutatingAdmissionPolicyBindingClusterInformer.
+func (v *version) MutatingAdmissionPolicyBindings() MutatingAdmissionPolicyBindingClusterInformer {
+	return &mutatingAdmissionPolicyBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyClusterInformer.
 func (v *version) ValidatingAdmissionPolicies() ValidatingAdmissionPolicyClusterInformer {
 	return &validatingAdmissionPolicyClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingClusterInformer
+// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingClusterInformer.
 func (v *version) ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingClusterInformer {
 	return &validatingAdmissionPolicyBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/admissionregistration/v1alpha1/mutatingadmissionpolicy.go b/informers/admissionregistration/v1alpha1/mutatingadmissionpolicy.go
new file mode 100644
index 000000000..828e9c44d
--- /dev/null
+++ b/informers/admissionregistration/v1alpha1/mutatingadmissionpolicy.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+	time "time"
+
+	apiadmissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1alpha1 "k8s.io/client-go/informers/admissionregistration/v1alpha1"
+	listersadmissionregistrationv1alpha1 "k8s.io/client-go/listers/admissionregistration/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/admissionregistration/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// MutatingAdmissionPolicyClusterInformer provides access to a shared informer and lister for
+// MutatingAdmissionPolicies.
+type MutatingAdmissionPolicyClusterInformer interface {
+	Cluster(logicalcluster.Name) admissionregistrationv1alpha1.MutatingAdmissionPolicyInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) admissionregistrationv1alpha1.MutatingAdmissionPolicyInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha1.MutatingAdmissionPolicyClusterLister
+}
+
+type mutatingAdmissionPolicyClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewMutatingAdmissionPolicyClusterInformer constructs a new informer for MutatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewMutatingAdmissionPolicyClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredMutatingAdmissionPolicyClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredMutatingAdmissionPolicyClusterInformer constructs a new informer for MutatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredMutatingAdmissionPolicyClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AdmissionregistrationV1alpha1().MutatingAdmissionPolicies().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AdmissionregistrationV1alpha1().MutatingAdmissionPolicies().Watch(context.Background(), options)
+			},
+		},
+		&apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *mutatingAdmissionPolicyClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredMutatingAdmissionPolicyClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *mutatingAdmissionPolicyClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiadmissionregistrationv1alpha1.MutatingAdmissionPolicy{}, i.defaultInformer)
+}
+
+func (i *mutatingAdmissionPolicyClusterInformer) Lister() kcpv1alpha1.MutatingAdmissionPolicyClusterLister {
+	return kcpv1alpha1.NewMutatingAdmissionPolicyClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *mutatingAdmissionPolicyClusterInformer) Cluster(clusterName logicalcluster.Name) admissionregistrationv1alpha1.MutatingAdmissionPolicyInformer {
+	return &mutatingAdmissionPolicyInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *mutatingAdmissionPolicyClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) admissionregistrationv1alpha1.MutatingAdmissionPolicyInformer {
+	return &mutatingAdmissionPolicyInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type mutatingAdmissionPolicyInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyLister
+}
+
+func (i *mutatingAdmissionPolicyInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *mutatingAdmissionPolicyInformer) Lister() listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyLister {
+	return i.lister
+}
diff --git a/informers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go b/informers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go
new file mode 100644
index 000000000..78bda5cbc
--- /dev/null
+++ b/informers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+	time "time"
+
+	apiadmissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1alpha1 "k8s.io/client-go/informers/admissionregistration/v1alpha1"
+	listersadmissionregistrationv1alpha1 "k8s.io/client-go/listers/admissionregistration/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/admissionregistration/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// MutatingAdmissionPolicyBindingClusterInformer provides access to a shared informer and lister for
+// MutatingAdmissionPolicyBindings.
+type MutatingAdmissionPolicyBindingClusterInformer interface {
+	Cluster(logicalcluster.Name) admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha1.MutatingAdmissionPolicyBindingClusterLister
+}
+
+type mutatingAdmissionPolicyBindingClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewMutatingAdmissionPolicyBindingClusterInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewMutatingAdmissionPolicyBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredMutatingAdmissionPolicyBindingClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredMutatingAdmissionPolicyBindingClusterInformer constructs a new informer for MutatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredMutatingAdmissionPolicyBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AdmissionregistrationV1alpha1().MutatingAdmissionPolicyBindings().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AdmissionregistrationV1alpha1().MutatingAdmissionPolicyBindings().Watch(context.Background(), options)
+			},
+		},
+		&apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *mutatingAdmissionPolicyBindingClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredMutatingAdmissionPolicyBindingClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *mutatingAdmissionPolicyBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBinding{}, i.defaultInformer)
+}
+
+func (i *mutatingAdmissionPolicyBindingClusterInformer) Lister() kcpv1alpha1.MutatingAdmissionPolicyBindingClusterLister {
+	return kcpv1alpha1.NewMutatingAdmissionPolicyBindingClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *mutatingAdmissionPolicyBindingClusterInformer) Cluster(clusterName logicalcluster.Name) admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingInformer {
+	return &mutatingAdmissionPolicyBindingInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *mutatingAdmissionPolicyBindingClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingInformer {
+	return &mutatingAdmissionPolicyBindingInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type mutatingAdmissionPolicyBindingInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingLister
+}
+
+func (i *mutatingAdmissionPolicyBindingInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *mutatingAdmissionPolicyBindingInformer) Lister() listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingLister {
+	return i.lister
+}
diff --git a/informers/admissionregistration/v1alpha1/validatingadmissionpolicy.go b/informers/admissionregistration/v1alpha1/validatingadmissionpolicy.go
index 34defa66c..4eb40d8f1 100644
--- a/informers/admissionregistration/v1alpha1/validatingadmissionpolicy.go
+++ b/informers/admissionregistration/v1alpha1/validatingadmissionpolicy.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiadmissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1alpha1 "k8s.io/client-go/informers/admissionregistration/v1alpha1"
+	listersadmissionregistrationv1alpha1 "k8s.io/client-go/listers/admissionregistration/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamadmissionregistrationv1alpha1informers "k8s.io/client-go/informers/admissionregistration/v1alpha1"
-	upstreamadmissionregistrationv1alpha1listers "k8s.io/client-go/listers/admissionregistration/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	admissionregistrationv1alpha1listers "github.com/kcp-dev/client-go/listers/admissionregistration/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/admissionregistration/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ValidatingAdmissionPolicyClusterInformer provides access to a shared informer and lister for
 // ValidatingAdmissionPolicies.
 type ValidatingAdmissionPolicyClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamadmissionregistrationv1alpha1informers.ValidatingAdmissionPolicyInformer
+	Cluster(logicalcluster.Name) admissionregistrationv1alpha1.ValidatingAdmissionPolicyInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) admissionregistrationv1alpha1.ValidatingAdmissionPolicyInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() admissionregistrationv1alpha1listers.ValidatingAdmissionPolicyClusterLister
+	Lister() kcpv1alpha1.ValidatingAdmissionPolicyClusterLister
 }
 
 type validatingAdmissionPolicyClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewValidatingAdmissionPolicyClusterInformer constructs a new informer for ValidatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewValidatingAdmissionPolicyClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewValidatingAdmissionPolicyClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredValidatingAdmissionPolicyClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredValidatingAdmissionPolicyClusterInformer constructs a new informer for ValidatingAdmissionPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredValidatingAdmissionPolicyClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredValidatingAdmissionPolicyClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AdmissionregistrationV1alpha1().ValidatingAdmissionPolicies().List(context.TODO(), options)
+				return client.AdmissionregistrationV1alpha1().ValidatingAdmissionPolicies().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AdmissionregistrationV1alpha1().ValidatingAdmissionPolicies().Watch(context.TODO(), options)
+				return client.AdmissionregistrationV1alpha1().ValidatingAdmissionPolicies().Watch(context.Background(), options)
 			},
 		},
-		&admissionregistrationv1alpha1.ValidatingAdmissionPolicy{},
+		&apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *validatingAdmissionPolicyClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *validatingAdmissionPolicyClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredValidatingAdmissionPolicyClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *validatingAdmissionPolicyClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&admissionregistrationv1alpha1.ValidatingAdmissionPolicy{}, f.defaultInformer)
+func (i *validatingAdmissionPolicyClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicy{}, i.defaultInformer)
 }
 
-func (f *validatingAdmissionPolicyClusterInformer) Lister() admissionregistrationv1alpha1listers.ValidatingAdmissionPolicyClusterLister {
-	return admissionregistrationv1alpha1listers.NewValidatingAdmissionPolicyClusterLister(f.Informer().GetIndexer())
+func (i *validatingAdmissionPolicyClusterInformer) Lister() kcpv1alpha1.ValidatingAdmissionPolicyClusterLister {
+	return kcpv1alpha1.NewValidatingAdmissionPolicyClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *validatingAdmissionPolicyClusterInformer) Cluster(clusterName logicalcluster.Name) admissionregistrationv1alpha1.ValidatingAdmissionPolicyInformer {
+	return &validatingAdmissionPolicyInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *validatingAdmissionPolicyClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamadmissionregistrationv1alpha1informers.ValidatingAdmissionPolicyInformer {
+func (i *validatingAdmissionPolicyClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) admissionregistrationv1alpha1.ValidatingAdmissionPolicyInformer {
 	return &validatingAdmissionPolicyInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type validatingAdmissionPolicyInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamadmissionregistrationv1alpha1listers.ValidatingAdmissionPolicyLister
+	lister   listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyLister
 }
 
-func (f *validatingAdmissionPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *validatingAdmissionPolicyInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *validatingAdmissionPolicyInformer) Lister() upstreamadmissionregistrationv1alpha1listers.ValidatingAdmissionPolicyLister {
-	return f.lister
+func (i *validatingAdmissionPolicyInformer) Lister() listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyLister {
+	return i.lister
 }
diff --git a/informers/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go b/informers/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
index 851999c7e..017b9d6e4 100644
--- a/informers/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
+++ b/informers/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiadmissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1alpha1 "k8s.io/client-go/informers/admissionregistration/v1alpha1"
+	listersadmissionregistrationv1alpha1 "k8s.io/client-go/listers/admissionregistration/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamadmissionregistrationv1alpha1informers "k8s.io/client-go/informers/admissionregistration/v1alpha1"
-	upstreamadmissionregistrationv1alpha1listers "k8s.io/client-go/listers/admissionregistration/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	admissionregistrationv1alpha1listers "github.com/kcp-dev/client-go/listers/admissionregistration/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/admissionregistration/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ValidatingAdmissionPolicyBindingClusterInformer provides access to a shared informer and lister for
 // ValidatingAdmissionPolicyBindings.
 type ValidatingAdmissionPolicyBindingClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamadmissionregistrationv1alpha1informers.ValidatingAdmissionPolicyBindingInformer
+	Cluster(logicalcluster.Name) admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() admissionregistrationv1alpha1listers.ValidatingAdmissionPolicyBindingClusterLister
+	Lister() kcpv1alpha1.ValidatingAdmissionPolicyBindingClusterLister
 }
 
 type validatingAdmissionPolicyBindingClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewValidatingAdmissionPolicyBindingClusterInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewValidatingAdmissionPolicyBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewValidatingAdmissionPolicyBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredValidatingAdmissionPolicyBindingClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredValidatingAdmissionPolicyBindingClusterInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredValidatingAdmissionPolicyBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredValidatingAdmissionPolicyBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AdmissionregistrationV1alpha1().ValidatingAdmissionPolicyBindings().List(context.TODO(), options)
+				return client.AdmissionregistrationV1alpha1().ValidatingAdmissionPolicyBindings().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AdmissionregistrationV1alpha1().ValidatingAdmissionPolicyBindings().Watch(context.TODO(), options)
+				return client.AdmissionregistrationV1alpha1().ValidatingAdmissionPolicyBindings().Watch(context.Background(), options)
 			},
 		},
-		&admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{},
+		&apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *validatingAdmissionPolicyBindingClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *validatingAdmissionPolicyBindingClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredValidatingAdmissionPolicyBindingClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *validatingAdmissionPolicyBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{}, f.defaultInformer)
+func (i *validatingAdmissionPolicyBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{}, i.defaultInformer)
 }
 
-func (f *validatingAdmissionPolicyBindingClusterInformer) Lister() admissionregistrationv1alpha1listers.ValidatingAdmissionPolicyBindingClusterLister {
-	return admissionregistrationv1alpha1listers.NewValidatingAdmissionPolicyBindingClusterLister(f.Informer().GetIndexer())
+func (i *validatingAdmissionPolicyBindingClusterInformer) Lister() kcpv1alpha1.ValidatingAdmissionPolicyBindingClusterLister {
+	return kcpv1alpha1.NewValidatingAdmissionPolicyBindingClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *validatingAdmissionPolicyBindingClusterInformer) Cluster(clusterName logicalcluster.Name) admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingInformer {
+	return &validatingAdmissionPolicyBindingInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *validatingAdmissionPolicyBindingClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamadmissionregistrationv1alpha1informers.ValidatingAdmissionPolicyBindingInformer {
+func (i *validatingAdmissionPolicyBindingClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingInformer {
 	return &validatingAdmissionPolicyBindingInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type validatingAdmissionPolicyBindingInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamadmissionregistrationv1alpha1listers.ValidatingAdmissionPolicyBindingLister
+	lister   listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingLister
 }
 
-func (f *validatingAdmissionPolicyBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *validatingAdmissionPolicyBindingInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *validatingAdmissionPolicyBindingInformer) Lister() upstreamadmissionregistrationv1alpha1listers.ValidatingAdmissionPolicyBindingLister {
-	return f.lister
+func (i *validatingAdmissionPolicyBindingInformer) Lister() listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingLister {
+	return i.lister
 }
diff --git a/informers/admissionregistration/v1beta1/interface.go b/informers/admissionregistration/v1beta1/interface.go
index 0d10c28e4..33a637e3e 100644
--- a/informers/admissionregistration/v1beta1/interface.go
+++ b/informers/admissionregistration/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,37 +14,51 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// ValidatingWebhookConfigurations returns a ValidatingWebhookConfigurationClusterInformer
-	ValidatingWebhookConfigurations() ValidatingWebhookConfigurationClusterInformer
-	// MutatingWebhookConfigurations returns a MutatingWebhookConfigurationClusterInformer
+	// MutatingWebhookConfigurations returns a MutatingWebhookConfigurationClusterInformer.
 	MutatingWebhookConfigurations() MutatingWebhookConfigurationClusterInformer
+	// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyClusterInformer.
+	ValidatingAdmissionPolicies() ValidatingAdmissionPolicyClusterInformer
+	// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingClusterInformer.
+	ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingClusterInformer
+	// ValidatingWebhookConfigurations returns a ValidatingWebhookConfigurationClusterInformer.
+	ValidatingWebhookConfigurations() ValidatingWebhookConfigurationClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// ValidatingWebhookConfigurations returns a ValidatingWebhookConfigurationClusterInformer
-func (v *version) ValidatingWebhookConfigurations() ValidatingWebhookConfigurationClusterInformer {
-	return &validatingWebhookConfigurationClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// MutatingWebhookConfigurations returns a MutatingWebhookConfigurationClusterInformer
+// MutatingWebhookConfigurations returns a MutatingWebhookConfigurationClusterInformer.
 func (v *version) MutatingWebhookConfigurations() MutatingWebhookConfigurationClusterInformer {
 	return &mutatingWebhookConfigurationClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// ValidatingAdmissionPolicies returns a ValidatingAdmissionPolicyClusterInformer.
+func (v *version) ValidatingAdmissionPolicies() ValidatingAdmissionPolicyClusterInformer {
+	return &validatingAdmissionPolicyClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ValidatingAdmissionPolicyBindings returns a ValidatingAdmissionPolicyBindingClusterInformer.
+func (v *version) ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingClusterInformer {
+	return &validatingAdmissionPolicyBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ValidatingWebhookConfigurations returns a ValidatingWebhookConfigurationClusterInformer.
+func (v *version) ValidatingWebhookConfigurations() ValidatingWebhookConfigurationClusterInformer {
+	return &validatingWebhookConfigurationClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/admissionregistration/v1beta1/mutatingwebhookconfiguration.go b/informers/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
index c2829f2da..2b5a03bf8 100644
--- a/informers/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
+++ b/informers/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiadmissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1beta1 "k8s.io/client-go/informers/admissionregistration/v1beta1"
+	listersadmissionregistrationv1beta1 "k8s.io/client-go/listers/admissionregistration/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamadmissionregistrationv1beta1informers "k8s.io/client-go/informers/admissionregistration/v1beta1"
-	upstreamadmissionregistrationv1beta1listers "k8s.io/client-go/listers/admissionregistration/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	admissionregistrationv1beta1listers "github.com/kcp-dev/client-go/listers/admissionregistration/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/admissionregistration/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // MutatingWebhookConfigurationClusterInformer provides access to a shared informer and lister for
 // MutatingWebhookConfigurations.
 type MutatingWebhookConfigurationClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamadmissionregistrationv1beta1informers.MutatingWebhookConfigurationInformer
+	Cluster(logicalcluster.Name) admissionregistrationv1beta1.MutatingWebhookConfigurationInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) admissionregistrationv1beta1.MutatingWebhookConfigurationInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() admissionregistrationv1beta1listers.MutatingWebhookConfigurationClusterLister
+	Lister() kcpv1beta1.MutatingWebhookConfigurationClusterLister
 }
 
 type mutatingWebhookConfigurationClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewMutatingWebhookConfigurationClusterInformer constructs a new informer for MutatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewMutatingWebhookConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewMutatingWebhookConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredMutatingWebhookConfigurationClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredMutatingWebhookConfigurationClusterInformer constructs a new informer for MutatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredMutatingWebhookConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredMutatingWebhookConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AdmissionregistrationV1beta1().MutatingWebhookConfigurations().List(context.TODO(), options)
+				return client.AdmissionregistrationV1beta1().MutatingWebhookConfigurations().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AdmissionregistrationV1beta1().MutatingWebhookConfigurations().Watch(context.TODO(), options)
+				return client.AdmissionregistrationV1beta1().MutatingWebhookConfigurations().Watch(context.Background(), options)
 			},
 		},
-		&admissionregistrationv1beta1.MutatingWebhookConfiguration{},
+		&apiadmissionregistrationv1beta1.MutatingWebhookConfiguration{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *mutatingWebhookConfigurationClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *mutatingWebhookConfigurationClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredMutatingWebhookConfigurationClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *mutatingWebhookConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&admissionregistrationv1beta1.MutatingWebhookConfiguration{}, f.defaultInformer)
+func (i *mutatingWebhookConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiadmissionregistrationv1beta1.MutatingWebhookConfiguration{}, i.defaultInformer)
 }
 
-func (f *mutatingWebhookConfigurationClusterInformer) Lister() admissionregistrationv1beta1listers.MutatingWebhookConfigurationClusterLister {
-	return admissionregistrationv1beta1listers.NewMutatingWebhookConfigurationClusterLister(f.Informer().GetIndexer())
+func (i *mutatingWebhookConfigurationClusterInformer) Lister() kcpv1beta1.MutatingWebhookConfigurationClusterLister {
+	return kcpv1beta1.NewMutatingWebhookConfigurationClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *mutatingWebhookConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) admissionregistrationv1beta1.MutatingWebhookConfigurationInformer {
+	return &mutatingWebhookConfigurationInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *mutatingWebhookConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamadmissionregistrationv1beta1informers.MutatingWebhookConfigurationInformer {
+func (i *mutatingWebhookConfigurationClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) admissionregistrationv1beta1.MutatingWebhookConfigurationInformer {
 	return &mutatingWebhookConfigurationInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type mutatingWebhookConfigurationInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamadmissionregistrationv1beta1listers.MutatingWebhookConfigurationLister
+	lister   listersadmissionregistrationv1beta1.MutatingWebhookConfigurationLister
 }
 
-func (f *mutatingWebhookConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *mutatingWebhookConfigurationInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *mutatingWebhookConfigurationInformer) Lister() upstreamadmissionregistrationv1beta1listers.MutatingWebhookConfigurationLister {
-	return f.lister
+func (i *mutatingWebhookConfigurationInformer) Lister() listersadmissionregistrationv1beta1.MutatingWebhookConfigurationLister {
+	return i.lister
 }
diff --git a/informers/admissionregistration/v1beta1/validatingadmissionpolicy.go b/informers/admissionregistration/v1beta1/validatingadmissionpolicy.go
new file mode 100644
index 000000000..b60867036
--- /dev/null
+++ b/informers/admissionregistration/v1beta1/validatingadmissionpolicy.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apiadmissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1beta1 "k8s.io/client-go/informers/admissionregistration/v1beta1"
+	listersadmissionregistrationv1beta1 "k8s.io/client-go/listers/admissionregistration/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/admissionregistration/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ValidatingAdmissionPolicyClusterInformer provides access to a shared informer and lister for
+// ValidatingAdmissionPolicies.
+type ValidatingAdmissionPolicyClusterInformer interface {
+	Cluster(logicalcluster.Name) admissionregistrationv1beta1.ValidatingAdmissionPolicyInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) admissionregistrationv1beta1.ValidatingAdmissionPolicyInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta1.ValidatingAdmissionPolicyClusterLister
+}
+
+type validatingAdmissionPolicyClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewValidatingAdmissionPolicyClusterInformer constructs a new informer for ValidatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewValidatingAdmissionPolicyClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredValidatingAdmissionPolicyClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredValidatingAdmissionPolicyClusterInformer constructs a new informer for ValidatingAdmissionPolicy type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredValidatingAdmissionPolicyClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AdmissionregistrationV1beta1().ValidatingAdmissionPolicies().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AdmissionregistrationV1beta1().ValidatingAdmissionPolicies().Watch(context.Background(), options)
+			},
+		},
+		&apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *validatingAdmissionPolicyClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredValidatingAdmissionPolicyClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *validatingAdmissionPolicyClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiadmissionregistrationv1beta1.ValidatingAdmissionPolicy{}, i.defaultInformer)
+}
+
+func (i *validatingAdmissionPolicyClusterInformer) Lister() kcpv1beta1.ValidatingAdmissionPolicyClusterLister {
+	return kcpv1beta1.NewValidatingAdmissionPolicyClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *validatingAdmissionPolicyClusterInformer) Cluster(clusterName logicalcluster.Name) admissionregistrationv1beta1.ValidatingAdmissionPolicyInformer {
+	return &validatingAdmissionPolicyInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *validatingAdmissionPolicyClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) admissionregistrationv1beta1.ValidatingAdmissionPolicyInformer {
+	return &validatingAdmissionPolicyInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type validatingAdmissionPolicyInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyLister
+}
+
+func (i *validatingAdmissionPolicyInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *validatingAdmissionPolicyInformer) Lister() listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyLister {
+	return i.lister
+}
diff --git a/informers/admissionregistration/v1beta1/validatingadmissionpolicybinding.go b/informers/admissionregistration/v1beta1/validatingadmissionpolicybinding.go
new file mode 100644
index 000000000..a675d4c46
--- /dev/null
+++ b/informers/admissionregistration/v1beta1/validatingadmissionpolicybinding.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apiadmissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1beta1 "k8s.io/client-go/informers/admissionregistration/v1beta1"
+	listersadmissionregistrationv1beta1 "k8s.io/client-go/listers/admissionregistration/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/admissionregistration/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ValidatingAdmissionPolicyBindingClusterInformer provides access to a shared informer and lister for
+// ValidatingAdmissionPolicyBindings.
+type ValidatingAdmissionPolicyBindingClusterInformer interface {
+	Cluster(logicalcluster.Name) admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta1.ValidatingAdmissionPolicyBindingClusterLister
+}
+
+type validatingAdmissionPolicyBindingClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewValidatingAdmissionPolicyBindingClusterInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewValidatingAdmissionPolicyBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredValidatingAdmissionPolicyBindingClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredValidatingAdmissionPolicyBindingClusterInformer constructs a new informer for ValidatingAdmissionPolicyBinding type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredValidatingAdmissionPolicyBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AdmissionregistrationV1beta1().ValidatingAdmissionPolicyBindings().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.AdmissionregistrationV1beta1().ValidatingAdmissionPolicyBindings().Watch(context.Background(), options)
+			},
+		},
+		&apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *validatingAdmissionPolicyBindingClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredValidatingAdmissionPolicyBindingClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *validatingAdmissionPolicyBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBinding{}, i.defaultInformer)
+}
+
+func (i *validatingAdmissionPolicyBindingClusterInformer) Lister() kcpv1beta1.ValidatingAdmissionPolicyBindingClusterLister {
+	return kcpv1beta1.NewValidatingAdmissionPolicyBindingClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *validatingAdmissionPolicyBindingClusterInformer) Cluster(clusterName logicalcluster.Name) admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingInformer {
+	return &validatingAdmissionPolicyBindingInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *validatingAdmissionPolicyBindingClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingInformer {
+	return &validatingAdmissionPolicyBindingInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type validatingAdmissionPolicyBindingInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingLister
+}
+
+func (i *validatingAdmissionPolicyBindingInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *validatingAdmissionPolicyBindingInformer) Lister() listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingLister {
+	return i.lister
+}
diff --git a/informers/admissionregistration/v1beta1/validatingwebhookconfiguration.go b/informers/admissionregistration/v1beta1/validatingwebhookconfiguration.go
index e89e98c8d..a78a3b63b 100644
--- a/informers/admissionregistration/v1beta1/validatingwebhookconfiguration.go
+++ b/informers/admissionregistration/v1beta1/validatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiadmissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1beta1 "k8s.io/client-go/informers/admissionregistration/v1beta1"
+	listersadmissionregistrationv1beta1 "k8s.io/client-go/listers/admissionregistration/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamadmissionregistrationv1beta1informers "k8s.io/client-go/informers/admissionregistration/v1beta1"
-	upstreamadmissionregistrationv1beta1listers "k8s.io/client-go/listers/admissionregistration/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	admissionregistrationv1beta1listers "github.com/kcp-dev/client-go/listers/admissionregistration/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/admissionregistration/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ValidatingWebhookConfigurationClusterInformer provides access to a shared informer and lister for
 // ValidatingWebhookConfigurations.
 type ValidatingWebhookConfigurationClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamadmissionregistrationv1beta1informers.ValidatingWebhookConfigurationInformer
+	Cluster(logicalcluster.Name) admissionregistrationv1beta1.ValidatingWebhookConfigurationInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) admissionregistrationv1beta1.ValidatingWebhookConfigurationInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() admissionregistrationv1beta1listers.ValidatingWebhookConfigurationClusterLister
+	Lister() kcpv1beta1.ValidatingWebhookConfigurationClusterLister
 }
 
 type validatingWebhookConfigurationClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewValidatingWebhookConfigurationClusterInformer constructs a new informer for ValidatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewValidatingWebhookConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewValidatingWebhookConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredValidatingWebhookConfigurationClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredValidatingWebhookConfigurationClusterInformer constructs a new informer for ValidatingWebhookConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredValidatingWebhookConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredValidatingWebhookConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().List(context.TODO(), options)
+				return client.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().Watch(context.TODO(), options)
+				return client.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().Watch(context.Background(), options)
 			},
 		},
-		&admissionregistrationv1beta1.ValidatingWebhookConfiguration{},
+		&apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *validatingWebhookConfigurationClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *validatingWebhookConfigurationClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredValidatingWebhookConfigurationClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *validatingWebhookConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&admissionregistrationv1beta1.ValidatingWebhookConfiguration{}, f.defaultInformer)
+func (i *validatingWebhookConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiadmissionregistrationv1beta1.ValidatingWebhookConfiguration{}, i.defaultInformer)
 }
 
-func (f *validatingWebhookConfigurationClusterInformer) Lister() admissionregistrationv1beta1listers.ValidatingWebhookConfigurationClusterLister {
-	return admissionregistrationv1beta1listers.NewValidatingWebhookConfigurationClusterLister(f.Informer().GetIndexer())
+func (i *validatingWebhookConfigurationClusterInformer) Lister() kcpv1beta1.ValidatingWebhookConfigurationClusterLister {
+	return kcpv1beta1.NewValidatingWebhookConfigurationClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *validatingWebhookConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) admissionregistrationv1beta1.ValidatingWebhookConfigurationInformer {
+	return &validatingWebhookConfigurationInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *validatingWebhookConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamadmissionregistrationv1beta1informers.ValidatingWebhookConfigurationInformer {
+func (i *validatingWebhookConfigurationClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) admissionregistrationv1beta1.ValidatingWebhookConfigurationInformer {
 	return &validatingWebhookConfigurationInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type validatingWebhookConfigurationInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamadmissionregistrationv1beta1listers.ValidatingWebhookConfigurationLister
+	lister   listersadmissionregistrationv1beta1.ValidatingWebhookConfigurationLister
 }
 
-func (f *validatingWebhookConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *validatingWebhookConfigurationInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *validatingWebhookConfigurationInformer) Lister() upstreamadmissionregistrationv1beta1listers.ValidatingWebhookConfigurationLister {
-	return f.lister
+func (i *validatingWebhookConfigurationInformer) Lister() listersadmissionregistrationv1beta1.ValidatingWebhookConfigurationLister {
+	return i.lister
 }
diff --git a/informers/apiserverinternal/interface.go b/informers/apiserverinternal/interface.go
index b50aef3b8..bb9602058 100644
--- a/informers/apiserverinternal/interface.go
+++ b/informers/apiserverinternal/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,31 +14,32 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package apiserverinternal
 
 import (
-	"github.com/kcp-dev/client-go/informers/apiserverinternal/v1alpha1"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/informers/apiserverinternal/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1alpha1 provides access to the shared informers in V1alpha1.
-	V1alpha1() v1alpha1.ClusterInterface
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() kcpv1alpha1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1alpha1 returns a new v1alpha1.ClusterInterface.
-func (g *group) V1alpha1() v1alpha1.ClusterInterface {
-	return v1alpha1.New(g.factory, g.tweakListOptions)
+// V1alpha1 returns a new kcpv1alpha1.ClusterInterface.
+func (g *group) V1alpha1() kcpv1alpha1.ClusterInterface {
+	return kcpv1alpha1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/apiserverinternal/v1alpha1/interface.go b/informers/apiserverinternal/v1alpha1/interface.go
index 23cf59afe..d14e42a82 100644
--- a/informers/apiserverinternal/v1alpha1/interface.go
+++ b/informers/apiserverinternal/v1alpha1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// StorageVersions returns a StorageVersionClusterInformer
+	// StorageVersions returns a StorageVersionClusterInformer.
 	StorageVersions() StorageVersionClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// StorageVersions returns a StorageVersionClusterInformer
+// StorageVersions returns a StorageVersionClusterInformer.
 func (v *version) StorageVersions() StorageVersionClusterInformer {
 	return &storageVersionClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/apiserverinternal/v1alpha1/storageversion.go b/informers/apiserverinternal/v1alpha1/storageversion.go
index 69a16d474..a953bb2ed 100644
--- a/informers/apiserverinternal/v1alpha1/storageversion.go
+++ b/informers/apiserverinternal/v1alpha1/storageversion.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiapiserverinternalv1alpha1 "k8s.io/api/apiserverinternal/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	apiserverinternalv1alpha1 "k8s.io/client-go/informers/apiserverinternal/v1alpha1"
+	listersapiserverinternalv1alpha1 "k8s.io/client-go/listers/apiserverinternal/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	internalv1alpha1 "k8s.io/api/apiserverinternal/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreaminternalv1alpha1informers "k8s.io/client-go/informers/apiserverinternal/v1alpha1"
-	upstreaminternalv1alpha1listers "k8s.io/client-go/listers/apiserverinternal/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	internalv1alpha1listers "github.com/kcp-dev/client-go/listers/apiserverinternal/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/apiserverinternal/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // StorageVersionClusterInformer provides access to a shared informer and lister for
 // StorageVersions.
 type StorageVersionClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreaminternalv1alpha1informers.StorageVersionInformer
+	Cluster(logicalcluster.Name) apiserverinternalv1alpha1.StorageVersionInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) apiserverinternalv1alpha1.StorageVersionInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() internalv1alpha1listers.StorageVersionClusterLister
+	Lister() kcpv1alpha1.StorageVersionClusterLister
 }
 
 type storageVersionClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewStorageVersionClusterInformer constructs a new informer for StorageVersion type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewStorageVersionClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewStorageVersionClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredStorageVersionClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredStorageVersionClusterInformer constructs a new informer for StorageVersion type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredStorageVersionClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredStorageVersionClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.InternalV1alpha1().StorageVersions().List(context.TODO(), options)
+				return client.InternalV1alpha1().StorageVersions().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.InternalV1alpha1().StorageVersions().Watch(context.TODO(), options)
+				return client.InternalV1alpha1().StorageVersions().Watch(context.Background(), options)
 			},
 		},
-		&internalv1alpha1.StorageVersion{},
+		&apiapiserverinternalv1alpha1.StorageVersion{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *storageVersionClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *storageVersionClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredStorageVersionClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *storageVersionClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&internalv1alpha1.StorageVersion{}, f.defaultInformer)
+func (i *storageVersionClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiapiserverinternalv1alpha1.StorageVersion{}, i.defaultInformer)
 }
 
-func (f *storageVersionClusterInformer) Lister() internalv1alpha1listers.StorageVersionClusterLister {
-	return internalv1alpha1listers.NewStorageVersionClusterLister(f.Informer().GetIndexer())
+func (i *storageVersionClusterInformer) Lister() kcpv1alpha1.StorageVersionClusterLister {
+	return kcpv1alpha1.NewStorageVersionClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *storageVersionClusterInformer) Cluster(clusterName logicalcluster.Name) apiserverinternalv1alpha1.StorageVersionInformer {
+	return &storageVersionInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *storageVersionClusterInformer) Cluster(clusterName logicalcluster.Name) upstreaminternalv1alpha1informers.StorageVersionInformer {
+func (i *storageVersionClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) apiserverinternalv1alpha1.StorageVersionInformer {
 	return &storageVersionInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type storageVersionInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreaminternalv1alpha1listers.StorageVersionLister
+	lister   listersapiserverinternalv1alpha1.StorageVersionLister
 }
 
-func (f *storageVersionInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *storageVersionInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *storageVersionInformer) Lister() upstreaminternalv1alpha1listers.StorageVersionLister {
-	return f.lister
+func (i *storageVersionInformer) Lister() listersapiserverinternalv1alpha1.StorageVersionLister {
+	return i.lister
 }
diff --git a/informers/apps/interface.go b/informers/apps/interface.go
index 3b36c5c95..aa7a801f3 100644
--- a/informers/apps/interface.go
+++ b/informers/apps/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,47 +14,48 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package apps
 
 import (
-	"github.com/kcp-dev/client-go/informers/apps/v1"
-	"github.com/kcp-dev/client-go/informers/apps/v1beta1"
-	"github.com/kcp-dev/client-go/informers/apps/v1beta2"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/apps/v1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/apps/v1beta1"
+	kcpv1beta2 "github.com/kcp-dev/client-go/informers/apps/v1beta2"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
-	// V1beta2 provides access to the shared informers in V1beta2.
-	V1beta2() v1beta2.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
+	// V1beta2 provides access to shared informers for resources in V1beta2.
+	V1beta2() kcpv1beta2.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta2 returns a new v1beta2.ClusterInterface.
-func (g *group) V1beta2() v1beta2.ClusterInterface {
-	return v1beta2.New(g.factory, g.tweakListOptions)
+// V1beta2 returns a new kcpv1beta2.ClusterInterface.
+func (g *group) V1beta2() kcpv1beta2.ClusterInterface {
+	return kcpv1beta2.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/apps/v1/controllerrevision.go b/informers/apps/v1/controllerrevision.go
index c981527cb..807e7cca3 100644
--- a/informers/apps/v1/controllerrevision.go
+++ b/informers/apps/v1/controllerrevision.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1 "k8s.io/client-go/informers/apps/v1"
+	listersappsv1 "k8s.io/client-go/listers/apps/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1 "k8s.io/api/apps/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1informers "k8s.io/client-go/informers/apps/v1"
-	upstreamappsv1listers "k8s.io/client-go/listers/apps/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1listers "github.com/kcp-dev/client-go/listers/apps/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/apps/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ControllerRevisionClusterInformer provides access to a shared informer and lister for
 // ControllerRevisions.
 type ControllerRevisionClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1informers.ControllerRevisionInformer
+	Cluster(logicalcluster.Name) appsv1.ControllerRevisionInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1.ControllerRevisionInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1listers.ControllerRevisionClusterLister
+	Lister() kcpv1.ControllerRevisionClusterLister
 }
 
 type controllerRevisionClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewControllerRevisionClusterInformer constructs a new informer for ControllerRevision type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewControllerRevisionClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewControllerRevisionClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredControllerRevisionClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredControllerRevisionClusterInformer constructs a new informer for ControllerRevision type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredControllerRevisionClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredControllerRevisionClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1().ControllerRevisions().List(context.TODO(), options)
+				return client.AppsV1().ControllerRevisions().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1().ControllerRevisions().Watch(context.TODO(), options)
+				return client.AppsV1().ControllerRevisions().Watch(context.Background(), options)
 			},
 		},
-		&appsv1.ControllerRevision{},
+		&apiappsv1.ControllerRevision{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *controllerRevisionClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *controllerRevisionClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredControllerRevisionClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *controllerRevisionClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1.ControllerRevision{}, i.defaultInformer)
 }
 
-func (f *controllerRevisionClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1.ControllerRevision{}, f.defaultInformer)
+func (i *controllerRevisionClusterInformer) Lister() kcpv1.ControllerRevisionClusterLister {
+	return kcpv1.NewControllerRevisionClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *controllerRevisionClusterInformer) Lister() appsv1listers.ControllerRevisionClusterLister {
-	return appsv1listers.NewControllerRevisionClusterLister(f.Informer().GetIndexer())
+func (i *controllerRevisionClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1.ControllerRevisionInformer {
+	return &controllerRevisionInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *controllerRevisionClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1informers.ControllerRevisionInformer {
+func (i *controllerRevisionClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1.ControllerRevisionInformer {
 	return &controllerRevisionInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type controllerRevisionInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1listers.ControllerRevisionLister
+	lister   listersappsv1.ControllerRevisionLister
 }
 
-func (f *controllerRevisionInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *controllerRevisionInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *controllerRevisionInformer) Lister() upstreamappsv1listers.ControllerRevisionLister {
-	return f.lister
+func (i *controllerRevisionInformer) Lister() listersappsv1.ControllerRevisionLister {
+	return i.lister
 }
diff --git a/informers/apps/v1/daemonset.go b/informers/apps/v1/daemonset.go
index 362ad4cbb..1e2cc5302 100644
--- a/informers/apps/v1/daemonset.go
+++ b/informers/apps/v1/daemonset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1 "k8s.io/client-go/informers/apps/v1"
+	listersappsv1 "k8s.io/client-go/listers/apps/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1 "k8s.io/api/apps/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1informers "k8s.io/client-go/informers/apps/v1"
-	upstreamappsv1listers "k8s.io/client-go/listers/apps/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1listers "github.com/kcp-dev/client-go/listers/apps/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/apps/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // DaemonSetClusterInformer provides access to a shared informer and lister for
 // DaemonSets.
 type DaemonSetClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1informers.DaemonSetInformer
+	Cluster(logicalcluster.Name) appsv1.DaemonSetInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1.DaemonSetInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1listers.DaemonSetClusterLister
+	Lister() kcpv1.DaemonSetClusterLister
 }
 
 type daemonSetClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewDaemonSetClusterInformer constructs a new informer for DaemonSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewDaemonSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewDaemonSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDaemonSetClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredDaemonSetClusterInformer constructs a new informer for DaemonSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredDaemonSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredDaemonSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1().DaemonSets().List(context.TODO(), options)
+				return client.AppsV1().DaemonSets().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1().DaemonSets().Watch(context.TODO(), options)
+				return client.AppsV1().DaemonSets().Watch(context.Background(), options)
 			},
 		},
-		&appsv1.DaemonSet{},
+		&apiappsv1.DaemonSet{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *daemonSetClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *daemonSetClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDaemonSetClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *daemonSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1.DaemonSet{}, i.defaultInformer)
 }
 
-func (f *daemonSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1.DaemonSet{}, f.defaultInformer)
+func (i *daemonSetClusterInformer) Lister() kcpv1.DaemonSetClusterLister {
+	return kcpv1.NewDaemonSetClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *daemonSetClusterInformer) Lister() appsv1listers.DaemonSetClusterLister {
-	return appsv1listers.NewDaemonSetClusterLister(f.Informer().GetIndexer())
+func (i *daemonSetClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1.DaemonSetInformer {
+	return &daemonSetInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *daemonSetClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1informers.DaemonSetInformer {
+func (i *daemonSetClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1.DaemonSetInformer {
 	return &daemonSetInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type daemonSetInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1listers.DaemonSetLister
+	lister   listersappsv1.DaemonSetLister
 }
 
-func (f *daemonSetInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *daemonSetInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *daemonSetInformer) Lister() upstreamappsv1listers.DaemonSetLister {
-	return f.lister
+func (i *daemonSetInformer) Lister() listersappsv1.DaemonSetLister {
+	return i.lister
 }
diff --git a/informers/apps/v1/deployment.go b/informers/apps/v1/deployment.go
index cc353058b..8e2cd2b31 100644
--- a/informers/apps/v1/deployment.go
+++ b/informers/apps/v1/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1 "k8s.io/client-go/informers/apps/v1"
+	listersappsv1 "k8s.io/client-go/listers/apps/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1 "k8s.io/api/apps/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1informers "k8s.io/client-go/informers/apps/v1"
-	upstreamappsv1listers "k8s.io/client-go/listers/apps/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1listers "github.com/kcp-dev/client-go/listers/apps/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/apps/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // DeploymentClusterInformer provides access to a shared informer and lister for
 // Deployments.
 type DeploymentClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1informers.DeploymentInformer
+	Cluster(logicalcluster.Name) appsv1.DeploymentInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1.DeploymentInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1listers.DeploymentClusterLister
+	Lister() kcpv1.DeploymentClusterLister
 }
 
 type deploymentClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewDeploymentClusterInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewDeploymentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewDeploymentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDeploymentClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredDeploymentClusterInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredDeploymentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredDeploymentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1().Deployments().List(context.TODO(), options)
+				return client.AppsV1().Deployments().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1().Deployments().Watch(context.TODO(), options)
+				return client.AppsV1().Deployments().Watch(context.Background(), options)
 			},
 		},
-		&appsv1.Deployment{},
+		&apiappsv1.Deployment{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *deploymentClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *deploymentClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDeploymentClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *deploymentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1.Deployment{}, i.defaultInformer)
 }
 
-func (f *deploymentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1.Deployment{}, f.defaultInformer)
+func (i *deploymentClusterInformer) Lister() kcpv1.DeploymentClusterLister {
+	return kcpv1.NewDeploymentClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *deploymentClusterInformer) Lister() appsv1listers.DeploymentClusterLister {
-	return appsv1listers.NewDeploymentClusterLister(f.Informer().GetIndexer())
+func (i *deploymentClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1.DeploymentInformer {
+	return &deploymentInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *deploymentClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1informers.DeploymentInformer {
+func (i *deploymentClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1.DeploymentInformer {
 	return &deploymentInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type deploymentInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1listers.DeploymentLister
+	lister   listersappsv1.DeploymentLister
 }
 
-func (f *deploymentInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *deploymentInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *deploymentInformer) Lister() upstreamappsv1listers.DeploymentLister {
-	return f.lister
+func (i *deploymentInformer) Lister() listersappsv1.DeploymentLister {
+	return i.lister
 }
diff --git a/informers/apps/v1/interface.go b/informers/apps/v1/interface.go
index 632206d40..bb4873ac5 100644
--- a/informers/apps/v1/interface.go
+++ b/informers/apps/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,58 +14,58 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// StatefulSets returns a StatefulSetClusterInformer
-	StatefulSets() StatefulSetClusterInformer
-	// Deployments returns a DeploymentClusterInformer
-	Deployments() DeploymentClusterInformer
-	// DaemonSets returns a DaemonSetClusterInformer
+	// ControllerRevisions returns a ControllerRevisionClusterInformer.
+	ControllerRevisions() ControllerRevisionClusterInformer
+	// DaemonSets returns a DaemonSetClusterInformer.
 	DaemonSets() DaemonSetClusterInformer
-	// ReplicaSets returns a ReplicaSetClusterInformer
+	// Deployments returns a DeploymentClusterInformer.
+	Deployments() DeploymentClusterInformer
+	// ReplicaSets returns a ReplicaSetClusterInformer.
 	ReplicaSets() ReplicaSetClusterInformer
-	// ControllerRevisions returns a ControllerRevisionClusterInformer
-	ControllerRevisions() ControllerRevisionClusterInformer
+	// StatefulSets returns a StatefulSetClusterInformer.
+	StatefulSets() StatefulSetClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// StatefulSets returns a StatefulSetClusterInformer
-func (v *version) StatefulSets() StatefulSetClusterInformer {
-	return &statefulSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// Deployments returns a DeploymentClusterInformer
-func (v *version) Deployments() DeploymentClusterInformer {
-	return &deploymentClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// ControllerRevisions returns a ControllerRevisionClusterInformer.
+func (v *version) ControllerRevisions() ControllerRevisionClusterInformer {
+	return &controllerRevisionClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// DaemonSets returns a DaemonSetClusterInformer
+// DaemonSets returns a DaemonSetClusterInformer.
 func (v *version) DaemonSets() DaemonSetClusterInformer {
 	return &daemonSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ReplicaSets returns a ReplicaSetClusterInformer
+// Deployments returns a DeploymentClusterInformer.
+func (v *version) Deployments() DeploymentClusterInformer {
+	return &deploymentClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ReplicaSets returns a ReplicaSetClusterInformer.
 func (v *version) ReplicaSets() ReplicaSetClusterInformer {
 	return &replicaSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ControllerRevisions returns a ControllerRevisionClusterInformer
-func (v *version) ControllerRevisions() ControllerRevisionClusterInformer {
-	return &controllerRevisionClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// StatefulSets returns a StatefulSetClusterInformer.
+func (v *version) StatefulSets() StatefulSetClusterInformer {
+	return &statefulSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/apps/v1/replicaset.go b/informers/apps/v1/replicaset.go
index d0c41ea6c..d20dcb0c9 100644
--- a/informers/apps/v1/replicaset.go
+++ b/informers/apps/v1/replicaset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1 "k8s.io/client-go/informers/apps/v1"
+	listersappsv1 "k8s.io/client-go/listers/apps/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1 "k8s.io/api/apps/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1informers "k8s.io/client-go/informers/apps/v1"
-	upstreamappsv1listers "k8s.io/client-go/listers/apps/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1listers "github.com/kcp-dev/client-go/listers/apps/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/apps/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ReplicaSetClusterInformer provides access to a shared informer and lister for
 // ReplicaSets.
 type ReplicaSetClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1informers.ReplicaSetInformer
+	Cluster(logicalcluster.Name) appsv1.ReplicaSetInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1.ReplicaSetInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1listers.ReplicaSetClusterLister
+	Lister() kcpv1.ReplicaSetClusterLister
 }
 
 type replicaSetClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewReplicaSetClusterInformer constructs a new informer for ReplicaSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewReplicaSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewReplicaSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredReplicaSetClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredReplicaSetClusterInformer constructs a new informer for ReplicaSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredReplicaSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredReplicaSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1().ReplicaSets().List(context.TODO(), options)
+				return client.AppsV1().ReplicaSets().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1().ReplicaSets().Watch(context.TODO(), options)
+				return client.AppsV1().ReplicaSets().Watch(context.Background(), options)
 			},
 		},
-		&appsv1.ReplicaSet{},
+		&apiappsv1.ReplicaSet{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *replicaSetClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *replicaSetClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredReplicaSetClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *replicaSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1.ReplicaSet{}, i.defaultInformer)
 }
 
-func (f *replicaSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1.ReplicaSet{}, f.defaultInformer)
+func (i *replicaSetClusterInformer) Lister() kcpv1.ReplicaSetClusterLister {
+	return kcpv1.NewReplicaSetClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *replicaSetClusterInformer) Lister() appsv1listers.ReplicaSetClusterLister {
-	return appsv1listers.NewReplicaSetClusterLister(f.Informer().GetIndexer())
+func (i *replicaSetClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1.ReplicaSetInformer {
+	return &replicaSetInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *replicaSetClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1informers.ReplicaSetInformer {
+func (i *replicaSetClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1.ReplicaSetInformer {
 	return &replicaSetInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type replicaSetInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1listers.ReplicaSetLister
+	lister   listersappsv1.ReplicaSetLister
 }
 
-func (f *replicaSetInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *replicaSetInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *replicaSetInformer) Lister() upstreamappsv1listers.ReplicaSetLister {
-	return f.lister
+func (i *replicaSetInformer) Lister() listersappsv1.ReplicaSetLister {
+	return i.lister
 }
diff --git a/informers/apps/v1/statefulset.go b/informers/apps/v1/statefulset.go
index 5eb426c78..d05922eea 100644
--- a/informers/apps/v1/statefulset.go
+++ b/informers/apps/v1/statefulset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1 "k8s.io/client-go/informers/apps/v1"
+	listersappsv1 "k8s.io/client-go/listers/apps/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1 "k8s.io/api/apps/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1informers "k8s.io/client-go/informers/apps/v1"
-	upstreamappsv1listers "k8s.io/client-go/listers/apps/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1listers "github.com/kcp-dev/client-go/listers/apps/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/apps/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // StatefulSetClusterInformer provides access to a shared informer and lister for
 // StatefulSets.
 type StatefulSetClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1informers.StatefulSetInformer
+	Cluster(logicalcluster.Name) appsv1.StatefulSetInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1.StatefulSetInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1listers.StatefulSetClusterLister
+	Lister() kcpv1.StatefulSetClusterLister
 }
 
 type statefulSetClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewStatefulSetClusterInformer constructs a new informer for StatefulSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewStatefulSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewStatefulSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredStatefulSetClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredStatefulSetClusterInformer constructs a new informer for StatefulSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredStatefulSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredStatefulSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1().StatefulSets().List(context.TODO(), options)
+				return client.AppsV1().StatefulSets().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1().StatefulSets().Watch(context.TODO(), options)
+				return client.AppsV1().StatefulSets().Watch(context.Background(), options)
 			},
 		},
-		&appsv1.StatefulSet{},
+		&apiappsv1.StatefulSet{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *statefulSetClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *statefulSetClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredStatefulSetClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *statefulSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1.StatefulSet{}, i.defaultInformer)
 }
 
-func (f *statefulSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1.StatefulSet{}, f.defaultInformer)
+func (i *statefulSetClusterInformer) Lister() kcpv1.StatefulSetClusterLister {
+	return kcpv1.NewStatefulSetClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *statefulSetClusterInformer) Lister() appsv1listers.StatefulSetClusterLister {
-	return appsv1listers.NewStatefulSetClusterLister(f.Informer().GetIndexer())
+func (i *statefulSetClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1.StatefulSetInformer {
+	return &statefulSetInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *statefulSetClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1informers.StatefulSetInformer {
+func (i *statefulSetClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1.StatefulSetInformer {
 	return &statefulSetInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type statefulSetInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1listers.StatefulSetLister
+	lister   listersappsv1.StatefulSetLister
 }
 
-func (f *statefulSetInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *statefulSetInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *statefulSetInformer) Lister() upstreamappsv1listers.StatefulSetLister {
-	return f.lister
+func (i *statefulSetInformer) Lister() listersappsv1.StatefulSetLister {
+	return i.lister
 }
diff --git a/informers/apps/v1beta1/controllerrevision.go b/informers/apps/v1beta1/controllerrevision.go
index 7628da09d..81168d725 100644
--- a/informers/apps/v1beta1/controllerrevision.go
+++ b/informers/apps/v1beta1/controllerrevision.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1beta1 "k8s.io/api/apps/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1beta1 "k8s.io/client-go/informers/apps/v1beta1"
+	listersappsv1beta1 "k8s.io/client-go/listers/apps/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1beta1informers "k8s.io/client-go/informers/apps/v1beta1"
-	upstreamappsv1beta1listers "k8s.io/client-go/listers/apps/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1beta1listers "github.com/kcp-dev/client-go/listers/apps/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/apps/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ControllerRevisionClusterInformer provides access to a shared informer and lister for
 // ControllerRevisions.
 type ControllerRevisionClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1beta1informers.ControllerRevisionInformer
+	Cluster(logicalcluster.Name) appsv1beta1.ControllerRevisionInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1beta1.ControllerRevisionInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1beta1listers.ControllerRevisionClusterLister
+	Lister() kcpv1beta1.ControllerRevisionClusterLister
 }
 
 type controllerRevisionClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewControllerRevisionClusterInformer constructs a new informer for ControllerRevision type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewControllerRevisionClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewControllerRevisionClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredControllerRevisionClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredControllerRevisionClusterInformer constructs a new informer for ControllerRevision type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredControllerRevisionClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredControllerRevisionClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta1().ControllerRevisions().List(context.TODO(), options)
+				return client.AppsV1beta1().ControllerRevisions().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta1().ControllerRevisions().Watch(context.TODO(), options)
+				return client.AppsV1beta1().ControllerRevisions().Watch(context.Background(), options)
 			},
 		},
-		&appsv1beta1.ControllerRevision{},
+		&apiappsv1beta1.ControllerRevision{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *controllerRevisionClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *controllerRevisionClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredControllerRevisionClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *controllerRevisionClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1beta1.ControllerRevision{}, f.defaultInformer)
+func (i *controllerRevisionClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1beta1.ControllerRevision{}, i.defaultInformer)
 }
 
-func (f *controllerRevisionClusterInformer) Lister() appsv1beta1listers.ControllerRevisionClusterLister {
-	return appsv1beta1listers.NewControllerRevisionClusterLister(f.Informer().GetIndexer())
+func (i *controllerRevisionClusterInformer) Lister() kcpv1beta1.ControllerRevisionClusterLister {
+	return kcpv1beta1.NewControllerRevisionClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *controllerRevisionClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1beta1.ControllerRevisionInformer {
+	return &controllerRevisionInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *controllerRevisionClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1beta1informers.ControllerRevisionInformer {
+func (i *controllerRevisionClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1beta1.ControllerRevisionInformer {
 	return &controllerRevisionInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type controllerRevisionInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1beta1listers.ControllerRevisionLister
+	lister   listersappsv1beta1.ControllerRevisionLister
 }
 
-func (f *controllerRevisionInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *controllerRevisionInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *controllerRevisionInformer) Lister() upstreamappsv1beta1listers.ControllerRevisionLister {
-	return f.lister
+func (i *controllerRevisionInformer) Lister() listersappsv1beta1.ControllerRevisionLister {
+	return i.lister
 }
diff --git a/informers/apps/v1beta1/deployment.go b/informers/apps/v1beta1/deployment.go
index d83dac8b0..eb83dfc28 100644
--- a/informers/apps/v1beta1/deployment.go
+++ b/informers/apps/v1beta1/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1beta1 "k8s.io/api/apps/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1beta1 "k8s.io/client-go/informers/apps/v1beta1"
+	listersappsv1beta1 "k8s.io/client-go/listers/apps/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1beta1informers "k8s.io/client-go/informers/apps/v1beta1"
-	upstreamappsv1beta1listers "k8s.io/client-go/listers/apps/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1beta1listers "github.com/kcp-dev/client-go/listers/apps/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/apps/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // DeploymentClusterInformer provides access to a shared informer and lister for
 // Deployments.
 type DeploymentClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1beta1informers.DeploymentInformer
+	Cluster(logicalcluster.Name) appsv1beta1.DeploymentInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1beta1.DeploymentInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1beta1listers.DeploymentClusterLister
+	Lister() kcpv1beta1.DeploymentClusterLister
 }
 
 type deploymentClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewDeploymentClusterInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewDeploymentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewDeploymentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDeploymentClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredDeploymentClusterInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredDeploymentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredDeploymentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta1().Deployments().List(context.TODO(), options)
+				return client.AppsV1beta1().Deployments().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta1().Deployments().Watch(context.TODO(), options)
+				return client.AppsV1beta1().Deployments().Watch(context.Background(), options)
 			},
 		},
-		&appsv1beta1.Deployment{},
+		&apiappsv1beta1.Deployment{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *deploymentClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *deploymentClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDeploymentClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *deploymentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1beta1.Deployment{}, f.defaultInformer)
+func (i *deploymentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1beta1.Deployment{}, i.defaultInformer)
 }
 
-func (f *deploymentClusterInformer) Lister() appsv1beta1listers.DeploymentClusterLister {
-	return appsv1beta1listers.NewDeploymentClusterLister(f.Informer().GetIndexer())
+func (i *deploymentClusterInformer) Lister() kcpv1beta1.DeploymentClusterLister {
+	return kcpv1beta1.NewDeploymentClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *deploymentClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1beta1.DeploymentInformer {
+	return &deploymentInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *deploymentClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1beta1informers.DeploymentInformer {
+func (i *deploymentClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1beta1.DeploymentInformer {
 	return &deploymentInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type deploymentInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1beta1listers.DeploymentLister
+	lister   listersappsv1beta1.DeploymentLister
 }
 
-func (f *deploymentInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *deploymentInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *deploymentInformer) Lister() upstreamappsv1beta1listers.DeploymentLister {
-	return f.lister
+func (i *deploymentInformer) Lister() listersappsv1beta1.DeploymentLister {
+	return i.lister
 }
diff --git a/informers/apps/v1beta1/interface.go b/informers/apps/v1beta1/interface.go
index 8f0af42fb..d54b4568d 100644
--- a/informers/apps/v1beta1/interface.go
+++ b/informers/apps/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,44 +14,44 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// StatefulSets returns a StatefulSetClusterInformer
-	StatefulSets() StatefulSetClusterInformer
-	// Deployments returns a DeploymentClusterInformer
-	Deployments() DeploymentClusterInformer
-	// ControllerRevisions returns a ControllerRevisionClusterInformer
+	// ControllerRevisions returns a ControllerRevisionClusterInformer.
 	ControllerRevisions() ControllerRevisionClusterInformer
+	// Deployments returns a DeploymentClusterInformer.
+	Deployments() DeploymentClusterInformer
+	// StatefulSets returns a StatefulSetClusterInformer.
+	StatefulSets() StatefulSetClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// StatefulSets returns a StatefulSetClusterInformer
-func (v *version) StatefulSets() StatefulSetClusterInformer {
-	return &statefulSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// ControllerRevisions returns a ControllerRevisionClusterInformer.
+func (v *version) ControllerRevisions() ControllerRevisionClusterInformer {
+	return &controllerRevisionClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Deployments returns a DeploymentClusterInformer
+// Deployments returns a DeploymentClusterInformer.
 func (v *version) Deployments() DeploymentClusterInformer {
 	return &deploymentClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ControllerRevisions returns a ControllerRevisionClusterInformer
-func (v *version) ControllerRevisions() ControllerRevisionClusterInformer {
-	return &controllerRevisionClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// StatefulSets returns a StatefulSetClusterInformer.
+func (v *version) StatefulSets() StatefulSetClusterInformer {
+	return &statefulSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/apps/v1beta1/statefulset.go b/informers/apps/v1beta1/statefulset.go
index d91aaefb5..8c26aa816 100644
--- a/informers/apps/v1beta1/statefulset.go
+++ b/informers/apps/v1beta1/statefulset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1beta1 "k8s.io/api/apps/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1beta1 "k8s.io/client-go/informers/apps/v1beta1"
+	listersappsv1beta1 "k8s.io/client-go/listers/apps/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1beta1informers "k8s.io/client-go/informers/apps/v1beta1"
-	upstreamappsv1beta1listers "k8s.io/client-go/listers/apps/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1beta1listers "github.com/kcp-dev/client-go/listers/apps/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/apps/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // StatefulSetClusterInformer provides access to a shared informer and lister for
 // StatefulSets.
 type StatefulSetClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1beta1informers.StatefulSetInformer
+	Cluster(logicalcluster.Name) appsv1beta1.StatefulSetInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1beta1.StatefulSetInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1beta1listers.StatefulSetClusterLister
+	Lister() kcpv1beta1.StatefulSetClusterLister
 }
 
 type statefulSetClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewStatefulSetClusterInformer constructs a new informer for StatefulSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewStatefulSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewStatefulSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredStatefulSetClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredStatefulSetClusterInformer constructs a new informer for StatefulSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredStatefulSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredStatefulSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta1().StatefulSets().List(context.TODO(), options)
+				return client.AppsV1beta1().StatefulSets().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta1().StatefulSets().Watch(context.TODO(), options)
+				return client.AppsV1beta1().StatefulSets().Watch(context.Background(), options)
 			},
 		},
-		&appsv1beta1.StatefulSet{},
+		&apiappsv1beta1.StatefulSet{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *statefulSetClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *statefulSetClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredStatefulSetClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *statefulSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1beta1.StatefulSet{}, f.defaultInformer)
+func (i *statefulSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1beta1.StatefulSet{}, i.defaultInformer)
 }
 
-func (f *statefulSetClusterInformer) Lister() appsv1beta1listers.StatefulSetClusterLister {
-	return appsv1beta1listers.NewStatefulSetClusterLister(f.Informer().GetIndexer())
+func (i *statefulSetClusterInformer) Lister() kcpv1beta1.StatefulSetClusterLister {
+	return kcpv1beta1.NewStatefulSetClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *statefulSetClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1beta1.StatefulSetInformer {
+	return &statefulSetInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *statefulSetClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1beta1informers.StatefulSetInformer {
+func (i *statefulSetClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1beta1.StatefulSetInformer {
 	return &statefulSetInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type statefulSetInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1beta1listers.StatefulSetLister
+	lister   listersappsv1beta1.StatefulSetLister
 }
 
-func (f *statefulSetInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *statefulSetInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *statefulSetInformer) Lister() upstreamappsv1beta1listers.StatefulSetLister {
-	return f.lister
+func (i *statefulSetInformer) Lister() listersappsv1beta1.StatefulSetLister {
+	return i.lister
 }
diff --git a/informers/apps/v1beta2/controllerrevision.go b/informers/apps/v1beta2/controllerrevision.go
index 6b1e6a32d..9d8cb9861 100644
--- a/informers/apps/v1beta2/controllerrevision.go
+++ b/informers/apps/v1beta2/controllerrevision.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1beta2 "k8s.io/api/apps/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1beta2 "k8s.io/client-go/informers/apps/v1beta2"
+	listersappsv1beta2 "k8s.io/client-go/listers/apps/v1beta2"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1beta2informers "k8s.io/client-go/informers/apps/v1beta2"
-	upstreamappsv1beta2listers "k8s.io/client-go/listers/apps/v1beta2"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1beta2listers "github.com/kcp-dev/client-go/listers/apps/v1beta2"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta2 "github.com/kcp-dev/client-go/listers/apps/v1beta2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ControllerRevisionClusterInformer provides access to a shared informer and lister for
 // ControllerRevisions.
 type ControllerRevisionClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1beta2informers.ControllerRevisionInformer
+	Cluster(logicalcluster.Name) appsv1beta2.ControllerRevisionInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1beta2.ControllerRevisionInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1beta2listers.ControllerRevisionClusterLister
+	Lister() kcpv1beta2.ControllerRevisionClusterLister
 }
 
 type controllerRevisionClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewControllerRevisionClusterInformer constructs a new informer for ControllerRevision type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewControllerRevisionClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewControllerRevisionClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredControllerRevisionClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredControllerRevisionClusterInformer constructs a new informer for ControllerRevision type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredControllerRevisionClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredControllerRevisionClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta2().ControllerRevisions().List(context.TODO(), options)
+				return client.AppsV1beta2().ControllerRevisions().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta2().ControllerRevisions().Watch(context.TODO(), options)
+				return client.AppsV1beta2().ControllerRevisions().Watch(context.Background(), options)
 			},
 		},
-		&appsv1beta2.ControllerRevision{},
+		&apiappsv1beta2.ControllerRevision{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *controllerRevisionClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *controllerRevisionClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredControllerRevisionClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *controllerRevisionClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1beta2.ControllerRevision{}, f.defaultInformer)
+func (i *controllerRevisionClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1beta2.ControllerRevision{}, i.defaultInformer)
 }
 
-func (f *controllerRevisionClusterInformer) Lister() appsv1beta2listers.ControllerRevisionClusterLister {
-	return appsv1beta2listers.NewControllerRevisionClusterLister(f.Informer().GetIndexer())
+func (i *controllerRevisionClusterInformer) Lister() kcpv1beta2.ControllerRevisionClusterLister {
+	return kcpv1beta2.NewControllerRevisionClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *controllerRevisionClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1beta2.ControllerRevisionInformer {
+	return &controllerRevisionInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *controllerRevisionClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1beta2informers.ControllerRevisionInformer {
+func (i *controllerRevisionClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1beta2.ControllerRevisionInformer {
 	return &controllerRevisionInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type controllerRevisionInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1beta2listers.ControllerRevisionLister
+	lister   listersappsv1beta2.ControllerRevisionLister
 }
 
-func (f *controllerRevisionInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *controllerRevisionInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *controllerRevisionInformer) Lister() upstreamappsv1beta2listers.ControllerRevisionLister {
-	return f.lister
+func (i *controllerRevisionInformer) Lister() listersappsv1beta2.ControllerRevisionLister {
+	return i.lister
 }
diff --git a/informers/apps/v1beta2/daemonset.go b/informers/apps/v1beta2/daemonset.go
index b419f8e2b..16f330af9 100644
--- a/informers/apps/v1beta2/daemonset.go
+++ b/informers/apps/v1beta2/daemonset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1beta2 "k8s.io/api/apps/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1beta2 "k8s.io/client-go/informers/apps/v1beta2"
+	listersappsv1beta2 "k8s.io/client-go/listers/apps/v1beta2"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1beta2informers "k8s.io/client-go/informers/apps/v1beta2"
-	upstreamappsv1beta2listers "k8s.io/client-go/listers/apps/v1beta2"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1beta2listers "github.com/kcp-dev/client-go/listers/apps/v1beta2"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta2 "github.com/kcp-dev/client-go/listers/apps/v1beta2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // DaemonSetClusterInformer provides access to a shared informer and lister for
 // DaemonSets.
 type DaemonSetClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1beta2informers.DaemonSetInformer
+	Cluster(logicalcluster.Name) appsv1beta2.DaemonSetInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1beta2.DaemonSetInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1beta2listers.DaemonSetClusterLister
+	Lister() kcpv1beta2.DaemonSetClusterLister
 }
 
 type daemonSetClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewDaemonSetClusterInformer constructs a new informer for DaemonSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewDaemonSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewDaemonSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDaemonSetClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredDaemonSetClusterInformer constructs a new informer for DaemonSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredDaemonSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredDaemonSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta2().DaemonSets().List(context.TODO(), options)
+				return client.AppsV1beta2().DaemonSets().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta2().DaemonSets().Watch(context.TODO(), options)
+				return client.AppsV1beta2().DaemonSets().Watch(context.Background(), options)
 			},
 		},
-		&appsv1beta2.DaemonSet{},
+		&apiappsv1beta2.DaemonSet{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *daemonSetClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *daemonSetClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDaemonSetClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *daemonSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1beta2.DaemonSet{}, f.defaultInformer)
+func (i *daemonSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1beta2.DaemonSet{}, i.defaultInformer)
 }
 
-func (f *daemonSetClusterInformer) Lister() appsv1beta2listers.DaemonSetClusterLister {
-	return appsv1beta2listers.NewDaemonSetClusterLister(f.Informer().GetIndexer())
+func (i *daemonSetClusterInformer) Lister() kcpv1beta2.DaemonSetClusterLister {
+	return kcpv1beta2.NewDaemonSetClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *daemonSetClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1beta2.DaemonSetInformer {
+	return &daemonSetInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *daemonSetClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1beta2informers.DaemonSetInformer {
+func (i *daemonSetClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1beta2.DaemonSetInformer {
 	return &daemonSetInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type daemonSetInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1beta2listers.DaemonSetLister
+	lister   listersappsv1beta2.DaemonSetLister
 }
 
-func (f *daemonSetInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *daemonSetInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *daemonSetInformer) Lister() upstreamappsv1beta2listers.DaemonSetLister {
-	return f.lister
+func (i *daemonSetInformer) Lister() listersappsv1beta2.DaemonSetLister {
+	return i.lister
 }
diff --git a/informers/apps/v1beta2/deployment.go b/informers/apps/v1beta2/deployment.go
index 1efbf6e73..685469c6d 100644
--- a/informers/apps/v1beta2/deployment.go
+++ b/informers/apps/v1beta2/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1beta2 "k8s.io/api/apps/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1beta2 "k8s.io/client-go/informers/apps/v1beta2"
+	listersappsv1beta2 "k8s.io/client-go/listers/apps/v1beta2"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1beta2informers "k8s.io/client-go/informers/apps/v1beta2"
-	upstreamappsv1beta2listers "k8s.io/client-go/listers/apps/v1beta2"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1beta2listers "github.com/kcp-dev/client-go/listers/apps/v1beta2"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta2 "github.com/kcp-dev/client-go/listers/apps/v1beta2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // DeploymentClusterInformer provides access to a shared informer and lister for
 // Deployments.
 type DeploymentClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1beta2informers.DeploymentInformer
+	Cluster(logicalcluster.Name) appsv1beta2.DeploymentInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1beta2.DeploymentInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1beta2listers.DeploymentClusterLister
+	Lister() kcpv1beta2.DeploymentClusterLister
 }
 
 type deploymentClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewDeploymentClusterInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewDeploymentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewDeploymentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDeploymentClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredDeploymentClusterInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredDeploymentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredDeploymentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta2().Deployments().List(context.TODO(), options)
+				return client.AppsV1beta2().Deployments().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta2().Deployments().Watch(context.TODO(), options)
+				return client.AppsV1beta2().Deployments().Watch(context.Background(), options)
 			},
 		},
-		&appsv1beta2.Deployment{},
+		&apiappsv1beta2.Deployment{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *deploymentClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *deploymentClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDeploymentClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *deploymentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1beta2.Deployment{}, f.defaultInformer)
+func (i *deploymentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1beta2.Deployment{}, i.defaultInformer)
 }
 
-func (f *deploymentClusterInformer) Lister() appsv1beta2listers.DeploymentClusterLister {
-	return appsv1beta2listers.NewDeploymentClusterLister(f.Informer().GetIndexer())
+func (i *deploymentClusterInformer) Lister() kcpv1beta2.DeploymentClusterLister {
+	return kcpv1beta2.NewDeploymentClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *deploymentClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1beta2.DeploymentInformer {
+	return &deploymentInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *deploymentClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1beta2informers.DeploymentInformer {
+func (i *deploymentClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1beta2.DeploymentInformer {
 	return &deploymentInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type deploymentInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1beta2listers.DeploymentLister
+	lister   listersappsv1beta2.DeploymentLister
 }
 
-func (f *deploymentInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *deploymentInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *deploymentInformer) Lister() upstreamappsv1beta2listers.DeploymentLister {
-	return f.lister
+func (i *deploymentInformer) Lister() listersappsv1beta2.DeploymentLister {
+	return i.lister
 }
diff --git a/informers/apps/v1beta2/interface.go b/informers/apps/v1beta2/interface.go
index b56ba2049..b7fc5f1d2 100644
--- a/informers/apps/v1beta2/interface.go
+++ b/informers/apps/v1beta2/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,58 +14,58 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// StatefulSets returns a StatefulSetClusterInformer
-	StatefulSets() StatefulSetClusterInformer
-	// Deployments returns a DeploymentClusterInformer
-	Deployments() DeploymentClusterInformer
-	// DaemonSets returns a DaemonSetClusterInformer
+	// ControllerRevisions returns a ControllerRevisionClusterInformer.
+	ControllerRevisions() ControllerRevisionClusterInformer
+	// DaemonSets returns a DaemonSetClusterInformer.
 	DaemonSets() DaemonSetClusterInformer
-	// ReplicaSets returns a ReplicaSetClusterInformer
+	// Deployments returns a DeploymentClusterInformer.
+	Deployments() DeploymentClusterInformer
+	// ReplicaSets returns a ReplicaSetClusterInformer.
 	ReplicaSets() ReplicaSetClusterInformer
-	// ControllerRevisions returns a ControllerRevisionClusterInformer
-	ControllerRevisions() ControllerRevisionClusterInformer
+	// StatefulSets returns a StatefulSetClusterInformer.
+	StatefulSets() StatefulSetClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// StatefulSets returns a StatefulSetClusterInformer
-func (v *version) StatefulSets() StatefulSetClusterInformer {
-	return &statefulSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// Deployments returns a DeploymentClusterInformer
-func (v *version) Deployments() DeploymentClusterInformer {
-	return &deploymentClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// ControllerRevisions returns a ControllerRevisionClusterInformer.
+func (v *version) ControllerRevisions() ControllerRevisionClusterInformer {
+	return &controllerRevisionClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// DaemonSets returns a DaemonSetClusterInformer
+// DaemonSets returns a DaemonSetClusterInformer.
 func (v *version) DaemonSets() DaemonSetClusterInformer {
 	return &daemonSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ReplicaSets returns a ReplicaSetClusterInformer
+// Deployments returns a DeploymentClusterInformer.
+func (v *version) Deployments() DeploymentClusterInformer {
+	return &deploymentClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ReplicaSets returns a ReplicaSetClusterInformer.
 func (v *version) ReplicaSets() ReplicaSetClusterInformer {
 	return &replicaSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ControllerRevisions returns a ControllerRevisionClusterInformer
-func (v *version) ControllerRevisions() ControllerRevisionClusterInformer {
-	return &controllerRevisionClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// StatefulSets returns a StatefulSetClusterInformer.
+func (v *version) StatefulSets() StatefulSetClusterInformer {
+	return &statefulSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/apps/v1beta2/replicaset.go b/informers/apps/v1beta2/replicaset.go
index 881067ff0..4c62832e0 100644
--- a/informers/apps/v1beta2/replicaset.go
+++ b/informers/apps/v1beta2/replicaset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1beta2 "k8s.io/api/apps/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1beta2 "k8s.io/client-go/informers/apps/v1beta2"
+	listersappsv1beta2 "k8s.io/client-go/listers/apps/v1beta2"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1beta2informers "k8s.io/client-go/informers/apps/v1beta2"
-	upstreamappsv1beta2listers "k8s.io/client-go/listers/apps/v1beta2"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1beta2listers "github.com/kcp-dev/client-go/listers/apps/v1beta2"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta2 "github.com/kcp-dev/client-go/listers/apps/v1beta2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ReplicaSetClusterInformer provides access to a shared informer and lister for
 // ReplicaSets.
 type ReplicaSetClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1beta2informers.ReplicaSetInformer
+	Cluster(logicalcluster.Name) appsv1beta2.ReplicaSetInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1beta2.ReplicaSetInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1beta2listers.ReplicaSetClusterLister
+	Lister() kcpv1beta2.ReplicaSetClusterLister
 }
 
 type replicaSetClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewReplicaSetClusterInformer constructs a new informer for ReplicaSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewReplicaSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewReplicaSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredReplicaSetClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredReplicaSetClusterInformer constructs a new informer for ReplicaSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredReplicaSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredReplicaSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta2().ReplicaSets().List(context.TODO(), options)
+				return client.AppsV1beta2().ReplicaSets().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta2().ReplicaSets().Watch(context.TODO(), options)
+				return client.AppsV1beta2().ReplicaSets().Watch(context.Background(), options)
 			},
 		},
-		&appsv1beta2.ReplicaSet{},
+		&apiappsv1beta2.ReplicaSet{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *replicaSetClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *replicaSetClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredReplicaSetClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *replicaSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1beta2.ReplicaSet{}, f.defaultInformer)
+func (i *replicaSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1beta2.ReplicaSet{}, i.defaultInformer)
 }
 
-func (f *replicaSetClusterInformer) Lister() appsv1beta2listers.ReplicaSetClusterLister {
-	return appsv1beta2listers.NewReplicaSetClusterLister(f.Informer().GetIndexer())
+func (i *replicaSetClusterInformer) Lister() kcpv1beta2.ReplicaSetClusterLister {
+	return kcpv1beta2.NewReplicaSetClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *replicaSetClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1beta2.ReplicaSetInformer {
+	return &replicaSetInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *replicaSetClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1beta2informers.ReplicaSetInformer {
+func (i *replicaSetClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1beta2.ReplicaSetInformer {
 	return &replicaSetInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type replicaSetInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1beta2listers.ReplicaSetLister
+	lister   listersappsv1beta2.ReplicaSetLister
 }
 
-func (f *replicaSetInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *replicaSetInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *replicaSetInformer) Lister() upstreamappsv1beta2listers.ReplicaSetLister {
-	return f.lister
+func (i *replicaSetInformer) Lister() listersappsv1beta2.ReplicaSetLister {
+	return i.lister
 }
diff --git a/informers/apps/v1beta2/statefulset.go b/informers/apps/v1beta2/statefulset.go
index c7beb2171..8a4dd5ec5 100644
--- a/informers/apps/v1beta2/statefulset.go
+++ b/informers/apps/v1beta2/statefulset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiappsv1beta2 "k8s.io/api/apps/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	appsv1beta2 "k8s.io/client-go/informers/apps/v1beta2"
+	listersappsv1beta2 "k8s.io/client-go/listers/apps/v1beta2"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamappsv1beta2informers "k8s.io/client-go/informers/apps/v1beta2"
-	upstreamappsv1beta2listers "k8s.io/client-go/listers/apps/v1beta2"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	appsv1beta2listers "github.com/kcp-dev/client-go/listers/apps/v1beta2"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta2 "github.com/kcp-dev/client-go/listers/apps/v1beta2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // StatefulSetClusterInformer provides access to a shared informer and lister for
 // StatefulSets.
 type StatefulSetClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamappsv1beta2informers.StatefulSetInformer
+	Cluster(logicalcluster.Name) appsv1beta2.StatefulSetInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) appsv1beta2.StatefulSetInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() appsv1beta2listers.StatefulSetClusterLister
+	Lister() kcpv1beta2.StatefulSetClusterLister
 }
 
 type statefulSetClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewStatefulSetClusterInformer constructs a new informer for StatefulSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewStatefulSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewStatefulSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredStatefulSetClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredStatefulSetClusterInformer constructs a new informer for StatefulSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredStatefulSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredStatefulSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta2().StatefulSets().List(context.TODO(), options)
+				return client.AppsV1beta2().StatefulSets().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AppsV1beta2().StatefulSets().Watch(context.TODO(), options)
+				return client.AppsV1beta2().StatefulSets().Watch(context.Background(), options)
 			},
 		},
-		&appsv1beta2.StatefulSet{},
+		&apiappsv1beta2.StatefulSet{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *statefulSetClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *statefulSetClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredStatefulSetClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *statefulSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&appsv1beta2.StatefulSet{}, f.defaultInformer)
+func (i *statefulSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiappsv1beta2.StatefulSet{}, i.defaultInformer)
 }
 
-func (f *statefulSetClusterInformer) Lister() appsv1beta2listers.StatefulSetClusterLister {
-	return appsv1beta2listers.NewStatefulSetClusterLister(f.Informer().GetIndexer())
+func (i *statefulSetClusterInformer) Lister() kcpv1beta2.StatefulSetClusterLister {
+	return kcpv1beta2.NewStatefulSetClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *statefulSetClusterInformer) Cluster(clusterName logicalcluster.Name) appsv1beta2.StatefulSetInformer {
+	return &statefulSetInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *statefulSetClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamappsv1beta2informers.StatefulSetInformer {
+func (i *statefulSetClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) appsv1beta2.StatefulSetInformer {
 	return &statefulSetInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type statefulSetInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamappsv1beta2listers.StatefulSetLister
+	lister   listersappsv1beta2.StatefulSetLister
 }
 
-func (f *statefulSetInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *statefulSetInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *statefulSetInformer) Lister() upstreamappsv1beta2listers.StatefulSetLister {
-	return f.lister
+func (i *statefulSetInformer) Lister() listersappsv1beta2.StatefulSetLister {
+	return i.lister
 }
diff --git a/informers/autoscaling/interface.go b/informers/autoscaling/interface.go
index b55046252..3956026f8 100644
--- a/informers/autoscaling/interface.go
+++ b/informers/autoscaling/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,55 +14,56 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package autoscaling
 
 import (
-	"github.com/kcp-dev/client-go/informers/autoscaling/v1"
-	"github.com/kcp-dev/client-go/informers/autoscaling/v2"
-	"github.com/kcp-dev/client-go/informers/autoscaling/v2beta1"
-	"github.com/kcp-dev/client-go/informers/autoscaling/v2beta2"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/autoscaling/v1"
+	kcpv2 "github.com/kcp-dev/client-go/informers/autoscaling/v2"
+	kcpv2beta1 "github.com/kcp-dev/client-go/informers/autoscaling/v2beta1"
+	kcpv2beta2 "github.com/kcp-dev/client-go/informers/autoscaling/v2beta2"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V2 provides access to the shared informers in V2.
-	V2() v2.ClusterInterface
-	// V2beta1 provides access to the shared informers in V2beta1.
-	V2beta1() v2beta1.ClusterInterface
-	// V2beta2 provides access to the shared informers in V2beta2.
-	V2beta2() v2beta2.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V2 provides access to shared informers for resources in V2.
+	V2() kcpv2.ClusterInterface
+	// V2beta1 provides access to shared informers for resources in V2beta1.
+	V2beta1() kcpv2beta1.ClusterInterface
+	// V2beta2 provides access to shared informers for resources in V2beta2.
+	V2beta2() kcpv2beta2.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V2 returns a new v2.ClusterInterface.
-func (g *group) V2() v2.ClusterInterface {
-	return v2.New(g.factory, g.tweakListOptions)
+// V2 returns a new kcpv2.ClusterInterface.
+func (g *group) V2() kcpv2.ClusterInterface {
+	return kcpv2.New(g.factory, g.tweakListOptions)
 }
 
-// V2beta1 returns a new v2beta1.ClusterInterface.
-func (g *group) V2beta1() v2beta1.ClusterInterface {
-	return v2beta1.New(g.factory, g.tweakListOptions)
+// V2beta1 returns a new kcpv2beta1.ClusterInterface.
+func (g *group) V2beta1() kcpv2beta1.ClusterInterface {
+	return kcpv2beta1.New(g.factory, g.tweakListOptions)
 }
 
-// V2beta2 returns a new v2beta2.ClusterInterface.
-func (g *group) V2beta2() v2beta2.ClusterInterface {
-	return v2beta2.New(g.factory, g.tweakListOptions)
+// V2beta2 returns a new kcpv2beta2.ClusterInterface.
+func (g *group) V2beta2() kcpv2beta2.ClusterInterface {
+	return kcpv2beta2.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/autoscaling/v1/horizontalpodautoscaler.go b/informers/autoscaling/v1/horizontalpodautoscaler.go
index d647e99ef..f04bb65fd 100644
--- a/informers/autoscaling/v1/horizontalpodautoscaler.go
+++ b/informers/autoscaling/v1/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiautoscalingv1 "k8s.io/api/autoscaling/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	autoscalingv1 "k8s.io/client-go/informers/autoscaling/v1"
+	listersautoscalingv1 "k8s.io/client-go/listers/autoscaling/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	autoscalingv1 "k8s.io/api/autoscaling/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamautoscalingv1informers "k8s.io/client-go/informers/autoscaling/v1"
-	upstreamautoscalingv1listers "k8s.io/client-go/listers/autoscaling/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	autoscalingv1listers "github.com/kcp-dev/client-go/listers/autoscaling/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/autoscaling/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // HorizontalPodAutoscalerClusterInformer provides access to a shared informer and lister for
 // HorizontalPodAutoscalers.
 type HorizontalPodAutoscalerClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamautoscalingv1informers.HorizontalPodAutoscalerInformer
+	Cluster(logicalcluster.Name) autoscalingv1.HorizontalPodAutoscalerInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) autoscalingv1.HorizontalPodAutoscalerInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() autoscalingv1listers.HorizontalPodAutoscalerClusterLister
+	Lister() kcpv1.HorizontalPodAutoscalerClusterLister
 }
 
 type horizontalPodAutoscalerClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewHorizontalPodAutoscalerClusterInformer constructs a new informer for HorizontalPodAutoscaler type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewHorizontalPodAutoscalerClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewHorizontalPodAutoscalerClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredHorizontalPodAutoscalerClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredHorizontalPodAutoscalerClusterInformer constructs a new informer for HorizontalPodAutoscaler type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredHorizontalPodAutoscalerClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredHorizontalPodAutoscalerClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AutoscalingV1().HorizontalPodAutoscalers().List(context.TODO(), options)
+				return client.AutoscalingV1().HorizontalPodAutoscalers().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AutoscalingV1().HorizontalPodAutoscalers().Watch(context.TODO(), options)
+				return client.AutoscalingV1().HorizontalPodAutoscalers().Watch(context.Background(), options)
 			},
 		},
-		&autoscalingv1.HorizontalPodAutoscaler{},
+		&apiautoscalingv1.HorizontalPodAutoscaler{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *horizontalPodAutoscalerClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredHorizontalPodAutoscalerClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *horizontalPodAutoscalerClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiautoscalingv1.HorizontalPodAutoscaler{}, i.defaultInformer)
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&autoscalingv1.HorizontalPodAutoscaler{}, f.defaultInformer)
+func (i *horizontalPodAutoscalerClusterInformer) Lister() kcpv1.HorizontalPodAutoscalerClusterLister {
+	return kcpv1.NewHorizontalPodAutoscalerClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) Lister() autoscalingv1listers.HorizontalPodAutoscalerClusterLister {
-	return autoscalingv1listers.NewHorizontalPodAutoscalerClusterLister(f.Informer().GetIndexer())
+func (i *horizontalPodAutoscalerClusterInformer) Cluster(clusterName logicalcluster.Name) autoscalingv1.HorizontalPodAutoscalerInformer {
+	return &horizontalPodAutoscalerInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamautoscalingv1informers.HorizontalPodAutoscalerInformer {
+func (i *horizontalPodAutoscalerClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) autoscalingv1.HorizontalPodAutoscalerInformer {
 	return &horizontalPodAutoscalerInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type horizontalPodAutoscalerInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamautoscalingv1listers.HorizontalPodAutoscalerLister
+	lister   listersautoscalingv1.HorizontalPodAutoscalerLister
 }
 
-func (f *horizontalPodAutoscalerInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *horizontalPodAutoscalerInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *horizontalPodAutoscalerInformer) Lister() upstreamautoscalingv1listers.HorizontalPodAutoscalerLister {
-	return f.lister
+func (i *horizontalPodAutoscalerInformer) Lister() listersautoscalingv1.HorizontalPodAutoscalerLister {
+	return i.lister
 }
diff --git a/informers/autoscaling/v1/interface.go b/informers/autoscaling/v1/interface.go
index 62c48596e..342976b1a 100644
--- a/informers/autoscaling/v1/interface.go
+++ b/informers/autoscaling/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer
+	// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer.
 	HorizontalPodAutoscalers() HorizontalPodAutoscalerClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer
+// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer.
 func (v *version) HorizontalPodAutoscalers() HorizontalPodAutoscalerClusterInformer {
 	return &horizontalPodAutoscalerClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/autoscaling/v2/horizontalpodautoscaler.go b/informers/autoscaling/v2/horizontalpodautoscaler.go
index 9d6de7277..c32739fc0 100644
--- a/informers/autoscaling/v2/horizontalpodautoscaler.go
+++ b/informers/autoscaling/v2/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v2
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiautoscalingv2 "k8s.io/api/autoscaling/v2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	autoscalingv2 "k8s.io/client-go/informers/autoscaling/v2"
+	listersautoscalingv2 "k8s.io/client-go/listers/autoscaling/v2"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	autoscalingv2 "k8s.io/api/autoscaling/v2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamautoscalingv2informers "k8s.io/client-go/informers/autoscaling/v2"
-	upstreamautoscalingv2listers "k8s.io/client-go/listers/autoscaling/v2"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	autoscalingv2listers "github.com/kcp-dev/client-go/listers/autoscaling/v2"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv2 "github.com/kcp-dev/client-go/listers/autoscaling/v2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // HorizontalPodAutoscalerClusterInformer provides access to a shared informer and lister for
 // HorizontalPodAutoscalers.
 type HorizontalPodAutoscalerClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamautoscalingv2informers.HorizontalPodAutoscalerInformer
+	Cluster(logicalcluster.Name) autoscalingv2.HorizontalPodAutoscalerInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) autoscalingv2.HorizontalPodAutoscalerInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() autoscalingv2listers.HorizontalPodAutoscalerClusterLister
+	Lister() kcpv2.HorizontalPodAutoscalerClusterLister
 }
 
 type horizontalPodAutoscalerClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewHorizontalPodAutoscalerClusterInformer constructs a new informer for HorizontalPodAutoscaler type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewHorizontalPodAutoscalerClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewHorizontalPodAutoscalerClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredHorizontalPodAutoscalerClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredHorizontalPodAutoscalerClusterInformer constructs a new informer for HorizontalPodAutoscaler type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredHorizontalPodAutoscalerClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredHorizontalPodAutoscalerClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AutoscalingV2().HorizontalPodAutoscalers().List(context.TODO(), options)
+				return client.AutoscalingV2().HorizontalPodAutoscalers().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AutoscalingV2().HorizontalPodAutoscalers().Watch(context.TODO(), options)
+				return client.AutoscalingV2().HorizontalPodAutoscalers().Watch(context.Background(), options)
 			},
 		},
-		&autoscalingv2.HorizontalPodAutoscaler{},
+		&apiautoscalingv2.HorizontalPodAutoscaler{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *horizontalPodAutoscalerClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredHorizontalPodAutoscalerClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&autoscalingv2.HorizontalPodAutoscaler{}, f.defaultInformer)
+func (i *horizontalPodAutoscalerClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiautoscalingv2.HorizontalPodAutoscaler{}, i.defaultInformer)
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) Lister() autoscalingv2listers.HorizontalPodAutoscalerClusterLister {
-	return autoscalingv2listers.NewHorizontalPodAutoscalerClusterLister(f.Informer().GetIndexer())
+func (i *horizontalPodAutoscalerClusterInformer) Lister() kcpv2.HorizontalPodAutoscalerClusterLister {
+	return kcpv2.NewHorizontalPodAutoscalerClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *horizontalPodAutoscalerClusterInformer) Cluster(clusterName logicalcluster.Name) autoscalingv2.HorizontalPodAutoscalerInformer {
+	return &horizontalPodAutoscalerInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamautoscalingv2informers.HorizontalPodAutoscalerInformer {
+func (i *horizontalPodAutoscalerClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) autoscalingv2.HorizontalPodAutoscalerInformer {
 	return &horizontalPodAutoscalerInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type horizontalPodAutoscalerInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamautoscalingv2listers.HorizontalPodAutoscalerLister
+	lister   listersautoscalingv2.HorizontalPodAutoscalerLister
 }
 
-func (f *horizontalPodAutoscalerInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *horizontalPodAutoscalerInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *horizontalPodAutoscalerInformer) Lister() upstreamautoscalingv2listers.HorizontalPodAutoscalerLister {
-	return f.lister
+func (i *horizontalPodAutoscalerInformer) Lister() listersautoscalingv2.HorizontalPodAutoscalerLister {
+	return i.lister
 }
diff --git a/informers/autoscaling/v2/interface.go b/informers/autoscaling/v2/interface.go
index 3d827ded8..44dad46c5 100644
--- a/informers/autoscaling/v2/interface.go
+++ b/informers/autoscaling/v2/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v2
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer
+	// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer.
 	HorizontalPodAutoscalers() HorizontalPodAutoscalerClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer
+// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer.
 func (v *version) HorizontalPodAutoscalers() HorizontalPodAutoscalerClusterInformer {
 	return &horizontalPodAutoscalerClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/autoscaling/v2beta1/horizontalpodautoscaler.go b/informers/autoscaling/v2beta1/horizontalpodautoscaler.go
index 24bcc9b6e..e13d89306 100644
--- a/informers/autoscaling/v2beta1/horizontalpodautoscaler.go
+++ b/informers/autoscaling/v2beta1/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v2beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiautoscalingv2beta1 "k8s.io/api/autoscaling/v2beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	autoscalingv2beta1 "k8s.io/client-go/informers/autoscaling/v2beta1"
+	listersautoscalingv2beta1 "k8s.io/client-go/listers/autoscaling/v2beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	autoscalingv2beta1 "k8s.io/api/autoscaling/v2beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamautoscalingv2beta1informers "k8s.io/client-go/informers/autoscaling/v2beta1"
-	upstreamautoscalingv2beta1listers "k8s.io/client-go/listers/autoscaling/v2beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	autoscalingv2beta1listers "github.com/kcp-dev/client-go/listers/autoscaling/v2beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv2beta1 "github.com/kcp-dev/client-go/listers/autoscaling/v2beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // HorizontalPodAutoscalerClusterInformer provides access to a shared informer and lister for
 // HorizontalPodAutoscalers.
 type HorizontalPodAutoscalerClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamautoscalingv2beta1informers.HorizontalPodAutoscalerInformer
+	Cluster(logicalcluster.Name) autoscalingv2beta1.HorizontalPodAutoscalerInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) autoscalingv2beta1.HorizontalPodAutoscalerInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() autoscalingv2beta1listers.HorizontalPodAutoscalerClusterLister
+	Lister() kcpv2beta1.HorizontalPodAutoscalerClusterLister
 }
 
 type horizontalPodAutoscalerClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewHorizontalPodAutoscalerClusterInformer constructs a new informer for HorizontalPodAutoscaler type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewHorizontalPodAutoscalerClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewHorizontalPodAutoscalerClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredHorizontalPodAutoscalerClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredHorizontalPodAutoscalerClusterInformer constructs a new informer for HorizontalPodAutoscaler type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredHorizontalPodAutoscalerClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredHorizontalPodAutoscalerClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AutoscalingV2beta1().HorizontalPodAutoscalers().List(context.TODO(), options)
+				return client.AutoscalingV2beta1().HorizontalPodAutoscalers().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AutoscalingV2beta1().HorizontalPodAutoscalers().Watch(context.TODO(), options)
+				return client.AutoscalingV2beta1().HorizontalPodAutoscalers().Watch(context.Background(), options)
 			},
 		},
-		&autoscalingv2beta1.HorizontalPodAutoscaler{},
+		&apiautoscalingv2beta1.HorizontalPodAutoscaler{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *horizontalPodAutoscalerClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredHorizontalPodAutoscalerClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&autoscalingv2beta1.HorizontalPodAutoscaler{}, f.defaultInformer)
+func (i *horizontalPodAutoscalerClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiautoscalingv2beta1.HorizontalPodAutoscaler{}, i.defaultInformer)
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) Lister() autoscalingv2beta1listers.HorizontalPodAutoscalerClusterLister {
-	return autoscalingv2beta1listers.NewHorizontalPodAutoscalerClusterLister(f.Informer().GetIndexer())
+func (i *horizontalPodAutoscalerClusterInformer) Lister() kcpv2beta1.HorizontalPodAutoscalerClusterLister {
+	return kcpv2beta1.NewHorizontalPodAutoscalerClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *horizontalPodAutoscalerClusterInformer) Cluster(clusterName logicalcluster.Name) autoscalingv2beta1.HorizontalPodAutoscalerInformer {
+	return &horizontalPodAutoscalerInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamautoscalingv2beta1informers.HorizontalPodAutoscalerInformer {
+func (i *horizontalPodAutoscalerClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) autoscalingv2beta1.HorizontalPodAutoscalerInformer {
 	return &horizontalPodAutoscalerInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type horizontalPodAutoscalerInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamautoscalingv2beta1listers.HorizontalPodAutoscalerLister
+	lister   listersautoscalingv2beta1.HorizontalPodAutoscalerLister
 }
 
-func (f *horizontalPodAutoscalerInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *horizontalPodAutoscalerInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *horizontalPodAutoscalerInformer) Lister() upstreamautoscalingv2beta1listers.HorizontalPodAutoscalerLister {
-	return f.lister
+func (i *horizontalPodAutoscalerInformer) Lister() listersautoscalingv2beta1.HorizontalPodAutoscalerLister {
+	return i.lister
 }
diff --git a/informers/autoscaling/v2beta1/interface.go b/informers/autoscaling/v2beta1/interface.go
index d86262066..7c0775ad8 100644
--- a/informers/autoscaling/v2beta1/interface.go
+++ b/informers/autoscaling/v2beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v2beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer
+	// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer.
 	HorizontalPodAutoscalers() HorizontalPodAutoscalerClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer
+// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer.
 func (v *version) HorizontalPodAutoscalers() HorizontalPodAutoscalerClusterInformer {
 	return &horizontalPodAutoscalerClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/autoscaling/v2beta2/horizontalpodautoscaler.go b/informers/autoscaling/v2beta2/horizontalpodautoscaler.go
index c38d187f7..a42865772 100644
--- a/informers/autoscaling/v2beta2/horizontalpodautoscaler.go
+++ b/informers/autoscaling/v2beta2/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v2beta2
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiautoscalingv2beta2 "k8s.io/api/autoscaling/v2beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	autoscalingv2beta2 "k8s.io/client-go/informers/autoscaling/v2beta2"
+	listersautoscalingv2beta2 "k8s.io/client-go/listers/autoscaling/v2beta2"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	autoscalingv2beta2 "k8s.io/api/autoscaling/v2beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamautoscalingv2beta2informers "k8s.io/client-go/informers/autoscaling/v2beta2"
-	upstreamautoscalingv2beta2listers "k8s.io/client-go/listers/autoscaling/v2beta2"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	autoscalingv2beta2listers "github.com/kcp-dev/client-go/listers/autoscaling/v2beta2"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv2beta2 "github.com/kcp-dev/client-go/listers/autoscaling/v2beta2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // HorizontalPodAutoscalerClusterInformer provides access to a shared informer and lister for
 // HorizontalPodAutoscalers.
 type HorizontalPodAutoscalerClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamautoscalingv2beta2informers.HorizontalPodAutoscalerInformer
+	Cluster(logicalcluster.Name) autoscalingv2beta2.HorizontalPodAutoscalerInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) autoscalingv2beta2.HorizontalPodAutoscalerInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() autoscalingv2beta2listers.HorizontalPodAutoscalerClusterLister
+	Lister() kcpv2beta2.HorizontalPodAutoscalerClusterLister
 }
 
 type horizontalPodAutoscalerClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewHorizontalPodAutoscalerClusterInformer constructs a new informer for HorizontalPodAutoscaler type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewHorizontalPodAutoscalerClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewHorizontalPodAutoscalerClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredHorizontalPodAutoscalerClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredHorizontalPodAutoscalerClusterInformer constructs a new informer for HorizontalPodAutoscaler type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredHorizontalPodAutoscalerClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredHorizontalPodAutoscalerClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AutoscalingV2beta2().HorizontalPodAutoscalers().List(context.TODO(), options)
+				return client.AutoscalingV2beta2().HorizontalPodAutoscalers().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.AutoscalingV2beta2().HorizontalPodAutoscalers().Watch(context.TODO(), options)
+				return client.AutoscalingV2beta2().HorizontalPodAutoscalers().Watch(context.Background(), options)
 			},
 		},
-		&autoscalingv2beta2.HorizontalPodAutoscaler{},
+		&apiautoscalingv2beta2.HorizontalPodAutoscaler{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *horizontalPodAutoscalerClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredHorizontalPodAutoscalerClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&autoscalingv2beta2.HorizontalPodAutoscaler{}, f.defaultInformer)
+func (i *horizontalPodAutoscalerClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiautoscalingv2beta2.HorizontalPodAutoscaler{}, i.defaultInformer)
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) Lister() autoscalingv2beta2listers.HorizontalPodAutoscalerClusterLister {
-	return autoscalingv2beta2listers.NewHorizontalPodAutoscalerClusterLister(f.Informer().GetIndexer())
+func (i *horizontalPodAutoscalerClusterInformer) Lister() kcpv2beta2.HorizontalPodAutoscalerClusterLister {
+	return kcpv2beta2.NewHorizontalPodAutoscalerClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *horizontalPodAutoscalerClusterInformer) Cluster(clusterName logicalcluster.Name) autoscalingv2beta2.HorizontalPodAutoscalerInformer {
+	return &horizontalPodAutoscalerInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *horizontalPodAutoscalerClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamautoscalingv2beta2informers.HorizontalPodAutoscalerInformer {
+func (i *horizontalPodAutoscalerClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) autoscalingv2beta2.HorizontalPodAutoscalerInformer {
 	return &horizontalPodAutoscalerInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type horizontalPodAutoscalerInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamautoscalingv2beta2listers.HorizontalPodAutoscalerLister
+	lister   listersautoscalingv2beta2.HorizontalPodAutoscalerLister
 }
 
-func (f *horizontalPodAutoscalerInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *horizontalPodAutoscalerInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *horizontalPodAutoscalerInformer) Lister() upstreamautoscalingv2beta2listers.HorizontalPodAutoscalerLister {
-	return f.lister
+func (i *horizontalPodAutoscalerInformer) Lister() listersautoscalingv2beta2.HorizontalPodAutoscalerLister {
+	return i.lister
 }
diff --git a/informers/autoscaling/v2beta2/interface.go b/informers/autoscaling/v2beta2/interface.go
index 9b4df5104..a3f9b3e7b 100644
--- a/informers/autoscaling/v2beta2/interface.go
+++ b/informers/autoscaling/v2beta2/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v2beta2
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer
+	// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer.
 	HorizontalPodAutoscalers() HorizontalPodAutoscalerClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer
+// HorizontalPodAutoscalers returns a HorizontalPodAutoscalerClusterInformer.
 func (v *version) HorizontalPodAutoscalers() HorizontalPodAutoscalerClusterInformer {
 	return &horizontalPodAutoscalerClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/batch/interface.go b/informers/batch/interface.go
index af7431fbb..609b3e545 100644
--- a/informers/batch/interface.go
+++ b/informers/batch/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,39 +14,40 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package batch
 
 import (
-	"github.com/kcp-dev/client-go/informers/batch/v1"
-	"github.com/kcp-dev/client-go/informers/batch/v1beta1"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/batch/v1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/batch/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/batch/v1/cronjob.go b/informers/batch/v1/cronjob.go
index 0a450837a..0db6bb4a8 100644
--- a/informers/batch/v1/cronjob.go
+++ b/informers/batch/v1/cronjob.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apibatchv1 "k8s.io/api/batch/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	batchv1 "k8s.io/client-go/informers/batch/v1"
+	listersbatchv1 "k8s.io/client-go/listers/batch/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	batchv1 "k8s.io/api/batch/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreambatchv1informers "k8s.io/client-go/informers/batch/v1"
-	upstreambatchv1listers "k8s.io/client-go/listers/batch/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	batchv1listers "github.com/kcp-dev/client-go/listers/batch/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/batch/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CronJobClusterInformer provides access to a shared informer and lister for
 // CronJobs.
 type CronJobClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreambatchv1informers.CronJobInformer
+	Cluster(logicalcluster.Name) batchv1.CronJobInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) batchv1.CronJobInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() batchv1listers.CronJobClusterLister
+	Lister() kcpv1.CronJobClusterLister
 }
 
 type cronJobClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewCronJobClusterInformer constructs a new informer for CronJob type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewCronJobClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewCronJobClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCronJobClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredCronJobClusterInformer constructs a new informer for CronJob type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredCronJobClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredCronJobClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.BatchV1().CronJobs().List(context.TODO(), options)
+				return client.BatchV1().CronJobs().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.BatchV1().CronJobs().Watch(context.TODO(), options)
+				return client.BatchV1().CronJobs().Watch(context.Background(), options)
 			},
 		},
-		&batchv1.CronJob{},
+		&apibatchv1.CronJob{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *cronJobClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *cronJobClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCronJobClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *cronJobClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apibatchv1.CronJob{}, i.defaultInformer)
 }
 
-func (f *cronJobClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&batchv1.CronJob{}, f.defaultInformer)
+func (i *cronJobClusterInformer) Lister() kcpv1.CronJobClusterLister {
+	return kcpv1.NewCronJobClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *cronJobClusterInformer) Lister() batchv1listers.CronJobClusterLister {
-	return batchv1listers.NewCronJobClusterLister(f.Informer().GetIndexer())
+func (i *cronJobClusterInformer) Cluster(clusterName logicalcluster.Name) batchv1.CronJobInformer {
+	return &cronJobInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *cronJobClusterInformer) Cluster(clusterName logicalcluster.Name) upstreambatchv1informers.CronJobInformer {
+func (i *cronJobClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) batchv1.CronJobInformer {
 	return &cronJobInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type cronJobInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreambatchv1listers.CronJobLister
+	lister   listersbatchv1.CronJobLister
 }
 
-func (f *cronJobInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *cronJobInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *cronJobInformer) Lister() upstreambatchv1listers.CronJobLister {
-	return f.lister
+func (i *cronJobInformer) Lister() listersbatchv1.CronJobLister {
+	return i.lister
 }
diff --git a/informers/batch/v1/interface.go b/informers/batch/v1/interface.go
index b938ab924..85f2fdab8 100644
--- a/informers/batch/v1/interface.go
+++ b/informers/batch/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,37 +14,37 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// Jobs returns a JobClusterInformer
-	Jobs() JobClusterInformer
-	// CronJobs returns a CronJobClusterInformer
+	// CronJobs returns a CronJobClusterInformer.
 	CronJobs() CronJobClusterInformer
+	// Jobs returns a JobClusterInformer.
+	Jobs() JobClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// Jobs returns a JobClusterInformer
-func (v *version) Jobs() JobClusterInformer {
-	return &jobClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// CronJobs returns a CronJobClusterInformer
+// CronJobs returns a CronJobClusterInformer.
 func (v *version) CronJobs() CronJobClusterInformer {
 	return &cronJobClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// Jobs returns a JobClusterInformer.
+func (v *version) Jobs() JobClusterInformer {
+	return &jobClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/batch/v1/job.go b/informers/batch/v1/job.go
index 1f3839f63..4d6085f5e 100644
--- a/informers/batch/v1/job.go
+++ b/informers/batch/v1/job.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apibatchv1 "k8s.io/api/batch/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	batchv1 "k8s.io/client-go/informers/batch/v1"
+	listersbatchv1 "k8s.io/client-go/listers/batch/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	batchv1 "k8s.io/api/batch/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreambatchv1informers "k8s.io/client-go/informers/batch/v1"
-	upstreambatchv1listers "k8s.io/client-go/listers/batch/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	batchv1listers "github.com/kcp-dev/client-go/listers/batch/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/batch/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // JobClusterInformer provides access to a shared informer and lister for
 // Jobs.
 type JobClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreambatchv1informers.JobInformer
+	Cluster(logicalcluster.Name) batchv1.JobInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) batchv1.JobInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() batchv1listers.JobClusterLister
+	Lister() kcpv1.JobClusterLister
 }
 
 type jobClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewJobClusterInformer constructs a new informer for Job type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewJobClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewJobClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredJobClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredJobClusterInformer constructs a new informer for Job type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredJobClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredJobClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.BatchV1().Jobs().List(context.TODO(), options)
+				return client.BatchV1().Jobs().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.BatchV1().Jobs().Watch(context.TODO(), options)
+				return client.BatchV1().Jobs().Watch(context.Background(), options)
 			},
 		},
-		&batchv1.Job{},
+		&apibatchv1.Job{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *jobClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *jobClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredJobClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *jobClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apibatchv1.Job{}, i.defaultInformer)
 }
 
-func (f *jobClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&batchv1.Job{}, f.defaultInformer)
+func (i *jobClusterInformer) Lister() kcpv1.JobClusterLister {
+	return kcpv1.NewJobClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *jobClusterInformer) Lister() batchv1listers.JobClusterLister {
-	return batchv1listers.NewJobClusterLister(f.Informer().GetIndexer())
+func (i *jobClusterInformer) Cluster(clusterName logicalcluster.Name) batchv1.JobInformer {
+	return &jobInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *jobClusterInformer) Cluster(clusterName logicalcluster.Name) upstreambatchv1informers.JobInformer {
+func (i *jobClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) batchv1.JobInformer {
 	return &jobInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type jobInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreambatchv1listers.JobLister
+	lister   listersbatchv1.JobLister
 }
 
-func (f *jobInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *jobInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *jobInformer) Lister() upstreambatchv1listers.JobLister {
-	return f.lister
+func (i *jobInformer) Lister() listersbatchv1.JobLister {
+	return i.lister
 }
diff --git a/informers/batch/v1beta1/cronjob.go b/informers/batch/v1beta1/cronjob.go
index 5cab4c1ef..7f36c3826 100644
--- a/informers/batch/v1beta1/cronjob.go
+++ b/informers/batch/v1beta1/cronjob.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apibatchv1beta1 "k8s.io/api/batch/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	batchv1beta1 "k8s.io/client-go/informers/batch/v1beta1"
+	listersbatchv1beta1 "k8s.io/client-go/listers/batch/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	batchv1beta1 "k8s.io/api/batch/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreambatchv1beta1informers "k8s.io/client-go/informers/batch/v1beta1"
-	upstreambatchv1beta1listers "k8s.io/client-go/listers/batch/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	batchv1beta1listers "github.com/kcp-dev/client-go/listers/batch/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/batch/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CronJobClusterInformer provides access to a shared informer and lister for
 // CronJobs.
 type CronJobClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreambatchv1beta1informers.CronJobInformer
+	Cluster(logicalcluster.Name) batchv1beta1.CronJobInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) batchv1beta1.CronJobInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() batchv1beta1listers.CronJobClusterLister
+	Lister() kcpv1beta1.CronJobClusterLister
 }
 
 type cronJobClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewCronJobClusterInformer constructs a new informer for CronJob type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewCronJobClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewCronJobClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCronJobClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredCronJobClusterInformer constructs a new informer for CronJob type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredCronJobClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredCronJobClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.BatchV1beta1().CronJobs().List(context.TODO(), options)
+				return client.BatchV1beta1().CronJobs().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.BatchV1beta1().CronJobs().Watch(context.TODO(), options)
+				return client.BatchV1beta1().CronJobs().Watch(context.Background(), options)
 			},
 		},
-		&batchv1beta1.CronJob{},
+		&apibatchv1beta1.CronJob{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *cronJobClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *cronJobClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCronJobClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *cronJobClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&batchv1beta1.CronJob{}, f.defaultInformer)
+func (i *cronJobClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apibatchv1beta1.CronJob{}, i.defaultInformer)
 }
 
-func (f *cronJobClusterInformer) Lister() batchv1beta1listers.CronJobClusterLister {
-	return batchv1beta1listers.NewCronJobClusterLister(f.Informer().GetIndexer())
+func (i *cronJobClusterInformer) Lister() kcpv1beta1.CronJobClusterLister {
+	return kcpv1beta1.NewCronJobClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *cronJobClusterInformer) Cluster(clusterName logicalcluster.Name) batchv1beta1.CronJobInformer {
+	return &cronJobInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *cronJobClusterInformer) Cluster(clusterName logicalcluster.Name) upstreambatchv1beta1informers.CronJobInformer {
+func (i *cronJobClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) batchv1beta1.CronJobInformer {
 	return &cronJobInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type cronJobInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreambatchv1beta1listers.CronJobLister
+	lister   listersbatchv1beta1.CronJobLister
 }
 
-func (f *cronJobInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *cronJobInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *cronJobInformer) Lister() upstreambatchv1beta1listers.CronJobLister {
-	return f.lister
+func (i *cronJobInformer) Lister() listersbatchv1beta1.CronJobLister {
+	return i.lister
 }
diff --git a/informers/batch/v1beta1/interface.go b/informers/batch/v1beta1/interface.go
index ba53cde8b..146dda567 100644
--- a/informers/batch/v1beta1/interface.go
+++ b/informers/batch/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// CronJobs returns a CronJobClusterInformer
+	// CronJobs returns a CronJobClusterInformer.
 	CronJobs() CronJobClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// CronJobs returns a CronJobClusterInformer
+// CronJobs returns a CronJobClusterInformer.
 func (v *version) CronJobs() CronJobClusterInformer {
 	return &cronJobClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/certificates/interface.go b/informers/certificates/interface.go
index d4cf811d9..de21bb4a0 100644
--- a/informers/certificates/interface.go
+++ b/informers/certificates/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,39 +14,48 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package certificates
 
 import (
-	"github.com/kcp-dev/client-go/informers/certificates/v1"
-	"github.com/kcp-dev/client-go/informers/certificates/v1beta1"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/certificates/v1"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/informers/certificates/v1alpha1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/certificates/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() kcpv1alpha1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
+}
+
+// V1alpha1 returns a new kcpv1alpha1.ClusterInterface.
+func (g *group) V1alpha1() kcpv1alpha1.ClusterInterface {
+	return kcpv1alpha1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/certificates/v1/certificatesigningrequest.go b/informers/certificates/v1/certificatesigningrequest.go
index 1f63d9b6a..b61608a5a 100644
--- a/informers/certificates/v1/certificatesigningrequest.go
+++ b/informers/certificates/v1/certificatesigningrequest.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicertificatesv1 "k8s.io/api/certificates/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	certificatesv1 "k8s.io/client-go/informers/certificates/v1"
+	listerscertificatesv1 "k8s.io/client-go/listers/certificates/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	certificatesv1 "k8s.io/api/certificates/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcertificatesv1informers "k8s.io/client-go/informers/certificates/v1"
-	upstreamcertificatesv1listers "k8s.io/client-go/listers/certificates/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	certificatesv1listers "github.com/kcp-dev/client-go/listers/certificates/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/certificates/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CertificateSigningRequestClusterInformer provides access to a shared informer and lister for
 // CertificateSigningRequests.
 type CertificateSigningRequestClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcertificatesv1informers.CertificateSigningRequestInformer
+	Cluster(logicalcluster.Name) certificatesv1.CertificateSigningRequestInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) certificatesv1.CertificateSigningRequestInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() certificatesv1listers.CertificateSigningRequestClusterLister
+	Lister() kcpv1.CertificateSigningRequestClusterLister
 }
 
 type certificateSigningRequestClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewCertificateSigningRequestClusterInformer constructs a new informer for CertificateSigningRequest type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewCertificateSigningRequestClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewCertificateSigningRequestClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCertificateSigningRequestClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredCertificateSigningRequestClusterInformer constructs a new informer for CertificateSigningRequest type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredCertificateSigningRequestClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredCertificateSigningRequestClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CertificatesV1().CertificateSigningRequests().List(context.TODO(), options)
+				return client.CertificatesV1().CertificateSigningRequests().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CertificatesV1().CertificateSigningRequests().Watch(context.TODO(), options)
+				return client.CertificatesV1().CertificateSigningRequests().Watch(context.Background(), options)
 			},
 		},
-		&certificatesv1.CertificateSigningRequest{},
+		&apicertificatesv1.CertificateSigningRequest{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *certificateSigningRequestClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *certificateSigningRequestClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCertificateSigningRequestClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *certificateSigningRequestClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicertificatesv1.CertificateSigningRequest{}, i.defaultInformer)
 }
 
-func (f *certificateSigningRequestClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&certificatesv1.CertificateSigningRequest{}, f.defaultInformer)
+func (i *certificateSigningRequestClusterInformer) Lister() kcpv1.CertificateSigningRequestClusterLister {
+	return kcpv1.NewCertificateSigningRequestClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *certificateSigningRequestClusterInformer) Lister() certificatesv1listers.CertificateSigningRequestClusterLister {
-	return certificatesv1listers.NewCertificateSigningRequestClusterLister(f.Informer().GetIndexer())
+func (i *certificateSigningRequestClusterInformer) Cluster(clusterName logicalcluster.Name) certificatesv1.CertificateSigningRequestInformer {
+	return &certificateSigningRequestInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *certificateSigningRequestClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcertificatesv1informers.CertificateSigningRequestInformer {
+func (i *certificateSigningRequestClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) certificatesv1.CertificateSigningRequestInformer {
 	return &certificateSigningRequestInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type certificateSigningRequestInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcertificatesv1listers.CertificateSigningRequestLister
+	lister   listerscertificatesv1.CertificateSigningRequestLister
 }
 
-func (f *certificateSigningRequestInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *certificateSigningRequestInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *certificateSigningRequestInformer) Lister() upstreamcertificatesv1listers.CertificateSigningRequestLister {
-	return f.lister
+func (i *certificateSigningRequestInformer) Lister() listerscertificatesv1.CertificateSigningRequestLister {
+	return i.lister
 }
diff --git a/informers/certificates/v1/interface.go b/informers/certificates/v1/interface.go
index 1e7fcbc2b..970795524 100644
--- a/informers/certificates/v1/interface.go
+++ b/informers/certificates/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// CertificateSigningRequests returns a CertificateSigningRequestClusterInformer
+	// CertificateSigningRequests returns a CertificateSigningRequestClusterInformer.
 	CertificateSigningRequests() CertificateSigningRequestClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// CertificateSigningRequests returns a CertificateSigningRequestClusterInformer
+// CertificateSigningRequests returns a CertificateSigningRequestClusterInformer.
 func (v *version) CertificateSigningRequests() CertificateSigningRequestClusterInformer {
 	return &certificateSigningRequestClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/certificates/v1alpha1/clustertrustbundle.go b/informers/certificates/v1alpha1/clustertrustbundle.go
new file mode 100644
index 000000000..f2e7bebec
--- /dev/null
+++ b/informers/certificates/v1alpha1/clustertrustbundle.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+	time "time"
+
+	apicertificatesv1alpha1 "k8s.io/api/certificates/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	certificatesv1alpha1 "k8s.io/client-go/informers/certificates/v1alpha1"
+	listerscertificatesv1alpha1 "k8s.io/client-go/listers/certificates/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/certificates/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ClusterTrustBundleClusterInformer provides access to a shared informer and lister for
+// ClusterTrustBundles.
+type ClusterTrustBundleClusterInformer interface {
+	Cluster(logicalcluster.Name) certificatesv1alpha1.ClusterTrustBundleInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) certificatesv1alpha1.ClusterTrustBundleInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha1.ClusterTrustBundleClusterLister
+}
+
+type clusterTrustBundleClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewClusterTrustBundleClusterInformer constructs a new informer for ClusterTrustBundle type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewClusterTrustBundleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredClusterTrustBundleClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredClusterTrustBundleClusterInformer constructs a new informer for ClusterTrustBundle type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredClusterTrustBundleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CertificatesV1alpha1().ClusterTrustBundles().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CertificatesV1alpha1().ClusterTrustBundles().Watch(context.Background(), options)
+			},
+		},
+		&apicertificatesv1alpha1.ClusterTrustBundle{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *clusterTrustBundleClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredClusterTrustBundleClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *clusterTrustBundleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicertificatesv1alpha1.ClusterTrustBundle{}, i.defaultInformer)
+}
+
+func (i *clusterTrustBundleClusterInformer) Lister() kcpv1alpha1.ClusterTrustBundleClusterLister {
+	return kcpv1alpha1.NewClusterTrustBundleClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *clusterTrustBundleClusterInformer) Cluster(clusterName logicalcluster.Name) certificatesv1alpha1.ClusterTrustBundleInformer {
+	return &clusterTrustBundleInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *clusterTrustBundleClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) certificatesv1alpha1.ClusterTrustBundleInformer {
+	return &clusterTrustBundleInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type clusterTrustBundleInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listerscertificatesv1alpha1.ClusterTrustBundleLister
+}
+
+func (i *clusterTrustBundleInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *clusterTrustBundleInformer) Lister() listerscertificatesv1alpha1.ClusterTrustBundleLister {
+	return i.lister
+}
diff --git a/informers/certificates/v1alpha1/interface.go b/informers/certificates/v1alpha1/interface.go
new file mode 100644
index 000000000..4928d9099
--- /dev/null
+++ b/informers/certificates/v1alpha1/interface.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+)
+
+type ClusterInterface interface {
+	// ClusterTrustBundles returns a ClusterTrustBundleClusterInformer.
+	ClusterTrustBundles() ClusterTrustBundleClusterInformer
+}
+
+type version struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
+	return &version{factory: f, tweakListOptions: tweakListOptions}
+}
+
+// ClusterTrustBundles returns a ClusterTrustBundleClusterInformer.
+func (v *version) ClusterTrustBundles() ClusterTrustBundleClusterInformer {
+	return &clusterTrustBundleClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/certificates/v1beta1/certificatesigningrequest.go b/informers/certificates/v1beta1/certificatesigningrequest.go
index 6656a6561..cca5b4693 100644
--- a/informers/certificates/v1beta1/certificatesigningrequest.go
+++ b/informers/certificates/v1beta1/certificatesigningrequest.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicertificatesv1beta1 "k8s.io/api/certificates/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	certificatesv1beta1 "k8s.io/client-go/informers/certificates/v1beta1"
+	listerscertificatesv1beta1 "k8s.io/client-go/listers/certificates/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcertificatesv1beta1informers "k8s.io/client-go/informers/certificates/v1beta1"
-	upstreamcertificatesv1beta1listers "k8s.io/client-go/listers/certificates/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	certificatesv1beta1listers "github.com/kcp-dev/client-go/listers/certificates/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/certificates/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CertificateSigningRequestClusterInformer provides access to a shared informer and lister for
 // CertificateSigningRequests.
 type CertificateSigningRequestClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcertificatesv1beta1informers.CertificateSigningRequestInformer
+	Cluster(logicalcluster.Name) certificatesv1beta1.CertificateSigningRequestInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) certificatesv1beta1.CertificateSigningRequestInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() certificatesv1beta1listers.CertificateSigningRequestClusterLister
+	Lister() kcpv1beta1.CertificateSigningRequestClusterLister
 }
 
 type certificateSigningRequestClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewCertificateSigningRequestClusterInformer constructs a new informer for CertificateSigningRequest type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewCertificateSigningRequestClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewCertificateSigningRequestClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCertificateSigningRequestClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredCertificateSigningRequestClusterInformer constructs a new informer for CertificateSigningRequest type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredCertificateSigningRequestClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredCertificateSigningRequestClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CertificatesV1beta1().CertificateSigningRequests().List(context.TODO(), options)
+				return client.CertificatesV1beta1().CertificateSigningRequests().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CertificatesV1beta1().CertificateSigningRequests().Watch(context.TODO(), options)
+				return client.CertificatesV1beta1().CertificateSigningRequests().Watch(context.Background(), options)
 			},
 		},
-		&certificatesv1beta1.CertificateSigningRequest{},
+		&apicertificatesv1beta1.CertificateSigningRequest{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *certificateSigningRequestClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *certificateSigningRequestClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCertificateSigningRequestClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *certificateSigningRequestClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&certificatesv1beta1.CertificateSigningRequest{}, f.defaultInformer)
+func (i *certificateSigningRequestClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicertificatesv1beta1.CertificateSigningRequest{}, i.defaultInformer)
 }
 
-func (f *certificateSigningRequestClusterInformer) Lister() certificatesv1beta1listers.CertificateSigningRequestClusterLister {
-	return certificatesv1beta1listers.NewCertificateSigningRequestClusterLister(f.Informer().GetIndexer())
+func (i *certificateSigningRequestClusterInformer) Lister() kcpv1beta1.CertificateSigningRequestClusterLister {
+	return kcpv1beta1.NewCertificateSigningRequestClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *certificateSigningRequestClusterInformer) Cluster(clusterName logicalcluster.Name) certificatesv1beta1.CertificateSigningRequestInformer {
+	return &certificateSigningRequestInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *certificateSigningRequestClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcertificatesv1beta1informers.CertificateSigningRequestInformer {
+func (i *certificateSigningRequestClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) certificatesv1beta1.CertificateSigningRequestInformer {
 	return &certificateSigningRequestInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type certificateSigningRequestInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcertificatesv1beta1listers.CertificateSigningRequestLister
+	lister   listerscertificatesv1beta1.CertificateSigningRequestLister
 }
 
-func (f *certificateSigningRequestInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *certificateSigningRequestInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *certificateSigningRequestInformer) Lister() upstreamcertificatesv1beta1listers.CertificateSigningRequestLister {
-	return f.lister
+func (i *certificateSigningRequestInformer) Lister() listerscertificatesv1beta1.CertificateSigningRequestLister {
+	return i.lister
 }
diff --git a/informers/certificates/v1beta1/clustertrustbundle.go b/informers/certificates/v1beta1/clustertrustbundle.go
new file mode 100644
index 000000000..603a0f485
--- /dev/null
+++ b/informers/certificates/v1beta1/clustertrustbundle.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apicertificatesv1beta1 "k8s.io/api/certificates/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	certificatesv1beta1 "k8s.io/client-go/informers/certificates/v1beta1"
+	listerscertificatesv1beta1 "k8s.io/client-go/listers/certificates/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/certificates/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ClusterTrustBundleClusterInformer provides access to a shared informer and lister for
+// ClusterTrustBundles.
+type ClusterTrustBundleClusterInformer interface {
+	Cluster(logicalcluster.Name) certificatesv1beta1.ClusterTrustBundleInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) certificatesv1beta1.ClusterTrustBundleInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta1.ClusterTrustBundleClusterLister
+}
+
+type clusterTrustBundleClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewClusterTrustBundleClusterInformer constructs a new informer for ClusterTrustBundle type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewClusterTrustBundleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredClusterTrustBundleClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredClusterTrustBundleClusterInformer constructs a new informer for ClusterTrustBundle type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredClusterTrustBundleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CertificatesV1beta1().ClusterTrustBundles().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CertificatesV1beta1().ClusterTrustBundles().Watch(context.Background(), options)
+			},
+		},
+		&apicertificatesv1beta1.ClusterTrustBundle{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *clusterTrustBundleClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredClusterTrustBundleClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *clusterTrustBundleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicertificatesv1beta1.ClusterTrustBundle{}, i.defaultInformer)
+}
+
+func (i *clusterTrustBundleClusterInformer) Lister() kcpv1beta1.ClusterTrustBundleClusterLister {
+	return kcpv1beta1.NewClusterTrustBundleClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *clusterTrustBundleClusterInformer) Cluster(clusterName logicalcluster.Name) certificatesv1beta1.ClusterTrustBundleInformer {
+	return &clusterTrustBundleInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *clusterTrustBundleClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) certificatesv1beta1.ClusterTrustBundleInformer {
+	return &clusterTrustBundleInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type clusterTrustBundleInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listerscertificatesv1beta1.ClusterTrustBundleLister
+}
+
+func (i *clusterTrustBundleInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *clusterTrustBundleInformer) Lister() listerscertificatesv1beta1.ClusterTrustBundleLister {
+	return i.lister
+}
diff --git a/informers/certificates/v1beta1/interface.go b/informers/certificates/v1beta1/interface.go
index 1d8109df0..e7023aa84 100644
--- a/informers/certificates/v1beta1/interface.go
+++ b/informers/certificates/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,37 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// CertificateSigningRequests returns a CertificateSigningRequestClusterInformer
+	// CertificateSigningRequests returns a CertificateSigningRequestClusterInformer.
 	CertificateSigningRequests() CertificateSigningRequestClusterInformer
+	// ClusterTrustBundles returns a ClusterTrustBundleClusterInformer.
+	ClusterTrustBundles() ClusterTrustBundleClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// CertificateSigningRequests returns a CertificateSigningRequestClusterInformer
+// CertificateSigningRequests returns a CertificateSigningRequestClusterInformer.
 func (v *version) CertificateSigningRequests() CertificateSigningRequestClusterInformer {
 	return &certificateSigningRequestClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// ClusterTrustBundles returns a ClusterTrustBundleClusterInformer.
+func (v *version) ClusterTrustBundles() ClusterTrustBundleClusterInformer {
+	return &clusterTrustBundleClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/coordination/interface.go b/informers/coordination/interface.go
index b2480330c..bfb8cb118 100644
--- a/informers/coordination/interface.go
+++ b/informers/coordination/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,39 +14,48 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package coordination
 
 import (
-	"github.com/kcp-dev/client-go/informers/coordination/v1"
-	"github.com/kcp-dev/client-go/informers/coordination/v1beta1"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/coordination/v1"
+	kcpv1alpha2 "github.com/kcp-dev/client-go/informers/coordination/v1alpha2"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/coordination/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1alpha2 provides access to shared informers for resources in V1alpha2.
+	V1alpha2() kcpv1alpha2.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
+}
+
+// V1alpha2 returns a new kcpv1alpha2.ClusterInterface.
+func (g *group) V1alpha2() kcpv1alpha2.ClusterInterface {
+	return kcpv1alpha2.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/coordination/v1/interface.go b/informers/coordination/v1/interface.go
index e4532ba3e..a9916ed7e 100644
--- a/informers/coordination/v1/interface.go
+++ b/informers/coordination/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// Leases returns a LeaseClusterInformer
+	// Leases returns a LeaseClusterInformer.
 	Leases() LeaseClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// Leases returns a LeaseClusterInformer
+// Leases returns a LeaseClusterInformer.
 func (v *version) Leases() LeaseClusterInformer {
 	return &leaseClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/coordination/v1/lease.go b/informers/coordination/v1/lease.go
index 02c2b4000..96261f9b6 100644
--- a/informers/coordination/v1/lease.go
+++ b/informers/coordination/v1/lease.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicoordinationv1 "k8s.io/api/coordination/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	coordinationv1 "k8s.io/client-go/informers/coordination/v1"
+	listerscoordinationv1 "k8s.io/client-go/listers/coordination/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	coordinationv1 "k8s.io/api/coordination/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcoordinationv1informers "k8s.io/client-go/informers/coordination/v1"
-	upstreamcoordinationv1listers "k8s.io/client-go/listers/coordination/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	coordinationv1listers "github.com/kcp-dev/client-go/listers/coordination/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/coordination/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // LeaseClusterInformer provides access to a shared informer and lister for
 // Leases.
 type LeaseClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcoordinationv1informers.LeaseInformer
+	Cluster(logicalcluster.Name) coordinationv1.LeaseInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) coordinationv1.LeaseInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() coordinationv1listers.LeaseClusterLister
+	Lister() kcpv1.LeaseClusterLister
 }
 
 type leaseClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewLeaseClusterInformer constructs a new informer for Lease type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewLeaseClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewLeaseClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredLeaseClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredLeaseClusterInformer constructs a new informer for Lease type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredLeaseClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredLeaseClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoordinationV1().Leases().List(context.TODO(), options)
+				return client.CoordinationV1().Leases().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoordinationV1().Leases().Watch(context.TODO(), options)
+				return client.CoordinationV1().Leases().Watch(context.Background(), options)
 			},
 		},
-		&coordinationv1.Lease{},
+		&apicoordinationv1.Lease{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *leaseClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *leaseClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredLeaseClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *leaseClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicoordinationv1.Lease{}, i.defaultInformer)
 }
 
-func (f *leaseClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&coordinationv1.Lease{}, f.defaultInformer)
+func (i *leaseClusterInformer) Lister() kcpv1.LeaseClusterLister {
+	return kcpv1.NewLeaseClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *leaseClusterInformer) Lister() coordinationv1listers.LeaseClusterLister {
-	return coordinationv1listers.NewLeaseClusterLister(f.Informer().GetIndexer())
+func (i *leaseClusterInformer) Cluster(clusterName logicalcluster.Name) coordinationv1.LeaseInformer {
+	return &leaseInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *leaseClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcoordinationv1informers.LeaseInformer {
+func (i *leaseClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) coordinationv1.LeaseInformer {
 	return &leaseInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type leaseInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcoordinationv1listers.LeaseLister
+	lister   listerscoordinationv1.LeaseLister
 }
 
-func (f *leaseInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *leaseInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *leaseInformer) Lister() upstreamcoordinationv1listers.LeaseLister {
-	return f.lister
+func (i *leaseInformer) Lister() listerscoordinationv1.LeaseLister {
+	return i.lister
 }
diff --git a/informers/coordination/v1alpha2/interface.go b/informers/coordination/v1alpha2/interface.go
new file mode 100644
index 000000000..dc7e402ff
--- /dev/null
+++ b/informers/coordination/v1alpha2/interface.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+)
+
+type ClusterInterface interface {
+	// LeaseCandidates returns a LeaseCandidateClusterInformer.
+	LeaseCandidates() LeaseCandidateClusterInformer
+}
+
+type version struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
+	return &version{factory: f, tweakListOptions: tweakListOptions}
+}
+
+// LeaseCandidates returns a LeaseCandidateClusterInformer.
+func (v *version) LeaseCandidates() LeaseCandidateClusterInformer {
+	return &leaseCandidateClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/coordination/v1alpha2/leasecandidate.go b/informers/coordination/v1alpha2/leasecandidate.go
new file mode 100644
index 000000000..eca5d98d6
--- /dev/null
+++ b/informers/coordination/v1alpha2/leasecandidate.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	context "context"
+	time "time"
+
+	apicoordinationv1alpha2 "k8s.io/api/coordination/v1alpha2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	coordinationv1alpha2 "k8s.io/client-go/informers/coordination/v1alpha2"
+	listerscoordinationv1alpha2 "k8s.io/client-go/listers/coordination/v1alpha2"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha2 "github.com/kcp-dev/client-go/listers/coordination/v1alpha2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// LeaseCandidateClusterInformer provides access to a shared informer and lister for
+// LeaseCandidates.
+type LeaseCandidateClusterInformer interface {
+	Cluster(logicalcluster.Name) coordinationv1alpha2.LeaseCandidateInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) coordinationv1alpha2.LeaseCandidateInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha2.LeaseCandidateClusterLister
+}
+
+type leaseCandidateClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewLeaseCandidateClusterInformer constructs a new informer for LeaseCandidate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewLeaseCandidateClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredLeaseCandidateClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredLeaseCandidateClusterInformer constructs a new informer for LeaseCandidate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredLeaseCandidateClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CoordinationV1alpha2().LeaseCandidates().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CoordinationV1alpha2().LeaseCandidates().Watch(context.Background(), options)
+			},
+		},
+		&apicoordinationv1alpha2.LeaseCandidate{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *leaseCandidateClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredLeaseCandidateClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *leaseCandidateClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicoordinationv1alpha2.LeaseCandidate{}, i.defaultInformer)
+}
+
+func (i *leaseCandidateClusterInformer) Lister() kcpv1alpha2.LeaseCandidateClusterLister {
+	return kcpv1alpha2.NewLeaseCandidateClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *leaseCandidateClusterInformer) Cluster(clusterName logicalcluster.Name) coordinationv1alpha2.LeaseCandidateInformer {
+	return &leaseCandidateInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *leaseCandidateClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) coordinationv1alpha2.LeaseCandidateInformer {
+	return &leaseCandidateInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type leaseCandidateInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listerscoordinationv1alpha2.LeaseCandidateLister
+}
+
+func (i *leaseCandidateInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *leaseCandidateInformer) Lister() listerscoordinationv1alpha2.LeaseCandidateLister {
+	return i.lister
+}
diff --git a/informers/coordination/v1beta1/interface.go b/informers/coordination/v1beta1/interface.go
index 91bbfb2f0..e14caa7c3 100644
--- a/informers/coordination/v1beta1/interface.go
+++ b/informers/coordination/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,37 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// Leases returns a LeaseClusterInformer
+	// Leases returns a LeaseClusterInformer.
 	Leases() LeaseClusterInformer
+	// LeaseCandidates returns a LeaseCandidateClusterInformer.
+	LeaseCandidates() LeaseCandidateClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// Leases returns a LeaseClusterInformer
+// Leases returns a LeaseClusterInformer.
 func (v *version) Leases() LeaseClusterInformer {
 	return &leaseClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// LeaseCandidates returns a LeaseCandidateClusterInformer.
+func (v *version) LeaseCandidates() LeaseCandidateClusterInformer {
+	return &leaseCandidateClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/coordination/v1beta1/lease.go b/informers/coordination/v1beta1/lease.go
index 42e28c28e..8e639234c 100644
--- a/informers/coordination/v1beta1/lease.go
+++ b/informers/coordination/v1beta1/lease.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicoordinationv1beta1 "k8s.io/api/coordination/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	coordinationv1beta1 "k8s.io/client-go/informers/coordination/v1beta1"
+	listerscoordinationv1beta1 "k8s.io/client-go/listers/coordination/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	coordinationv1beta1 "k8s.io/api/coordination/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcoordinationv1beta1informers "k8s.io/client-go/informers/coordination/v1beta1"
-	upstreamcoordinationv1beta1listers "k8s.io/client-go/listers/coordination/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	coordinationv1beta1listers "github.com/kcp-dev/client-go/listers/coordination/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/coordination/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // LeaseClusterInformer provides access to a shared informer and lister for
 // Leases.
 type LeaseClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcoordinationv1beta1informers.LeaseInformer
+	Cluster(logicalcluster.Name) coordinationv1beta1.LeaseInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) coordinationv1beta1.LeaseInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() coordinationv1beta1listers.LeaseClusterLister
+	Lister() kcpv1beta1.LeaseClusterLister
 }
 
 type leaseClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewLeaseClusterInformer constructs a new informer for Lease type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewLeaseClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewLeaseClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredLeaseClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredLeaseClusterInformer constructs a new informer for Lease type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredLeaseClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredLeaseClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoordinationV1beta1().Leases().List(context.TODO(), options)
+				return client.CoordinationV1beta1().Leases().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoordinationV1beta1().Leases().Watch(context.TODO(), options)
+				return client.CoordinationV1beta1().Leases().Watch(context.Background(), options)
 			},
 		},
-		&coordinationv1beta1.Lease{},
+		&apicoordinationv1beta1.Lease{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *leaseClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *leaseClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredLeaseClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *leaseClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&coordinationv1beta1.Lease{}, f.defaultInformer)
+func (i *leaseClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicoordinationv1beta1.Lease{}, i.defaultInformer)
 }
 
-func (f *leaseClusterInformer) Lister() coordinationv1beta1listers.LeaseClusterLister {
-	return coordinationv1beta1listers.NewLeaseClusterLister(f.Informer().GetIndexer())
+func (i *leaseClusterInformer) Lister() kcpv1beta1.LeaseClusterLister {
+	return kcpv1beta1.NewLeaseClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *leaseClusterInformer) Cluster(clusterName logicalcluster.Name) coordinationv1beta1.LeaseInformer {
+	return &leaseInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *leaseClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcoordinationv1beta1informers.LeaseInformer {
+func (i *leaseClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) coordinationv1beta1.LeaseInformer {
 	return &leaseInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type leaseInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcoordinationv1beta1listers.LeaseLister
+	lister   listerscoordinationv1beta1.LeaseLister
 }
 
-func (f *leaseInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *leaseInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *leaseInformer) Lister() upstreamcoordinationv1beta1listers.LeaseLister {
-	return f.lister
+func (i *leaseInformer) Lister() listerscoordinationv1beta1.LeaseLister {
+	return i.lister
 }
diff --git a/informers/coordination/v1beta1/leasecandidate.go b/informers/coordination/v1beta1/leasecandidate.go
new file mode 100644
index 000000000..f24e3367e
--- /dev/null
+++ b/informers/coordination/v1beta1/leasecandidate.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apicoordinationv1beta1 "k8s.io/api/coordination/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	coordinationv1beta1 "k8s.io/client-go/informers/coordination/v1beta1"
+	listerscoordinationv1beta1 "k8s.io/client-go/listers/coordination/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/coordination/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// LeaseCandidateClusterInformer provides access to a shared informer and lister for
+// LeaseCandidates.
+type LeaseCandidateClusterInformer interface {
+	Cluster(logicalcluster.Name) coordinationv1beta1.LeaseCandidateInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) coordinationv1beta1.LeaseCandidateInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta1.LeaseCandidateClusterLister
+}
+
+type leaseCandidateClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewLeaseCandidateClusterInformer constructs a new informer for LeaseCandidate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewLeaseCandidateClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredLeaseCandidateClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredLeaseCandidateClusterInformer constructs a new informer for LeaseCandidate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredLeaseCandidateClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CoordinationV1beta1().LeaseCandidates().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.CoordinationV1beta1().LeaseCandidates().Watch(context.Background(), options)
+			},
+		},
+		&apicoordinationv1beta1.LeaseCandidate{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *leaseCandidateClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredLeaseCandidateClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *leaseCandidateClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicoordinationv1beta1.LeaseCandidate{}, i.defaultInformer)
+}
+
+func (i *leaseCandidateClusterInformer) Lister() kcpv1beta1.LeaseCandidateClusterLister {
+	return kcpv1beta1.NewLeaseCandidateClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *leaseCandidateClusterInformer) Cluster(clusterName logicalcluster.Name) coordinationv1beta1.LeaseCandidateInformer {
+	return &leaseCandidateInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *leaseCandidateClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) coordinationv1beta1.LeaseCandidateInformer {
+	return &leaseCandidateInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type leaseCandidateInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listerscoordinationv1beta1.LeaseCandidateLister
+}
+
+func (i *leaseCandidateInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *leaseCandidateInformer) Lister() listerscoordinationv1beta1.LeaseCandidateLister {
+	return i.lister
+}
diff --git a/informers/core/interface.go b/informers/core/interface.go
index 3ce653c76..635244f35 100644
--- a/informers/core/interface.go
+++ b/informers/core/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,31 +14,32 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package core
 
 import (
-	"github.com/kcp-dev/client-go/informers/core/v1"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/core/v1/componentstatus.go b/informers/core/v1/componentstatus.go
index 01c9c2139..2f9f1196f 100644
--- a/informers/core/v1/componentstatus.go
+++ b/informers/core/v1/componentstatus.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ComponentStatusClusterInformer provides access to a shared informer and lister for
 // ComponentStatuses.
 type ComponentStatusClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.ComponentStatusInformer
+	Cluster(logicalcluster.Name) corev1.ComponentStatusInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.ComponentStatusInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.ComponentStatusClusterLister
+	Lister() kcpv1.ComponentStatusClusterLister
 }
 
 type componentStatusClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewComponentStatusClusterInformer constructs a new informer for ComponentStatus type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewComponentStatusClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewComponentStatusClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredComponentStatusClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredComponentStatusClusterInformer constructs a new informer for ComponentStatus type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredComponentStatusClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredComponentStatusClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().ComponentStatuses().List(context.TODO(), options)
+				return client.CoreV1().ComponentStatuses().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().ComponentStatuses().Watch(context.TODO(), options)
+				return client.CoreV1().ComponentStatuses().Watch(context.Background(), options)
 			},
 		},
-		&corev1.ComponentStatus{},
+		&apicorev1.ComponentStatus{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *componentStatusClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *componentStatusClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredComponentStatusClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *componentStatusClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.ComponentStatus{}, i.defaultInformer)
 }
 
-func (f *componentStatusClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.ComponentStatus{}, f.defaultInformer)
+func (i *componentStatusClusterInformer) Lister() kcpv1.ComponentStatusClusterLister {
+	return kcpv1.NewComponentStatusClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *componentStatusClusterInformer) Lister() corev1listers.ComponentStatusClusterLister {
-	return corev1listers.NewComponentStatusClusterLister(f.Informer().GetIndexer())
+func (i *componentStatusClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.ComponentStatusInformer {
+	return &componentStatusInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *componentStatusClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.ComponentStatusInformer {
+func (i *componentStatusClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.ComponentStatusInformer {
 	return &componentStatusInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type componentStatusInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.ComponentStatusLister
+	lister   listerscorev1.ComponentStatusLister
 }
 
-func (f *componentStatusInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *componentStatusInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *componentStatusInformer) Lister() upstreamcorev1listers.ComponentStatusLister {
-	return f.lister
+func (i *componentStatusInformer) Lister() listerscorev1.ComponentStatusLister {
+	return i.lister
 }
diff --git a/informers/core/v1/configmap.go b/informers/core/v1/configmap.go
index 857dde1f6..f38590c70 100644
--- a/informers/core/v1/configmap.go
+++ b/informers/core/v1/configmap.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ConfigMapClusterInformer provides access to a shared informer and lister for
 // ConfigMaps.
 type ConfigMapClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.ConfigMapInformer
+	Cluster(logicalcluster.Name) corev1.ConfigMapInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.ConfigMapInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.ConfigMapClusterLister
+	Lister() kcpv1.ConfigMapClusterLister
 }
 
 type configMapClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewConfigMapClusterInformer constructs a new informer for ConfigMap type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewConfigMapClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewConfigMapClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredConfigMapClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredConfigMapClusterInformer constructs a new informer for ConfigMap type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredConfigMapClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredConfigMapClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().ConfigMaps().List(context.TODO(), options)
+				return client.CoreV1().ConfigMaps().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().ConfigMaps().Watch(context.TODO(), options)
+				return client.CoreV1().ConfigMaps().Watch(context.Background(), options)
 			},
 		},
-		&corev1.ConfigMap{},
+		&apicorev1.ConfigMap{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *configMapClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *configMapClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredConfigMapClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *configMapClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.ConfigMap{}, i.defaultInformer)
 }
 
-func (f *configMapClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.ConfigMap{}, f.defaultInformer)
+func (i *configMapClusterInformer) Lister() kcpv1.ConfigMapClusterLister {
+	return kcpv1.NewConfigMapClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *configMapClusterInformer) Lister() corev1listers.ConfigMapClusterLister {
-	return corev1listers.NewConfigMapClusterLister(f.Informer().GetIndexer())
+func (i *configMapClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.ConfigMapInformer {
+	return &configMapInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *configMapClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.ConfigMapInformer {
+func (i *configMapClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.ConfigMapInformer {
 	return &configMapInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type configMapInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.ConfigMapLister
+	lister   listerscorev1.ConfigMapLister
 }
 
-func (f *configMapInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *configMapInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *configMapInformer) Lister() upstreamcorev1listers.ConfigMapLister {
-	return f.lister
+func (i *configMapInformer) Lister() listerscorev1.ConfigMapLister {
+	return i.lister
 }
diff --git a/informers/core/v1/endpoints.go b/informers/core/v1/endpoints.go
index a142502e2..9aa17c17e 100644
--- a/informers/core/v1/endpoints.go
+++ b/informers/core/v1/endpoints.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // EndpointsClusterInformer provides access to a shared informer and lister for
 // Endpoints.
 type EndpointsClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.EndpointsInformer
+	Cluster(logicalcluster.Name) corev1.EndpointsInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.EndpointsInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.EndpointsClusterLister
+	Lister() kcpv1.EndpointsClusterLister
 }
 
 type endpointsClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewEndpointsClusterInformer constructs a new informer for Endpoints type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewEndpointsClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewEndpointsClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredEndpointsClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredEndpointsClusterInformer constructs a new informer for Endpoints type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredEndpointsClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredEndpointsClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Endpoints().List(context.TODO(), options)
+				return client.CoreV1().Endpoints().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Endpoints().Watch(context.TODO(), options)
+				return client.CoreV1().Endpoints().Watch(context.Background(), options)
 			},
 		},
-		&corev1.Endpoints{},
+		&apicorev1.Endpoints{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *endpointsClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *endpointsClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredEndpointsClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *endpointsClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.Endpoints{}, i.defaultInformer)
 }
 
-func (f *endpointsClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.Endpoints{}, f.defaultInformer)
+func (i *endpointsClusterInformer) Lister() kcpv1.EndpointsClusterLister {
+	return kcpv1.NewEndpointsClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *endpointsClusterInformer) Lister() corev1listers.EndpointsClusterLister {
-	return corev1listers.NewEndpointsClusterLister(f.Informer().GetIndexer())
+func (i *endpointsClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.EndpointsInformer {
+	return &endpointsInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *endpointsClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.EndpointsInformer {
+func (i *endpointsClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.EndpointsInformer {
 	return &endpointsInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type endpointsInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.EndpointsLister
+	lister   listerscorev1.EndpointsLister
 }
 
-func (f *endpointsInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *endpointsInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *endpointsInformer) Lister() upstreamcorev1listers.EndpointsLister {
-	return f.lister
+func (i *endpointsInformer) Lister() listerscorev1.EndpointsLister {
+	return i.lister
 }
diff --git a/informers/core/v1/event.go b/informers/core/v1/event.go
index a0f752c64..ed3e75545 100644
--- a/informers/core/v1/event.go
+++ b/informers/core/v1/event.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // EventClusterInformer provides access to a shared informer and lister for
 // Events.
 type EventClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.EventInformer
+	Cluster(logicalcluster.Name) corev1.EventInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.EventInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.EventClusterLister
+	Lister() kcpv1.EventClusterLister
 }
 
 type eventClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewEventClusterInformer constructs a new informer for Event type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewEventClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewEventClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredEventClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredEventClusterInformer constructs a new informer for Event type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredEventClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredEventClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Events().List(context.TODO(), options)
+				return client.CoreV1().Events().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Events().Watch(context.TODO(), options)
+				return client.CoreV1().Events().Watch(context.Background(), options)
 			},
 		},
-		&corev1.Event{},
+		&apicorev1.Event{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *eventClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *eventClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredEventClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *eventClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.Event{}, i.defaultInformer)
 }
 
-func (f *eventClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.Event{}, f.defaultInformer)
+func (i *eventClusterInformer) Lister() kcpv1.EventClusterLister {
+	return kcpv1.NewEventClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *eventClusterInformer) Lister() corev1listers.EventClusterLister {
-	return corev1listers.NewEventClusterLister(f.Informer().GetIndexer())
+func (i *eventClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.EventInformer {
+	return &eventInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *eventClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.EventInformer {
+func (i *eventClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.EventInformer {
 	return &eventInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type eventInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.EventLister
+	lister   listerscorev1.EventLister
 }
 
-func (f *eventInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *eventInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *eventInformer) Lister() upstreamcorev1listers.EventLister {
-	return f.lister
+func (i *eventInformer) Lister() listerscorev1.EventLister {
+	return i.lister
 }
diff --git a/informers/core/v1/interface.go b/informers/core/v1/interface.go
index 1762169ae..c65e6ed7c 100644
--- a/informers/core/v1/interface.go
+++ b/informers/core/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,135 +14,135 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// PersistentVolumes returns a PersistentVolumeClusterInformer
+	// ComponentStatuses returns a ComponentStatusClusterInformer.
+	ComponentStatuses() ComponentStatusClusterInformer
+	// ConfigMaps returns a ConfigMapClusterInformer.
+	ConfigMaps() ConfigMapClusterInformer
+	// Endpoints returns a EndpointsClusterInformer.
+	Endpoints() EndpointsClusterInformer
+	// Events returns a EventClusterInformer.
+	Events() EventClusterInformer
+	// LimitRanges returns a LimitRangeClusterInformer.
+	LimitRanges() LimitRangeClusterInformer
+	// Namespaces returns a NamespaceClusterInformer.
+	Namespaces() NamespaceClusterInformer
+	// Nodes returns a NodeClusterInformer.
+	Nodes() NodeClusterInformer
+	// PersistentVolumes returns a PersistentVolumeClusterInformer.
 	PersistentVolumes() PersistentVolumeClusterInformer
-	// PersistentVolumeClaims returns a PersistentVolumeClaimClusterInformer
+	// PersistentVolumeClaims returns a PersistentVolumeClaimClusterInformer.
 	PersistentVolumeClaims() PersistentVolumeClaimClusterInformer
-	// Pods returns a PodClusterInformer
+	// Pods returns a PodClusterInformer.
 	Pods() PodClusterInformer
-	// PodTemplates returns a PodTemplateClusterInformer
+	// PodTemplates returns a PodTemplateClusterInformer.
 	PodTemplates() PodTemplateClusterInformer
-	// ReplicationControllers returns a ReplicationControllerClusterInformer
+	// ReplicationControllers returns a ReplicationControllerClusterInformer.
 	ReplicationControllers() ReplicationControllerClusterInformer
-	// Services returns a ServiceClusterInformer
-	Services() ServiceClusterInformer
-	// ServiceAccounts returns a ServiceAccountClusterInformer
-	ServiceAccounts() ServiceAccountClusterInformer
-	// Endpoints returns a EndpointsClusterInformer
-	Endpoints() EndpointsClusterInformer
-	// Nodes returns a NodeClusterInformer
-	Nodes() NodeClusterInformer
-	// Namespaces returns a NamespaceClusterInformer
-	Namespaces() NamespaceClusterInformer
-	// Events returns a EventClusterInformer
-	Events() EventClusterInformer
-	// LimitRanges returns a LimitRangeClusterInformer
-	LimitRanges() LimitRangeClusterInformer
-	// ResourceQuotas returns a ResourceQuotaClusterInformer
+	// ResourceQuotas returns a ResourceQuotaClusterInformer.
 	ResourceQuotas() ResourceQuotaClusterInformer
-	// Secrets returns a SecretClusterInformer
+	// Secrets returns a SecretClusterInformer.
 	Secrets() SecretClusterInformer
-	// ConfigMaps returns a ConfigMapClusterInformer
-	ConfigMaps() ConfigMapClusterInformer
-	// ComponentStatuses returns a ComponentStatusClusterInformer
-	ComponentStatuses() ComponentStatusClusterInformer
+	// Services returns a ServiceClusterInformer.
+	Services() ServiceClusterInformer
+	// ServiceAccounts returns a ServiceAccountClusterInformer.
+	ServiceAccounts() ServiceAccountClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// PersistentVolumes returns a PersistentVolumeClusterInformer
-func (v *version) PersistentVolumes() PersistentVolumeClusterInformer {
-	return &persistentVolumeClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// ComponentStatuses returns a ComponentStatusClusterInformer.
+func (v *version) ComponentStatuses() ComponentStatusClusterInformer {
+	return &componentStatusClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PersistentVolumeClaims returns a PersistentVolumeClaimClusterInformer
-func (v *version) PersistentVolumeClaims() PersistentVolumeClaimClusterInformer {
-	return &persistentVolumeClaimClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// ConfigMaps returns a ConfigMapClusterInformer.
+func (v *version) ConfigMaps() ConfigMapClusterInformer {
+	return &configMapClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Pods returns a PodClusterInformer
-func (v *version) Pods() PodClusterInformer {
-	return &podClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// Endpoints returns a EndpointsClusterInformer.
+func (v *version) Endpoints() EndpointsClusterInformer {
+	return &endpointsClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PodTemplates returns a PodTemplateClusterInformer
-func (v *version) PodTemplates() PodTemplateClusterInformer {
-	return &podTemplateClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// Events returns a EventClusterInformer.
+func (v *version) Events() EventClusterInformer {
+	return &eventClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ReplicationControllers returns a ReplicationControllerClusterInformer
-func (v *version) ReplicationControllers() ReplicationControllerClusterInformer {
-	return &replicationControllerClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// LimitRanges returns a LimitRangeClusterInformer.
+func (v *version) LimitRanges() LimitRangeClusterInformer {
+	return &limitRangeClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Services returns a ServiceClusterInformer
-func (v *version) Services() ServiceClusterInformer {
-	return &serviceClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// Namespaces returns a NamespaceClusterInformer.
+func (v *version) Namespaces() NamespaceClusterInformer {
+	return &namespaceClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ServiceAccounts returns a ServiceAccountClusterInformer
-func (v *version) ServiceAccounts() ServiceAccountClusterInformer {
-	return &serviceAccountClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// Nodes returns a NodeClusterInformer.
+func (v *version) Nodes() NodeClusterInformer {
+	return &nodeClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Endpoints returns a EndpointsClusterInformer
-func (v *version) Endpoints() EndpointsClusterInformer {
-	return &endpointsClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// PersistentVolumes returns a PersistentVolumeClusterInformer.
+func (v *version) PersistentVolumes() PersistentVolumeClusterInformer {
+	return &persistentVolumeClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Nodes returns a NodeClusterInformer
-func (v *version) Nodes() NodeClusterInformer {
-	return &nodeClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// PersistentVolumeClaims returns a PersistentVolumeClaimClusterInformer.
+func (v *version) PersistentVolumeClaims() PersistentVolumeClaimClusterInformer {
+	return &persistentVolumeClaimClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Namespaces returns a NamespaceClusterInformer
-func (v *version) Namespaces() NamespaceClusterInformer {
-	return &namespaceClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// Pods returns a PodClusterInformer.
+func (v *version) Pods() PodClusterInformer {
+	return &podClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Events returns a EventClusterInformer
-func (v *version) Events() EventClusterInformer {
-	return &eventClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// PodTemplates returns a PodTemplateClusterInformer.
+func (v *version) PodTemplates() PodTemplateClusterInformer {
+	return &podTemplateClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// LimitRanges returns a LimitRangeClusterInformer
-func (v *version) LimitRanges() LimitRangeClusterInformer {
-	return &limitRangeClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// ReplicationControllers returns a ReplicationControllerClusterInformer.
+func (v *version) ReplicationControllers() ReplicationControllerClusterInformer {
+	return &replicationControllerClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceQuotas returns a ResourceQuotaClusterInformer
+// ResourceQuotas returns a ResourceQuotaClusterInformer.
 func (v *version) ResourceQuotas() ResourceQuotaClusterInformer {
 	return &resourceQuotaClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Secrets returns a SecretClusterInformer
+// Secrets returns a SecretClusterInformer.
 func (v *version) Secrets() SecretClusterInformer {
 	return &secretClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ConfigMaps returns a ConfigMapClusterInformer
-func (v *version) ConfigMaps() ConfigMapClusterInformer {
-	return &configMapClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// Services returns a ServiceClusterInformer.
+func (v *version) Services() ServiceClusterInformer {
+	return &serviceClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ComponentStatuses returns a ComponentStatusClusterInformer
-func (v *version) ComponentStatuses() ComponentStatusClusterInformer {
-	return &componentStatusClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// ServiceAccounts returns a ServiceAccountClusterInformer.
+func (v *version) ServiceAccounts() ServiceAccountClusterInformer {
+	return &serviceAccountClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/core/v1/limitrange.go b/informers/core/v1/limitrange.go
index 867fc5282..6c0245d4f 100644
--- a/informers/core/v1/limitrange.go
+++ b/informers/core/v1/limitrange.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // LimitRangeClusterInformer provides access to a shared informer and lister for
 // LimitRanges.
 type LimitRangeClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.LimitRangeInformer
+	Cluster(logicalcluster.Name) corev1.LimitRangeInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.LimitRangeInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.LimitRangeClusterLister
+	Lister() kcpv1.LimitRangeClusterLister
 }
 
 type limitRangeClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewLimitRangeClusterInformer constructs a new informer for LimitRange type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewLimitRangeClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewLimitRangeClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredLimitRangeClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredLimitRangeClusterInformer constructs a new informer for LimitRange type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredLimitRangeClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredLimitRangeClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().LimitRanges().List(context.TODO(), options)
+				return client.CoreV1().LimitRanges().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().LimitRanges().Watch(context.TODO(), options)
+				return client.CoreV1().LimitRanges().Watch(context.Background(), options)
 			},
 		},
-		&corev1.LimitRange{},
+		&apicorev1.LimitRange{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *limitRangeClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *limitRangeClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredLimitRangeClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *limitRangeClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.LimitRange{}, i.defaultInformer)
 }
 
-func (f *limitRangeClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.LimitRange{}, f.defaultInformer)
+func (i *limitRangeClusterInformer) Lister() kcpv1.LimitRangeClusterLister {
+	return kcpv1.NewLimitRangeClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *limitRangeClusterInformer) Lister() corev1listers.LimitRangeClusterLister {
-	return corev1listers.NewLimitRangeClusterLister(f.Informer().GetIndexer())
+func (i *limitRangeClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.LimitRangeInformer {
+	return &limitRangeInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *limitRangeClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.LimitRangeInformer {
+func (i *limitRangeClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.LimitRangeInformer {
 	return &limitRangeInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type limitRangeInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.LimitRangeLister
+	lister   listerscorev1.LimitRangeLister
 }
 
-func (f *limitRangeInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *limitRangeInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *limitRangeInformer) Lister() upstreamcorev1listers.LimitRangeLister {
-	return f.lister
+func (i *limitRangeInformer) Lister() listerscorev1.LimitRangeLister {
+	return i.lister
 }
diff --git a/informers/core/v1/namespace.go b/informers/core/v1/namespace.go
index c64bad0e7..d4d40d083 100644
--- a/informers/core/v1/namespace.go
+++ b/informers/core/v1/namespace.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // NamespaceClusterInformer provides access to a shared informer and lister for
 // Namespaces.
 type NamespaceClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.NamespaceInformer
+	Cluster(logicalcluster.Name) corev1.NamespaceInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.NamespaceInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.NamespaceClusterLister
+	Lister() kcpv1.NamespaceClusterLister
 }
 
 type namespaceClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewNamespaceClusterInformer constructs a new informer for Namespace type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewNamespaceClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewNamespaceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredNamespaceClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredNamespaceClusterInformer constructs a new informer for Namespace type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredNamespaceClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredNamespaceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Namespaces().List(context.TODO(), options)
+				return client.CoreV1().Namespaces().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Namespaces().Watch(context.TODO(), options)
+				return client.CoreV1().Namespaces().Watch(context.Background(), options)
 			},
 		},
-		&corev1.Namespace{},
+		&apicorev1.Namespace{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *namespaceClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *namespaceClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredNamespaceClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *namespaceClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.Namespace{}, i.defaultInformer)
 }
 
-func (f *namespaceClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.Namespace{}, f.defaultInformer)
+func (i *namespaceClusterInformer) Lister() kcpv1.NamespaceClusterLister {
+	return kcpv1.NewNamespaceClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *namespaceClusterInformer) Lister() corev1listers.NamespaceClusterLister {
-	return corev1listers.NewNamespaceClusterLister(f.Informer().GetIndexer())
+func (i *namespaceClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.NamespaceInformer {
+	return &namespaceInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *namespaceClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.NamespaceInformer {
+func (i *namespaceClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.NamespaceInformer {
 	return &namespaceInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type namespaceInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.NamespaceLister
+	lister   listerscorev1.NamespaceLister
 }
 
-func (f *namespaceInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *namespaceInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *namespaceInformer) Lister() upstreamcorev1listers.NamespaceLister {
-	return f.lister
+func (i *namespaceInformer) Lister() listerscorev1.NamespaceLister {
+	return i.lister
 }
diff --git a/informers/core/v1/node.go b/informers/core/v1/node.go
index bb7c76903..3930e5021 100644
--- a/informers/core/v1/node.go
+++ b/informers/core/v1/node.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // NodeClusterInformer provides access to a shared informer and lister for
 // Nodes.
 type NodeClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.NodeInformer
+	Cluster(logicalcluster.Name) corev1.NodeInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.NodeInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.NodeClusterLister
+	Lister() kcpv1.NodeClusterLister
 }
 
 type nodeClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewNodeClusterInformer constructs a new informer for Node type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewNodeClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewNodeClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredNodeClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredNodeClusterInformer constructs a new informer for Node type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredNodeClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredNodeClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Nodes().List(context.TODO(), options)
+				return client.CoreV1().Nodes().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Nodes().Watch(context.TODO(), options)
+				return client.CoreV1().Nodes().Watch(context.Background(), options)
 			},
 		},
-		&corev1.Node{},
+		&apicorev1.Node{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *nodeClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *nodeClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredNodeClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *nodeClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.Node{}, i.defaultInformer)
 }
 
-func (f *nodeClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.Node{}, f.defaultInformer)
+func (i *nodeClusterInformer) Lister() kcpv1.NodeClusterLister {
+	return kcpv1.NewNodeClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *nodeClusterInformer) Lister() corev1listers.NodeClusterLister {
-	return corev1listers.NewNodeClusterLister(f.Informer().GetIndexer())
+func (i *nodeClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.NodeInformer {
+	return &nodeInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *nodeClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.NodeInformer {
+func (i *nodeClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.NodeInformer {
 	return &nodeInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type nodeInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.NodeLister
+	lister   listerscorev1.NodeLister
 }
 
-func (f *nodeInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *nodeInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *nodeInformer) Lister() upstreamcorev1listers.NodeLister {
-	return f.lister
+func (i *nodeInformer) Lister() listerscorev1.NodeLister {
+	return i.lister
 }
diff --git a/informers/core/v1/persistentvolume.go b/informers/core/v1/persistentvolume.go
index 984d5119e..72b50e0d0 100644
--- a/informers/core/v1/persistentvolume.go
+++ b/informers/core/v1/persistentvolume.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PersistentVolumeClusterInformer provides access to a shared informer and lister for
 // PersistentVolumes.
 type PersistentVolumeClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.PersistentVolumeInformer
+	Cluster(logicalcluster.Name) corev1.PersistentVolumeInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.PersistentVolumeInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.PersistentVolumeClusterLister
+	Lister() kcpv1.PersistentVolumeClusterLister
 }
 
 type persistentVolumeClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewPersistentVolumeClusterInformer constructs a new informer for PersistentVolume type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPersistentVolumeClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewPersistentVolumeClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPersistentVolumeClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredPersistentVolumeClusterInformer constructs a new informer for PersistentVolume type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPersistentVolumeClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredPersistentVolumeClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().PersistentVolumes().List(context.TODO(), options)
+				return client.CoreV1().PersistentVolumes().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().PersistentVolumes().Watch(context.TODO(), options)
+				return client.CoreV1().PersistentVolumes().Watch(context.Background(), options)
 			},
 		},
-		&corev1.PersistentVolume{},
+		&apicorev1.PersistentVolume{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *persistentVolumeClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *persistentVolumeClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPersistentVolumeClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *persistentVolumeClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.PersistentVolume{}, i.defaultInformer)
 }
 
-func (f *persistentVolumeClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.PersistentVolume{}, f.defaultInformer)
+func (i *persistentVolumeClusterInformer) Lister() kcpv1.PersistentVolumeClusterLister {
+	return kcpv1.NewPersistentVolumeClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *persistentVolumeClusterInformer) Lister() corev1listers.PersistentVolumeClusterLister {
-	return corev1listers.NewPersistentVolumeClusterLister(f.Informer().GetIndexer())
+func (i *persistentVolumeClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.PersistentVolumeInformer {
+	return &persistentVolumeInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *persistentVolumeClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.PersistentVolumeInformer {
+func (i *persistentVolumeClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.PersistentVolumeInformer {
 	return &persistentVolumeInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type persistentVolumeInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.PersistentVolumeLister
+	lister   listerscorev1.PersistentVolumeLister
 }
 
-func (f *persistentVolumeInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *persistentVolumeInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *persistentVolumeInformer) Lister() upstreamcorev1listers.PersistentVolumeLister {
-	return f.lister
+func (i *persistentVolumeInformer) Lister() listerscorev1.PersistentVolumeLister {
+	return i.lister
 }
diff --git a/informers/core/v1/persistentvolumeclaim.go b/informers/core/v1/persistentvolumeclaim.go
index e0736e042..c3ecf91eb 100644
--- a/informers/core/v1/persistentvolumeclaim.go
+++ b/informers/core/v1/persistentvolumeclaim.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PersistentVolumeClaimClusterInformer provides access to a shared informer and lister for
 // PersistentVolumeClaims.
 type PersistentVolumeClaimClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.PersistentVolumeClaimInformer
+	Cluster(logicalcluster.Name) corev1.PersistentVolumeClaimInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.PersistentVolumeClaimInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.PersistentVolumeClaimClusterLister
+	Lister() kcpv1.PersistentVolumeClaimClusterLister
 }
 
 type persistentVolumeClaimClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewPersistentVolumeClaimClusterInformer constructs a new informer for PersistentVolumeClaim type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPersistentVolumeClaimClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewPersistentVolumeClaimClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPersistentVolumeClaimClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredPersistentVolumeClaimClusterInformer constructs a new informer for PersistentVolumeClaim type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPersistentVolumeClaimClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredPersistentVolumeClaimClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().PersistentVolumeClaims().List(context.TODO(), options)
+				return client.CoreV1().PersistentVolumeClaims().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().PersistentVolumeClaims().Watch(context.TODO(), options)
+				return client.CoreV1().PersistentVolumeClaims().Watch(context.Background(), options)
 			},
 		},
-		&corev1.PersistentVolumeClaim{},
+		&apicorev1.PersistentVolumeClaim{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *persistentVolumeClaimClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *persistentVolumeClaimClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPersistentVolumeClaimClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *persistentVolumeClaimClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.PersistentVolumeClaim{}, i.defaultInformer)
 }
 
-func (f *persistentVolumeClaimClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.PersistentVolumeClaim{}, f.defaultInformer)
+func (i *persistentVolumeClaimClusterInformer) Lister() kcpv1.PersistentVolumeClaimClusterLister {
+	return kcpv1.NewPersistentVolumeClaimClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *persistentVolumeClaimClusterInformer) Lister() corev1listers.PersistentVolumeClaimClusterLister {
-	return corev1listers.NewPersistentVolumeClaimClusterLister(f.Informer().GetIndexer())
+func (i *persistentVolumeClaimClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.PersistentVolumeClaimInformer {
+	return &persistentVolumeClaimInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *persistentVolumeClaimClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.PersistentVolumeClaimInformer {
+func (i *persistentVolumeClaimClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.PersistentVolumeClaimInformer {
 	return &persistentVolumeClaimInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type persistentVolumeClaimInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.PersistentVolumeClaimLister
+	lister   listerscorev1.PersistentVolumeClaimLister
 }
 
-func (f *persistentVolumeClaimInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *persistentVolumeClaimInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *persistentVolumeClaimInformer) Lister() upstreamcorev1listers.PersistentVolumeClaimLister {
-	return f.lister
+func (i *persistentVolumeClaimInformer) Lister() listerscorev1.PersistentVolumeClaimLister {
+	return i.lister
 }
diff --git a/informers/core/v1/pod.go b/informers/core/v1/pod.go
index 8cb08d975..d3ae5a96e 100644
--- a/informers/core/v1/pod.go
+++ b/informers/core/v1/pod.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PodClusterInformer provides access to a shared informer and lister for
 // Pods.
 type PodClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.PodInformer
+	Cluster(logicalcluster.Name) corev1.PodInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.PodInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.PodClusterLister
+	Lister() kcpv1.PodClusterLister
 }
 
 type podClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewPodClusterInformer constructs a new informer for Pod type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPodClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewPodClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPodClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredPodClusterInformer constructs a new informer for Pod type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPodClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredPodClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Pods().List(context.TODO(), options)
+				return client.CoreV1().Pods().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Pods().Watch(context.TODO(), options)
+				return client.CoreV1().Pods().Watch(context.Background(), options)
 			},
 		},
-		&corev1.Pod{},
+		&apicorev1.Pod{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *podClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *podClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPodClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *podClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.Pod{}, i.defaultInformer)
 }
 
-func (f *podClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.Pod{}, f.defaultInformer)
+func (i *podClusterInformer) Lister() kcpv1.PodClusterLister {
+	return kcpv1.NewPodClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *podClusterInformer) Lister() corev1listers.PodClusterLister {
-	return corev1listers.NewPodClusterLister(f.Informer().GetIndexer())
+func (i *podClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.PodInformer {
+	return &podInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *podClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.PodInformer {
+func (i *podClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.PodInformer {
 	return &podInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type podInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.PodLister
+	lister   listerscorev1.PodLister
 }
 
-func (f *podInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *podInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *podInformer) Lister() upstreamcorev1listers.PodLister {
-	return f.lister
+func (i *podInformer) Lister() listerscorev1.PodLister {
+	return i.lister
 }
diff --git a/informers/core/v1/podtemplate.go b/informers/core/v1/podtemplate.go
index 167ec9ad4..80d97859a 100644
--- a/informers/core/v1/podtemplate.go
+++ b/informers/core/v1/podtemplate.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PodTemplateClusterInformer provides access to a shared informer and lister for
 // PodTemplates.
 type PodTemplateClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.PodTemplateInformer
+	Cluster(logicalcluster.Name) corev1.PodTemplateInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.PodTemplateInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.PodTemplateClusterLister
+	Lister() kcpv1.PodTemplateClusterLister
 }
 
 type podTemplateClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewPodTemplateClusterInformer constructs a new informer for PodTemplate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPodTemplateClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewPodTemplateClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPodTemplateClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredPodTemplateClusterInformer constructs a new informer for PodTemplate type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPodTemplateClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredPodTemplateClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().PodTemplates().List(context.TODO(), options)
+				return client.CoreV1().PodTemplates().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().PodTemplates().Watch(context.TODO(), options)
+				return client.CoreV1().PodTemplates().Watch(context.Background(), options)
 			},
 		},
-		&corev1.PodTemplate{},
+		&apicorev1.PodTemplate{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *podTemplateClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *podTemplateClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPodTemplateClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *podTemplateClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.PodTemplate{}, i.defaultInformer)
 }
 
-func (f *podTemplateClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.PodTemplate{}, f.defaultInformer)
+func (i *podTemplateClusterInformer) Lister() kcpv1.PodTemplateClusterLister {
+	return kcpv1.NewPodTemplateClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *podTemplateClusterInformer) Lister() corev1listers.PodTemplateClusterLister {
-	return corev1listers.NewPodTemplateClusterLister(f.Informer().GetIndexer())
+func (i *podTemplateClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.PodTemplateInformer {
+	return &podTemplateInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *podTemplateClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.PodTemplateInformer {
+func (i *podTemplateClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.PodTemplateInformer {
 	return &podTemplateInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type podTemplateInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.PodTemplateLister
+	lister   listerscorev1.PodTemplateLister
 }
 
-func (f *podTemplateInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *podTemplateInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *podTemplateInformer) Lister() upstreamcorev1listers.PodTemplateLister {
-	return f.lister
+func (i *podTemplateInformer) Lister() listerscorev1.PodTemplateLister {
+	return i.lister
 }
diff --git a/informers/core/v1/replicationcontroller.go b/informers/core/v1/replicationcontroller.go
index b74c0b58d..fe68a7242 100644
--- a/informers/core/v1/replicationcontroller.go
+++ b/informers/core/v1/replicationcontroller.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ReplicationControllerClusterInformer provides access to a shared informer and lister for
 // ReplicationControllers.
 type ReplicationControllerClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.ReplicationControllerInformer
+	Cluster(logicalcluster.Name) corev1.ReplicationControllerInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.ReplicationControllerInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.ReplicationControllerClusterLister
+	Lister() kcpv1.ReplicationControllerClusterLister
 }
 
 type replicationControllerClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewReplicationControllerClusterInformer constructs a new informer for ReplicationController type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewReplicationControllerClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewReplicationControllerClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredReplicationControllerClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredReplicationControllerClusterInformer constructs a new informer for ReplicationController type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredReplicationControllerClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredReplicationControllerClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().ReplicationControllers().List(context.TODO(), options)
+				return client.CoreV1().ReplicationControllers().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().ReplicationControllers().Watch(context.TODO(), options)
+				return client.CoreV1().ReplicationControllers().Watch(context.Background(), options)
 			},
 		},
-		&corev1.ReplicationController{},
+		&apicorev1.ReplicationController{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *replicationControllerClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *replicationControllerClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredReplicationControllerClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *replicationControllerClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.ReplicationController{}, i.defaultInformer)
 }
 
-func (f *replicationControllerClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.ReplicationController{}, f.defaultInformer)
+func (i *replicationControllerClusterInformer) Lister() kcpv1.ReplicationControllerClusterLister {
+	return kcpv1.NewReplicationControllerClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *replicationControllerClusterInformer) Lister() corev1listers.ReplicationControllerClusterLister {
-	return corev1listers.NewReplicationControllerClusterLister(f.Informer().GetIndexer())
+func (i *replicationControllerClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.ReplicationControllerInformer {
+	return &replicationControllerInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *replicationControllerClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.ReplicationControllerInformer {
+func (i *replicationControllerClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.ReplicationControllerInformer {
 	return &replicationControllerInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type replicationControllerInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.ReplicationControllerLister
+	lister   listerscorev1.ReplicationControllerLister
 }
 
-func (f *replicationControllerInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *replicationControllerInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *replicationControllerInformer) Lister() upstreamcorev1listers.ReplicationControllerLister {
-	return f.lister
+func (i *replicationControllerInformer) Lister() listerscorev1.ReplicationControllerLister {
+	return i.lister
 }
diff --git a/informers/core/v1/resourcequota.go b/informers/core/v1/resourcequota.go
index e14915f83..c6928e1b3 100644
--- a/informers/core/v1/resourcequota.go
+++ b/informers/core/v1/resourcequota.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ResourceQuotaClusterInformer provides access to a shared informer and lister for
 // ResourceQuotas.
 type ResourceQuotaClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.ResourceQuotaInformer
+	Cluster(logicalcluster.Name) corev1.ResourceQuotaInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.ResourceQuotaInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.ResourceQuotaClusterLister
+	Lister() kcpv1.ResourceQuotaClusterLister
 }
 
 type resourceQuotaClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewResourceQuotaClusterInformer constructs a new informer for ResourceQuota type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewResourceQuotaClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewResourceQuotaClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredResourceQuotaClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredResourceQuotaClusterInformer constructs a new informer for ResourceQuota type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredResourceQuotaClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredResourceQuotaClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().ResourceQuotas().List(context.TODO(), options)
+				return client.CoreV1().ResourceQuotas().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().ResourceQuotas().Watch(context.TODO(), options)
+				return client.CoreV1().ResourceQuotas().Watch(context.Background(), options)
 			},
 		},
-		&corev1.ResourceQuota{},
+		&apicorev1.ResourceQuota{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *resourceQuotaClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *resourceQuotaClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredResourceQuotaClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *resourceQuotaClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.ResourceQuota{}, i.defaultInformer)
 }
 
-func (f *resourceQuotaClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.ResourceQuota{}, f.defaultInformer)
+func (i *resourceQuotaClusterInformer) Lister() kcpv1.ResourceQuotaClusterLister {
+	return kcpv1.NewResourceQuotaClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *resourceQuotaClusterInformer) Lister() corev1listers.ResourceQuotaClusterLister {
-	return corev1listers.NewResourceQuotaClusterLister(f.Informer().GetIndexer())
+func (i *resourceQuotaClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.ResourceQuotaInformer {
+	return &resourceQuotaInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *resourceQuotaClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.ResourceQuotaInformer {
+func (i *resourceQuotaClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.ResourceQuotaInformer {
 	return &resourceQuotaInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type resourceQuotaInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.ResourceQuotaLister
+	lister   listerscorev1.ResourceQuotaLister
 }
 
-func (f *resourceQuotaInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *resourceQuotaInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *resourceQuotaInformer) Lister() upstreamcorev1listers.ResourceQuotaLister {
-	return f.lister
+func (i *resourceQuotaInformer) Lister() listerscorev1.ResourceQuotaLister {
+	return i.lister
 }
diff --git a/informers/core/v1/secret.go b/informers/core/v1/secret.go
index 14c529b12..dc0843c3f 100644
--- a/informers/core/v1/secret.go
+++ b/informers/core/v1/secret.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // SecretClusterInformer provides access to a shared informer and lister for
 // Secrets.
 type SecretClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.SecretInformer
+	Cluster(logicalcluster.Name) corev1.SecretInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.SecretInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.SecretClusterLister
+	Lister() kcpv1.SecretClusterLister
 }
 
 type secretClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewSecretClusterInformer constructs a new informer for Secret type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewSecretClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewSecretClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredSecretClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredSecretClusterInformer constructs a new informer for Secret type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredSecretClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredSecretClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Secrets().List(context.TODO(), options)
+				return client.CoreV1().Secrets().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Secrets().Watch(context.TODO(), options)
+				return client.CoreV1().Secrets().Watch(context.Background(), options)
 			},
 		},
-		&corev1.Secret{},
+		&apicorev1.Secret{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *secretClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *secretClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredSecretClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *secretClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.Secret{}, i.defaultInformer)
 }
 
-func (f *secretClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.Secret{}, f.defaultInformer)
+func (i *secretClusterInformer) Lister() kcpv1.SecretClusterLister {
+	return kcpv1.NewSecretClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *secretClusterInformer) Lister() corev1listers.SecretClusterLister {
-	return corev1listers.NewSecretClusterLister(f.Informer().GetIndexer())
+func (i *secretClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.SecretInformer {
+	return &secretInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *secretClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.SecretInformer {
+func (i *secretClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.SecretInformer {
 	return &secretInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type secretInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.SecretLister
+	lister   listerscorev1.SecretLister
 }
 
-func (f *secretInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *secretInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *secretInformer) Lister() upstreamcorev1listers.SecretLister {
-	return f.lister
+func (i *secretInformer) Lister() listerscorev1.SecretLister {
+	return i.lister
 }
diff --git a/informers/core/v1/service.go b/informers/core/v1/service.go
index fd974700c..c78bec8c8 100644
--- a/informers/core/v1/service.go
+++ b/informers/core/v1/service.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ServiceClusterInformer provides access to a shared informer and lister for
 // Services.
 type ServiceClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.ServiceInformer
+	Cluster(logicalcluster.Name) corev1.ServiceInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.ServiceInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.ServiceClusterLister
+	Lister() kcpv1.ServiceClusterLister
 }
 
 type serviceClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewServiceClusterInformer constructs a new informer for Service type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewServiceClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewServiceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredServiceClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredServiceClusterInformer constructs a new informer for Service type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredServiceClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredServiceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Services().List(context.TODO(), options)
+				return client.CoreV1().Services().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().Services().Watch(context.TODO(), options)
+				return client.CoreV1().Services().Watch(context.Background(), options)
 			},
 		},
-		&corev1.Service{},
+		&apicorev1.Service{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *serviceClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *serviceClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredServiceClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *serviceClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.Service{}, i.defaultInformer)
 }
 
-func (f *serviceClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.Service{}, f.defaultInformer)
+func (i *serviceClusterInformer) Lister() kcpv1.ServiceClusterLister {
+	return kcpv1.NewServiceClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *serviceClusterInformer) Lister() corev1listers.ServiceClusterLister {
-	return corev1listers.NewServiceClusterLister(f.Informer().GetIndexer())
+func (i *serviceClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.ServiceInformer {
+	return &serviceInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *serviceClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.ServiceInformer {
+func (i *serviceClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.ServiceInformer {
 	return &serviceInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type serviceInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.ServiceLister
+	lister   listerscorev1.ServiceLister
 }
 
-func (f *serviceInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *serviceInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *serviceInformer) Lister() upstreamcorev1listers.ServiceLister {
-	return f.lister
+func (i *serviceInformer) Lister() listerscorev1.ServiceLister {
+	return i.lister
 }
diff --git a/informers/core/v1/serviceaccount.go b/informers/core/v1/serviceaccount.go
index 73069f7d5..fe666fe37 100644
--- a/informers/core/v1/serviceaccount.go
+++ b/informers/core/v1/serviceaccount.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/informers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamcorev1informers "k8s.io/client-go/informers/core/v1"
-	upstreamcorev1listers "k8s.io/client-go/listers/core/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	corev1listers "github.com/kcp-dev/client-go/listers/core/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/core/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ServiceAccountClusterInformer provides access to a shared informer and lister for
 // ServiceAccounts.
 type ServiceAccountClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamcorev1informers.ServiceAccountInformer
+	Cluster(logicalcluster.Name) corev1.ServiceAccountInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) corev1.ServiceAccountInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() corev1listers.ServiceAccountClusterLister
+	Lister() kcpv1.ServiceAccountClusterLister
 }
 
 type serviceAccountClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewServiceAccountClusterInformer constructs a new informer for ServiceAccount type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewServiceAccountClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewServiceAccountClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredServiceAccountClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredServiceAccountClusterInformer constructs a new informer for ServiceAccount type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredServiceAccountClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredServiceAccountClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().ServiceAccounts().List(context.TODO(), options)
+				return client.CoreV1().ServiceAccounts().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.CoreV1().ServiceAccounts().Watch(context.TODO(), options)
+				return client.CoreV1().ServiceAccounts().Watch(context.Background(), options)
 			},
 		},
-		&corev1.ServiceAccount{},
+		&apicorev1.ServiceAccount{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *serviceAccountClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *serviceAccountClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredServiceAccountClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *serviceAccountClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apicorev1.ServiceAccount{}, i.defaultInformer)
 }
 
-func (f *serviceAccountClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&corev1.ServiceAccount{}, f.defaultInformer)
+func (i *serviceAccountClusterInformer) Lister() kcpv1.ServiceAccountClusterLister {
+	return kcpv1.NewServiceAccountClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *serviceAccountClusterInformer) Lister() corev1listers.ServiceAccountClusterLister {
-	return corev1listers.NewServiceAccountClusterLister(f.Informer().GetIndexer())
+func (i *serviceAccountClusterInformer) Cluster(clusterName logicalcluster.Name) corev1.ServiceAccountInformer {
+	return &serviceAccountInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *serviceAccountClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamcorev1informers.ServiceAccountInformer {
+func (i *serviceAccountClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) corev1.ServiceAccountInformer {
 	return &serviceAccountInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type serviceAccountInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamcorev1listers.ServiceAccountLister
+	lister   listerscorev1.ServiceAccountLister
 }
 
-func (f *serviceAccountInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *serviceAccountInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *serviceAccountInformer) Lister() upstreamcorev1listers.ServiceAccountLister {
-	return f.lister
+func (i *serviceAccountInformer) Lister() listerscorev1.ServiceAccountLister {
+	return i.lister
 }
diff --git a/informers/discovery/interface.go b/informers/discovery/interface.go
index 82e3957a0..464ef96fa 100644
--- a/informers/discovery/interface.go
+++ b/informers/discovery/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,39 +14,40 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package discovery
 
 import (
-	"github.com/kcp-dev/client-go/informers/discovery/v1"
-	"github.com/kcp-dev/client-go/informers/discovery/v1beta1"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/discovery/v1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/discovery/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/discovery/v1/endpointslice.go b/informers/discovery/v1/endpointslice.go
index 51f1fddef..a7494ca67 100644
--- a/informers/discovery/v1/endpointslice.go
+++ b/informers/discovery/v1/endpointslice.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apidiscoveryv1 "k8s.io/api/discovery/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	discoveryv1 "k8s.io/client-go/informers/discovery/v1"
+	listersdiscoveryv1 "k8s.io/client-go/listers/discovery/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	discoveryv1 "k8s.io/api/discovery/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamdiscoveryv1informers "k8s.io/client-go/informers/discovery/v1"
-	upstreamdiscoveryv1listers "k8s.io/client-go/listers/discovery/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	discoveryv1listers "github.com/kcp-dev/client-go/listers/discovery/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/discovery/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // EndpointSliceClusterInformer provides access to a shared informer and lister for
 // EndpointSlices.
 type EndpointSliceClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamdiscoveryv1informers.EndpointSliceInformer
+	Cluster(logicalcluster.Name) discoveryv1.EndpointSliceInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) discoveryv1.EndpointSliceInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() discoveryv1listers.EndpointSliceClusterLister
+	Lister() kcpv1.EndpointSliceClusterLister
 }
 
 type endpointSliceClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewEndpointSliceClusterInformer constructs a new informer for EndpointSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewEndpointSliceClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewEndpointSliceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredEndpointSliceClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredEndpointSliceClusterInformer constructs a new informer for EndpointSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredEndpointSliceClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredEndpointSliceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.DiscoveryV1().EndpointSlices().List(context.TODO(), options)
+				return client.DiscoveryV1().EndpointSlices().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.DiscoveryV1().EndpointSlices().Watch(context.TODO(), options)
+				return client.DiscoveryV1().EndpointSlices().Watch(context.Background(), options)
 			},
 		},
-		&discoveryv1.EndpointSlice{},
+		&apidiscoveryv1.EndpointSlice{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *endpointSliceClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *endpointSliceClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredEndpointSliceClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *endpointSliceClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apidiscoveryv1.EndpointSlice{}, i.defaultInformer)
 }
 
-func (f *endpointSliceClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&discoveryv1.EndpointSlice{}, f.defaultInformer)
+func (i *endpointSliceClusterInformer) Lister() kcpv1.EndpointSliceClusterLister {
+	return kcpv1.NewEndpointSliceClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *endpointSliceClusterInformer) Lister() discoveryv1listers.EndpointSliceClusterLister {
-	return discoveryv1listers.NewEndpointSliceClusterLister(f.Informer().GetIndexer())
+func (i *endpointSliceClusterInformer) Cluster(clusterName logicalcluster.Name) discoveryv1.EndpointSliceInformer {
+	return &endpointSliceInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *endpointSliceClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamdiscoveryv1informers.EndpointSliceInformer {
+func (i *endpointSliceClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) discoveryv1.EndpointSliceInformer {
 	return &endpointSliceInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type endpointSliceInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamdiscoveryv1listers.EndpointSliceLister
+	lister   listersdiscoveryv1.EndpointSliceLister
 }
 
-func (f *endpointSliceInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *endpointSliceInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *endpointSliceInformer) Lister() upstreamdiscoveryv1listers.EndpointSliceLister {
-	return f.lister
+func (i *endpointSliceInformer) Lister() listersdiscoveryv1.EndpointSliceLister {
+	return i.lister
 }
diff --git a/informers/discovery/v1/interface.go b/informers/discovery/v1/interface.go
index 212a28e5e..29acbd12f 100644
--- a/informers/discovery/v1/interface.go
+++ b/informers/discovery/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// EndpointSlices returns a EndpointSliceClusterInformer
+	// EndpointSlices returns a EndpointSliceClusterInformer.
 	EndpointSlices() EndpointSliceClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// EndpointSlices returns a EndpointSliceClusterInformer
+// EndpointSlices returns a EndpointSliceClusterInformer.
 func (v *version) EndpointSlices() EndpointSliceClusterInformer {
 	return &endpointSliceClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/discovery/v1beta1/endpointslice.go b/informers/discovery/v1beta1/endpointslice.go
index 066cc1767..cef014f4b 100644
--- a/informers/discovery/v1beta1/endpointslice.go
+++ b/informers/discovery/v1beta1/endpointslice.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apidiscoveryv1beta1 "k8s.io/api/discovery/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	discoveryv1beta1 "k8s.io/client-go/informers/discovery/v1beta1"
+	listersdiscoveryv1beta1 "k8s.io/client-go/listers/discovery/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	discoveryv1beta1 "k8s.io/api/discovery/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamdiscoveryv1beta1informers "k8s.io/client-go/informers/discovery/v1beta1"
-	upstreamdiscoveryv1beta1listers "k8s.io/client-go/listers/discovery/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	discoveryv1beta1listers "github.com/kcp-dev/client-go/listers/discovery/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/discovery/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // EndpointSliceClusterInformer provides access to a shared informer and lister for
 // EndpointSlices.
 type EndpointSliceClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamdiscoveryv1beta1informers.EndpointSliceInformer
+	Cluster(logicalcluster.Name) discoveryv1beta1.EndpointSliceInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) discoveryv1beta1.EndpointSliceInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() discoveryv1beta1listers.EndpointSliceClusterLister
+	Lister() kcpv1beta1.EndpointSliceClusterLister
 }
 
 type endpointSliceClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewEndpointSliceClusterInformer constructs a new informer for EndpointSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewEndpointSliceClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewEndpointSliceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredEndpointSliceClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredEndpointSliceClusterInformer constructs a new informer for EndpointSlice type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredEndpointSliceClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredEndpointSliceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.DiscoveryV1beta1().EndpointSlices().List(context.TODO(), options)
+				return client.DiscoveryV1beta1().EndpointSlices().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.DiscoveryV1beta1().EndpointSlices().Watch(context.TODO(), options)
+				return client.DiscoveryV1beta1().EndpointSlices().Watch(context.Background(), options)
 			},
 		},
-		&discoveryv1beta1.EndpointSlice{},
+		&apidiscoveryv1beta1.EndpointSlice{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *endpointSliceClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *endpointSliceClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredEndpointSliceClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *endpointSliceClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&discoveryv1beta1.EndpointSlice{}, f.defaultInformer)
+func (i *endpointSliceClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apidiscoveryv1beta1.EndpointSlice{}, i.defaultInformer)
 }
 
-func (f *endpointSliceClusterInformer) Lister() discoveryv1beta1listers.EndpointSliceClusterLister {
-	return discoveryv1beta1listers.NewEndpointSliceClusterLister(f.Informer().GetIndexer())
+func (i *endpointSliceClusterInformer) Lister() kcpv1beta1.EndpointSliceClusterLister {
+	return kcpv1beta1.NewEndpointSliceClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *endpointSliceClusterInformer) Cluster(clusterName logicalcluster.Name) discoveryv1beta1.EndpointSliceInformer {
+	return &endpointSliceInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *endpointSliceClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamdiscoveryv1beta1informers.EndpointSliceInformer {
+func (i *endpointSliceClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) discoveryv1beta1.EndpointSliceInformer {
 	return &endpointSliceInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type endpointSliceInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamdiscoveryv1beta1listers.EndpointSliceLister
+	lister   listersdiscoveryv1beta1.EndpointSliceLister
 }
 
-func (f *endpointSliceInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *endpointSliceInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *endpointSliceInformer) Lister() upstreamdiscoveryv1beta1listers.EndpointSliceLister {
-	return f.lister
+func (i *endpointSliceInformer) Lister() listersdiscoveryv1beta1.EndpointSliceLister {
+	return i.lister
 }
diff --git a/informers/discovery/v1beta1/interface.go b/informers/discovery/v1beta1/interface.go
index 0bb215db1..51367b1cc 100644
--- a/informers/discovery/v1beta1/interface.go
+++ b/informers/discovery/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// EndpointSlices returns a EndpointSliceClusterInformer
+	// EndpointSlices returns a EndpointSliceClusterInformer.
 	EndpointSlices() EndpointSliceClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// EndpointSlices returns a EndpointSliceClusterInformer
+// EndpointSlices returns a EndpointSliceClusterInformer.
 func (v *version) EndpointSlices() EndpointSliceClusterInformer {
 	return &endpointSliceClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/events/interface.go b/informers/events/interface.go
index acd3cfa01..285cabf82 100644
--- a/informers/events/interface.go
+++ b/informers/events/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,39 +14,40 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package events
 
 import (
-	"github.com/kcp-dev/client-go/informers/events/v1"
-	"github.com/kcp-dev/client-go/informers/events/v1beta1"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/events/v1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/events/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/events/v1/event.go b/informers/events/v1/event.go
index 70b8c65ea..53f348c89 100644
--- a/informers/events/v1/event.go
+++ b/informers/events/v1/event.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apieventsv1 "k8s.io/api/events/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	eventsv1 "k8s.io/client-go/informers/events/v1"
+	listerseventsv1 "k8s.io/client-go/listers/events/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	eventsv1 "k8s.io/api/events/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreameventsv1informers "k8s.io/client-go/informers/events/v1"
-	upstreameventsv1listers "k8s.io/client-go/listers/events/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	eventsv1listers "github.com/kcp-dev/client-go/listers/events/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/events/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // EventClusterInformer provides access to a shared informer and lister for
 // Events.
 type EventClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreameventsv1informers.EventInformer
+	Cluster(logicalcluster.Name) eventsv1.EventInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) eventsv1.EventInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() eventsv1listers.EventClusterLister
+	Lister() kcpv1.EventClusterLister
 }
 
 type eventClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewEventClusterInformer constructs a new informer for Event type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewEventClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewEventClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredEventClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredEventClusterInformer constructs a new informer for Event type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredEventClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredEventClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.EventsV1().Events().List(context.TODO(), options)
+				return client.EventsV1().Events().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.EventsV1().Events().Watch(context.TODO(), options)
+				return client.EventsV1().Events().Watch(context.Background(), options)
 			},
 		},
-		&eventsv1.Event{},
+		&apieventsv1.Event{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *eventClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *eventClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredEventClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *eventClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apieventsv1.Event{}, i.defaultInformer)
 }
 
-func (f *eventClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&eventsv1.Event{}, f.defaultInformer)
+func (i *eventClusterInformer) Lister() kcpv1.EventClusterLister {
+	return kcpv1.NewEventClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *eventClusterInformer) Lister() eventsv1listers.EventClusterLister {
-	return eventsv1listers.NewEventClusterLister(f.Informer().GetIndexer())
+func (i *eventClusterInformer) Cluster(clusterName logicalcluster.Name) eventsv1.EventInformer {
+	return &eventInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *eventClusterInformer) Cluster(clusterName logicalcluster.Name) upstreameventsv1informers.EventInformer {
+func (i *eventClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) eventsv1.EventInformer {
 	return &eventInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type eventInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreameventsv1listers.EventLister
+	lister   listerseventsv1.EventLister
 }
 
-func (f *eventInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *eventInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *eventInformer) Lister() upstreameventsv1listers.EventLister {
-	return f.lister
+func (i *eventInformer) Lister() listerseventsv1.EventLister {
+	return i.lister
 }
diff --git a/informers/events/v1/interface.go b/informers/events/v1/interface.go
index a497ff730..6421bc7cf 100644
--- a/informers/events/v1/interface.go
+++ b/informers/events/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// Events returns a EventClusterInformer
+	// Events returns a EventClusterInformer.
 	Events() EventClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// Events returns a EventClusterInformer
+// Events returns a EventClusterInformer.
 func (v *version) Events() EventClusterInformer {
 	return &eventClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/events/v1beta1/event.go b/informers/events/v1beta1/event.go
index 8948b8eea..c3e76eb22 100644
--- a/informers/events/v1beta1/event.go
+++ b/informers/events/v1beta1/event.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apieventsv1beta1 "k8s.io/api/events/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	eventsv1beta1 "k8s.io/client-go/informers/events/v1beta1"
+	listerseventsv1beta1 "k8s.io/client-go/listers/events/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	eventsv1beta1 "k8s.io/api/events/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreameventsv1beta1informers "k8s.io/client-go/informers/events/v1beta1"
-	upstreameventsv1beta1listers "k8s.io/client-go/listers/events/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	eventsv1beta1listers "github.com/kcp-dev/client-go/listers/events/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/events/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // EventClusterInformer provides access to a shared informer and lister for
 // Events.
 type EventClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreameventsv1beta1informers.EventInformer
+	Cluster(logicalcluster.Name) eventsv1beta1.EventInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) eventsv1beta1.EventInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() eventsv1beta1listers.EventClusterLister
+	Lister() kcpv1beta1.EventClusterLister
 }
 
 type eventClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewEventClusterInformer constructs a new informer for Event type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewEventClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewEventClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredEventClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredEventClusterInformer constructs a new informer for Event type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredEventClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredEventClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.EventsV1beta1().Events().List(context.TODO(), options)
+				return client.EventsV1beta1().Events().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.EventsV1beta1().Events().Watch(context.TODO(), options)
+				return client.EventsV1beta1().Events().Watch(context.Background(), options)
 			},
 		},
-		&eventsv1beta1.Event{},
+		&apieventsv1beta1.Event{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *eventClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *eventClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredEventClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *eventClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&eventsv1beta1.Event{}, f.defaultInformer)
+func (i *eventClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apieventsv1beta1.Event{}, i.defaultInformer)
 }
 
-func (f *eventClusterInformer) Lister() eventsv1beta1listers.EventClusterLister {
-	return eventsv1beta1listers.NewEventClusterLister(f.Informer().GetIndexer())
+func (i *eventClusterInformer) Lister() kcpv1beta1.EventClusterLister {
+	return kcpv1beta1.NewEventClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *eventClusterInformer) Cluster(clusterName logicalcluster.Name) eventsv1beta1.EventInformer {
+	return &eventInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *eventClusterInformer) Cluster(clusterName logicalcluster.Name) upstreameventsv1beta1informers.EventInformer {
+func (i *eventClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) eventsv1beta1.EventInformer {
 	return &eventInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type eventInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreameventsv1beta1listers.EventLister
+	lister   listerseventsv1beta1.EventLister
 }
 
-func (f *eventInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *eventInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *eventInformer) Lister() upstreameventsv1beta1listers.EventLister {
-	return f.lister
+func (i *eventInformer) Lister() listerseventsv1beta1.EventLister {
+	return i.lister
 }
diff --git a/informers/events/v1beta1/interface.go b/informers/events/v1beta1/interface.go
index 36bec7a23..5b2dfaaad 100644
--- a/informers/events/v1beta1/interface.go
+++ b/informers/events/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// Events returns a EventClusterInformer
+	// Events returns a EventClusterInformer.
 	Events() EventClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// Events returns a EventClusterInformer
+// Events returns a EventClusterInformer.
 func (v *version) Events() EventClusterInformer {
 	return &eventClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/extensions/interface.go b/informers/extensions/interface.go
index 57073d898..e19677a37 100644
--- a/informers/extensions/interface.go
+++ b/informers/extensions/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,31 +14,32 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package extensions
 
 import (
-	"github.com/kcp-dev/client-go/informers/extensions/v1beta1"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/extensions/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/extensions/v1beta1/daemonset.go b/informers/extensions/v1beta1/daemonset.go
index da9709ad4..7a6ee805f 100644
--- a/informers/extensions/v1beta1/daemonset.go
+++ b/informers/extensions/v1beta1/daemonset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiextensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	extensionsv1beta1 "k8s.io/client-go/informers/extensions/v1beta1"
+	listersextensionsv1beta1 "k8s.io/client-go/listers/extensions/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamextensionsv1beta1informers "k8s.io/client-go/informers/extensions/v1beta1"
-	upstreamextensionsv1beta1listers "k8s.io/client-go/listers/extensions/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	extensionsv1beta1listers "github.com/kcp-dev/client-go/listers/extensions/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/extensions/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // DaemonSetClusterInformer provides access to a shared informer and lister for
 // DaemonSets.
 type DaemonSetClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamextensionsv1beta1informers.DaemonSetInformer
+	Cluster(logicalcluster.Name) extensionsv1beta1.DaemonSetInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) extensionsv1beta1.DaemonSetInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() extensionsv1beta1listers.DaemonSetClusterLister
+	Lister() kcpv1beta1.DaemonSetClusterLister
 }
 
 type daemonSetClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewDaemonSetClusterInformer constructs a new informer for DaemonSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewDaemonSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewDaemonSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDaemonSetClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredDaemonSetClusterInformer constructs a new informer for DaemonSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredDaemonSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredDaemonSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.ExtensionsV1beta1().DaemonSets().List(context.TODO(), options)
+				return client.ExtensionsV1beta1().DaemonSets().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.ExtensionsV1beta1().DaemonSets().Watch(context.TODO(), options)
+				return client.ExtensionsV1beta1().DaemonSets().Watch(context.Background(), options)
 			},
 		},
-		&extensionsv1beta1.DaemonSet{},
+		&apiextensionsv1beta1.DaemonSet{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *daemonSetClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *daemonSetClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDaemonSetClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *daemonSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&extensionsv1beta1.DaemonSet{}, f.defaultInformer)
+func (i *daemonSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiextensionsv1beta1.DaemonSet{}, i.defaultInformer)
 }
 
-func (f *daemonSetClusterInformer) Lister() extensionsv1beta1listers.DaemonSetClusterLister {
-	return extensionsv1beta1listers.NewDaemonSetClusterLister(f.Informer().GetIndexer())
+func (i *daemonSetClusterInformer) Lister() kcpv1beta1.DaemonSetClusterLister {
+	return kcpv1beta1.NewDaemonSetClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *daemonSetClusterInformer) Cluster(clusterName logicalcluster.Name) extensionsv1beta1.DaemonSetInformer {
+	return &daemonSetInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *daemonSetClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamextensionsv1beta1informers.DaemonSetInformer {
+func (i *daemonSetClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) extensionsv1beta1.DaemonSetInformer {
 	return &daemonSetInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type daemonSetInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamextensionsv1beta1listers.DaemonSetLister
+	lister   listersextensionsv1beta1.DaemonSetLister
 }
 
-func (f *daemonSetInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *daemonSetInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *daemonSetInformer) Lister() upstreamextensionsv1beta1listers.DaemonSetLister {
-	return f.lister
+func (i *daemonSetInformer) Lister() listersextensionsv1beta1.DaemonSetLister {
+	return i.lister
 }
diff --git a/informers/extensions/v1beta1/deployment.go b/informers/extensions/v1beta1/deployment.go
index 823ee8932..80b5dad1c 100644
--- a/informers/extensions/v1beta1/deployment.go
+++ b/informers/extensions/v1beta1/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiextensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	extensionsv1beta1 "k8s.io/client-go/informers/extensions/v1beta1"
+	listersextensionsv1beta1 "k8s.io/client-go/listers/extensions/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamextensionsv1beta1informers "k8s.io/client-go/informers/extensions/v1beta1"
-	upstreamextensionsv1beta1listers "k8s.io/client-go/listers/extensions/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	extensionsv1beta1listers "github.com/kcp-dev/client-go/listers/extensions/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/extensions/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // DeploymentClusterInformer provides access to a shared informer and lister for
 // Deployments.
 type DeploymentClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamextensionsv1beta1informers.DeploymentInformer
+	Cluster(logicalcluster.Name) extensionsv1beta1.DeploymentInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) extensionsv1beta1.DeploymentInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() extensionsv1beta1listers.DeploymentClusterLister
+	Lister() kcpv1beta1.DeploymentClusterLister
 }
 
 type deploymentClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewDeploymentClusterInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewDeploymentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewDeploymentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDeploymentClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredDeploymentClusterInformer constructs a new informer for Deployment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredDeploymentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredDeploymentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.ExtensionsV1beta1().Deployments().List(context.TODO(), options)
+				return client.ExtensionsV1beta1().Deployments().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.ExtensionsV1beta1().Deployments().Watch(context.TODO(), options)
+				return client.ExtensionsV1beta1().Deployments().Watch(context.Background(), options)
 			},
 		},
-		&extensionsv1beta1.Deployment{},
+		&apiextensionsv1beta1.Deployment{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *deploymentClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *deploymentClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredDeploymentClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *deploymentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&extensionsv1beta1.Deployment{}, f.defaultInformer)
+func (i *deploymentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiextensionsv1beta1.Deployment{}, i.defaultInformer)
 }
 
-func (f *deploymentClusterInformer) Lister() extensionsv1beta1listers.DeploymentClusterLister {
-	return extensionsv1beta1listers.NewDeploymentClusterLister(f.Informer().GetIndexer())
+func (i *deploymentClusterInformer) Lister() kcpv1beta1.DeploymentClusterLister {
+	return kcpv1beta1.NewDeploymentClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *deploymentClusterInformer) Cluster(clusterName logicalcluster.Name) extensionsv1beta1.DeploymentInformer {
+	return &deploymentInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *deploymentClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamextensionsv1beta1informers.DeploymentInformer {
+func (i *deploymentClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) extensionsv1beta1.DeploymentInformer {
 	return &deploymentInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type deploymentInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamextensionsv1beta1listers.DeploymentLister
+	lister   listersextensionsv1beta1.DeploymentLister
 }
 
-func (f *deploymentInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *deploymentInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *deploymentInformer) Lister() upstreamextensionsv1beta1listers.DeploymentLister {
-	return f.lister
+func (i *deploymentInformer) Lister() listersextensionsv1beta1.DeploymentLister {
+	return i.lister
 }
diff --git a/informers/extensions/v1beta1/ingress.go b/informers/extensions/v1beta1/ingress.go
index a08adacf1..203c1d137 100644
--- a/informers/extensions/v1beta1/ingress.go
+++ b/informers/extensions/v1beta1/ingress.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiextensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	extensionsv1beta1 "k8s.io/client-go/informers/extensions/v1beta1"
+	listersextensionsv1beta1 "k8s.io/client-go/listers/extensions/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamextensionsv1beta1informers "k8s.io/client-go/informers/extensions/v1beta1"
-	upstreamextensionsv1beta1listers "k8s.io/client-go/listers/extensions/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	extensionsv1beta1listers "github.com/kcp-dev/client-go/listers/extensions/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/extensions/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // IngressClusterInformer provides access to a shared informer and lister for
 // Ingresses.
 type IngressClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamextensionsv1beta1informers.IngressInformer
+	Cluster(logicalcluster.Name) extensionsv1beta1.IngressInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) extensionsv1beta1.IngressInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() extensionsv1beta1listers.IngressClusterLister
+	Lister() kcpv1beta1.IngressClusterLister
 }
 
 type ingressClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewIngressClusterInformer constructs a new informer for Ingress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewIngressClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewIngressClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredIngressClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredIngressClusterInformer constructs a new informer for Ingress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredIngressClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredIngressClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.ExtensionsV1beta1().Ingresses().List(context.TODO(), options)
+				return client.ExtensionsV1beta1().Ingresses().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.ExtensionsV1beta1().Ingresses().Watch(context.TODO(), options)
+				return client.ExtensionsV1beta1().Ingresses().Watch(context.Background(), options)
 			},
 		},
-		&extensionsv1beta1.Ingress{},
+		&apiextensionsv1beta1.Ingress{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *ingressClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *ingressClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredIngressClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *ingressClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&extensionsv1beta1.Ingress{}, f.defaultInformer)
+func (i *ingressClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiextensionsv1beta1.Ingress{}, i.defaultInformer)
 }
 
-func (f *ingressClusterInformer) Lister() extensionsv1beta1listers.IngressClusterLister {
-	return extensionsv1beta1listers.NewIngressClusterLister(f.Informer().GetIndexer())
+func (i *ingressClusterInformer) Lister() kcpv1beta1.IngressClusterLister {
+	return kcpv1beta1.NewIngressClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *ingressClusterInformer) Cluster(clusterName logicalcluster.Name) extensionsv1beta1.IngressInformer {
+	return &ingressInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *ingressClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamextensionsv1beta1informers.IngressInformer {
+func (i *ingressClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) extensionsv1beta1.IngressInformer {
 	return &ingressInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type ingressInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamextensionsv1beta1listers.IngressLister
+	lister   listersextensionsv1beta1.IngressLister
 }
 
-func (f *ingressInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *ingressInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *ingressInformer) Lister() upstreamextensionsv1beta1listers.IngressLister {
-	return f.lister
+func (i *ingressInformer) Lister() listersextensionsv1beta1.IngressLister {
+	return i.lister
 }
diff --git a/informers/extensions/v1beta1/interface.go b/informers/extensions/v1beta1/interface.go
index a9fe4c40a..91312d7ec 100644
--- a/informers/extensions/v1beta1/interface.go
+++ b/informers/extensions/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,65 +14,58 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// Deployments returns a DeploymentClusterInformer
-	Deployments() DeploymentClusterInformer
-	// DaemonSets returns a DaemonSetClusterInformer
+	// DaemonSets returns a DaemonSetClusterInformer.
 	DaemonSets() DaemonSetClusterInformer
-	// Ingresses returns a IngressClusterInformer
+	// Deployments returns a DeploymentClusterInformer.
+	Deployments() DeploymentClusterInformer
+	// Ingresses returns a IngressClusterInformer.
 	Ingresses() IngressClusterInformer
-	// ReplicaSets returns a ReplicaSetClusterInformer
-	ReplicaSets() ReplicaSetClusterInformer
-	// PodSecurityPolicies returns a PodSecurityPolicyClusterInformer
-	PodSecurityPolicies() PodSecurityPolicyClusterInformer
-	// NetworkPolicies returns a NetworkPolicyClusterInformer
+	// NetworkPolicies returns a NetworkPolicyClusterInformer.
 	NetworkPolicies() NetworkPolicyClusterInformer
+	// ReplicaSets returns a ReplicaSetClusterInformer.
+	ReplicaSets() ReplicaSetClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// Deployments returns a DeploymentClusterInformer
-func (v *version) Deployments() DeploymentClusterInformer {
-	return &deploymentClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// DaemonSets returns a DaemonSetClusterInformer
+// DaemonSets returns a DaemonSetClusterInformer.
 func (v *version) DaemonSets() DaemonSetClusterInformer {
 	return &daemonSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Ingresses returns a IngressClusterInformer
-func (v *version) Ingresses() IngressClusterInformer {
-	return &ingressClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// ReplicaSets returns a ReplicaSetClusterInformer
-func (v *version) ReplicaSets() ReplicaSetClusterInformer {
-	return &replicaSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// Deployments returns a DeploymentClusterInformer.
+func (v *version) Deployments() DeploymentClusterInformer {
+	return &deploymentClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PodSecurityPolicies returns a PodSecurityPolicyClusterInformer
-func (v *version) PodSecurityPolicies() PodSecurityPolicyClusterInformer {
-	return &podSecurityPolicyClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// Ingresses returns a IngressClusterInformer.
+func (v *version) Ingresses() IngressClusterInformer {
+	return &ingressClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// NetworkPolicies returns a NetworkPolicyClusterInformer
+// NetworkPolicies returns a NetworkPolicyClusterInformer.
 func (v *version) NetworkPolicies() NetworkPolicyClusterInformer {
 	return &networkPolicyClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// ReplicaSets returns a ReplicaSetClusterInformer.
+func (v *version) ReplicaSets() ReplicaSetClusterInformer {
+	return &replicaSetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/extensions/v1beta1/networkpolicy.go b/informers/extensions/v1beta1/networkpolicy.go
index 3e925c91a..3efc6b070 100644
--- a/informers/extensions/v1beta1/networkpolicy.go
+++ b/informers/extensions/v1beta1/networkpolicy.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiextensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	extensionsv1beta1 "k8s.io/client-go/informers/extensions/v1beta1"
+	listersextensionsv1beta1 "k8s.io/client-go/listers/extensions/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamextensionsv1beta1informers "k8s.io/client-go/informers/extensions/v1beta1"
-	upstreamextensionsv1beta1listers "k8s.io/client-go/listers/extensions/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	extensionsv1beta1listers "github.com/kcp-dev/client-go/listers/extensions/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/extensions/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // NetworkPolicyClusterInformer provides access to a shared informer and lister for
 // NetworkPolicies.
 type NetworkPolicyClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamextensionsv1beta1informers.NetworkPolicyInformer
+	Cluster(logicalcluster.Name) extensionsv1beta1.NetworkPolicyInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) extensionsv1beta1.NetworkPolicyInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() extensionsv1beta1listers.NetworkPolicyClusterLister
+	Lister() kcpv1beta1.NetworkPolicyClusterLister
 }
 
 type networkPolicyClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewNetworkPolicyClusterInformer constructs a new informer for NetworkPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewNetworkPolicyClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewNetworkPolicyClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredNetworkPolicyClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredNetworkPolicyClusterInformer constructs a new informer for NetworkPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredNetworkPolicyClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredNetworkPolicyClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.ExtensionsV1beta1().NetworkPolicies().List(context.TODO(), options)
+				return client.ExtensionsV1beta1().NetworkPolicies().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.ExtensionsV1beta1().NetworkPolicies().Watch(context.TODO(), options)
+				return client.ExtensionsV1beta1().NetworkPolicies().Watch(context.Background(), options)
 			},
 		},
-		&extensionsv1beta1.NetworkPolicy{},
+		&apiextensionsv1beta1.NetworkPolicy{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *networkPolicyClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *networkPolicyClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredNetworkPolicyClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *networkPolicyClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&extensionsv1beta1.NetworkPolicy{}, f.defaultInformer)
+func (i *networkPolicyClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiextensionsv1beta1.NetworkPolicy{}, i.defaultInformer)
 }
 
-func (f *networkPolicyClusterInformer) Lister() extensionsv1beta1listers.NetworkPolicyClusterLister {
-	return extensionsv1beta1listers.NewNetworkPolicyClusterLister(f.Informer().GetIndexer())
+func (i *networkPolicyClusterInformer) Lister() kcpv1beta1.NetworkPolicyClusterLister {
+	return kcpv1beta1.NewNetworkPolicyClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *networkPolicyClusterInformer) Cluster(clusterName logicalcluster.Name) extensionsv1beta1.NetworkPolicyInformer {
+	return &networkPolicyInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *networkPolicyClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamextensionsv1beta1informers.NetworkPolicyInformer {
+func (i *networkPolicyClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) extensionsv1beta1.NetworkPolicyInformer {
 	return &networkPolicyInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type networkPolicyInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamextensionsv1beta1listers.NetworkPolicyLister
+	lister   listersextensionsv1beta1.NetworkPolicyLister
 }
 
-func (f *networkPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *networkPolicyInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *networkPolicyInformer) Lister() upstreamextensionsv1beta1listers.NetworkPolicyLister {
-	return f.lister
+func (i *networkPolicyInformer) Lister() listersextensionsv1beta1.NetworkPolicyLister {
+	return i.lister
 }
diff --git a/informers/extensions/v1beta1/podsecuritypolicy.go b/informers/extensions/v1beta1/podsecuritypolicy.go
deleted file mode 100644
index 1aa09ea56..000000000
--- a/informers/extensions/v1beta1/podsecuritypolicy.go
+++ /dev/null
@@ -1,124 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1beta1
-
-import (
-	"context"
-	"time"
-
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamextensionsv1beta1informers "k8s.io/client-go/informers/extensions/v1beta1"
-	upstreamextensionsv1beta1listers "k8s.io/client-go/listers/extensions/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	extensionsv1beta1listers "github.com/kcp-dev/client-go/listers/extensions/v1beta1"
-)
-
-// PodSecurityPolicyClusterInformer provides access to a shared informer and lister for
-// PodSecurityPolicies.
-type PodSecurityPolicyClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamextensionsv1beta1informers.PodSecurityPolicyInformer
-	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() extensionsv1beta1listers.PodSecurityPolicyClusterLister
-}
-
-type podSecurityPolicyClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// NewPodSecurityPolicyClusterInformer constructs a new informer for PodSecurityPolicy type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewPodSecurityPolicyClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredPodSecurityPolicyClusterInformer(client, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredPodSecurityPolicyClusterInformer constructs a new informer for PodSecurityPolicy type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPodSecurityPolicyClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
-	return kcpinformers.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.ExtensionsV1beta1().PodSecurityPolicies().List(context.TODO(), options)
-			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.ExtensionsV1beta1().PodSecurityPolicies().Watch(context.TODO(), options)
-			},
-		},
-		&extensionsv1beta1.PodSecurityPolicy{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *podSecurityPolicyClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredPodSecurityPolicyClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
-}
-
-func (f *podSecurityPolicyClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&extensionsv1beta1.PodSecurityPolicy{}, f.defaultInformer)
-}
-
-func (f *podSecurityPolicyClusterInformer) Lister() extensionsv1beta1listers.PodSecurityPolicyClusterLister {
-	return extensionsv1beta1listers.NewPodSecurityPolicyClusterLister(f.Informer().GetIndexer())
-}
-
-func (f *podSecurityPolicyClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamextensionsv1beta1informers.PodSecurityPolicyInformer {
-	return &podSecurityPolicyInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
-	}
-}
-
-type podSecurityPolicyInformer struct {
-	informer cache.SharedIndexInformer
-	lister   upstreamextensionsv1beta1listers.PodSecurityPolicyLister
-}
-
-func (f *podSecurityPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
-}
-
-func (f *podSecurityPolicyInformer) Lister() upstreamextensionsv1beta1listers.PodSecurityPolicyLister {
-	return f.lister
-}
diff --git a/informers/extensions/v1beta1/replicaset.go b/informers/extensions/v1beta1/replicaset.go
index dd4c6a17a..5b04ba800 100644
--- a/informers/extensions/v1beta1/replicaset.go
+++ b/informers/extensions/v1beta1/replicaset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiextensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	extensionsv1beta1 "k8s.io/client-go/informers/extensions/v1beta1"
+	listersextensionsv1beta1 "k8s.io/client-go/listers/extensions/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamextensionsv1beta1informers "k8s.io/client-go/informers/extensions/v1beta1"
-	upstreamextensionsv1beta1listers "k8s.io/client-go/listers/extensions/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	extensionsv1beta1listers "github.com/kcp-dev/client-go/listers/extensions/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/extensions/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ReplicaSetClusterInformer provides access to a shared informer and lister for
 // ReplicaSets.
 type ReplicaSetClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamextensionsv1beta1informers.ReplicaSetInformer
+	Cluster(logicalcluster.Name) extensionsv1beta1.ReplicaSetInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) extensionsv1beta1.ReplicaSetInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() extensionsv1beta1listers.ReplicaSetClusterLister
+	Lister() kcpv1beta1.ReplicaSetClusterLister
 }
 
 type replicaSetClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewReplicaSetClusterInformer constructs a new informer for ReplicaSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewReplicaSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewReplicaSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredReplicaSetClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredReplicaSetClusterInformer constructs a new informer for ReplicaSet type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredReplicaSetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredReplicaSetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.ExtensionsV1beta1().ReplicaSets().List(context.TODO(), options)
+				return client.ExtensionsV1beta1().ReplicaSets().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.ExtensionsV1beta1().ReplicaSets().Watch(context.TODO(), options)
+				return client.ExtensionsV1beta1().ReplicaSets().Watch(context.Background(), options)
 			},
 		},
-		&extensionsv1beta1.ReplicaSet{},
+		&apiextensionsv1beta1.ReplicaSet{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *replicaSetClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *replicaSetClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredReplicaSetClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *replicaSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&extensionsv1beta1.ReplicaSet{}, f.defaultInformer)
+func (i *replicaSetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiextensionsv1beta1.ReplicaSet{}, i.defaultInformer)
 }
 
-func (f *replicaSetClusterInformer) Lister() extensionsv1beta1listers.ReplicaSetClusterLister {
-	return extensionsv1beta1listers.NewReplicaSetClusterLister(f.Informer().GetIndexer())
+func (i *replicaSetClusterInformer) Lister() kcpv1beta1.ReplicaSetClusterLister {
+	return kcpv1beta1.NewReplicaSetClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *replicaSetClusterInformer) Cluster(clusterName logicalcluster.Name) extensionsv1beta1.ReplicaSetInformer {
+	return &replicaSetInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *replicaSetClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamextensionsv1beta1informers.ReplicaSetInformer {
+func (i *replicaSetClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) extensionsv1beta1.ReplicaSetInformer {
 	return &replicaSetInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type replicaSetInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamextensionsv1beta1listers.ReplicaSetLister
+	lister   listersextensionsv1beta1.ReplicaSetLister
 }
 
-func (f *replicaSetInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *replicaSetInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *replicaSetInformer) Lister() upstreamextensionsv1beta1listers.ReplicaSetLister {
-	return f.lister
+func (i *replicaSetInformer) Lister() listersextensionsv1beta1.ReplicaSetLister {
+	return i.lister
 }
diff --git a/informers/factory.go b/informers/factory.go
index 52c26a84b..83a88f013 100644
--- a/informers/factory.go
+++ b/informers/factory.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,45 +14,45 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package informers
 
 import (
-	"reflect"
-	"sync"
-	"time"
+	reflect "reflect"
+	sync "sync"
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	clientgoinformers "k8s.io/client-go/informers"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	upstreaminformers "k8s.io/client-go/informers"
-	"k8s.io/client-go/tools/cache"
-
-	admissionregistrationinformers "github.com/kcp-dev/client-go/informers/admissionregistration"
-	apiserverinternalinformers "github.com/kcp-dev/client-go/informers/apiserverinternal"
-	appsinformers "github.com/kcp-dev/client-go/informers/apps"
-	autoscalinginformers "github.com/kcp-dev/client-go/informers/autoscaling"
-	batchinformers "github.com/kcp-dev/client-go/informers/batch"
-	certificatesinformers "github.com/kcp-dev/client-go/informers/certificates"
-	coordinationinformers "github.com/kcp-dev/client-go/informers/coordination"
-	coreinformers "github.com/kcp-dev/client-go/informers/core"
-	discoveryinformers "github.com/kcp-dev/client-go/informers/discovery"
-	eventsinformers "github.com/kcp-dev/client-go/informers/events"
-	extensionsinformers "github.com/kcp-dev/client-go/informers/extensions"
-	flowcontrolinformers "github.com/kcp-dev/client-go/informers/flowcontrol"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	networkinginformers "github.com/kcp-dev/client-go/informers/networking"
-	nodeinformers "github.com/kcp-dev/client-go/informers/node"
-	policyinformers "github.com/kcp-dev/client-go/informers/policy"
-	rbacinformers "github.com/kcp-dev/client-go/informers/rbac"
-	resourceinformers "github.com/kcp-dev/client-go/informers/resource"
-	schedulinginformers "github.com/kcp-dev/client-go/informers/scheduling"
-	storageinformers "github.com/kcp-dev/client-go/informers/storage"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
+	kcpadmissionregistration "github.com/kcp-dev/client-go/informers/admissionregistration"
+	kcpapiserverinternal "github.com/kcp-dev/client-go/informers/apiserverinternal"
+	kcpapps "github.com/kcp-dev/client-go/informers/apps"
+	kcpautoscaling "github.com/kcp-dev/client-go/informers/autoscaling"
+	kcpbatch "github.com/kcp-dev/client-go/informers/batch"
+	kcpcertificates "github.com/kcp-dev/client-go/informers/certificates"
+	kcpcoordination "github.com/kcp-dev/client-go/informers/coordination"
+	kcpcore "github.com/kcp-dev/client-go/informers/core"
+	kcpdiscovery "github.com/kcp-dev/client-go/informers/discovery"
+	kcpevents "github.com/kcp-dev/client-go/informers/events"
+	kcpextensions "github.com/kcp-dev/client-go/informers/extensions"
+	kcpflowcontrol "github.com/kcp-dev/client-go/informers/flowcontrol"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpnetworking "github.com/kcp-dev/client-go/informers/networking"
+	kcpnode "github.com/kcp-dev/client-go/informers/node"
+	kcppolicy "github.com/kcp-dev/client-go/informers/policy"
+	kcprbac "github.com/kcp-dev/client-go/informers/rbac"
+	kcpresource "github.com/kcp-dev/client-go/informers/resource"
+	kcpscheduling "github.com/kcp-dev/client-go/informers/scheduling"
+	kcpstorage "github.com/kcp-dev/client-go/informers/storage"
+	kcpstoragemigration "github.com/kcp-dev/client-go/informers/storagemigration"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // SharedInformerOption defines the functional option type for SharedInformerFactory.
@@ -63,24 +60,32 @@ type SharedInformerOption func(*SharedInformerOptions) *SharedInformerOptions
 
 type SharedInformerOptions struct {
 	customResync     map[reflect.Type]time.Duration
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+	transform        cache.TransformFunc
+	namespace        string
 }
 
 type sharedInformerFactory struct {
-	client           clientset.ClusterInterface
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	client           kcpkubernetes.ClusterInterface
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 	lock             sync.Mutex
 	defaultResync    time.Duration
 	customResync     map[reflect.Type]time.Duration
+	transform        cache.TransformFunc
 
 	informers map[reflect.Type]kcpcache.ScopeableSharedIndexInformer
 	// startedInformers is used for tracking which informers have been started.
 	// This allows Start() to be called multiple times safely.
 	startedInformers map[reflect.Type]bool
+	// wg tracks how many goroutines were started.
+	wg sync.WaitGroup
+	// shuttingDown is true when Shutdown has been called. It may still be running
+	// because it needs to wait for goroutines.
+	shuttingDown bool
 }
 
 // WithCustomResyncConfig sets a custom resync period for the specified informer types.
-func WithCustomResyncConfig(resyncConfig map[metav1.Object]time.Duration) SharedInformerOption {
+func WithCustomResyncConfig(resyncConfig map[v1.Object]time.Duration) SharedInformerOption {
 	return func(opts *SharedInformerOptions) *SharedInformerOptions {
 		for k, v := range resyncConfig {
 			opts.customResync[reflect.TypeOf(k)] = v
@@ -90,20 +95,36 @@ func WithCustomResyncConfig(resyncConfig map[metav1.Object]time.Duration) Shared
 }
 
 // WithTweakListOptions sets a custom filter on all listers of the configured SharedInformerFactory.
-func WithTweakListOptions(tweakListOptions internalinterfaces.TweakListOptionsFunc) SharedInformerOption {
+func WithTweakListOptions(tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) SharedInformerOption {
 	return func(opts *SharedInformerOptions) *SharedInformerOptions {
 		opts.tweakListOptions = tweakListOptions
 		return opts
 	}
 }
 
-// NewSharedInformerFactory constructs a new instance of SharedInformerFactory for all namespaces.
-func NewSharedInformerFactory(client clientset.ClusterInterface, defaultResync time.Duration) SharedInformerFactory {
+// WithTransform sets a transform on all informers.
+func WithTransform(transform cache.TransformFunc) SharedInformerOption {
+	return func(opts *SharedInformerOptions) *SharedInformerOptions {
+		opts.transform = transform
+		return opts
+	}
+}
+
+// NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
+func NewSharedInformerFactory(client kcpkubernetes.ClusterInterface, defaultResync time.Duration) SharedInformerFactory {
 	return NewSharedInformerFactoryWithOptions(client, defaultResync)
 }
 
+// NewFilteredSharedInformerFactory constructs a new instance of sharedInformerFactory.
+// Listers obtained via this SharedInformerFactory will be subject to the same filters
+// as specified here.
+// Deprecated: Please use NewSharedInformerFactoryWithOptions instead
+func NewFilteredSharedInformerFactory(client kcpkubernetes.ClusterInterface, defaultResync time.Duration, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) SharedInformerFactory {
+	return NewSharedInformerFactoryWithOptions(client, defaultResync, WithTweakListOptions(tweakListOptions))
+}
+
 // NewSharedInformerFactoryWithOptions constructs a new instance of a SharedInformerFactory with additional options.
-func NewSharedInformerFactoryWithOptions(client clientset.ClusterInterface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
+func NewSharedInformerFactoryWithOptions(client kcpkubernetes.ClusterInterface, defaultResync time.Duration, options ...SharedInformerOption) SharedInformerFactory {
 	factory := &sharedInformerFactory{
 		client:           client,
 		defaultResync:    defaultResync,
@@ -124,24 +145,44 @@ func NewSharedInformerFactoryWithOptions(client clientset.ClusterInterface, defa
 	// Forward options to the factory
 	factory.customResync = opts.customResync
 	factory.tweakListOptions = opts.tweakListOptions
+	factory.transform = opts.transform
 
 	return factory
 }
 
-// Start initializes all requested informers.
 func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
 	f.lock.Lock()
 	defer f.lock.Unlock()
 
+	if f.shuttingDown {
+		return
+	}
+
 	for informerType, informer := range f.informers {
 		if !f.startedInformers[informerType] {
-			go informer.Run(stopCh)
+			f.wg.Add(1)
+			// We need a new variable in each loop iteration,
+			// otherwise the goroutine would use the loop variable
+			// and that keeps changing.
+			informer := informer
+			go func() {
+				defer f.wg.Done()
+				informer.Run(stopCh)
+			}()
 			f.startedInformers[informerType] = true
 		}
 	}
 }
 
-// WaitForCacheSync waits for all started informers' cache were synced.
+func (f *sharedInformerFactory) Shutdown() {
+	f.lock.Lock()
+	f.shuttingDown = true
+	f.lock.Unlock()
+
+	// Will return immediately if there is nothing to wait for.
+	f.wg.Wait()
+}
+
 func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
 	informers := func() map[reflect.Type]kcpcache.ScopeableSharedIndexInformer {
 		f.lock.Lock()
@@ -160,12 +201,12 @@ func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[ref
 	for informType, informer := range informers {
 		res[informType] = cache.WaitForCacheSync(stopCh, informer.HasSynced)
 	}
+
 	return res
 }
 
-// InformerFor returns the SharedIndexInformer for obj using an internal
-// client.
-func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) kcpcache.ScopeableSharedIndexInformer {
+// InformerFor returns the ScopeableSharedIndexInformer for obj using an internal client.
+func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc kcpinternalinterfaces.NewInformerFunc) kcpcache.ScopeableSharedIndexInformer {
 	f.lock.Lock()
 	defer f.lock.Unlock()
 
@@ -181,119 +222,178 @@ func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internal
 	}
 
 	informer = newFunc(f.client, resyncPeriod)
+	informer.SetTransform(f.transform)
 	f.informers[informerType] = informer
 
 	return informer
 }
 
 type ScopedDynamicSharedInformerFactory interface {
-	ForResource(resource schema.GroupVersionResource) (upstreaminformers.GenericInformer, error)
+	// ForResource gives generic access to a shared informer of the matching type.
+	ForResource(resource schema.GroupVersionResource) (clientgoinformers.GenericInformer, error)
+
+	// Start initializes all requested informers. They are handled in goroutines
+	// which run until the stop channel gets closed.
 	Start(stopCh <-chan struct{})
 }
 
 // SharedInformerFactory provides shared informers for resources in all known
 // API group versions.
+//
+// It is typically used like this:
+//
+//	ctx, cancel := context.Background()
+//	defer cancel()
+//	factory := NewSharedInformerFactory(client, resyncPeriod)
+//	defer factory.WaitForStop()    // Returns immediately if nothing was started.
+//	genericInformer := factory.ForResource(resource)
+//	typedInformer := factory.SomeAPIGroup().V1().SomeType()
+//	factory.Start(ctx.Done())      // Start processing these informers.
+//	synced := factory.WaitForCacheSync(ctx.Done())
+//	for v, ok := range synced {
+//	    if !ok {
+//	        fmt.Fprintf(os.Stderr, "caches failed to sync: %v", v)
+//	        return
+//	    }
+//	}
+//
+//	// Creating informers can also be created after Start, but then
+//	// Start must be called again:
+//	anotherGenericInformer := factory.ForResource(resource)
+//	factory.Start(ctx.Done())
 type SharedInformerFactory interface {
-	internalinterfaces.SharedInformerFactory
+	kcpinternalinterfaces.SharedInformerFactory
+
 	Cluster(logicalcluster.Name) ScopedDynamicSharedInformerFactory
-	ForResource(resource schema.GroupVersionResource) (GenericClusterInformer, error)
+
+	// Start initializes all requested informers. They are handled in goroutines
+	// which run until the stop channel gets closed.
+	// Warning: Start does not block. When run in a go-routine, it will race with a later WaitForCacheSync.
+	Start(stopCh <-chan struct{})
+
+	// Shutdown marks a factory as shutting down. At that point no new
+	// informers can be started anymore and Start will return without
+	// doing anything.
+	//
+	// In addition, Shutdown blocks until all goroutines have terminated. For that
+	// to happen, the close channel(s) that they were started with must be closed,
+	// either before Shutdown gets called or while it is waiting.
+	//
+	// Shutdown may be called multiple times, even concurrently. All such calls will
+	// block until all goroutines have terminated.
+	Shutdown()
+
+	// WaitForCacheSync blocks until all started informers' caches were synced
+	// or the stop channel gets closed.
 	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
 
-	Admissionregistration() admissionregistrationinformers.ClusterInterface
-	Internal() apiserverinternalinformers.ClusterInterface
-	Apps() appsinformers.ClusterInterface
-	Autoscaling() autoscalinginformers.ClusterInterface
-	Batch() batchinformers.ClusterInterface
-	Certificates() certificatesinformers.ClusterInterface
-	Coordination() coordinationinformers.ClusterInterface
-	Core() coreinformers.ClusterInterface
-	Discovery() discoveryinformers.ClusterInterface
-	Events() eventsinformers.ClusterInterface
-	Extensions() extensionsinformers.ClusterInterface
-	Flowcontrol() flowcontrolinformers.ClusterInterface
-	Networking() networkinginformers.ClusterInterface
-	Node() nodeinformers.ClusterInterface
-	Policy() policyinformers.ClusterInterface
-	Rbac() rbacinformers.ClusterInterface
-	Resource() resourceinformers.ClusterInterface
-	Scheduling() schedulinginformers.ClusterInterface
-	Storage() storageinformers.ClusterInterface
+	// ForResource gives generic access to a shared informer of the matching type.
+	ForResource(resource schema.GroupVersionResource) (GenericClusterInformer, error)
+
+	// InformerFor returns the SharedIndexInformer for obj using an internal
+	// client.
+	InformerFor(obj runtime.Object, newFunc kcpinternalinterfaces.NewInformerFunc) kcpcache.ScopeableSharedIndexInformer
+
+	Admissionregistration() kcpadmissionregistration.ClusterInterface
+	Internal() kcpapiserverinternal.ClusterInterface
+	Apps() kcpapps.ClusterInterface
+	Autoscaling() kcpautoscaling.ClusterInterface
+	Batch() kcpbatch.ClusterInterface
+	Certificates() kcpcertificates.ClusterInterface
+	Coordination() kcpcoordination.ClusterInterface
+	Core() kcpcore.ClusterInterface
+	Discovery() kcpdiscovery.ClusterInterface
+	Events() kcpevents.ClusterInterface
+	Extensions() kcpextensions.ClusterInterface
+	Flowcontrol() kcpflowcontrol.ClusterInterface
+	Networking() kcpnetworking.ClusterInterface
+	Node() kcpnode.ClusterInterface
+	Policy() kcppolicy.ClusterInterface
+	Rbac() kcprbac.ClusterInterface
+	Resource() kcpresource.ClusterInterface
+	Scheduling() kcpscheduling.ClusterInterface
+	Storage() kcpstorage.ClusterInterface
+	Storagemigration() kcpstoragemigration.ClusterInterface
+}
+
+func (f *sharedInformerFactory) Admissionregistration() kcpadmissionregistration.ClusterInterface {
+	return kcpadmissionregistration.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Admissionregistration() admissionregistrationinformers.ClusterInterface {
-	return admissionregistrationinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Internal() kcpapiserverinternal.ClusterInterface {
+	return kcpapiserverinternal.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Internal() apiserverinternalinformers.ClusterInterface {
-	return apiserverinternalinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Apps() kcpapps.ClusterInterface {
+	return kcpapps.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Apps() appsinformers.ClusterInterface {
-	return appsinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Autoscaling() kcpautoscaling.ClusterInterface {
+	return kcpautoscaling.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Autoscaling() autoscalinginformers.ClusterInterface {
-	return autoscalinginformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Batch() kcpbatch.ClusterInterface {
+	return kcpbatch.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Batch() batchinformers.ClusterInterface {
-	return batchinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Certificates() kcpcertificates.ClusterInterface {
+	return kcpcertificates.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Certificates() certificatesinformers.ClusterInterface {
-	return certificatesinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Coordination() kcpcoordination.ClusterInterface {
+	return kcpcoordination.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Coordination() coordinationinformers.ClusterInterface {
-	return coordinationinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Core() kcpcore.ClusterInterface {
+	return kcpcore.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Core() coreinformers.ClusterInterface {
-	return coreinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Discovery() kcpdiscovery.ClusterInterface {
+	return kcpdiscovery.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Discovery() discoveryinformers.ClusterInterface {
-	return discoveryinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Events() kcpevents.ClusterInterface {
+	return kcpevents.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Events() eventsinformers.ClusterInterface {
-	return eventsinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Extensions() kcpextensions.ClusterInterface {
+	return kcpextensions.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Extensions() extensionsinformers.ClusterInterface {
-	return extensionsinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Flowcontrol() kcpflowcontrol.ClusterInterface {
+	return kcpflowcontrol.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Flowcontrol() flowcontrolinformers.ClusterInterface {
-	return flowcontrolinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Networking() kcpnetworking.ClusterInterface {
+	return kcpnetworking.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Networking() networkinginformers.ClusterInterface {
-	return networkinginformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Node() kcpnode.ClusterInterface {
+	return kcpnode.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Node() nodeinformers.ClusterInterface {
-	return nodeinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Policy() kcppolicy.ClusterInterface {
+	return kcppolicy.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Policy() policyinformers.ClusterInterface {
-	return policyinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Rbac() kcprbac.ClusterInterface {
+	return kcprbac.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Rbac() rbacinformers.ClusterInterface {
-	return rbacinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Resource() kcpresource.ClusterInterface {
+	return kcpresource.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Resource() resourceinformers.ClusterInterface {
-	return resourceinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Scheduling() kcpscheduling.ClusterInterface {
+	return kcpscheduling.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Scheduling() schedulinginformers.ClusterInterface {
-	return schedulinginformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Storage() kcpstorage.ClusterInterface {
+	return kcpstorage.New(f, f.tweakListOptions)
 }
 
-func (f *sharedInformerFactory) Storage() storageinformers.ClusterInterface {
-	return storageinformers.New(f, f.tweakListOptions)
+func (f *sharedInformerFactory) Storagemigration() kcpstoragemigration.ClusterInterface {
+	return kcpstoragemigration.New(f, f.tweakListOptions)
 }
 
 func (f *sharedInformerFactory) Cluster(clusterName logicalcluster.Name) ScopedDynamicSharedInformerFactory {
@@ -308,7 +408,7 @@ type scopedDynamicSharedInformerFactory struct {
 	clusterName logicalcluster.Name
 }
 
-func (f *scopedDynamicSharedInformerFactory) ForResource(resource schema.GroupVersionResource) (upstreaminformers.GenericInformer, error) {
+func (f *scopedDynamicSharedInformerFactory) ForResource(resource schema.GroupVersionResource) (clientgoinformers.GenericInformer, error) {
 	clusterInformer, err := f.sharedInformerFactory.ForResource(resource)
 	if err != nil {
 		return nil, err
diff --git a/informers/flowcontrol/interface.go b/informers/flowcontrol/interface.go
index 7536ea286..f3bfc47f4 100644
--- a/informers/flowcontrol/interface.go
+++ b/informers/flowcontrol/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,55 +14,56 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package flowcontrol
 
 import (
-	"github.com/kcp-dev/client-go/informers/flowcontrol/v1alpha1"
-	"github.com/kcp-dev/client-go/informers/flowcontrol/v1beta1"
-	"github.com/kcp-dev/client-go/informers/flowcontrol/v1beta2"
-	"github.com/kcp-dev/client-go/informers/flowcontrol/v1beta3"
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/flowcontrol/v1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/flowcontrol/v1beta1"
+	kcpv1beta2 "github.com/kcp-dev/client-go/informers/flowcontrol/v1beta2"
+	kcpv1beta3 "github.com/kcp-dev/client-go/informers/flowcontrol/v1beta3"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1alpha1 provides access to the shared informers in V1alpha1.
-	V1alpha1() v1alpha1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
-	// V1beta2 provides access to the shared informers in V1beta2.
-	V1beta2() v1beta2.ClusterInterface
-	// V1beta3 provides access to the shared informers in V1beta3.
-	V1beta3() v1beta3.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
+	// V1beta2 provides access to shared informers for resources in V1beta2.
+	V1beta2() kcpv1beta2.ClusterInterface
+	// V1beta3 provides access to shared informers for resources in V1beta3.
+	V1beta3() kcpv1beta3.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1alpha1 returns a new v1alpha1.ClusterInterface.
-func (g *group) V1alpha1() v1alpha1.ClusterInterface {
-	return v1alpha1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta2 returns a new v1beta2.ClusterInterface.
-func (g *group) V1beta2() v1beta2.ClusterInterface {
-	return v1beta2.New(g.factory, g.tweakListOptions)
+// V1beta2 returns a new kcpv1beta2.ClusterInterface.
+func (g *group) V1beta2() kcpv1beta2.ClusterInterface {
+	return kcpv1beta2.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta3 returns a new v1beta3.ClusterInterface.
-func (g *group) V1beta3() v1beta3.ClusterInterface {
-	return v1beta3.New(g.factory, g.tweakListOptions)
+// V1beta3 returns a new kcpv1beta3.ClusterInterface.
+func (g *group) V1beta3() kcpv1beta3.ClusterInterface {
+	return kcpv1beta3.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/flowcontrol/v1/flowschema.go b/informers/flowcontrol/v1/flowschema.go
new file mode 100644
index 000000000..30d885973
--- /dev/null
+++ b/informers/flowcontrol/v1/flowschema.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	apiflowcontrolv1 "k8s.io/api/flowcontrol/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1 "k8s.io/client-go/informers/flowcontrol/v1"
+	listersflowcontrolv1 "k8s.io/client-go/listers/flowcontrol/v1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/flowcontrol/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// FlowSchemaClusterInformer provides access to a shared informer and lister for
+// FlowSchemas.
+type FlowSchemaClusterInformer interface {
+	Cluster(logicalcluster.Name) flowcontrolv1.FlowSchemaInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) flowcontrolv1.FlowSchemaInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1.FlowSchemaClusterLister
+}
+
+type flowSchemaClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewFlowSchemaClusterInformer constructs a new informer for FlowSchema type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFlowSchemaClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredFlowSchemaClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredFlowSchemaClusterInformer constructs a new informer for FlowSchema type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredFlowSchemaClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.FlowcontrolV1().FlowSchemas().List(context.Background(), options)
+			},
+			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.FlowcontrolV1().FlowSchemas().Watch(context.Background(), options)
+			},
+		},
+		&apiflowcontrolv1.FlowSchema{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *flowSchemaClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredFlowSchemaClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *flowSchemaClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiflowcontrolv1.FlowSchema{}, i.defaultInformer)
+}
+
+func (i *flowSchemaClusterInformer) Lister() kcpv1.FlowSchemaClusterLister {
+	return kcpv1.NewFlowSchemaClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *flowSchemaClusterInformer) Cluster(clusterName logicalcluster.Name) flowcontrolv1.FlowSchemaInformer {
+	return &flowSchemaInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *flowSchemaClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) flowcontrolv1.FlowSchemaInformer {
+	return &flowSchemaInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type flowSchemaInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersflowcontrolv1.FlowSchemaLister
+}
+
+func (i *flowSchemaInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *flowSchemaInformer) Lister() listersflowcontrolv1.FlowSchemaLister {
+	return i.lister
+}
diff --git a/informers/flowcontrol/v1alpha1/interface.go b/informers/flowcontrol/v1/interface.go
similarity index 66%
rename from informers/flowcontrol/v1alpha1/interface.go
rename to informers/flowcontrol/v1/interface.go
index 91567e452..a0f0e138a 100644
--- a/informers/flowcontrol/v1alpha1/interface.go
+++ b/informers/flowcontrol/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,37 +14,37 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
-package v1alpha1
+package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// FlowSchemas returns a FlowSchemaClusterInformer
+	// FlowSchemas returns a FlowSchemaClusterInformer.
 	FlowSchemas() FlowSchemaClusterInformer
-	// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer
+	// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer.
 	PriorityLevelConfigurations() PriorityLevelConfigurationClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// FlowSchemas returns a FlowSchemaClusterInformer
+// FlowSchemas returns a FlowSchemaClusterInformer.
 func (v *version) FlowSchemas() FlowSchemaClusterInformer {
 	return &flowSchemaClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer
+// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer.
 func (v *version) PriorityLevelConfigurations() PriorityLevelConfigurationClusterInformer {
 	return &priorityLevelConfigurationClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/flowcontrol/v1/prioritylevelconfiguration.go b/informers/flowcontrol/v1/prioritylevelconfiguration.go
new file mode 100644
index 000000000..296eb52c2
--- /dev/null
+++ b/informers/flowcontrol/v1/prioritylevelconfiguration.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	apiflowcontrolv1 "k8s.io/api/flowcontrol/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1 "k8s.io/client-go/informers/flowcontrol/v1"
+	listersflowcontrolv1 "k8s.io/client-go/listers/flowcontrol/v1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/flowcontrol/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// PriorityLevelConfigurationClusterInformer provides access to a shared informer and lister for
+// PriorityLevelConfigurations.
+type PriorityLevelConfigurationClusterInformer interface {
+	Cluster(logicalcluster.Name) flowcontrolv1.PriorityLevelConfigurationInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) flowcontrolv1.PriorityLevelConfigurationInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1.PriorityLevelConfigurationClusterLister
+}
+
+type priorityLevelConfigurationClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewPriorityLevelConfigurationClusterInformer constructs a new informer for PriorityLevelConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewPriorityLevelConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredPriorityLevelConfigurationClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredPriorityLevelConfigurationClusterInformer constructs a new informer for PriorityLevelConfiguration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredPriorityLevelConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.FlowcontrolV1().PriorityLevelConfigurations().List(context.Background(), options)
+			},
+			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.FlowcontrolV1().PriorityLevelConfigurations().Watch(context.Background(), options)
+			},
+		},
+		&apiflowcontrolv1.PriorityLevelConfiguration{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *priorityLevelConfigurationClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredPriorityLevelConfigurationClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *priorityLevelConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiflowcontrolv1.PriorityLevelConfiguration{}, i.defaultInformer)
+}
+
+func (i *priorityLevelConfigurationClusterInformer) Lister() kcpv1.PriorityLevelConfigurationClusterLister {
+	return kcpv1.NewPriorityLevelConfigurationClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *priorityLevelConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) flowcontrolv1.PriorityLevelConfigurationInformer {
+	return &priorityLevelConfigurationInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *priorityLevelConfigurationClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) flowcontrolv1.PriorityLevelConfigurationInformer {
+	return &priorityLevelConfigurationInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type priorityLevelConfigurationInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersflowcontrolv1.PriorityLevelConfigurationLister
+}
+
+func (i *priorityLevelConfigurationInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *priorityLevelConfigurationInformer) Lister() listersflowcontrolv1.PriorityLevelConfigurationLister {
+	return i.lister
+}
diff --git a/informers/flowcontrol/v1alpha1/flowschema.go b/informers/flowcontrol/v1alpha1/flowschema.go
deleted file mode 100644
index df538fa02..000000000
--- a/informers/flowcontrol/v1alpha1/flowschema.go
+++ /dev/null
@@ -1,124 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1alpha1 "k8s.io/api/flowcontrol/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamflowcontrolv1alpha1informers "k8s.io/client-go/informers/flowcontrol/v1alpha1"
-	upstreamflowcontrolv1alpha1listers "k8s.io/client-go/listers/flowcontrol/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	flowcontrolv1alpha1listers "github.com/kcp-dev/client-go/listers/flowcontrol/v1alpha1"
-)
-
-// FlowSchemaClusterInformer provides access to a shared informer and lister for
-// FlowSchemas.
-type FlowSchemaClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamflowcontrolv1alpha1informers.FlowSchemaInformer
-	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() flowcontrolv1alpha1listers.FlowSchemaClusterLister
-}
-
-type flowSchemaClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// NewFlowSchemaClusterInformer constructs a new informer for FlowSchema type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFlowSchemaClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredFlowSchemaClusterInformer(client, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredFlowSchemaClusterInformer constructs a new informer for FlowSchema type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredFlowSchemaClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
-	return kcpinformers.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.FlowcontrolV1alpha1().FlowSchemas().List(context.TODO(), options)
-			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.FlowcontrolV1alpha1().FlowSchemas().Watch(context.TODO(), options)
-			},
-		},
-		&flowcontrolv1alpha1.FlowSchema{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *flowSchemaClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredFlowSchemaClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
-}
-
-func (f *flowSchemaClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&flowcontrolv1alpha1.FlowSchema{}, f.defaultInformer)
-}
-
-func (f *flowSchemaClusterInformer) Lister() flowcontrolv1alpha1listers.FlowSchemaClusterLister {
-	return flowcontrolv1alpha1listers.NewFlowSchemaClusterLister(f.Informer().GetIndexer())
-}
-
-func (f *flowSchemaClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamflowcontrolv1alpha1informers.FlowSchemaInformer {
-	return &flowSchemaInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
-	}
-}
-
-type flowSchemaInformer struct {
-	informer cache.SharedIndexInformer
-	lister   upstreamflowcontrolv1alpha1listers.FlowSchemaLister
-}
-
-func (f *flowSchemaInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
-}
-
-func (f *flowSchemaInformer) Lister() upstreamflowcontrolv1alpha1listers.FlowSchemaLister {
-	return f.lister
-}
diff --git a/informers/flowcontrol/v1alpha1/prioritylevelconfiguration.go b/informers/flowcontrol/v1alpha1/prioritylevelconfiguration.go
deleted file mode 100644
index 3840ce1fd..000000000
--- a/informers/flowcontrol/v1alpha1/prioritylevelconfiguration.go
+++ /dev/null
@@ -1,124 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1alpha1 "k8s.io/api/flowcontrol/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamflowcontrolv1alpha1informers "k8s.io/client-go/informers/flowcontrol/v1alpha1"
-	upstreamflowcontrolv1alpha1listers "k8s.io/client-go/listers/flowcontrol/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	flowcontrolv1alpha1listers "github.com/kcp-dev/client-go/listers/flowcontrol/v1alpha1"
-)
-
-// PriorityLevelConfigurationClusterInformer provides access to a shared informer and lister for
-// PriorityLevelConfigurations.
-type PriorityLevelConfigurationClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamflowcontrolv1alpha1informers.PriorityLevelConfigurationInformer
-	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() flowcontrolv1alpha1listers.PriorityLevelConfigurationClusterLister
-}
-
-type priorityLevelConfigurationClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// NewPriorityLevelConfigurationClusterInformer constructs a new informer for PriorityLevelConfiguration type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewPriorityLevelConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredPriorityLevelConfigurationClusterInformer(client, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredPriorityLevelConfigurationClusterInformer constructs a new informer for PriorityLevelConfiguration type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPriorityLevelConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
-	return kcpinformers.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.FlowcontrolV1alpha1().PriorityLevelConfigurations().List(context.TODO(), options)
-			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.FlowcontrolV1alpha1().PriorityLevelConfigurations().Watch(context.TODO(), options)
-			},
-		},
-		&flowcontrolv1alpha1.PriorityLevelConfiguration{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *priorityLevelConfigurationClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredPriorityLevelConfigurationClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
-}
-
-func (f *priorityLevelConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&flowcontrolv1alpha1.PriorityLevelConfiguration{}, f.defaultInformer)
-}
-
-func (f *priorityLevelConfigurationClusterInformer) Lister() flowcontrolv1alpha1listers.PriorityLevelConfigurationClusterLister {
-	return flowcontrolv1alpha1listers.NewPriorityLevelConfigurationClusterLister(f.Informer().GetIndexer())
-}
-
-func (f *priorityLevelConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamflowcontrolv1alpha1informers.PriorityLevelConfigurationInformer {
-	return &priorityLevelConfigurationInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
-	}
-}
-
-type priorityLevelConfigurationInformer struct {
-	informer cache.SharedIndexInformer
-	lister   upstreamflowcontrolv1alpha1listers.PriorityLevelConfigurationLister
-}
-
-func (f *priorityLevelConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
-}
-
-func (f *priorityLevelConfigurationInformer) Lister() upstreamflowcontrolv1alpha1listers.PriorityLevelConfigurationLister {
-	return f.lister
-}
diff --git a/informers/flowcontrol/v1beta1/flowschema.go b/informers/flowcontrol/v1beta1/flowschema.go
index ae28f974a..24f253501 100644
--- a/informers/flowcontrol/v1beta1/flowschema.go
+++ b/informers/flowcontrol/v1beta1/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiflowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1beta1 "k8s.io/client-go/informers/flowcontrol/v1beta1"
+	listersflowcontrolv1beta1 "k8s.io/client-go/listers/flowcontrol/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamflowcontrolv1beta1informers "k8s.io/client-go/informers/flowcontrol/v1beta1"
-	upstreamflowcontrolv1beta1listers "k8s.io/client-go/listers/flowcontrol/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	flowcontrolv1beta1listers "github.com/kcp-dev/client-go/listers/flowcontrol/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/flowcontrol/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // FlowSchemaClusterInformer provides access to a shared informer and lister for
 // FlowSchemas.
 type FlowSchemaClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamflowcontrolv1beta1informers.FlowSchemaInformer
+	Cluster(logicalcluster.Name) flowcontrolv1beta1.FlowSchemaInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) flowcontrolv1beta1.FlowSchemaInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() flowcontrolv1beta1listers.FlowSchemaClusterLister
+	Lister() kcpv1beta1.FlowSchemaClusterLister
 }
 
 type flowSchemaClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewFlowSchemaClusterInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFlowSchemaClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewFlowSchemaClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredFlowSchemaClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredFlowSchemaClusterInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredFlowSchemaClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredFlowSchemaClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.FlowcontrolV1beta1().FlowSchemas().List(context.TODO(), options)
+				return client.FlowcontrolV1beta1().FlowSchemas().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.FlowcontrolV1beta1().FlowSchemas().Watch(context.TODO(), options)
+				return client.FlowcontrolV1beta1().FlowSchemas().Watch(context.Background(), options)
 			},
 		},
-		&flowcontrolv1beta1.FlowSchema{},
+		&apiflowcontrolv1beta1.FlowSchema{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *flowSchemaClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *flowSchemaClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredFlowSchemaClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *flowSchemaClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&flowcontrolv1beta1.FlowSchema{}, f.defaultInformer)
+func (i *flowSchemaClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiflowcontrolv1beta1.FlowSchema{}, i.defaultInformer)
 }
 
-func (f *flowSchemaClusterInformer) Lister() flowcontrolv1beta1listers.FlowSchemaClusterLister {
-	return flowcontrolv1beta1listers.NewFlowSchemaClusterLister(f.Informer().GetIndexer())
+func (i *flowSchemaClusterInformer) Lister() kcpv1beta1.FlowSchemaClusterLister {
+	return kcpv1beta1.NewFlowSchemaClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *flowSchemaClusterInformer) Cluster(clusterName logicalcluster.Name) flowcontrolv1beta1.FlowSchemaInformer {
+	return &flowSchemaInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *flowSchemaClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamflowcontrolv1beta1informers.FlowSchemaInformer {
+func (i *flowSchemaClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) flowcontrolv1beta1.FlowSchemaInformer {
 	return &flowSchemaInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type flowSchemaInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamflowcontrolv1beta1listers.FlowSchemaLister
+	lister   listersflowcontrolv1beta1.FlowSchemaLister
 }
 
-func (f *flowSchemaInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *flowSchemaInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *flowSchemaInformer) Lister() upstreamflowcontrolv1beta1listers.FlowSchemaLister {
-	return f.lister
+func (i *flowSchemaInformer) Lister() listersflowcontrolv1beta1.FlowSchemaLister {
+	return i.lister
 }
diff --git a/informers/flowcontrol/v1beta1/interface.go b/informers/flowcontrol/v1beta1/interface.go
index ad2da3c19..dbb0144d5 100644
--- a/informers/flowcontrol/v1beta1/interface.go
+++ b/informers/flowcontrol/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,37 +14,37 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// FlowSchemas returns a FlowSchemaClusterInformer
+	// FlowSchemas returns a FlowSchemaClusterInformer.
 	FlowSchemas() FlowSchemaClusterInformer
-	// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer
+	// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer.
 	PriorityLevelConfigurations() PriorityLevelConfigurationClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// FlowSchemas returns a FlowSchemaClusterInformer
+// FlowSchemas returns a FlowSchemaClusterInformer.
 func (v *version) FlowSchemas() FlowSchemaClusterInformer {
 	return &flowSchemaClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer
+// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer.
 func (v *version) PriorityLevelConfigurations() PriorityLevelConfigurationClusterInformer {
 	return &priorityLevelConfigurationClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/flowcontrol/v1beta1/prioritylevelconfiguration.go b/informers/flowcontrol/v1beta1/prioritylevelconfiguration.go
index 0b7d970a9..17f802ae8 100644
--- a/informers/flowcontrol/v1beta1/prioritylevelconfiguration.go
+++ b/informers/flowcontrol/v1beta1/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiflowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1beta1 "k8s.io/client-go/informers/flowcontrol/v1beta1"
+	listersflowcontrolv1beta1 "k8s.io/client-go/listers/flowcontrol/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamflowcontrolv1beta1informers "k8s.io/client-go/informers/flowcontrol/v1beta1"
-	upstreamflowcontrolv1beta1listers "k8s.io/client-go/listers/flowcontrol/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	flowcontrolv1beta1listers "github.com/kcp-dev/client-go/listers/flowcontrol/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/flowcontrol/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PriorityLevelConfigurationClusterInformer provides access to a shared informer and lister for
 // PriorityLevelConfigurations.
 type PriorityLevelConfigurationClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamflowcontrolv1beta1informers.PriorityLevelConfigurationInformer
+	Cluster(logicalcluster.Name) flowcontrolv1beta1.PriorityLevelConfigurationInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) flowcontrolv1beta1.PriorityLevelConfigurationInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() flowcontrolv1beta1listers.PriorityLevelConfigurationClusterLister
+	Lister() kcpv1beta1.PriorityLevelConfigurationClusterLister
 }
 
 type priorityLevelConfigurationClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewPriorityLevelConfigurationClusterInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPriorityLevelConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewPriorityLevelConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPriorityLevelConfigurationClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredPriorityLevelConfigurationClusterInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPriorityLevelConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredPriorityLevelConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.FlowcontrolV1beta1().PriorityLevelConfigurations().List(context.TODO(), options)
+				return client.FlowcontrolV1beta1().PriorityLevelConfigurations().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.FlowcontrolV1beta1().PriorityLevelConfigurations().Watch(context.TODO(), options)
+				return client.FlowcontrolV1beta1().PriorityLevelConfigurations().Watch(context.Background(), options)
 			},
 		},
-		&flowcontrolv1beta1.PriorityLevelConfiguration{},
+		&apiflowcontrolv1beta1.PriorityLevelConfiguration{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *priorityLevelConfigurationClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *priorityLevelConfigurationClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPriorityLevelConfigurationClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *priorityLevelConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&flowcontrolv1beta1.PriorityLevelConfiguration{}, f.defaultInformer)
+func (i *priorityLevelConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiflowcontrolv1beta1.PriorityLevelConfiguration{}, i.defaultInformer)
 }
 
-func (f *priorityLevelConfigurationClusterInformer) Lister() flowcontrolv1beta1listers.PriorityLevelConfigurationClusterLister {
-	return flowcontrolv1beta1listers.NewPriorityLevelConfigurationClusterLister(f.Informer().GetIndexer())
+func (i *priorityLevelConfigurationClusterInformer) Lister() kcpv1beta1.PriorityLevelConfigurationClusterLister {
+	return kcpv1beta1.NewPriorityLevelConfigurationClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *priorityLevelConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) flowcontrolv1beta1.PriorityLevelConfigurationInformer {
+	return &priorityLevelConfigurationInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *priorityLevelConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamflowcontrolv1beta1informers.PriorityLevelConfigurationInformer {
+func (i *priorityLevelConfigurationClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) flowcontrolv1beta1.PriorityLevelConfigurationInformer {
 	return &priorityLevelConfigurationInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type priorityLevelConfigurationInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamflowcontrolv1beta1listers.PriorityLevelConfigurationLister
+	lister   listersflowcontrolv1beta1.PriorityLevelConfigurationLister
 }
 
-func (f *priorityLevelConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *priorityLevelConfigurationInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *priorityLevelConfigurationInformer) Lister() upstreamflowcontrolv1beta1listers.PriorityLevelConfigurationLister {
-	return f.lister
+func (i *priorityLevelConfigurationInformer) Lister() listersflowcontrolv1beta1.PriorityLevelConfigurationLister {
+	return i.lister
 }
diff --git a/informers/flowcontrol/v1beta2/flowschema.go b/informers/flowcontrol/v1beta2/flowschema.go
index adb85000c..142f68681 100644
--- a/informers/flowcontrol/v1beta2/flowschema.go
+++ b/informers/flowcontrol/v1beta2/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiflowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1beta2 "k8s.io/client-go/informers/flowcontrol/v1beta2"
+	listersflowcontrolv1beta2 "k8s.io/client-go/listers/flowcontrol/v1beta2"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamflowcontrolv1beta2informers "k8s.io/client-go/informers/flowcontrol/v1beta2"
-	upstreamflowcontrolv1beta2listers "k8s.io/client-go/listers/flowcontrol/v1beta2"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	flowcontrolv1beta2listers "github.com/kcp-dev/client-go/listers/flowcontrol/v1beta2"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta2 "github.com/kcp-dev/client-go/listers/flowcontrol/v1beta2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // FlowSchemaClusterInformer provides access to a shared informer and lister for
 // FlowSchemas.
 type FlowSchemaClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamflowcontrolv1beta2informers.FlowSchemaInformer
+	Cluster(logicalcluster.Name) flowcontrolv1beta2.FlowSchemaInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) flowcontrolv1beta2.FlowSchemaInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() flowcontrolv1beta2listers.FlowSchemaClusterLister
+	Lister() kcpv1beta2.FlowSchemaClusterLister
 }
 
 type flowSchemaClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewFlowSchemaClusterInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFlowSchemaClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewFlowSchemaClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredFlowSchemaClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredFlowSchemaClusterInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredFlowSchemaClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredFlowSchemaClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.FlowcontrolV1beta2().FlowSchemas().List(context.TODO(), options)
+				return client.FlowcontrolV1beta2().FlowSchemas().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.FlowcontrolV1beta2().FlowSchemas().Watch(context.TODO(), options)
+				return client.FlowcontrolV1beta2().FlowSchemas().Watch(context.Background(), options)
 			},
 		},
-		&flowcontrolv1beta2.FlowSchema{},
+		&apiflowcontrolv1beta2.FlowSchema{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *flowSchemaClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *flowSchemaClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredFlowSchemaClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *flowSchemaClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&flowcontrolv1beta2.FlowSchema{}, f.defaultInformer)
+func (i *flowSchemaClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiflowcontrolv1beta2.FlowSchema{}, i.defaultInformer)
 }
 
-func (f *flowSchemaClusterInformer) Lister() flowcontrolv1beta2listers.FlowSchemaClusterLister {
-	return flowcontrolv1beta2listers.NewFlowSchemaClusterLister(f.Informer().GetIndexer())
+func (i *flowSchemaClusterInformer) Lister() kcpv1beta2.FlowSchemaClusterLister {
+	return kcpv1beta2.NewFlowSchemaClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *flowSchemaClusterInformer) Cluster(clusterName logicalcluster.Name) flowcontrolv1beta2.FlowSchemaInformer {
+	return &flowSchemaInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *flowSchemaClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamflowcontrolv1beta2informers.FlowSchemaInformer {
+func (i *flowSchemaClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) flowcontrolv1beta2.FlowSchemaInformer {
 	return &flowSchemaInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type flowSchemaInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamflowcontrolv1beta2listers.FlowSchemaLister
+	lister   listersflowcontrolv1beta2.FlowSchemaLister
 }
 
-func (f *flowSchemaInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *flowSchemaInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *flowSchemaInformer) Lister() upstreamflowcontrolv1beta2listers.FlowSchemaLister {
-	return f.lister
+func (i *flowSchemaInformer) Lister() listersflowcontrolv1beta2.FlowSchemaLister {
+	return i.lister
 }
diff --git a/informers/flowcontrol/v1beta2/interface.go b/informers/flowcontrol/v1beta2/interface.go
index b2cef8004..df0c9f720 100644
--- a/informers/flowcontrol/v1beta2/interface.go
+++ b/informers/flowcontrol/v1beta2/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,37 +14,37 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// FlowSchemas returns a FlowSchemaClusterInformer
+	// FlowSchemas returns a FlowSchemaClusterInformer.
 	FlowSchemas() FlowSchemaClusterInformer
-	// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer
+	// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer.
 	PriorityLevelConfigurations() PriorityLevelConfigurationClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// FlowSchemas returns a FlowSchemaClusterInformer
+// FlowSchemas returns a FlowSchemaClusterInformer.
 func (v *version) FlowSchemas() FlowSchemaClusterInformer {
 	return &flowSchemaClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer
+// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer.
 func (v *version) PriorityLevelConfigurations() PriorityLevelConfigurationClusterInformer {
 	return &priorityLevelConfigurationClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/flowcontrol/v1beta2/prioritylevelconfiguration.go b/informers/flowcontrol/v1beta2/prioritylevelconfiguration.go
index f432746ed..bce617cbf 100644
--- a/informers/flowcontrol/v1beta2/prioritylevelconfiguration.go
+++ b/informers/flowcontrol/v1beta2/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiflowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1beta2 "k8s.io/client-go/informers/flowcontrol/v1beta2"
+	listersflowcontrolv1beta2 "k8s.io/client-go/listers/flowcontrol/v1beta2"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamflowcontrolv1beta2informers "k8s.io/client-go/informers/flowcontrol/v1beta2"
-	upstreamflowcontrolv1beta2listers "k8s.io/client-go/listers/flowcontrol/v1beta2"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	flowcontrolv1beta2listers "github.com/kcp-dev/client-go/listers/flowcontrol/v1beta2"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta2 "github.com/kcp-dev/client-go/listers/flowcontrol/v1beta2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PriorityLevelConfigurationClusterInformer provides access to a shared informer and lister for
 // PriorityLevelConfigurations.
 type PriorityLevelConfigurationClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamflowcontrolv1beta2informers.PriorityLevelConfigurationInformer
+	Cluster(logicalcluster.Name) flowcontrolv1beta2.PriorityLevelConfigurationInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) flowcontrolv1beta2.PriorityLevelConfigurationInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() flowcontrolv1beta2listers.PriorityLevelConfigurationClusterLister
+	Lister() kcpv1beta2.PriorityLevelConfigurationClusterLister
 }
 
 type priorityLevelConfigurationClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewPriorityLevelConfigurationClusterInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPriorityLevelConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewPriorityLevelConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPriorityLevelConfigurationClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredPriorityLevelConfigurationClusterInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPriorityLevelConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredPriorityLevelConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.FlowcontrolV1beta2().PriorityLevelConfigurations().List(context.TODO(), options)
+				return client.FlowcontrolV1beta2().PriorityLevelConfigurations().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.FlowcontrolV1beta2().PriorityLevelConfigurations().Watch(context.TODO(), options)
+				return client.FlowcontrolV1beta2().PriorityLevelConfigurations().Watch(context.Background(), options)
 			},
 		},
-		&flowcontrolv1beta2.PriorityLevelConfiguration{},
+		&apiflowcontrolv1beta2.PriorityLevelConfiguration{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *priorityLevelConfigurationClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *priorityLevelConfigurationClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPriorityLevelConfigurationClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *priorityLevelConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&flowcontrolv1beta2.PriorityLevelConfiguration{}, f.defaultInformer)
+func (i *priorityLevelConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiflowcontrolv1beta2.PriorityLevelConfiguration{}, i.defaultInformer)
 }
 
-func (f *priorityLevelConfigurationClusterInformer) Lister() flowcontrolv1beta2listers.PriorityLevelConfigurationClusterLister {
-	return flowcontrolv1beta2listers.NewPriorityLevelConfigurationClusterLister(f.Informer().GetIndexer())
+func (i *priorityLevelConfigurationClusterInformer) Lister() kcpv1beta2.PriorityLevelConfigurationClusterLister {
+	return kcpv1beta2.NewPriorityLevelConfigurationClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *priorityLevelConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) flowcontrolv1beta2.PriorityLevelConfigurationInformer {
+	return &priorityLevelConfigurationInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *priorityLevelConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamflowcontrolv1beta2informers.PriorityLevelConfigurationInformer {
+func (i *priorityLevelConfigurationClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) flowcontrolv1beta2.PriorityLevelConfigurationInformer {
 	return &priorityLevelConfigurationInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type priorityLevelConfigurationInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamflowcontrolv1beta2listers.PriorityLevelConfigurationLister
+	lister   listersflowcontrolv1beta2.PriorityLevelConfigurationLister
 }
 
-func (f *priorityLevelConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *priorityLevelConfigurationInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *priorityLevelConfigurationInformer) Lister() upstreamflowcontrolv1beta2listers.PriorityLevelConfigurationLister {
-	return f.lister
+func (i *priorityLevelConfigurationInformer) Lister() listersflowcontrolv1beta2.PriorityLevelConfigurationLister {
+	return i.lister
 }
diff --git a/informers/flowcontrol/v1beta3/flowschema.go b/informers/flowcontrol/v1beta3/flowschema.go
index 90ca2db0f..5f84b7db7 100644
--- a/informers/flowcontrol/v1beta3/flowschema.go
+++ b/informers/flowcontrol/v1beta3/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta3
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiflowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1beta3 "k8s.io/client-go/informers/flowcontrol/v1beta3"
+	listersflowcontrolv1beta3 "k8s.io/client-go/listers/flowcontrol/v1beta3"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamflowcontrolv1beta3informers "k8s.io/client-go/informers/flowcontrol/v1beta3"
-	upstreamflowcontrolv1beta3listers "k8s.io/client-go/listers/flowcontrol/v1beta3"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	flowcontrolv1beta3listers "github.com/kcp-dev/client-go/listers/flowcontrol/v1beta3"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta3 "github.com/kcp-dev/client-go/listers/flowcontrol/v1beta3"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // FlowSchemaClusterInformer provides access to a shared informer and lister for
 // FlowSchemas.
 type FlowSchemaClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamflowcontrolv1beta3informers.FlowSchemaInformer
+	Cluster(logicalcluster.Name) flowcontrolv1beta3.FlowSchemaInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) flowcontrolv1beta3.FlowSchemaInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() flowcontrolv1beta3listers.FlowSchemaClusterLister
+	Lister() kcpv1beta3.FlowSchemaClusterLister
 }
 
 type flowSchemaClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewFlowSchemaClusterInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFlowSchemaClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewFlowSchemaClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredFlowSchemaClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredFlowSchemaClusterInformer constructs a new informer for FlowSchema type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredFlowSchemaClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredFlowSchemaClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.FlowcontrolV1beta3().FlowSchemas().List(context.TODO(), options)
+				return client.FlowcontrolV1beta3().FlowSchemas().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.FlowcontrolV1beta3().FlowSchemas().Watch(context.TODO(), options)
+				return client.FlowcontrolV1beta3().FlowSchemas().Watch(context.Background(), options)
 			},
 		},
-		&flowcontrolv1beta3.FlowSchema{},
+		&apiflowcontrolv1beta3.FlowSchema{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *flowSchemaClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *flowSchemaClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredFlowSchemaClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *flowSchemaClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&flowcontrolv1beta3.FlowSchema{}, f.defaultInformer)
+func (i *flowSchemaClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiflowcontrolv1beta3.FlowSchema{}, i.defaultInformer)
 }
 
-func (f *flowSchemaClusterInformer) Lister() flowcontrolv1beta3listers.FlowSchemaClusterLister {
-	return flowcontrolv1beta3listers.NewFlowSchemaClusterLister(f.Informer().GetIndexer())
+func (i *flowSchemaClusterInformer) Lister() kcpv1beta3.FlowSchemaClusterLister {
+	return kcpv1beta3.NewFlowSchemaClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *flowSchemaClusterInformer) Cluster(clusterName logicalcluster.Name) flowcontrolv1beta3.FlowSchemaInformer {
+	return &flowSchemaInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *flowSchemaClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamflowcontrolv1beta3informers.FlowSchemaInformer {
+func (i *flowSchemaClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) flowcontrolv1beta3.FlowSchemaInformer {
 	return &flowSchemaInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type flowSchemaInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamflowcontrolv1beta3listers.FlowSchemaLister
+	lister   listersflowcontrolv1beta3.FlowSchemaLister
 }
 
-func (f *flowSchemaInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *flowSchemaInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *flowSchemaInformer) Lister() upstreamflowcontrolv1beta3listers.FlowSchemaLister {
-	return f.lister
+func (i *flowSchemaInformer) Lister() listersflowcontrolv1beta3.FlowSchemaLister {
+	return i.lister
 }
diff --git a/informers/flowcontrol/v1beta3/interface.go b/informers/flowcontrol/v1beta3/interface.go
index 5307f069f..f57a713ee 100644
--- a/informers/flowcontrol/v1beta3/interface.go
+++ b/informers/flowcontrol/v1beta3/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,37 +14,37 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta3
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// FlowSchemas returns a FlowSchemaClusterInformer
+	// FlowSchemas returns a FlowSchemaClusterInformer.
 	FlowSchemas() FlowSchemaClusterInformer
-	// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer
+	// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer.
 	PriorityLevelConfigurations() PriorityLevelConfigurationClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// FlowSchemas returns a FlowSchemaClusterInformer
+// FlowSchemas returns a FlowSchemaClusterInformer.
 func (v *version) FlowSchemas() FlowSchemaClusterInformer {
 	return &flowSchemaClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer
+// PriorityLevelConfigurations returns a PriorityLevelConfigurationClusterInformer.
 func (v *version) PriorityLevelConfigurations() PriorityLevelConfigurationClusterInformer {
 	return &priorityLevelConfigurationClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/flowcontrol/v1beta3/prioritylevelconfiguration.go b/informers/flowcontrol/v1beta3/prioritylevelconfiguration.go
index 1dc1db345..425d66f05 100644
--- a/informers/flowcontrol/v1beta3/prioritylevelconfiguration.go
+++ b/informers/flowcontrol/v1beta3/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta3
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apiflowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1beta3 "k8s.io/client-go/informers/flowcontrol/v1beta3"
+	listersflowcontrolv1beta3 "k8s.io/client-go/listers/flowcontrol/v1beta3"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamflowcontrolv1beta3informers "k8s.io/client-go/informers/flowcontrol/v1beta3"
-	upstreamflowcontrolv1beta3listers "k8s.io/client-go/listers/flowcontrol/v1beta3"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	flowcontrolv1beta3listers "github.com/kcp-dev/client-go/listers/flowcontrol/v1beta3"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta3 "github.com/kcp-dev/client-go/listers/flowcontrol/v1beta3"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PriorityLevelConfigurationClusterInformer provides access to a shared informer and lister for
 // PriorityLevelConfigurations.
 type PriorityLevelConfigurationClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamflowcontrolv1beta3informers.PriorityLevelConfigurationInformer
+	Cluster(logicalcluster.Name) flowcontrolv1beta3.PriorityLevelConfigurationInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) flowcontrolv1beta3.PriorityLevelConfigurationInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() flowcontrolv1beta3listers.PriorityLevelConfigurationClusterLister
+	Lister() kcpv1beta3.PriorityLevelConfigurationClusterLister
 }
 
 type priorityLevelConfigurationClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewPriorityLevelConfigurationClusterInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPriorityLevelConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewPriorityLevelConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPriorityLevelConfigurationClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredPriorityLevelConfigurationClusterInformer constructs a new informer for PriorityLevelConfiguration type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPriorityLevelConfigurationClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredPriorityLevelConfigurationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.FlowcontrolV1beta3().PriorityLevelConfigurations().List(context.TODO(), options)
+				return client.FlowcontrolV1beta3().PriorityLevelConfigurations().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.FlowcontrolV1beta3().PriorityLevelConfigurations().Watch(context.TODO(), options)
+				return client.FlowcontrolV1beta3().PriorityLevelConfigurations().Watch(context.Background(), options)
 			},
 		},
-		&flowcontrolv1beta3.PriorityLevelConfiguration{},
+		&apiflowcontrolv1beta3.PriorityLevelConfiguration{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *priorityLevelConfigurationClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *priorityLevelConfigurationClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPriorityLevelConfigurationClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *priorityLevelConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&flowcontrolv1beta3.PriorityLevelConfiguration{}, f.defaultInformer)
+func (i *priorityLevelConfigurationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiflowcontrolv1beta3.PriorityLevelConfiguration{}, i.defaultInformer)
 }
 
-func (f *priorityLevelConfigurationClusterInformer) Lister() flowcontrolv1beta3listers.PriorityLevelConfigurationClusterLister {
-	return flowcontrolv1beta3listers.NewPriorityLevelConfigurationClusterLister(f.Informer().GetIndexer())
+func (i *priorityLevelConfigurationClusterInformer) Lister() kcpv1beta3.PriorityLevelConfigurationClusterLister {
+	return kcpv1beta3.NewPriorityLevelConfigurationClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *priorityLevelConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) flowcontrolv1beta3.PriorityLevelConfigurationInformer {
+	return &priorityLevelConfigurationInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *priorityLevelConfigurationClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamflowcontrolv1beta3informers.PriorityLevelConfigurationInformer {
+func (i *priorityLevelConfigurationClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) flowcontrolv1beta3.PriorityLevelConfigurationInformer {
 	return &priorityLevelConfigurationInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type priorityLevelConfigurationInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamflowcontrolv1beta3listers.PriorityLevelConfigurationLister
+	lister   listersflowcontrolv1beta3.PriorityLevelConfigurationLister
 }
 
-func (f *priorityLevelConfigurationInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *priorityLevelConfigurationInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *priorityLevelConfigurationInformer) Lister() upstreamflowcontrolv1beta3listers.PriorityLevelConfigurationLister {
-	return f.lister
+func (i *priorityLevelConfigurationInformer) Lister() listersflowcontrolv1beta3.PriorityLevelConfigurationLister {
+	return i.lister
 }
diff --git a/informers/generic.go b/informers/generic.go
index a31a590b5..817ea0098 100644
--- a/informers/generic.go
+++ b/informers/generic.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,32 +14,32 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package informers
 
 import (
-	"fmt"
-
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
+	fmt "fmt"
 
-	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
-	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
-	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
-	internalv1alpha1 "k8s.io/api/apiserverinternal/v1alpha1"
+	v1 "k8s.io/api/admissionregistration/v1"
+	v1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	v1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	apiserverinternalv1alpha1 "k8s.io/api/apiserverinternal/v1alpha1"
 	appsv1 "k8s.io/api/apps/v1"
 	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	v1beta2 "k8s.io/api/apps/v1beta2"
 	autoscalingv1 "k8s.io/api/autoscaling/v1"
-	autoscalingv2 "k8s.io/api/autoscaling/v2"
-	autoscalingv2beta1 "k8s.io/api/autoscaling/v2beta1"
-	autoscalingv2beta2 "k8s.io/api/autoscaling/v2beta2"
+	v2 "k8s.io/api/autoscaling/v2"
+	v2beta1 "k8s.io/api/autoscaling/v2beta1"
+	v2beta2 "k8s.io/api/autoscaling/v2beta2"
 	batchv1 "k8s.io/api/batch/v1"
 	batchv1beta1 "k8s.io/api/batch/v1beta1"
 	certificatesv1 "k8s.io/api/certificates/v1"
+	certificatesv1alpha1 "k8s.io/api/certificates/v1alpha1"
 	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
 	coordinationv1 "k8s.io/api/coordination/v1"
+	v1alpha2 "k8s.io/api/coordination/v1alpha2"
 	coordinationv1beta1 "k8s.io/api/coordination/v1beta1"
 	corev1 "k8s.io/api/core/v1"
 	discoveryv1 "k8s.io/api/discovery/v1"
@@ -50,10 +47,10 @@ import (
 	eventsv1 "k8s.io/api/events/v1"
 	eventsv1beta1 "k8s.io/api/events/v1beta1"
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	flowcontrolv1alpha1 "k8s.io/api/flowcontrol/v1alpha1"
+	flowcontrolv1 "k8s.io/api/flowcontrol/v1"
 	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
 	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
-	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
+	v1beta3 "k8s.io/api/flowcontrol/v1beta3"
 	networkingv1 "k8s.io/api/networking/v1"
 	networkingv1alpha1 "k8s.io/api/networking/v1alpha1"
 	networkingv1beta1 "k8s.io/api/networking/v1beta1"
@@ -65,20 +62,27 @@ import (
 	rbacv1 "k8s.io/api/rbac/v1"
 	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
 	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
+	v1alpha3 "k8s.io/api/resource/v1alpha3"
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
 	schedulingv1 "k8s.io/api/scheduling/v1"
 	schedulingv1alpha1 "k8s.io/api/scheduling/v1alpha1"
 	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
 	storagev1 "k8s.io/api/storage/v1"
 	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	upstreaminformers "k8s.io/client-go/informers"
-	"k8s.io/client-go/tools/cache"
+	storagemigrationv1alpha1 "k8s.io/api/storagemigration/v1alpha1"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	clientgoinformers "k8s.io/client-go/informers"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 type GenericClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreaminformers.GenericInformer
+	Cluster(logicalcluster.Name) clientgoinformers.GenericInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) clientgoinformers.GenericInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
 	Lister() kcpcache.GenericClusterLister
 }
@@ -89,20 +93,29 @@ type genericClusterInformer struct {
 }
 
 // Informer returns the SharedIndexInformer.
-func (f *genericClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.informer
+func (i *genericClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.informer
 }
 
-// Lister returns the GenericClusterLister.
-func (f *genericClusterInformer) Lister() kcpcache.GenericClusterLister {
-	return kcpcache.NewGenericClusterLister(f.Informer().GetIndexer(), f.resource)
+// Lister returns the GenericLister.
+func (i *genericClusterInformer) Lister() kcpcache.GenericClusterLister {
+	return kcpcache.NewGenericClusterLister(i.Informer().GetIndexer(), i.resource)
 }
 
 // Cluster scopes to a GenericInformer.
-func (f *genericClusterInformer) Cluster(clusterName logicalcluster.Name) upstreaminformers.GenericInformer {
+func (i *genericClusterInformer) Cluster(clusterName logicalcluster.Name) clientgoinformers.GenericInformer {
 	return &genericInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().ByCluster(clusterName),
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().ByCluster(clusterName),
+	}
+}
+
+// ClusterWithContext scopes to a GenericInformer and unregisters all
+// handles registered through it once the provided context is canceled.
+func (i *genericClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) clientgoinformers.GenericInformer {
+	return &genericInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().ByCluster(clusterName),
 	}
 }
 
@@ -112,96 +125,150 @@ type genericInformer struct {
 }
 
 // Informer returns the SharedIndexInformer.
-func (f *genericInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *genericInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
 // Lister returns the GenericLister.
-func (f *genericInformer) Lister() cache.GenericLister {
-	return f.lister
+func (i *genericInformer) Lister() cache.GenericLister {
+	return i.lister
 }
 
 // ForResource gives generic access to a shared informer of the matching type
 // TODO extend this to unknown resources with a client pool
 func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericClusterInformer, error) {
 	switch resource {
-	// Group=admissionregistration.k8s.io, Version=V1
-	case admissionregistrationv1.SchemeGroupVersion.WithResource("validatingwebhookconfigurations"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1().ValidatingWebhookConfigurations().Informer()}, nil
-	case admissionregistrationv1.SchemeGroupVersion.WithResource("mutatingwebhookconfigurations"):
+	// Group=admissionregistration.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithResource("mutatingwebhookconfigurations"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1().MutatingWebhookConfigurations().Informer()}, nil
-	// Group=admissionregistration.k8s.io, Version=V1alpha1
-	case admissionregistrationv1alpha1.SchemeGroupVersion.WithResource("validatingadmissionpolicies"):
+	case v1.SchemeGroupVersion.WithResource("validatingadmissionpolicies"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1().ValidatingAdmissionPolicies().Informer()}, nil
+	case v1.SchemeGroupVersion.WithResource("validatingadmissionpolicybindings"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1().ValidatingAdmissionPolicyBindings().Informer()}, nil
+	case v1.SchemeGroupVersion.WithResource("validatingwebhookconfigurations"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1().ValidatingWebhookConfigurations().Informer()}, nil
+
+		// Group=admissionregistration.k8s.io, Version=v1alpha1
+	case v1alpha1.SchemeGroupVersion.WithResource("mutatingadmissionpolicies"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1alpha1().MutatingAdmissionPolicies().Informer()}, nil
+	case v1alpha1.SchemeGroupVersion.WithResource("mutatingadmissionpolicybindings"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1alpha1().MutatingAdmissionPolicyBindings().Informer()}, nil
+	case v1alpha1.SchemeGroupVersion.WithResource("validatingadmissionpolicies"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1alpha1().ValidatingAdmissionPolicies().Informer()}, nil
-	case admissionregistrationv1alpha1.SchemeGroupVersion.WithResource("validatingadmissionpolicybindings"):
+	case v1alpha1.SchemeGroupVersion.WithResource("validatingadmissionpolicybindings"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1alpha1().ValidatingAdmissionPolicyBindings().Informer()}, nil
-	// Group=admissionregistration.k8s.io, Version=V1beta1
-	case admissionregistrationv1beta1.SchemeGroupVersion.WithResource("validatingwebhookconfigurations"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1beta1().ValidatingWebhookConfigurations().Informer()}, nil
-	case admissionregistrationv1beta1.SchemeGroupVersion.WithResource("mutatingwebhookconfigurations"):
+
+		// Group=admissionregistration.k8s.io, Version=v1beta1
+	case v1beta1.SchemeGroupVersion.WithResource("mutatingwebhookconfigurations"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1beta1().MutatingWebhookConfigurations().Informer()}, nil
-	// Group=apps, Version=V1
-	case appsv1.SchemeGroupVersion.WithResource("statefulsets"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1().StatefulSets().Informer()}, nil
-	case appsv1.SchemeGroupVersion.WithResource("deployments"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1().Deployments().Informer()}, nil
+	case v1beta1.SchemeGroupVersion.WithResource("validatingadmissionpolicies"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1beta1().ValidatingAdmissionPolicies().Informer()}, nil
+	case v1beta1.SchemeGroupVersion.WithResource("validatingadmissionpolicybindings"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1beta1().ValidatingAdmissionPolicyBindings().Informer()}, nil
+	case v1beta1.SchemeGroupVersion.WithResource("validatingwebhookconfigurations"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Admissionregistration().V1beta1().ValidatingWebhookConfigurations().Informer()}, nil
+
+		// Group=apps, Version=v1
+	case appsv1.SchemeGroupVersion.WithResource("controllerrevisions"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1().ControllerRevisions().Informer()}, nil
 	case appsv1.SchemeGroupVersion.WithResource("daemonsets"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1().DaemonSets().Informer()}, nil
+	case appsv1.SchemeGroupVersion.WithResource("deployments"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1().Deployments().Informer()}, nil
 	case appsv1.SchemeGroupVersion.WithResource("replicasets"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1().ReplicaSets().Informer()}, nil
-	case appsv1.SchemeGroupVersion.WithResource("controllerrevisions"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1().ControllerRevisions().Informer()}, nil
-	// Group=apps, Version=V1beta1
-	case appsv1beta1.SchemeGroupVersion.WithResource("statefulsets"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta1().StatefulSets().Informer()}, nil
-	case appsv1beta1.SchemeGroupVersion.WithResource("deployments"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta1().Deployments().Informer()}, nil
+	case appsv1.SchemeGroupVersion.WithResource("statefulsets"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1().StatefulSets().Informer()}, nil
+
+		// Group=apps, Version=v1beta1
 	case appsv1beta1.SchemeGroupVersion.WithResource("controllerrevisions"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta1().ControllerRevisions().Informer()}, nil
-	// Group=apps, Version=V1beta2
-	case appsv1beta2.SchemeGroupVersion.WithResource("statefulsets"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta2().StatefulSets().Informer()}, nil
-	case appsv1beta2.SchemeGroupVersion.WithResource("deployments"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta2().Deployments().Informer()}, nil
-	case appsv1beta2.SchemeGroupVersion.WithResource("daemonsets"):
+	case appsv1beta1.SchemeGroupVersion.WithResource("deployments"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta1().Deployments().Informer()}, nil
+	case appsv1beta1.SchemeGroupVersion.WithResource("statefulsets"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta1().StatefulSets().Informer()}, nil
+
+		// Group=apps, Version=v1beta2
+	case v1beta2.SchemeGroupVersion.WithResource("controllerrevisions"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta2().ControllerRevisions().Informer()}, nil
+	case v1beta2.SchemeGroupVersion.WithResource("daemonsets"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta2().DaemonSets().Informer()}, nil
-	case appsv1beta2.SchemeGroupVersion.WithResource("replicasets"):
+	case v1beta2.SchemeGroupVersion.WithResource("deployments"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta2().Deployments().Informer()}, nil
+	case v1beta2.SchemeGroupVersion.WithResource("replicasets"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta2().ReplicaSets().Informer()}, nil
-	case appsv1beta2.SchemeGroupVersion.WithResource("controllerrevisions"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta2().ControllerRevisions().Informer()}, nil
-	// Group=autoscaling, Version=V1
+	case v1beta2.SchemeGroupVersion.WithResource("statefulsets"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Apps().V1beta2().StatefulSets().Informer()}, nil
+
+		// Group=autoscaling, Version=v1
 	case autoscalingv1.SchemeGroupVersion.WithResource("horizontalpodautoscalers"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Autoscaling().V1().HorizontalPodAutoscalers().Informer()}, nil
-	// Group=autoscaling, Version=V2
-	case autoscalingv2.SchemeGroupVersion.WithResource("horizontalpodautoscalers"):
+
+		// Group=autoscaling, Version=v2
+	case v2.SchemeGroupVersion.WithResource("horizontalpodautoscalers"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Autoscaling().V2().HorizontalPodAutoscalers().Informer()}, nil
-	// Group=autoscaling, Version=V2beta1
-	case autoscalingv2beta1.SchemeGroupVersion.WithResource("horizontalpodautoscalers"):
+
+		// Group=autoscaling, Version=v2beta1
+	case v2beta1.SchemeGroupVersion.WithResource("horizontalpodautoscalers"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Autoscaling().V2beta1().HorizontalPodAutoscalers().Informer()}, nil
-	// Group=autoscaling, Version=V2beta2
-	case autoscalingv2beta2.SchemeGroupVersion.WithResource("horizontalpodautoscalers"):
+
+		// Group=autoscaling, Version=v2beta2
+	case v2beta2.SchemeGroupVersion.WithResource("horizontalpodautoscalers"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Autoscaling().V2beta2().HorizontalPodAutoscalers().Informer()}, nil
-	// Group=batch, Version=V1
-	case batchv1.SchemeGroupVersion.WithResource("jobs"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Batch().V1().Jobs().Informer()}, nil
+
+		// Group=batch, Version=v1
 	case batchv1.SchemeGroupVersion.WithResource("cronjobs"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Batch().V1().CronJobs().Informer()}, nil
-	// Group=batch, Version=V1beta1
+	case batchv1.SchemeGroupVersion.WithResource("jobs"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Batch().V1().Jobs().Informer()}, nil
+
+		// Group=batch, Version=v1beta1
 	case batchv1beta1.SchemeGroupVersion.WithResource("cronjobs"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Batch().V1beta1().CronJobs().Informer()}, nil
-	// Group=certificates.k8s.io, Version=V1
+
+		// Group=certificates.k8s.io, Version=v1
 	case certificatesv1.SchemeGroupVersion.WithResource("certificatesigningrequests"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Certificates().V1().CertificateSigningRequests().Informer()}, nil
-	// Group=certificates.k8s.io, Version=V1beta1
+
+		// Group=certificates.k8s.io, Version=v1alpha1
+	case certificatesv1alpha1.SchemeGroupVersion.WithResource("clustertrustbundles"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Certificates().V1alpha1().ClusterTrustBundles().Informer()}, nil
+
+		// Group=certificates.k8s.io, Version=v1beta1
 	case certificatesv1beta1.SchemeGroupVersion.WithResource("certificatesigningrequests"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Certificates().V1beta1().CertificateSigningRequests().Informer()}, nil
-	// Group=coordination.k8s.io, Version=V1
+	case certificatesv1beta1.SchemeGroupVersion.WithResource("clustertrustbundles"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Certificates().V1beta1().ClusterTrustBundles().Informer()}, nil
+
+		// Group=coordination.k8s.io, Version=v1
 	case coordinationv1.SchemeGroupVersion.WithResource("leases"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Coordination().V1().Leases().Informer()}, nil
-	// Group=coordination.k8s.io, Version=V1beta1
+
+		// Group=coordination.k8s.io, Version=v1alpha2
+	case v1alpha2.SchemeGroupVersion.WithResource("leasecandidates"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Coordination().V1alpha2().LeaseCandidates().Informer()}, nil
+
+		// Group=coordination.k8s.io, Version=v1beta1
 	case coordinationv1beta1.SchemeGroupVersion.WithResource("leases"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Coordination().V1beta1().Leases().Informer()}, nil
-	// Group=core, Version=V1
+	case coordinationv1beta1.SchemeGroupVersion.WithResource("leasecandidates"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Coordination().V1beta1().LeaseCandidates().Informer()}, nil
+
+		// Group=core, Version=v1
+	case corev1.SchemeGroupVersion.WithResource("componentstatuses"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().ComponentStatuses().Informer()}, nil
+	case corev1.SchemeGroupVersion.WithResource("configmaps"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().ConfigMaps().Informer()}, nil
+	case corev1.SchemeGroupVersion.WithResource("endpoints"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().Endpoints().Informer()}, nil
+	case corev1.SchemeGroupVersion.WithResource("events"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().Events().Informer()}, nil
+	case corev1.SchemeGroupVersion.WithResource("limitranges"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().LimitRanges().Informer()}, nil
+	case corev1.SchemeGroupVersion.WithResource("namespaces"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().Namespaces().Informer()}, nil
+	case corev1.SchemeGroupVersion.WithResource("nodes"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().Nodes().Informer()}, nil
 	case corev1.SchemeGroupVersion.WithResource("persistentvolumes"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().PersistentVolumes().Informer()}, nil
 	case corev1.SchemeGroupVersion.WithResource("persistentvolumeclaims"):
@@ -212,180 +279,231 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().PodTemplates().Informer()}, nil
 	case corev1.SchemeGroupVersion.WithResource("replicationcontrollers"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().ReplicationControllers().Informer()}, nil
-	case corev1.SchemeGroupVersion.WithResource("services"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().Services().Informer()}, nil
-	case corev1.SchemeGroupVersion.WithResource("serviceaccounts"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().ServiceAccounts().Informer()}, nil
-	case corev1.SchemeGroupVersion.WithResource("endpoints"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().Endpoints().Informer()}, nil
-	case corev1.SchemeGroupVersion.WithResource("nodes"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().Nodes().Informer()}, nil
-	case corev1.SchemeGroupVersion.WithResource("namespaces"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().Namespaces().Informer()}, nil
-	case corev1.SchemeGroupVersion.WithResource("events"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().Events().Informer()}, nil
-	case corev1.SchemeGroupVersion.WithResource("limitranges"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().LimitRanges().Informer()}, nil
 	case corev1.SchemeGroupVersion.WithResource("resourcequotas"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().ResourceQuotas().Informer()}, nil
 	case corev1.SchemeGroupVersion.WithResource("secrets"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().Secrets().Informer()}, nil
-	case corev1.SchemeGroupVersion.WithResource("configmaps"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().ConfigMaps().Informer()}, nil
-	case corev1.SchemeGroupVersion.WithResource("componentstatuses"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().ComponentStatuses().Informer()}, nil
-	// Group=discovery.k8s.io, Version=V1
+	case corev1.SchemeGroupVersion.WithResource("services"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().Services().Informer()}, nil
+	case corev1.SchemeGroupVersion.WithResource("serviceaccounts"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Core().V1().ServiceAccounts().Informer()}, nil
+
+		// Group=discovery.k8s.io, Version=v1
 	case discoveryv1.SchemeGroupVersion.WithResource("endpointslices"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Discovery().V1().EndpointSlices().Informer()}, nil
-	// Group=discovery.k8s.io, Version=V1beta1
+
+		// Group=discovery.k8s.io, Version=v1beta1
 	case discoveryv1beta1.SchemeGroupVersion.WithResource("endpointslices"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Discovery().V1beta1().EndpointSlices().Informer()}, nil
-	// Group=events.k8s.io, Version=V1
+
+		// Group=events.k8s.io, Version=v1
 	case eventsv1.SchemeGroupVersion.WithResource("events"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Events().V1().Events().Informer()}, nil
-	// Group=events.k8s.io, Version=V1beta1
+
+		// Group=events.k8s.io, Version=v1beta1
 	case eventsv1beta1.SchemeGroupVersion.WithResource("events"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Events().V1beta1().Events().Informer()}, nil
-	// Group=extensions, Version=V1beta1
-	case extensionsv1beta1.SchemeGroupVersion.WithResource("deployments"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Extensions().V1beta1().Deployments().Informer()}, nil
+
+		// Group=extensions, Version=v1beta1
 	case extensionsv1beta1.SchemeGroupVersion.WithResource("daemonsets"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Extensions().V1beta1().DaemonSets().Informer()}, nil
+	case extensionsv1beta1.SchemeGroupVersion.WithResource("deployments"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Extensions().V1beta1().Deployments().Informer()}, nil
 	case extensionsv1beta1.SchemeGroupVersion.WithResource("ingresses"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Extensions().V1beta1().Ingresses().Informer()}, nil
-	case extensionsv1beta1.SchemeGroupVersion.WithResource("replicasets"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Extensions().V1beta1().ReplicaSets().Informer()}, nil
-	case extensionsv1beta1.SchemeGroupVersion.WithResource("podsecuritypolicies"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Extensions().V1beta1().PodSecurityPolicies().Informer()}, nil
 	case extensionsv1beta1.SchemeGroupVersion.WithResource("networkpolicies"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Extensions().V1beta1().NetworkPolicies().Informer()}, nil
-	// Group=flowcontrol.apiserver.k8s.io, Version=V1alpha1
-	case flowcontrolv1alpha1.SchemeGroupVersion.WithResource("flowschemas"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Flowcontrol().V1alpha1().FlowSchemas().Informer()}, nil
-	case flowcontrolv1alpha1.SchemeGroupVersion.WithResource("prioritylevelconfigurations"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Flowcontrol().V1alpha1().PriorityLevelConfigurations().Informer()}, nil
-	// Group=flowcontrol.apiserver.k8s.io, Version=V1beta1
+	case extensionsv1beta1.SchemeGroupVersion.WithResource("replicasets"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Extensions().V1beta1().ReplicaSets().Informer()}, nil
+
+		// Group=flowcontrol.apiserver.k8s.io, Version=v1
+	case flowcontrolv1.SchemeGroupVersion.WithResource("flowschemas"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Flowcontrol().V1().FlowSchemas().Informer()}, nil
+	case flowcontrolv1.SchemeGroupVersion.WithResource("prioritylevelconfigurations"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Flowcontrol().V1().PriorityLevelConfigurations().Informer()}, nil
+
+		// Group=flowcontrol.apiserver.k8s.io, Version=v1beta1
 	case flowcontrolv1beta1.SchemeGroupVersion.WithResource("flowschemas"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Flowcontrol().V1beta1().FlowSchemas().Informer()}, nil
 	case flowcontrolv1beta1.SchemeGroupVersion.WithResource("prioritylevelconfigurations"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Flowcontrol().V1beta1().PriorityLevelConfigurations().Informer()}, nil
-	// Group=flowcontrol.apiserver.k8s.io, Version=V1beta2
+
+		// Group=flowcontrol.apiserver.k8s.io, Version=v1beta2
 	case flowcontrolv1beta2.SchemeGroupVersion.WithResource("flowschemas"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Flowcontrol().V1beta2().FlowSchemas().Informer()}, nil
 	case flowcontrolv1beta2.SchemeGroupVersion.WithResource("prioritylevelconfigurations"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Flowcontrol().V1beta2().PriorityLevelConfigurations().Informer()}, nil
-	// Group=flowcontrol.apiserver.k8s.io, Version=V1beta3
-	case flowcontrolv1beta3.SchemeGroupVersion.WithResource("flowschemas"):
+
+		// Group=flowcontrol.apiserver.k8s.io, Version=v1beta3
+	case v1beta3.SchemeGroupVersion.WithResource("flowschemas"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Flowcontrol().V1beta3().FlowSchemas().Informer()}, nil
-	case flowcontrolv1beta3.SchemeGroupVersion.WithResource("prioritylevelconfigurations"):
+	case v1beta3.SchemeGroupVersion.WithResource("prioritylevelconfigurations"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Flowcontrol().V1beta3().PriorityLevelConfigurations().Informer()}, nil
-	// Group=internal.apiserver.k8s.io, Version=V1alpha1
-	case internalv1alpha1.SchemeGroupVersion.WithResource("storageversions"):
+
+		// Group=internal.apiserver.k8s.io, Version=v1alpha1
+	case apiserverinternalv1alpha1.SchemeGroupVersion.WithResource("storageversions"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Internal().V1alpha1().StorageVersions().Informer()}, nil
-	// Group=networking.k8s.io, Version=V1
-	case networkingv1.SchemeGroupVersion.WithResource("networkpolicies"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1().NetworkPolicies().Informer()}, nil
+
+		// Group=networking.k8s.io, Version=v1
+	case networkingv1.SchemeGroupVersion.WithResource("ipaddresses"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1().IPAddresses().Informer()}, nil
 	case networkingv1.SchemeGroupVersion.WithResource("ingresses"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1().Ingresses().Informer()}, nil
 	case networkingv1.SchemeGroupVersion.WithResource("ingressclasses"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1().IngressClasses().Informer()}, nil
-	// Group=networking.k8s.io, Version=V1alpha1
-	case networkingv1alpha1.SchemeGroupVersion.WithResource("clustercidrs"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1alpha1().ClusterCIDRs().Informer()}, nil
-	// Group=networking.k8s.io, Version=V1beta1
+	case networkingv1.SchemeGroupVersion.WithResource("networkpolicies"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1().NetworkPolicies().Informer()}, nil
+	case networkingv1.SchemeGroupVersion.WithResource("servicecidrs"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1().ServiceCIDRs().Informer()}, nil
+
+		// Group=networking.k8s.io, Version=v1alpha1
+	case networkingv1alpha1.SchemeGroupVersion.WithResource("ipaddresses"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1alpha1().IPAddresses().Informer()}, nil
+	case networkingv1alpha1.SchemeGroupVersion.WithResource("servicecidrs"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1alpha1().ServiceCIDRs().Informer()}, nil
+
+		// Group=networking.k8s.io, Version=v1beta1
+	case networkingv1beta1.SchemeGroupVersion.WithResource("ipaddresses"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1beta1().IPAddresses().Informer()}, nil
 	case networkingv1beta1.SchemeGroupVersion.WithResource("ingresses"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1beta1().Ingresses().Informer()}, nil
 	case networkingv1beta1.SchemeGroupVersion.WithResource("ingressclasses"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1beta1().IngressClasses().Informer()}, nil
-	// Group=node.k8s.io, Version=V1
+	case networkingv1beta1.SchemeGroupVersion.WithResource("servicecidrs"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Networking().V1beta1().ServiceCIDRs().Informer()}, nil
+
+		// Group=node.k8s.io, Version=v1
 	case nodev1.SchemeGroupVersion.WithResource("runtimeclasses"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Node().V1().RuntimeClasses().Informer()}, nil
-	// Group=node.k8s.io, Version=V1alpha1
+
+		// Group=node.k8s.io, Version=v1alpha1
 	case nodev1alpha1.SchemeGroupVersion.WithResource("runtimeclasses"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Node().V1alpha1().RuntimeClasses().Informer()}, nil
-	// Group=node.k8s.io, Version=V1beta1
+
+		// Group=node.k8s.io, Version=v1beta1
 	case nodev1beta1.SchemeGroupVersion.WithResource("runtimeclasses"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Node().V1beta1().RuntimeClasses().Informer()}, nil
-	// Group=policy, Version=V1
+
+		// Group=policy, Version=v1
 	case policyv1.SchemeGroupVersion.WithResource("poddisruptionbudgets"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Policy().V1().PodDisruptionBudgets().Informer()}, nil
-	// Group=policy, Version=V1beta1
+
+		// Group=policy, Version=v1beta1
 	case policyv1beta1.SchemeGroupVersion.WithResource("poddisruptionbudgets"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Policy().V1beta1().PodDisruptionBudgets().Informer()}, nil
-	case policyv1beta1.SchemeGroupVersion.WithResource("podsecuritypolicies"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Policy().V1beta1().PodSecurityPolicies().Informer()}, nil
-	// Group=rbac.authorization.k8s.io, Version=V1
-	case rbacv1.SchemeGroupVersion.WithResource("roles"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1().Roles().Informer()}, nil
-	case rbacv1.SchemeGroupVersion.WithResource("rolebindings"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1().RoleBindings().Informer()}, nil
+
+		// Group=rbac.authorization.k8s.io, Version=v1
 	case rbacv1.SchemeGroupVersion.WithResource("clusterroles"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1().ClusterRoles().Informer()}, nil
 	case rbacv1.SchemeGroupVersion.WithResource("clusterrolebindings"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1().ClusterRoleBindings().Informer()}, nil
-	// Group=rbac.authorization.k8s.io, Version=V1alpha1
-	case rbacv1alpha1.SchemeGroupVersion.WithResource("roles"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1alpha1().Roles().Informer()}, nil
-	case rbacv1alpha1.SchemeGroupVersion.WithResource("rolebindings"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1alpha1().RoleBindings().Informer()}, nil
+	case rbacv1.SchemeGroupVersion.WithResource("roles"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1().Roles().Informer()}, nil
+	case rbacv1.SchemeGroupVersion.WithResource("rolebindings"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1().RoleBindings().Informer()}, nil
+
+		// Group=rbac.authorization.k8s.io, Version=v1alpha1
 	case rbacv1alpha1.SchemeGroupVersion.WithResource("clusterroles"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1alpha1().ClusterRoles().Informer()}, nil
 	case rbacv1alpha1.SchemeGroupVersion.WithResource("clusterrolebindings"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1alpha1().ClusterRoleBindings().Informer()}, nil
-	// Group=rbac.authorization.k8s.io, Version=V1beta1
-	case rbacv1beta1.SchemeGroupVersion.WithResource("roles"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1beta1().Roles().Informer()}, nil
-	case rbacv1beta1.SchemeGroupVersion.WithResource("rolebindings"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1beta1().RoleBindings().Informer()}, nil
+	case rbacv1alpha1.SchemeGroupVersion.WithResource("roles"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1alpha1().Roles().Informer()}, nil
+	case rbacv1alpha1.SchemeGroupVersion.WithResource("rolebindings"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1alpha1().RoleBindings().Informer()}, nil
+
+		// Group=rbac.authorization.k8s.io, Version=v1beta1
 	case rbacv1beta1.SchemeGroupVersion.WithResource("clusterroles"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1beta1().ClusterRoles().Informer()}, nil
 	case rbacv1beta1.SchemeGroupVersion.WithResource("clusterrolebindings"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1beta1().ClusterRoleBindings().Informer()}, nil
-	// Group=resource.k8s.io, Version=V1alpha1
-	case resourcev1alpha1.SchemeGroupVersion.WithResource("resourceclaims"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1alpha1().ResourceClaims().Informer()}, nil
-	case resourcev1alpha1.SchemeGroupVersion.WithResource("podschedulings"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1alpha1().PodSchedulings().Informer()}, nil
-	case resourcev1alpha1.SchemeGroupVersion.WithResource("resourceclasses"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1alpha1().ResourceClasses().Informer()}, nil
-	case resourcev1alpha1.SchemeGroupVersion.WithResource("resourceclaimtemplates"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1alpha1().ResourceClaimTemplates().Informer()}, nil
-	// Group=scheduling.k8s.io, Version=V1
+	case rbacv1beta1.SchemeGroupVersion.WithResource("roles"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1beta1().Roles().Informer()}, nil
+	case rbacv1beta1.SchemeGroupVersion.WithResource("rolebindings"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Rbac().V1beta1().RoleBindings().Informer()}, nil
+
+		// Group=resource.k8s.io, Version=v1alpha3
+	case v1alpha3.SchemeGroupVersion.WithResource("deviceclasses"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1alpha3().DeviceClasses().Informer()}, nil
+	case v1alpha3.SchemeGroupVersion.WithResource("devicetaintrules"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1alpha3().DeviceTaintRules().Informer()}, nil
+	case v1alpha3.SchemeGroupVersion.WithResource("resourceclaims"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1alpha3().ResourceClaims().Informer()}, nil
+	case v1alpha3.SchemeGroupVersion.WithResource("resourceclaimtemplates"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1alpha3().ResourceClaimTemplates().Informer()}, nil
+	case v1alpha3.SchemeGroupVersion.WithResource("resourceslices"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1alpha3().ResourceSlices().Informer()}, nil
+
+		// Group=resource.k8s.io, Version=v1beta1
+	case resourcev1beta1.SchemeGroupVersion.WithResource("deviceclasses"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1beta1().DeviceClasses().Informer()}, nil
+	case resourcev1beta1.SchemeGroupVersion.WithResource("resourceclaims"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1beta1().ResourceClaims().Informer()}, nil
+	case resourcev1beta1.SchemeGroupVersion.WithResource("resourceclaimtemplates"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1beta1().ResourceClaimTemplates().Informer()}, nil
+	case resourcev1beta1.SchemeGroupVersion.WithResource("resourceslices"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1beta1().ResourceSlices().Informer()}, nil
+
+		// Group=resource.k8s.io, Version=v1beta2
+	case resourcev1beta2.SchemeGroupVersion.WithResource("deviceclasses"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1beta2().DeviceClasses().Informer()}, nil
+	case resourcev1beta2.SchemeGroupVersion.WithResource("resourceclaims"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1beta2().ResourceClaims().Informer()}, nil
+	case resourcev1beta2.SchemeGroupVersion.WithResource("resourceclaimtemplates"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1beta2().ResourceClaimTemplates().Informer()}, nil
+	case resourcev1beta2.SchemeGroupVersion.WithResource("resourceslices"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Resource().V1beta2().ResourceSlices().Informer()}, nil
+
+		// Group=scheduling.k8s.io, Version=v1
 	case schedulingv1.SchemeGroupVersion.WithResource("priorityclasses"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Scheduling().V1().PriorityClasses().Informer()}, nil
-	// Group=scheduling.k8s.io, Version=V1alpha1
+
+		// Group=scheduling.k8s.io, Version=v1alpha1
 	case schedulingv1alpha1.SchemeGroupVersion.WithResource("priorityclasses"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Scheduling().V1alpha1().PriorityClasses().Informer()}, nil
-	// Group=scheduling.k8s.io, Version=V1beta1
+
+		// Group=scheduling.k8s.io, Version=v1beta1
 	case schedulingv1beta1.SchemeGroupVersion.WithResource("priorityclasses"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Scheduling().V1beta1().PriorityClasses().Informer()}, nil
-	// Group=storage.k8s.io, Version=V1
-	case storagev1.SchemeGroupVersion.WithResource("storageclasses"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1().StorageClasses().Informer()}, nil
-	case storagev1.SchemeGroupVersion.WithResource("volumeattachments"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1().VolumeAttachments().Informer()}, nil
+
+		// Group=storage.k8s.io, Version=v1
 	case storagev1.SchemeGroupVersion.WithResource("csidrivers"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1().CSIDrivers().Informer()}, nil
 	case storagev1.SchemeGroupVersion.WithResource("csinodes"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1().CSINodes().Informer()}, nil
 	case storagev1.SchemeGroupVersion.WithResource("csistoragecapacities"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1().CSIStorageCapacities().Informer()}, nil
-	// Group=storage.k8s.io, Version=V1alpha1
-	case storagev1alpha1.SchemeGroupVersion.WithResource("volumeattachments"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1alpha1().VolumeAttachments().Informer()}, nil
+	case storagev1.SchemeGroupVersion.WithResource("storageclasses"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1().StorageClasses().Informer()}, nil
+	case storagev1.SchemeGroupVersion.WithResource("volumeattachments"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1().VolumeAttachments().Informer()}, nil
+
+		// Group=storage.k8s.io, Version=v1alpha1
 	case storagev1alpha1.SchemeGroupVersion.WithResource("csistoragecapacities"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1alpha1().CSIStorageCapacities().Informer()}, nil
-	// Group=storage.k8s.io, Version=V1beta1
-	case storagev1beta1.SchemeGroupVersion.WithResource("storageclasses"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1beta1().StorageClasses().Informer()}, nil
-	case storagev1beta1.SchemeGroupVersion.WithResource("volumeattachments"):
-		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1beta1().VolumeAttachments().Informer()}, nil
+	case storagev1alpha1.SchemeGroupVersion.WithResource("volumeattachments"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1alpha1().VolumeAttachments().Informer()}, nil
+	case storagev1alpha1.SchemeGroupVersion.WithResource("volumeattributesclasses"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1alpha1().VolumeAttributesClasses().Informer()}, nil
+
+		// Group=storage.k8s.io, Version=v1beta1
 	case storagev1beta1.SchemeGroupVersion.WithResource("csidrivers"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1beta1().CSIDrivers().Informer()}, nil
 	case storagev1beta1.SchemeGroupVersion.WithResource("csinodes"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1beta1().CSINodes().Informer()}, nil
 	case storagev1beta1.SchemeGroupVersion.WithResource("csistoragecapacities"):
 		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1beta1().CSIStorageCapacities().Informer()}, nil
+	case storagev1beta1.SchemeGroupVersion.WithResource("storageclasses"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1beta1().StorageClasses().Informer()}, nil
+	case storagev1beta1.SchemeGroupVersion.WithResource("volumeattachments"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1beta1().VolumeAttachments().Informer()}, nil
+	case storagev1beta1.SchemeGroupVersion.WithResource("volumeattributesclasses"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storage().V1beta1().VolumeAttributesClasses().Informer()}, nil
+
+		// Group=storagemigration.k8s.io, Version=v1alpha1
+	case storagemigrationv1alpha1.SchemeGroupVersion.WithResource("storageversionmigrations"):
+		return &genericClusterInformer{resource: resource.GroupResource(), informer: f.Storagemigration().V1alpha1().StorageVersionMigrations().Informer()}, nil
+
 	}
 
 	return nil, fmt.Errorf("no informer found for %v", resource)
diff --git a/informers/internalinterfaces/factory_interfaces.go b/informers/internalinterfaces/factory_interfaces.go
index 01669ce0a..8689e37b9 100644
--- a/informers/internalinterfaces/factory_interfaces.go
+++ b/informers/internalinterfaces/factory_interfaces.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,29 +14,28 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package internalinterfaces
 
 import (
 	time "time"
 
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 
-	clientset "github.com/kcp-dev/client-go/kubernetes"
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
 )
 
-// NewInformerFunc takes clientset.ClusterInterface and time.Duration to return a ScopeableSharedIndexInformer.
-type NewInformerFunc func(clientset.ClusterInterface, time.Duration) kcpcache.ScopeableSharedIndexInformer
+// TweakListOptionsFunc is a function that transforms a v1.ListOptions.
+type TweakListOptionsFunc func(*v1.ListOptions)
+
+// NewInformerFunc takes kcpkubernetes.ClusterInterface and time.Duration to return a kcpcache.ScopeableSharedIndexInformer.
+type NewInformerFunc func(kcpkubernetes.ClusterInterface, time.Duration) kcpcache.ScopeableSharedIndexInformer
 
-// SharedInformerFactory a small interface to allow for adding an informer without an import cycle
+// SharedInformerFactory a small interface to allow for adding an informer without an import cycle.
 type SharedInformerFactory interface {
 	Start(stopCh <-chan struct{})
 	InformerFor(obj runtime.Object, newFunc NewInformerFunc) kcpcache.ScopeableSharedIndexInformer
 }
-
-// TweakListOptionsFunc is a function that transforms a metav1.ListOptions.
-type TweakListOptionsFunc func(*metav1.ListOptions)
diff --git a/informers/networking/interface.go b/informers/networking/interface.go
index b32bb73b4..d302a4e81 100644
--- a/informers/networking/interface.go
+++ b/informers/networking/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,47 +14,48 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package networking
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	"github.com/kcp-dev/client-go/informers/networking/v1"
-	"github.com/kcp-dev/client-go/informers/networking/v1alpha1"
-	"github.com/kcp-dev/client-go/informers/networking/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/networking/v1"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/informers/networking/v1alpha1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/networking/v1beta1"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1alpha1 provides access to the shared informers in V1alpha1.
-	V1alpha1() v1alpha1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() kcpv1alpha1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V1alpha1 returns a new v1alpha1.ClusterInterface.
-func (g *group) V1alpha1() v1alpha1.ClusterInterface {
-	return v1alpha1.New(g.factory, g.tweakListOptions)
+// V1alpha1 returns a new kcpv1alpha1.ClusterInterface.
+func (g *group) V1alpha1() kcpv1alpha1.ClusterInterface {
+	return kcpv1alpha1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/networking/v1/ingress.go b/informers/networking/v1/ingress.go
index a0d8b684d..539b37bcc 100644
--- a/informers/networking/v1/ingress.go
+++ b/informers/networking/v1/ingress.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apinetworkingv1 "k8s.io/api/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1 "k8s.io/client-go/informers/networking/v1"
+	listersnetworkingv1 "k8s.io/client-go/listers/networking/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1 "k8s.io/api/networking/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamnetworkingv1informers "k8s.io/client-go/informers/networking/v1"
-	upstreamnetworkingv1listers "k8s.io/client-go/listers/networking/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	networkingv1listers "github.com/kcp-dev/client-go/listers/networking/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/networking/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // IngressClusterInformer provides access to a shared informer and lister for
 // Ingresses.
 type IngressClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamnetworkingv1informers.IngressInformer
+	Cluster(logicalcluster.Name) networkingv1.IngressInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) networkingv1.IngressInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() networkingv1listers.IngressClusterLister
+	Lister() kcpv1.IngressClusterLister
 }
 
 type ingressClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewIngressClusterInformer constructs a new informer for Ingress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewIngressClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewIngressClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredIngressClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredIngressClusterInformer constructs a new informer for Ingress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredIngressClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredIngressClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NetworkingV1().Ingresses().List(context.TODO(), options)
+				return client.NetworkingV1().Ingresses().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NetworkingV1().Ingresses().Watch(context.TODO(), options)
+				return client.NetworkingV1().Ingresses().Watch(context.Background(), options)
 			},
 		},
-		&networkingv1.Ingress{},
+		&apinetworkingv1.Ingress{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *ingressClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *ingressClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredIngressClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *ingressClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinetworkingv1.Ingress{}, i.defaultInformer)
 }
 
-func (f *ingressClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&networkingv1.Ingress{}, f.defaultInformer)
+func (i *ingressClusterInformer) Lister() kcpv1.IngressClusterLister {
+	return kcpv1.NewIngressClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *ingressClusterInformer) Lister() networkingv1listers.IngressClusterLister {
-	return networkingv1listers.NewIngressClusterLister(f.Informer().GetIndexer())
+func (i *ingressClusterInformer) Cluster(clusterName logicalcluster.Name) networkingv1.IngressInformer {
+	return &ingressInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *ingressClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamnetworkingv1informers.IngressInformer {
+func (i *ingressClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) networkingv1.IngressInformer {
 	return &ingressInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type ingressInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamnetworkingv1listers.IngressLister
+	lister   listersnetworkingv1.IngressLister
 }
 
-func (f *ingressInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *ingressInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *ingressInformer) Lister() upstreamnetworkingv1listers.IngressLister {
-	return f.lister
+func (i *ingressInformer) Lister() listersnetworkingv1.IngressLister {
+	return i.lister
 }
diff --git a/informers/networking/v1/ingressclass.go b/informers/networking/v1/ingressclass.go
index 8493ab241..e50bb0828 100644
--- a/informers/networking/v1/ingressclass.go
+++ b/informers/networking/v1/ingressclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apinetworkingv1 "k8s.io/api/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1 "k8s.io/client-go/informers/networking/v1"
+	listersnetworkingv1 "k8s.io/client-go/listers/networking/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1 "k8s.io/api/networking/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamnetworkingv1informers "k8s.io/client-go/informers/networking/v1"
-	upstreamnetworkingv1listers "k8s.io/client-go/listers/networking/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	networkingv1listers "github.com/kcp-dev/client-go/listers/networking/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/networking/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // IngressClassClusterInformer provides access to a shared informer and lister for
 // IngressClasses.
 type IngressClassClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamnetworkingv1informers.IngressClassInformer
+	Cluster(logicalcluster.Name) networkingv1.IngressClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) networkingv1.IngressClassInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() networkingv1listers.IngressClassClusterLister
+	Lister() kcpv1.IngressClassClusterLister
 }
 
 type ingressClassClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewIngressClassClusterInformer constructs a new informer for IngressClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewIngressClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewIngressClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredIngressClassClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredIngressClassClusterInformer constructs a new informer for IngressClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredIngressClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredIngressClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NetworkingV1().IngressClasses().List(context.TODO(), options)
+				return client.NetworkingV1().IngressClasses().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NetworkingV1().IngressClasses().Watch(context.TODO(), options)
+				return client.NetworkingV1().IngressClasses().Watch(context.Background(), options)
 			},
 		},
-		&networkingv1.IngressClass{},
+		&apinetworkingv1.IngressClass{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *ingressClassClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *ingressClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredIngressClassClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *ingressClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinetworkingv1.IngressClass{}, i.defaultInformer)
 }
 
-func (f *ingressClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&networkingv1.IngressClass{}, f.defaultInformer)
+func (i *ingressClassClusterInformer) Lister() kcpv1.IngressClassClusterLister {
+	return kcpv1.NewIngressClassClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *ingressClassClusterInformer) Lister() networkingv1listers.IngressClassClusterLister {
-	return networkingv1listers.NewIngressClassClusterLister(f.Informer().GetIndexer())
+func (i *ingressClassClusterInformer) Cluster(clusterName logicalcluster.Name) networkingv1.IngressClassInformer {
+	return &ingressClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *ingressClassClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamnetworkingv1informers.IngressClassInformer {
+func (i *ingressClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) networkingv1.IngressClassInformer {
 	return &ingressClassInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type ingressClassInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamnetworkingv1listers.IngressClassLister
+	lister   listersnetworkingv1.IngressClassLister
 }
 
-func (f *ingressClassInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *ingressClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *ingressClassInformer) Lister() upstreamnetworkingv1listers.IngressClassLister {
-	return f.lister
+func (i *ingressClassInformer) Lister() listersnetworkingv1.IngressClassLister {
+	return i.lister
 }
diff --git a/informers/networking/v1/interface.go b/informers/networking/v1/interface.go
index b117031d3..24a950a3e 100644
--- a/informers/networking/v1/interface.go
+++ b/informers/networking/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,44 +14,58 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// NetworkPolicies returns a NetworkPolicyClusterInformer
-	NetworkPolicies() NetworkPolicyClusterInformer
-	// Ingresses returns a IngressClusterInformer
+	// IPAddresses returns a IPAddressClusterInformer.
+	IPAddresses() IPAddressClusterInformer
+	// Ingresses returns a IngressClusterInformer.
 	Ingresses() IngressClusterInformer
-	// IngressClasses returns a IngressClassClusterInformer
+	// IngressClasses returns a IngressClassClusterInformer.
 	IngressClasses() IngressClassClusterInformer
+	// NetworkPolicies returns a NetworkPolicyClusterInformer.
+	NetworkPolicies() NetworkPolicyClusterInformer
+	// ServiceCIDRs returns a ServiceCIDRClusterInformer.
+	ServiceCIDRs() ServiceCIDRClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// NetworkPolicies returns a NetworkPolicyClusterInformer
-func (v *version) NetworkPolicies() NetworkPolicyClusterInformer {
-	return &networkPolicyClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// IPAddresses returns a IPAddressClusterInformer.
+func (v *version) IPAddresses() IPAddressClusterInformer {
+	return &iPAddressClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// Ingresses returns a IngressClusterInformer
+// Ingresses returns a IngressClusterInformer.
 func (v *version) Ingresses() IngressClusterInformer {
 	return &ingressClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// IngressClasses returns a IngressClassClusterInformer
+// IngressClasses returns a IngressClassClusterInformer.
 func (v *version) IngressClasses() IngressClassClusterInformer {
 	return &ingressClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// NetworkPolicies returns a NetworkPolicyClusterInformer.
+func (v *version) NetworkPolicies() NetworkPolicyClusterInformer {
+	return &networkPolicyClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ServiceCIDRs returns a ServiceCIDRClusterInformer.
+func (v *version) ServiceCIDRs() ServiceCIDRClusterInformer {
+	return &serviceCIDRClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/networking/v1/ipaddress.go b/informers/networking/v1/ipaddress.go
new file mode 100644
index 000000000..2ec2be5be
--- /dev/null
+++ b/informers/networking/v1/ipaddress.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	apinetworkingv1 "k8s.io/api/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1 "k8s.io/client-go/informers/networking/v1"
+	listersnetworkingv1 "k8s.io/client-go/listers/networking/v1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/networking/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// IPAddressClusterInformer provides access to a shared informer and lister for
+// IPAddresses.
+type IPAddressClusterInformer interface {
+	Cluster(logicalcluster.Name) networkingv1.IPAddressInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) networkingv1.IPAddressInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1.IPAddressClusterLister
+}
+
+type iPAddressClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewIPAddressClusterInformer constructs a new informer for IPAddress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewIPAddressClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredIPAddressClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredIPAddressClusterInformer constructs a new informer for IPAddress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredIPAddressClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1().IPAddresses().List(context.Background(), options)
+			},
+			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1().IPAddresses().Watch(context.Background(), options)
+			},
+		},
+		&apinetworkingv1.IPAddress{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *iPAddressClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredIPAddressClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *iPAddressClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinetworkingv1.IPAddress{}, i.defaultInformer)
+}
+
+func (i *iPAddressClusterInformer) Lister() kcpv1.IPAddressClusterLister {
+	return kcpv1.NewIPAddressClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *iPAddressClusterInformer) Cluster(clusterName logicalcluster.Name) networkingv1.IPAddressInformer {
+	return &iPAddressInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *iPAddressClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) networkingv1.IPAddressInformer {
+	return &iPAddressInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type iPAddressInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersnetworkingv1.IPAddressLister
+}
+
+func (i *iPAddressInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *iPAddressInformer) Lister() listersnetworkingv1.IPAddressLister {
+	return i.lister
+}
diff --git a/informers/networking/v1/networkpolicy.go b/informers/networking/v1/networkpolicy.go
index 6ad34dd07..a426ba52f 100644
--- a/informers/networking/v1/networkpolicy.go
+++ b/informers/networking/v1/networkpolicy.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apinetworkingv1 "k8s.io/api/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1 "k8s.io/client-go/informers/networking/v1"
+	listersnetworkingv1 "k8s.io/client-go/listers/networking/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1 "k8s.io/api/networking/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamnetworkingv1informers "k8s.io/client-go/informers/networking/v1"
-	upstreamnetworkingv1listers "k8s.io/client-go/listers/networking/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	networkingv1listers "github.com/kcp-dev/client-go/listers/networking/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/networking/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // NetworkPolicyClusterInformer provides access to a shared informer and lister for
 // NetworkPolicies.
 type NetworkPolicyClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamnetworkingv1informers.NetworkPolicyInformer
+	Cluster(logicalcluster.Name) networkingv1.NetworkPolicyInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) networkingv1.NetworkPolicyInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() networkingv1listers.NetworkPolicyClusterLister
+	Lister() kcpv1.NetworkPolicyClusterLister
 }
 
 type networkPolicyClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewNetworkPolicyClusterInformer constructs a new informer for NetworkPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewNetworkPolicyClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewNetworkPolicyClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredNetworkPolicyClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredNetworkPolicyClusterInformer constructs a new informer for NetworkPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredNetworkPolicyClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredNetworkPolicyClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NetworkingV1().NetworkPolicies().List(context.TODO(), options)
+				return client.NetworkingV1().NetworkPolicies().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NetworkingV1().NetworkPolicies().Watch(context.TODO(), options)
+				return client.NetworkingV1().NetworkPolicies().Watch(context.Background(), options)
 			},
 		},
-		&networkingv1.NetworkPolicy{},
+		&apinetworkingv1.NetworkPolicy{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *networkPolicyClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *networkPolicyClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredNetworkPolicyClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *networkPolicyClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinetworkingv1.NetworkPolicy{}, i.defaultInformer)
 }
 
-func (f *networkPolicyClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&networkingv1.NetworkPolicy{}, f.defaultInformer)
+func (i *networkPolicyClusterInformer) Lister() kcpv1.NetworkPolicyClusterLister {
+	return kcpv1.NewNetworkPolicyClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *networkPolicyClusterInformer) Lister() networkingv1listers.NetworkPolicyClusterLister {
-	return networkingv1listers.NewNetworkPolicyClusterLister(f.Informer().GetIndexer())
+func (i *networkPolicyClusterInformer) Cluster(clusterName logicalcluster.Name) networkingv1.NetworkPolicyInformer {
+	return &networkPolicyInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *networkPolicyClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamnetworkingv1informers.NetworkPolicyInformer {
+func (i *networkPolicyClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) networkingv1.NetworkPolicyInformer {
 	return &networkPolicyInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type networkPolicyInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamnetworkingv1listers.NetworkPolicyLister
+	lister   listersnetworkingv1.NetworkPolicyLister
 }
 
-func (f *networkPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *networkPolicyInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *networkPolicyInformer) Lister() upstreamnetworkingv1listers.NetworkPolicyLister {
-	return f.lister
+func (i *networkPolicyInformer) Lister() listersnetworkingv1.NetworkPolicyLister {
+	return i.lister
 }
diff --git a/informers/networking/v1/servicecidr.go b/informers/networking/v1/servicecidr.go
new file mode 100644
index 000000000..a1392c715
--- /dev/null
+++ b/informers/networking/v1/servicecidr.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+	time "time"
+
+	apinetworkingv1 "k8s.io/api/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1 "k8s.io/client-go/informers/networking/v1"
+	listersnetworkingv1 "k8s.io/client-go/listers/networking/v1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/networking/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ServiceCIDRClusterInformer provides access to a shared informer and lister for
+// ServiceCIDRs.
+type ServiceCIDRClusterInformer interface {
+	Cluster(logicalcluster.Name) networkingv1.ServiceCIDRInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) networkingv1.ServiceCIDRInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1.ServiceCIDRClusterLister
+}
+
+type serviceCIDRClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewServiceCIDRClusterInformer constructs a new informer for ServiceCIDR type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewServiceCIDRClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredServiceCIDRClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredServiceCIDRClusterInformer constructs a new informer for ServiceCIDR type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredServiceCIDRClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1().ServiceCIDRs().List(context.Background(), options)
+			},
+			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1().ServiceCIDRs().Watch(context.Background(), options)
+			},
+		},
+		&apinetworkingv1.ServiceCIDR{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *serviceCIDRClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredServiceCIDRClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *serviceCIDRClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinetworkingv1.ServiceCIDR{}, i.defaultInformer)
+}
+
+func (i *serviceCIDRClusterInformer) Lister() kcpv1.ServiceCIDRClusterLister {
+	return kcpv1.NewServiceCIDRClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *serviceCIDRClusterInformer) Cluster(clusterName logicalcluster.Name) networkingv1.ServiceCIDRInformer {
+	return &serviceCIDRInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *serviceCIDRClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) networkingv1.ServiceCIDRInformer {
+	return &serviceCIDRInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type serviceCIDRInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersnetworkingv1.ServiceCIDRLister
+}
+
+func (i *serviceCIDRInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *serviceCIDRInformer) Lister() listersnetworkingv1.ServiceCIDRLister {
+	return i.lister
+}
diff --git a/informers/networking/v1alpha1/clustercidr.go b/informers/networking/v1alpha1/clustercidr.go
deleted file mode 100644
index a540326d1..000000000
--- a/informers/networking/v1alpha1/clustercidr.go
+++ /dev/null
@@ -1,124 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1alpha1 "k8s.io/api/networking/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamnetworkingv1alpha1informers "k8s.io/client-go/informers/networking/v1alpha1"
-	upstreamnetworkingv1alpha1listers "k8s.io/client-go/listers/networking/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	networkingv1alpha1listers "github.com/kcp-dev/client-go/listers/networking/v1alpha1"
-)
-
-// ClusterCIDRClusterInformer provides access to a shared informer and lister for
-// ClusterCIDRs.
-type ClusterCIDRClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamnetworkingv1alpha1informers.ClusterCIDRInformer
-	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() networkingv1alpha1listers.ClusterCIDRClusterLister
-}
-
-type clusterCIDRClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// NewClusterCIDRClusterInformer constructs a new informer for ClusterCIDR type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewClusterCIDRClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredClusterCIDRClusterInformer(client, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredClusterCIDRClusterInformer constructs a new informer for ClusterCIDR type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredClusterCIDRClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
-	return kcpinformers.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.NetworkingV1alpha1().ClusterCIDRs().List(context.TODO(), options)
-			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.NetworkingV1alpha1().ClusterCIDRs().Watch(context.TODO(), options)
-			},
-		},
-		&networkingv1alpha1.ClusterCIDR{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *clusterCIDRClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredClusterCIDRClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
-}
-
-func (f *clusterCIDRClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&networkingv1alpha1.ClusterCIDR{}, f.defaultInformer)
-}
-
-func (f *clusterCIDRClusterInformer) Lister() networkingv1alpha1listers.ClusterCIDRClusterLister {
-	return networkingv1alpha1listers.NewClusterCIDRClusterLister(f.Informer().GetIndexer())
-}
-
-func (f *clusterCIDRClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamnetworkingv1alpha1informers.ClusterCIDRInformer {
-	return &clusterCIDRInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
-	}
-}
-
-type clusterCIDRInformer struct {
-	informer cache.SharedIndexInformer
-	lister   upstreamnetworkingv1alpha1listers.ClusterCIDRLister
-}
-
-func (f *clusterCIDRInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
-}
-
-func (f *clusterCIDRInformer) Lister() upstreamnetworkingv1alpha1listers.ClusterCIDRLister {
-	return f.lister
-}
diff --git a/informers/networking/v1alpha1/interface.go b/informers/networking/v1alpha1/interface.go
index 54bf9c7fc..aead27ace 100644
--- a/informers/networking/v1alpha1/interface.go
+++ b/informers/networking/v1alpha1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,37 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// ClusterCIDRs returns a ClusterCIDRClusterInformer
-	ClusterCIDRs() ClusterCIDRClusterInformer
+	// IPAddresses returns a IPAddressClusterInformer.
+	IPAddresses() IPAddressClusterInformer
+	// ServiceCIDRs returns a ServiceCIDRClusterInformer.
+	ServiceCIDRs() ServiceCIDRClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// ClusterCIDRs returns a ClusterCIDRClusterInformer
-func (v *version) ClusterCIDRs() ClusterCIDRClusterInformer {
-	return &clusterCIDRClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// IPAddresses returns a IPAddressClusterInformer.
+func (v *version) IPAddresses() IPAddressClusterInformer {
+	return &iPAddressClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ServiceCIDRs returns a ServiceCIDRClusterInformer.
+func (v *version) ServiceCIDRs() ServiceCIDRClusterInformer {
+	return &serviceCIDRClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/networking/v1alpha1/ipaddress.go b/informers/networking/v1alpha1/ipaddress.go
new file mode 100644
index 000000000..445db64d4
--- /dev/null
+++ b/informers/networking/v1alpha1/ipaddress.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+	time "time"
+
+	apinetworkingv1alpha1 "k8s.io/api/networking/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1alpha1 "k8s.io/client-go/informers/networking/v1alpha1"
+	listersnetworkingv1alpha1 "k8s.io/client-go/listers/networking/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/networking/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// IPAddressClusterInformer provides access to a shared informer and lister for
+// IPAddresses.
+type IPAddressClusterInformer interface {
+	Cluster(logicalcluster.Name) networkingv1alpha1.IPAddressInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) networkingv1alpha1.IPAddressInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha1.IPAddressClusterLister
+}
+
+type iPAddressClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewIPAddressClusterInformer constructs a new informer for IPAddress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewIPAddressClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredIPAddressClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredIPAddressClusterInformer constructs a new informer for IPAddress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredIPAddressClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1alpha1().IPAddresses().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1alpha1().IPAddresses().Watch(context.Background(), options)
+			},
+		},
+		&apinetworkingv1alpha1.IPAddress{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *iPAddressClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredIPAddressClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *iPAddressClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinetworkingv1alpha1.IPAddress{}, i.defaultInformer)
+}
+
+func (i *iPAddressClusterInformer) Lister() kcpv1alpha1.IPAddressClusterLister {
+	return kcpv1alpha1.NewIPAddressClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *iPAddressClusterInformer) Cluster(clusterName logicalcluster.Name) networkingv1alpha1.IPAddressInformer {
+	return &iPAddressInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *iPAddressClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) networkingv1alpha1.IPAddressInformer {
+	return &iPAddressInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type iPAddressInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersnetworkingv1alpha1.IPAddressLister
+}
+
+func (i *iPAddressInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *iPAddressInformer) Lister() listersnetworkingv1alpha1.IPAddressLister {
+	return i.lister
+}
diff --git a/informers/networking/v1alpha1/servicecidr.go b/informers/networking/v1alpha1/servicecidr.go
new file mode 100644
index 000000000..8329a6eed
--- /dev/null
+++ b/informers/networking/v1alpha1/servicecidr.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+	time "time"
+
+	apinetworkingv1alpha1 "k8s.io/api/networking/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1alpha1 "k8s.io/client-go/informers/networking/v1alpha1"
+	listersnetworkingv1alpha1 "k8s.io/client-go/listers/networking/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/networking/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ServiceCIDRClusterInformer provides access to a shared informer and lister for
+// ServiceCIDRs.
+type ServiceCIDRClusterInformer interface {
+	Cluster(logicalcluster.Name) networkingv1alpha1.ServiceCIDRInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) networkingv1alpha1.ServiceCIDRInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha1.ServiceCIDRClusterLister
+}
+
+type serviceCIDRClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewServiceCIDRClusterInformer constructs a new informer for ServiceCIDR type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewServiceCIDRClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredServiceCIDRClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredServiceCIDRClusterInformer constructs a new informer for ServiceCIDR type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredServiceCIDRClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1alpha1().ServiceCIDRs().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1alpha1().ServiceCIDRs().Watch(context.Background(), options)
+			},
+		},
+		&apinetworkingv1alpha1.ServiceCIDR{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *serviceCIDRClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredServiceCIDRClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *serviceCIDRClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinetworkingv1alpha1.ServiceCIDR{}, i.defaultInformer)
+}
+
+func (i *serviceCIDRClusterInformer) Lister() kcpv1alpha1.ServiceCIDRClusterLister {
+	return kcpv1alpha1.NewServiceCIDRClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *serviceCIDRClusterInformer) Cluster(clusterName logicalcluster.Name) networkingv1alpha1.ServiceCIDRInformer {
+	return &serviceCIDRInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *serviceCIDRClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) networkingv1alpha1.ServiceCIDRInformer {
+	return &serviceCIDRInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type serviceCIDRInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersnetworkingv1alpha1.ServiceCIDRLister
+}
+
+func (i *serviceCIDRInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *serviceCIDRInformer) Lister() listersnetworkingv1alpha1.ServiceCIDRLister {
+	return i.lister
+}
diff --git a/informers/networking/v1beta1/ingress.go b/informers/networking/v1beta1/ingress.go
index 644ccf2ae..933fe7c56 100644
--- a/informers/networking/v1beta1/ingress.go
+++ b/informers/networking/v1beta1/ingress.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apinetworkingv1beta1 "k8s.io/api/networking/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1beta1 "k8s.io/client-go/informers/networking/v1beta1"
+	listersnetworkingv1beta1 "k8s.io/client-go/listers/networking/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1beta1 "k8s.io/api/networking/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamnetworkingv1beta1informers "k8s.io/client-go/informers/networking/v1beta1"
-	upstreamnetworkingv1beta1listers "k8s.io/client-go/listers/networking/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	networkingv1beta1listers "github.com/kcp-dev/client-go/listers/networking/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/networking/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // IngressClusterInformer provides access to a shared informer and lister for
 // Ingresses.
 type IngressClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamnetworkingv1beta1informers.IngressInformer
+	Cluster(logicalcluster.Name) networkingv1beta1.IngressInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) networkingv1beta1.IngressInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() networkingv1beta1listers.IngressClusterLister
+	Lister() kcpv1beta1.IngressClusterLister
 }
 
 type ingressClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewIngressClusterInformer constructs a new informer for Ingress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewIngressClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewIngressClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredIngressClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredIngressClusterInformer constructs a new informer for Ingress type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredIngressClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredIngressClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NetworkingV1beta1().Ingresses().List(context.TODO(), options)
+				return client.NetworkingV1beta1().Ingresses().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NetworkingV1beta1().Ingresses().Watch(context.TODO(), options)
+				return client.NetworkingV1beta1().Ingresses().Watch(context.Background(), options)
 			},
 		},
-		&networkingv1beta1.Ingress{},
+		&apinetworkingv1beta1.Ingress{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *ingressClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *ingressClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredIngressClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *ingressClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&networkingv1beta1.Ingress{}, f.defaultInformer)
+func (i *ingressClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinetworkingv1beta1.Ingress{}, i.defaultInformer)
 }
 
-func (f *ingressClusterInformer) Lister() networkingv1beta1listers.IngressClusterLister {
-	return networkingv1beta1listers.NewIngressClusterLister(f.Informer().GetIndexer())
+func (i *ingressClusterInformer) Lister() kcpv1beta1.IngressClusterLister {
+	return kcpv1beta1.NewIngressClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *ingressClusterInformer) Cluster(clusterName logicalcluster.Name) networkingv1beta1.IngressInformer {
+	return &ingressInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *ingressClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamnetworkingv1beta1informers.IngressInformer {
+func (i *ingressClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) networkingv1beta1.IngressInformer {
 	return &ingressInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type ingressInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamnetworkingv1beta1listers.IngressLister
+	lister   listersnetworkingv1beta1.IngressLister
 }
 
-func (f *ingressInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *ingressInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *ingressInformer) Lister() upstreamnetworkingv1beta1listers.IngressLister {
-	return f.lister
+func (i *ingressInformer) Lister() listersnetworkingv1beta1.IngressLister {
+	return i.lister
 }
diff --git a/informers/networking/v1beta1/ingressclass.go b/informers/networking/v1beta1/ingressclass.go
index c3a1cbc35..bef30e9a9 100644
--- a/informers/networking/v1beta1/ingressclass.go
+++ b/informers/networking/v1beta1/ingressclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apinetworkingv1beta1 "k8s.io/api/networking/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1beta1 "k8s.io/client-go/informers/networking/v1beta1"
+	listersnetworkingv1beta1 "k8s.io/client-go/listers/networking/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1beta1 "k8s.io/api/networking/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamnetworkingv1beta1informers "k8s.io/client-go/informers/networking/v1beta1"
-	upstreamnetworkingv1beta1listers "k8s.io/client-go/listers/networking/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	networkingv1beta1listers "github.com/kcp-dev/client-go/listers/networking/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/networking/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // IngressClassClusterInformer provides access to a shared informer and lister for
 // IngressClasses.
 type IngressClassClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamnetworkingv1beta1informers.IngressClassInformer
+	Cluster(logicalcluster.Name) networkingv1beta1.IngressClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) networkingv1beta1.IngressClassInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() networkingv1beta1listers.IngressClassClusterLister
+	Lister() kcpv1beta1.IngressClassClusterLister
 }
 
 type ingressClassClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewIngressClassClusterInformer constructs a new informer for IngressClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewIngressClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewIngressClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredIngressClassClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredIngressClassClusterInformer constructs a new informer for IngressClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredIngressClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredIngressClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NetworkingV1beta1().IngressClasses().List(context.TODO(), options)
+				return client.NetworkingV1beta1().IngressClasses().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NetworkingV1beta1().IngressClasses().Watch(context.TODO(), options)
+				return client.NetworkingV1beta1().IngressClasses().Watch(context.Background(), options)
 			},
 		},
-		&networkingv1beta1.IngressClass{},
+		&apinetworkingv1beta1.IngressClass{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *ingressClassClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *ingressClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredIngressClassClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *ingressClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&networkingv1beta1.IngressClass{}, f.defaultInformer)
+func (i *ingressClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinetworkingv1beta1.IngressClass{}, i.defaultInformer)
 }
 
-func (f *ingressClassClusterInformer) Lister() networkingv1beta1listers.IngressClassClusterLister {
-	return networkingv1beta1listers.NewIngressClassClusterLister(f.Informer().GetIndexer())
+func (i *ingressClassClusterInformer) Lister() kcpv1beta1.IngressClassClusterLister {
+	return kcpv1beta1.NewIngressClassClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *ingressClassClusterInformer) Cluster(clusterName logicalcluster.Name) networkingv1beta1.IngressClassInformer {
+	return &ingressClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *ingressClassClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamnetworkingv1beta1informers.IngressClassInformer {
+func (i *ingressClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) networkingv1beta1.IngressClassInformer {
 	return &ingressClassInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type ingressClassInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamnetworkingv1beta1listers.IngressClassLister
+	lister   listersnetworkingv1beta1.IngressClassLister
 }
 
-func (f *ingressClassInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *ingressClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *ingressClassInformer) Lister() upstreamnetworkingv1beta1listers.IngressClassLister {
-	return f.lister
+func (i *ingressClassInformer) Lister() listersnetworkingv1beta1.IngressClassLister {
+	return i.lister
 }
diff --git a/informers/networking/v1beta1/interface.go b/informers/networking/v1beta1/interface.go
index c034ecc0d..212db64bf 100644
--- a/informers/networking/v1beta1/interface.go
+++ b/informers/networking/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,37 +14,51 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// Ingresses returns a IngressClusterInformer
+	// IPAddresses returns a IPAddressClusterInformer.
+	IPAddresses() IPAddressClusterInformer
+	// Ingresses returns a IngressClusterInformer.
 	Ingresses() IngressClusterInformer
-	// IngressClasses returns a IngressClassClusterInformer
+	// IngressClasses returns a IngressClassClusterInformer.
 	IngressClasses() IngressClassClusterInformer
+	// ServiceCIDRs returns a ServiceCIDRClusterInformer.
+	ServiceCIDRs() ServiceCIDRClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// Ingresses returns a IngressClusterInformer
+// IPAddresses returns a IPAddressClusterInformer.
+func (v *version) IPAddresses() IPAddressClusterInformer {
+	return &iPAddressClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// Ingresses returns a IngressClusterInformer.
 func (v *version) Ingresses() IngressClusterInformer {
 	return &ingressClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// IngressClasses returns a IngressClassClusterInformer
+// IngressClasses returns a IngressClassClusterInformer.
 func (v *version) IngressClasses() IngressClassClusterInformer {
 	return &ingressClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// ServiceCIDRs returns a ServiceCIDRClusterInformer.
+func (v *version) ServiceCIDRs() ServiceCIDRClusterInformer {
+	return &serviceCIDRClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/networking/v1beta1/ipaddress.go b/informers/networking/v1beta1/ipaddress.go
new file mode 100644
index 000000000..f20a8364b
--- /dev/null
+++ b/informers/networking/v1beta1/ipaddress.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apinetworkingv1beta1 "k8s.io/api/networking/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1beta1 "k8s.io/client-go/informers/networking/v1beta1"
+	listersnetworkingv1beta1 "k8s.io/client-go/listers/networking/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/networking/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// IPAddressClusterInformer provides access to a shared informer and lister for
+// IPAddresses.
+type IPAddressClusterInformer interface {
+	Cluster(logicalcluster.Name) networkingv1beta1.IPAddressInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) networkingv1beta1.IPAddressInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta1.IPAddressClusterLister
+}
+
+type iPAddressClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewIPAddressClusterInformer constructs a new informer for IPAddress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewIPAddressClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredIPAddressClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredIPAddressClusterInformer constructs a new informer for IPAddress type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredIPAddressClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1beta1().IPAddresses().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1beta1().IPAddresses().Watch(context.Background(), options)
+			},
+		},
+		&apinetworkingv1beta1.IPAddress{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *iPAddressClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredIPAddressClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *iPAddressClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinetworkingv1beta1.IPAddress{}, i.defaultInformer)
+}
+
+func (i *iPAddressClusterInformer) Lister() kcpv1beta1.IPAddressClusterLister {
+	return kcpv1beta1.NewIPAddressClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *iPAddressClusterInformer) Cluster(clusterName logicalcluster.Name) networkingv1beta1.IPAddressInformer {
+	return &iPAddressInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *iPAddressClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) networkingv1beta1.IPAddressInformer {
+	return &iPAddressInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type iPAddressInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersnetworkingv1beta1.IPAddressLister
+}
+
+func (i *iPAddressInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *iPAddressInformer) Lister() listersnetworkingv1beta1.IPAddressLister {
+	return i.lister
+}
diff --git a/informers/networking/v1beta1/servicecidr.go b/informers/networking/v1beta1/servicecidr.go
new file mode 100644
index 000000000..204fbc0bb
--- /dev/null
+++ b/informers/networking/v1beta1/servicecidr.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apinetworkingv1beta1 "k8s.io/api/networking/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1beta1 "k8s.io/client-go/informers/networking/v1beta1"
+	listersnetworkingv1beta1 "k8s.io/client-go/listers/networking/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/networking/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ServiceCIDRClusterInformer provides access to a shared informer and lister for
+// ServiceCIDRs.
+type ServiceCIDRClusterInformer interface {
+	Cluster(logicalcluster.Name) networkingv1beta1.ServiceCIDRInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) networkingv1beta1.ServiceCIDRInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta1.ServiceCIDRClusterLister
+}
+
+type serviceCIDRClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewServiceCIDRClusterInformer constructs a new informer for ServiceCIDR type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewServiceCIDRClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredServiceCIDRClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredServiceCIDRClusterInformer constructs a new informer for ServiceCIDR type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredServiceCIDRClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1beta1().ServiceCIDRs().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.NetworkingV1beta1().ServiceCIDRs().Watch(context.Background(), options)
+			},
+		},
+		&apinetworkingv1beta1.ServiceCIDR{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *serviceCIDRClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredServiceCIDRClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *serviceCIDRClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinetworkingv1beta1.ServiceCIDR{}, i.defaultInformer)
+}
+
+func (i *serviceCIDRClusterInformer) Lister() kcpv1beta1.ServiceCIDRClusterLister {
+	return kcpv1beta1.NewServiceCIDRClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *serviceCIDRClusterInformer) Cluster(clusterName logicalcluster.Name) networkingv1beta1.ServiceCIDRInformer {
+	return &serviceCIDRInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *serviceCIDRClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) networkingv1beta1.ServiceCIDRInformer {
+	return &serviceCIDRInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type serviceCIDRInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersnetworkingv1beta1.ServiceCIDRLister
+}
+
+func (i *serviceCIDRInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *serviceCIDRInformer) Lister() listersnetworkingv1beta1.ServiceCIDRLister {
+	return i.lister
+}
diff --git a/informers/node/interface.go b/informers/node/interface.go
index cbeac9e70..d6d040445 100644
--- a/informers/node/interface.go
+++ b/informers/node/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,47 +14,48 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package node
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	"github.com/kcp-dev/client-go/informers/node/v1"
-	"github.com/kcp-dev/client-go/informers/node/v1alpha1"
-	"github.com/kcp-dev/client-go/informers/node/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/node/v1"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/informers/node/v1alpha1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/node/v1beta1"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1alpha1 provides access to the shared informers in V1alpha1.
-	V1alpha1() v1alpha1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() kcpv1alpha1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V1alpha1 returns a new v1alpha1.ClusterInterface.
-func (g *group) V1alpha1() v1alpha1.ClusterInterface {
-	return v1alpha1.New(g.factory, g.tweakListOptions)
+// V1alpha1 returns a new kcpv1alpha1.ClusterInterface.
+func (g *group) V1alpha1() kcpv1alpha1.ClusterInterface {
+	return kcpv1alpha1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/node/v1/interface.go b/informers/node/v1/interface.go
index fa153851f..671b5c51a 100644
--- a/informers/node/v1/interface.go
+++ b/informers/node/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// RuntimeClasses returns a RuntimeClassClusterInformer
+	// RuntimeClasses returns a RuntimeClassClusterInformer.
 	RuntimeClasses() RuntimeClassClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// RuntimeClasses returns a RuntimeClassClusterInformer
+// RuntimeClasses returns a RuntimeClassClusterInformer.
 func (v *version) RuntimeClasses() RuntimeClassClusterInformer {
 	return &runtimeClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/node/v1/runtimeclass.go b/informers/node/v1/runtimeclass.go
index 3460a5f7a..977896c4c 100644
--- a/informers/node/v1/runtimeclass.go
+++ b/informers/node/v1/runtimeclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apinodev1 "k8s.io/api/node/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	nodev1 "k8s.io/client-go/informers/node/v1"
+	listersnodev1 "k8s.io/client-go/listers/node/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	nodev1 "k8s.io/api/node/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamnodev1informers "k8s.io/client-go/informers/node/v1"
-	upstreamnodev1listers "k8s.io/client-go/listers/node/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	nodev1listers "github.com/kcp-dev/client-go/listers/node/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/node/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // RuntimeClassClusterInformer provides access to a shared informer and lister for
 // RuntimeClasses.
 type RuntimeClassClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamnodev1informers.RuntimeClassInformer
+	Cluster(logicalcluster.Name) nodev1.RuntimeClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) nodev1.RuntimeClassInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() nodev1listers.RuntimeClassClusterLister
+	Lister() kcpv1.RuntimeClassClusterLister
 }
 
 type runtimeClassClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewRuntimeClassClusterInformer constructs a new informer for RuntimeClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewRuntimeClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewRuntimeClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRuntimeClassClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredRuntimeClassClusterInformer constructs a new informer for RuntimeClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredRuntimeClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredRuntimeClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NodeV1().RuntimeClasses().List(context.TODO(), options)
+				return client.NodeV1().RuntimeClasses().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NodeV1().RuntimeClasses().Watch(context.TODO(), options)
+				return client.NodeV1().RuntimeClasses().Watch(context.Background(), options)
 			},
 		},
-		&nodev1.RuntimeClass{},
+		&apinodev1.RuntimeClass{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *runtimeClassClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *runtimeClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRuntimeClassClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *runtimeClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinodev1.RuntimeClass{}, i.defaultInformer)
 }
 
-func (f *runtimeClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&nodev1.RuntimeClass{}, f.defaultInformer)
+func (i *runtimeClassClusterInformer) Lister() kcpv1.RuntimeClassClusterLister {
+	return kcpv1.NewRuntimeClassClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *runtimeClassClusterInformer) Lister() nodev1listers.RuntimeClassClusterLister {
-	return nodev1listers.NewRuntimeClassClusterLister(f.Informer().GetIndexer())
+func (i *runtimeClassClusterInformer) Cluster(clusterName logicalcluster.Name) nodev1.RuntimeClassInformer {
+	return &runtimeClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *runtimeClassClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamnodev1informers.RuntimeClassInformer {
+func (i *runtimeClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) nodev1.RuntimeClassInformer {
 	return &runtimeClassInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type runtimeClassInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamnodev1listers.RuntimeClassLister
+	lister   listersnodev1.RuntimeClassLister
 }
 
-func (f *runtimeClassInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *runtimeClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *runtimeClassInformer) Lister() upstreamnodev1listers.RuntimeClassLister {
-	return f.lister
+func (i *runtimeClassInformer) Lister() listersnodev1.RuntimeClassLister {
+	return i.lister
 }
diff --git a/informers/node/v1alpha1/interface.go b/informers/node/v1alpha1/interface.go
index 80bb77768..4b20e9258 100644
--- a/informers/node/v1alpha1/interface.go
+++ b/informers/node/v1alpha1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// RuntimeClasses returns a RuntimeClassClusterInformer
+	// RuntimeClasses returns a RuntimeClassClusterInformer.
 	RuntimeClasses() RuntimeClassClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// RuntimeClasses returns a RuntimeClassClusterInformer
+// RuntimeClasses returns a RuntimeClassClusterInformer.
 func (v *version) RuntimeClasses() RuntimeClassClusterInformer {
 	return &runtimeClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/node/v1alpha1/runtimeclass.go b/informers/node/v1alpha1/runtimeclass.go
index 19dcc3a3d..eccbf0eec 100644
--- a/informers/node/v1alpha1/runtimeclass.go
+++ b/informers/node/v1alpha1/runtimeclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apinodev1alpha1 "k8s.io/api/node/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	nodev1alpha1 "k8s.io/client-go/informers/node/v1alpha1"
+	listersnodev1alpha1 "k8s.io/client-go/listers/node/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	nodev1alpha1 "k8s.io/api/node/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamnodev1alpha1informers "k8s.io/client-go/informers/node/v1alpha1"
-	upstreamnodev1alpha1listers "k8s.io/client-go/listers/node/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	nodev1alpha1listers "github.com/kcp-dev/client-go/listers/node/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/node/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // RuntimeClassClusterInformer provides access to a shared informer and lister for
 // RuntimeClasses.
 type RuntimeClassClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamnodev1alpha1informers.RuntimeClassInformer
+	Cluster(logicalcluster.Name) nodev1alpha1.RuntimeClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) nodev1alpha1.RuntimeClassInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() nodev1alpha1listers.RuntimeClassClusterLister
+	Lister() kcpv1alpha1.RuntimeClassClusterLister
 }
 
 type runtimeClassClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewRuntimeClassClusterInformer constructs a new informer for RuntimeClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewRuntimeClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewRuntimeClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRuntimeClassClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredRuntimeClassClusterInformer constructs a new informer for RuntimeClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredRuntimeClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredRuntimeClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NodeV1alpha1().RuntimeClasses().List(context.TODO(), options)
+				return client.NodeV1alpha1().RuntimeClasses().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NodeV1alpha1().RuntimeClasses().Watch(context.TODO(), options)
+				return client.NodeV1alpha1().RuntimeClasses().Watch(context.Background(), options)
 			},
 		},
-		&nodev1alpha1.RuntimeClass{},
+		&apinodev1alpha1.RuntimeClass{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *runtimeClassClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *runtimeClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRuntimeClassClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *runtimeClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&nodev1alpha1.RuntimeClass{}, f.defaultInformer)
+func (i *runtimeClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinodev1alpha1.RuntimeClass{}, i.defaultInformer)
 }
 
-func (f *runtimeClassClusterInformer) Lister() nodev1alpha1listers.RuntimeClassClusterLister {
-	return nodev1alpha1listers.NewRuntimeClassClusterLister(f.Informer().GetIndexer())
+func (i *runtimeClassClusterInformer) Lister() kcpv1alpha1.RuntimeClassClusterLister {
+	return kcpv1alpha1.NewRuntimeClassClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *runtimeClassClusterInformer) Cluster(clusterName logicalcluster.Name) nodev1alpha1.RuntimeClassInformer {
+	return &runtimeClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *runtimeClassClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamnodev1alpha1informers.RuntimeClassInformer {
+func (i *runtimeClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) nodev1alpha1.RuntimeClassInformer {
 	return &runtimeClassInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type runtimeClassInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamnodev1alpha1listers.RuntimeClassLister
+	lister   listersnodev1alpha1.RuntimeClassLister
 }
 
-func (f *runtimeClassInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *runtimeClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *runtimeClassInformer) Lister() upstreamnodev1alpha1listers.RuntimeClassLister {
-	return f.lister
+func (i *runtimeClassInformer) Lister() listersnodev1alpha1.RuntimeClassLister {
+	return i.lister
 }
diff --git a/informers/node/v1beta1/interface.go b/informers/node/v1beta1/interface.go
index f6b468a8f..c2b328dec 100644
--- a/informers/node/v1beta1/interface.go
+++ b/informers/node/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// RuntimeClasses returns a RuntimeClassClusterInformer
+	// RuntimeClasses returns a RuntimeClassClusterInformer.
 	RuntimeClasses() RuntimeClassClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// RuntimeClasses returns a RuntimeClassClusterInformer
+// RuntimeClasses returns a RuntimeClassClusterInformer.
 func (v *version) RuntimeClasses() RuntimeClassClusterInformer {
 	return &runtimeClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/node/v1beta1/runtimeclass.go b/informers/node/v1beta1/runtimeclass.go
index 1eebb1093..8833f326b 100644
--- a/informers/node/v1beta1/runtimeclass.go
+++ b/informers/node/v1beta1/runtimeclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apinodev1beta1 "k8s.io/api/node/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	nodev1beta1 "k8s.io/client-go/informers/node/v1beta1"
+	listersnodev1beta1 "k8s.io/client-go/listers/node/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	nodev1beta1 "k8s.io/api/node/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamnodev1beta1informers "k8s.io/client-go/informers/node/v1beta1"
-	upstreamnodev1beta1listers "k8s.io/client-go/listers/node/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	nodev1beta1listers "github.com/kcp-dev/client-go/listers/node/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/node/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // RuntimeClassClusterInformer provides access to a shared informer and lister for
 // RuntimeClasses.
 type RuntimeClassClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamnodev1beta1informers.RuntimeClassInformer
+	Cluster(logicalcluster.Name) nodev1beta1.RuntimeClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) nodev1beta1.RuntimeClassInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() nodev1beta1listers.RuntimeClassClusterLister
+	Lister() kcpv1beta1.RuntimeClassClusterLister
 }
 
 type runtimeClassClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewRuntimeClassClusterInformer constructs a new informer for RuntimeClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewRuntimeClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewRuntimeClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRuntimeClassClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredRuntimeClassClusterInformer constructs a new informer for RuntimeClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredRuntimeClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredRuntimeClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NodeV1beta1().RuntimeClasses().List(context.TODO(), options)
+				return client.NodeV1beta1().RuntimeClasses().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.NodeV1beta1().RuntimeClasses().Watch(context.TODO(), options)
+				return client.NodeV1beta1().RuntimeClasses().Watch(context.Background(), options)
 			},
 		},
-		&nodev1beta1.RuntimeClass{},
+		&apinodev1beta1.RuntimeClass{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *runtimeClassClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *runtimeClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRuntimeClassClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *runtimeClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&nodev1beta1.RuntimeClass{}, f.defaultInformer)
+func (i *runtimeClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apinodev1beta1.RuntimeClass{}, i.defaultInformer)
 }
 
-func (f *runtimeClassClusterInformer) Lister() nodev1beta1listers.RuntimeClassClusterLister {
-	return nodev1beta1listers.NewRuntimeClassClusterLister(f.Informer().GetIndexer())
+func (i *runtimeClassClusterInformer) Lister() kcpv1beta1.RuntimeClassClusterLister {
+	return kcpv1beta1.NewRuntimeClassClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *runtimeClassClusterInformer) Cluster(clusterName logicalcluster.Name) nodev1beta1.RuntimeClassInformer {
+	return &runtimeClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *runtimeClassClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamnodev1beta1informers.RuntimeClassInformer {
+func (i *runtimeClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) nodev1beta1.RuntimeClassInformer {
 	return &runtimeClassInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type runtimeClassInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamnodev1beta1listers.RuntimeClassLister
+	lister   listersnodev1beta1.RuntimeClassLister
 }
 
-func (f *runtimeClassInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *runtimeClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *runtimeClassInformer) Lister() upstreamnodev1beta1listers.RuntimeClassLister {
-	return f.lister
+func (i *runtimeClassInformer) Lister() listersnodev1beta1.RuntimeClassLister {
+	return i.lister
 }
diff --git a/informers/policy/interface.go b/informers/policy/interface.go
index f14f0ded7..c43452f32 100644
--- a/informers/policy/interface.go
+++ b/informers/policy/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,39 +14,40 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package policy
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	"github.com/kcp-dev/client-go/informers/policy/v1"
-	"github.com/kcp-dev/client-go/informers/policy/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/policy/v1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/policy/v1beta1"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/policy/v1/interface.go b/informers/policy/v1/interface.go
index 9d2606c26..152a1abe9 100644
--- a/informers/policy/v1/interface.go
+++ b/informers/policy/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// PodDisruptionBudgets returns a PodDisruptionBudgetClusterInformer
+	// PodDisruptionBudgets returns a PodDisruptionBudgetClusterInformer.
 	PodDisruptionBudgets() PodDisruptionBudgetClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// PodDisruptionBudgets returns a PodDisruptionBudgetClusterInformer
+// PodDisruptionBudgets returns a PodDisruptionBudgetClusterInformer.
 func (v *version) PodDisruptionBudgets() PodDisruptionBudgetClusterInformer {
 	return &podDisruptionBudgetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/policy/v1/poddisruptionbudget.go b/informers/policy/v1/poddisruptionbudget.go
index 3f9f440cc..9b082ad65 100644
--- a/informers/policy/v1/poddisruptionbudget.go
+++ b/informers/policy/v1/poddisruptionbudget.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apipolicyv1 "k8s.io/api/policy/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	policyv1 "k8s.io/client-go/informers/policy/v1"
+	listerspolicyv1 "k8s.io/client-go/listers/policy/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	policyv1 "k8s.io/api/policy/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreampolicyv1informers "k8s.io/client-go/informers/policy/v1"
-	upstreampolicyv1listers "k8s.io/client-go/listers/policy/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	policyv1listers "github.com/kcp-dev/client-go/listers/policy/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/policy/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PodDisruptionBudgetClusterInformer provides access to a shared informer and lister for
 // PodDisruptionBudgets.
 type PodDisruptionBudgetClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreampolicyv1informers.PodDisruptionBudgetInformer
+	Cluster(logicalcluster.Name) policyv1.PodDisruptionBudgetInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) policyv1.PodDisruptionBudgetInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() policyv1listers.PodDisruptionBudgetClusterLister
+	Lister() kcpv1.PodDisruptionBudgetClusterLister
 }
 
 type podDisruptionBudgetClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewPodDisruptionBudgetClusterInformer constructs a new informer for PodDisruptionBudget type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPodDisruptionBudgetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewPodDisruptionBudgetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPodDisruptionBudgetClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredPodDisruptionBudgetClusterInformer constructs a new informer for PodDisruptionBudget type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPodDisruptionBudgetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredPodDisruptionBudgetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.PolicyV1().PodDisruptionBudgets().List(context.TODO(), options)
+				return client.PolicyV1().PodDisruptionBudgets().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.PolicyV1().PodDisruptionBudgets().Watch(context.TODO(), options)
+				return client.PolicyV1().PodDisruptionBudgets().Watch(context.Background(), options)
 			},
 		},
-		&policyv1.PodDisruptionBudget{},
+		&apipolicyv1.PodDisruptionBudget{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *podDisruptionBudgetClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *podDisruptionBudgetClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPodDisruptionBudgetClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *podDisruptionBudgetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apipolicyv1.PodDisruptionBudget{}, i.defaultInformer)
 }
 
-func (f *podDisruptionBudgetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&policyv1.PodDisruptionBudget{}, f.defaultInformer)
+func (i *podDisruptionBudgetClusterInformer) Lister() kcpv1.PodDisruptionBudgetClusterLister {
+	return kcpv1.NewPodDisruptionBudgetClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *podDisruptionBudgetClusterInformer) Lister() policyv1listers.PodDisruptionBudgetClusterLister {
-	return policyv1listers.NewPodDisruptionBudgetClusterLister(f.Informer().GetIndexer())
+func (i *podDisruptionBudgetClusterInformer) Cluster(clusterName logicalcluster.Name) policyv1.PodDisruptionBudgetInformer {
+	return &podDisruptionBudgetInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *podDisruptionBudgetClusterInformer) Cluster(clusterName logicalcluster.Name) upstreampolicyv1informers.PodDisruptionBudgetInformer {
+func (i *podDisruptionBudgetClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) policyv1.PodDisruptionBudgetInformer {
 	return &podDisruptionBudgetInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type podDisruptionBudgetInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreampolicyv1listers.PodDisruptionBudgetLister
+	lister   listerspolicyv1.PodDisruptionBudgetLister
 }
 
-func (f *podDisruptionBudgetInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *podDisruptionBudgetInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *podDisruptionBudgetInformer) Lister() upstreampolicyv1listers.PodDisruptionBudgetLister {
-	return f.lister
+func (i *podDisruptionBudgetInformer) Lister() listerspolicyv1.PodDisruptionBudgetLister {
+	return i.lister
 }
diff --git a/informers/policy/v1beta1/interface.go b/informers/policy/v1beta1/interface.go
index 9a896b73e..29bd91efb 100644
--- a/informers/policy/v1beta1/interface.go
+++ b/informers/policy/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,37 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// PodDisruptionBudgets returns a PodDisruptionBudgetClusterInformer
+	// PodDisruptionBudgets returns a PodDisruptionBudgetClusterInformer.
 	PodDisruptionBudgets() PodDisruptionBudgetClusterInformer
-	// PodSecurityPolicies returns a PodSecurityPolicyClusterInformer
-	PodSecurityPolicies() PodSecurityPolicyClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// PodDisruptionBudgets returns a PodDisruptionBudgetClusterInformer
+// PodDisruptionBudgets returns a PodDisruptionBudgetClusterInformer.
 func (v *version) PodDisruptionBudgets() PodDisruptionBudgetClusterInformer {
 	return &podDisruptionBudgetClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
-
-// PodSecurityPolicies returns a PodSecurityPolicyClusterInformer
-func (v *version) PodSecurityPolicies() PodSecurityPolicyClusterInformer {
-	return &podSecurityPolicyClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
diff --git a/informers/policy/v1beta1/poddisruptionbudget.go b/informers/policy/v1beta1/poddisruptionbudget.go
index 43327f900..26d2b28e5 100644
--- a/informers/policy/v1beta1/poddisruptionbudget.go
+++ b/informers/policy/v1beta1/poddisruptionbudget.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apipolicyv1beta1 "k8s.io/api/policy/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	policyv1beta1 "k8s.io/client-go/informers/policy/v1beta1"
+	listerspolicyv1beta1 "k8s.io/client-go/listers/policy/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	policyv1beta1 "k8s.io/api/policy/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreampolicyv1beta1informers "k8s.io/client-go/informers/policy/v1beta1"
-	upstreampolicyv1beta1listers "k8s.io/client-go/listers/policy/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	policyv1beta1listers "github.com/kcp-dev/client-go/listers/policy/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/policy/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PodDisruptionBudgetClusterInformer provides access to a shared informer and lister for
 // PodDisruptionBudgets.
 type PodDisruptionBudgetClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreampolicyv1beta1informers.PodDisruptionBudgetInformer
+	Cluster(logicalcluster.Name) policyv1beta1.PodDisruptionBudgetInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) policyv1beta1.PodDisruptionBudgetInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() policyv1beta1listers.PodDisruptionBudgetClusterLister
+	Lister() kcpv1beta1.PodDisruptionBudgetClusterLister
 }
 
 type podDisruptionBudgetClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewPodDisruptionBudgetClusterInformer constructs a new informer for PodDisruptionBudget type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPodDisruptionBudgetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewPodDisruptionBudgetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPodDisruptionBudgetClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredPodDisruptionBudgetClusterInformer constructs a new informer for PodDisruptionBudget type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPodDisruptionBudgetClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredPodDisruptionBudgetClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.PolicyV1beta1().PodDisruptionBudgets().List(context.TODO(), options)
+				return client.PolicyV1beta1().PodDisruptionBudgets().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.PolicyV1beta1().PodDisruptionBudgets().Watch(context.TODO(), options)
+				return client.PolicyV1beta1().PodDisruptionBudgets().Watch(context.Background(), options)
 			},
 		},
-		&policyv1beta1.PodDisruptionBudget{},
+		&apipolicyv1beta1.PodDisruptionBudget{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *podDisruptionBudgetClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *podDisruptionBudgetClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPodDisruptionBudgetClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *podDisruptionBudgetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&policyv1beta1.PodDisruptionBudget{}, f.defaultInformer)
+func (i *podDisruptionBudgetClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apipolicyv1beta1.PodDisruptionBudget{}, i.defaultInformer)
 }
 
-func (f *podDisruptionBudgetClusterInformer) Lister() policyv1beta1listers.PodDisruptionBudgetClusterLister {
-	return policyv1beta1listers.NewPodDisruptionBudgetClusterLister(f.Informer().GetIndexer())
+func (i *podDisruptionBudgetClusterInformer) Lister() kcpv1beta1.PodDisruptionBudgetClusterLister {
+	return kcpv1beta1.NewPodDisruptionBudgetClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *podDisruptionBudgetClusterInformer) Cluster(clusterName logicalcluster.Name) policyv1beta1.PodDisruptionBudgetInformer {
+	return &podDisruptionBudgetInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *podDisruptionBudgetClusterInformer) Cluster(clusterName logicalcluster.Name) upstreampolicyv1beta1informers.PodDisruptionBudgetInformer {
+func (i *podDisruptionBudgetClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) policyv1beta1.PodDisruptionBudgetInformer {
 	return &podDisruptionBudgetInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type podDisruptionBudgetInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreampolicyv1beta1listers.PodDisruptionBudgetLister
+	lister   listerspolicyv1beta1.PodDisruptionBudgetLister
 }
 
-func (f *podDisruptionBudgetInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *podDisruptionBudgetInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *podDisruptionBudgetInformer) Lister() upstreampolicyv1beta1listers.PodDisruptionBudgetLister {
-	return f.lister
+func (i *podDisruptionBudgetInformer) Lister() listerspolicyv1beta1.PodDisruptionBudgetLister {
+	return i.lister
 }
diff --git a/informers/policy/v1beta1/podsecuritypolicy.go b/informers/policy/v1beta1/podsecuritypolicy.go
deleted file mode 100644
index 875f50533..000000000
--- a/informers/policy/v1beta1/podsecuritypolicy.go
+++ /dev/null
@@ -1,124 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1beta1
-
-import (
-	"context"
-	"time"
-
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	policyv1beta1 "k8s.io/api/policy/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreampolicyv1beta1informers "k8s.io/client-go/informers/policy/v1beta1"
-	upstreampolicyv1beta1listers "k8s.io/client-go/listers/policy/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	policyv1beta1listers "github.com/kcp-dev/client-go/listers/policy/v1beta1"
-)
-
-// PodSecurityPolicyClusterInformer provides access to a shared informer and lister for
-// PodSecurityPolicies.
-type PodSecurityPolicyClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreampolicyv1beta1informers.PodSecurityPolicyInformer
-	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() policyv1beta1listers.PodSecurityPolicyClusterLister
-}
-
-type podSecurityPolicyClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// NewPodSecurityPolicyClusterInformer constructs a new informer for PodSecurityPolicy type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewPodSecurityPolicyClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredPodSecurityPolicyClusterInformer(client, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredPodSecurityPolicyClusterInformer constructs a new informer for PodSecurityPolicy type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPodSecurityPolicyClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
-	return kcpinformers.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.PolicyV1beta1().PodSecurityPolicies().List(context.TODO(), options)
-			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.PolicyV1beta1().PodSecurityPolicies().Watch(context.TODO(), options)
-			},
-		},
-		&policyv1beta1.PodSecurityPolicy{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *podSecurityPolicyClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredPodSecurityPolicyClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
-}
-
-func (f *podSecurityPolicyClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&policyv1beta1.PodSecurityPolicy{}, f.defaultInformer)
-}
-
-func (f *podSecurityPolicyClusterInformer) Lister() policyv1beta1listers.PodSecurityPolicyClusterLister {
-	return policyv1beta1listers.NewPodSecurityPolicyClusterLister(f.Informer().GetIndexer())
-}
-
-func (f *podSecurityPolicyClusterInformer) Cluster(clusterName logicalcluster.Name) upstreampolicyv1beta1informers.PodSecurityPolicyInformer {
-	return &podSecurityPolicyInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
-	}
-}
-
-type podSecurityPolicyInformer struct {
-	informer cache.SharedIndexInformer
-	lister   upstreampolicyv1beta1listers.PodSecurityPolicyLister
-}
-
-func (f *podSecurityPolicyInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
-}
-
-func (f *podSecurityPolicyInformer) Lister() upstreampolicyv1beta1listers.PodSecurityPolicyLister {
-	return f.lister
-}
diff --git a/informers/rbac/interface.go b/informers/rbac/interface.go
index 9d55adae7..deb5be460 100644
--- a/informers/rbac/interface.go
+++ b/informers/rbac/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,47 +14,48 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package rbac
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	"github.com/kcp-dev/client-go/informers/rbac/v1"
-	"github.com/kcp-dev/client-go/informers/rbac/v1alpha1"
-	"github.com/kcp-dev/client-go/informers/rbac/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/rbac/v1"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/informers/rbac/v1alpha1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/rbac/v1beta1"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1alpha1 provides access to the shared informers in V1alpha1.
-	V1alpha1() v1alpha1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() kcpv1alpha1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V1alpha1 returns a new v1alpha1.ClusterInterface.
-func (g *group) V1alpha1() v1alpha1.ClusterInterface {
-	return v1alpha1.New(g.factory, g.tweakListOptions)
+// V1alpha1 returns a new kcpv1alpha1.ClusterInterface.
+func (g *group) V1alpha1() kcpv1alpha1.ClusterInterface {
+	return kcpv1alpha1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/rbac/v1/clusterrole.go b/informers/rbac/v1/clusterrole.go
index 34b8196be..e10e6fe06 100644
--- a/informers/rbac/v1/clusterrole.go
+++ b/informers/rbac/v1/clusterrole.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apirbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1 "k8s.io/client-go/informers/rbac/v1"
+	listersrbacv1 "k8s.io/client-go/listers/rbac/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamrbacv1informers "k8s.io/client-go/informers/rbac/v1"
-	upstreamrbacv1listers "k8s.io/client-go/listers/rbac/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	rbacv1listers "github.com/kcp-dev/client-go/listers/rbac/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/rbac/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ClusterRoleClusterInformer provides access to a shared informer and lister for
 // ClusterRoles.
 type ClusterRoleClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamrbacv1informers.ClusterRoleInformer
+	Cluster(logicalcluster.Name) rbacv1.ClusterRoleInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) rbacv1.ClusterRoleInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() rbacv1listers.ClusterRoleClusterLister
+	Lister() kcpv1.ClusterRoleClusterLister
 }
 
 type clusterRoleClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewClusterRoleClusterInformer constructs a new informer for ClusterRole type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewClusterRoleClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewClusterRoleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredClusterRoleClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredClusterRoleClusterInformer constructs a new informer for ClusterRole type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredClusterRoleClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredClusterRoleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1().ClusterRoles().List(context.TODO(), options)
+				return client.RbacV1().ClusterRoles().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1().ClusterRoles().Watch(context.TODO(), options)
+				return client.RbacV1().ClusterRoles().Watch(context.Background(), options)
 			},
 		},
-		&rbacv1.ClusterRole{},
+		&apirbacv1.ClusterRole{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *clusterRoleClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *clusterRoleClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredClusterRoleClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *clusterRoleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apirbacv1.ClusterRole{}, i.defaultInformer)
 }
 
-func (f *clusterRoleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&rbacv1.ClusterRole{}, f.defaultInformer)
+func (i *clusterRoleClusterInformer) Lister() kcpv1.ClusterRoleClusterLister {
+	return kcpv1.NewClusterRoleClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *clusterRoleClusterInformer) Lister() rbacv1listers.ClusterRoleClusterLister {
-	return rbacv1listers.NewClusterRoleClusterLister(f.Informer().GetIndexer())
+func (i *clusterRoleClusterInformer) Cluster(clusterName logicalcluster.Name) rbacv1.ClusterRoleInformer {
+	return &clusterRoleInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *clusterRoleClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamrbacv1informers.ClusterRoleInformer {
+func (i *clusterRoleClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) rbacv1.ClusterRoleInformer {
 	return &clusterRoleInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type clusterRoleInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamrbacv1listers.ClusterRoleLister
+	lister   listersrbacv1.ClusterRoleLister
 }
 
-func (f *clusterRoleInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *clusterRoleInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *clusterRoleInformer) Lister() upstreamrbacv1listers.ClusterRoleLister {
-	return f.lister
+func (i *clusterRoleInformer) Lister() listersrbacv1.ClusterRoleLister {
+	return i.lister
 }
diff --git a/informers/rbac/v1/clusterrolebinding.go b/informers/rbac/v1/clusterrolebinding.go
index 2da44c3ca..9102f892f 100644
--- a/informers/rbac/v1/clusterrolebinding.go
+++ b/informers/rbac/v1/clusterrolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apirbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1 "k8s.io/client-go/informers/rbac/v1"
+	listersrbacv1 "k8s.io/client-go/listers/rbac/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamrbacv1informers "k8s.io/client-go/informers/rbac/v1"
-	upstreamrbacv1listers "k8s.io/client-go/listers/rbac/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	rbacv1listers "github.com/kcp-dev/client-go/listers/rbac/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/rbac/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ClusterRoleBindingClusterInformer provides access to a shared informer and lister for
 // ClusterRoleBindings.
 type ClusterRoleBindingClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamrbacv1informers.ClusterRoleBindingInformer
+	Cluster(logicalcluster.Name) rbacv1.ClusterRoleBindingInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) rbacv1.ClusterRoleBindingInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() rbacv1listers.ClusterRoleBindingClusterLister
+	Lister() kcpv1.ClusterRoleBindingClusterLister
 }
 
 type clusterRoleBindingClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewClusterRoleBindingClusterInformer constructs a new informer for ClusterRoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewClusterRoleBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewClusterRoleBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredClusterRoleBindingClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredClusterRoleBindingClusterInformer constructs a new informer for ClusterRoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredClusterRoleBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredClusterRoleBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1().ClusterRoleBindings().List(context.TODO(), options)
+				return client.RbacV1().ClusterRoleBindings().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1().ClusterRoleBindings().Watch(context.TODO(), options)
+				return client.RbacV1().ClusterRoleBindings().Watch(context.Background(), options)
 			},
 		},
-		&rbacv1.ClusterRoleBinding{},
+		&apirbacv1.ClusterRoleBinding{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *clusterRoleBindingClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *clusterRoleBindingClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredClusterRoleBindingClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *clusterRoleBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apirbacv1.ClusterRoleBinding{}, i.defaultInformer)
 }
 
-func (f *clusterRoleBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&rbacv1.ClusterRoleBinding{}, f.defaultInformer)
+func (i *clusterRoleBindingClusterInformer) Lister() kcpv1.ClusterRoleBindingClusterLister {
+	return kcpv1.NewClusterRoleBindingClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *clusterRoleBindingClusterInformer) Lister() rbacv1listers.ClusterRoleBindingClusterLister {
-	return rbacv1listers.NewClusterRoleBindingClusterLister(f.Informer().GetIndexer())
+func (i *clusterRoleBindingClusterInformer) Cluster(clusterName logicalcluster.Name) rbacv1.ClusterRoleBindingInformer {
+	return &clusterRoleBindingInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *clusterRoleBindingClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamrbacv1informers.ClusterRoleBindingInformer {
+func (i *clusterRoleBindingClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) rbacv1.ClusterRoleBindingInformer {
 	return &clusterRoleBindingInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type clusterRoleBindingInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamrbacv1listers.ClusterRoleBindingLister
+	lister   listersrbacv1.ClusterRoleBindingLister
 }
 
-func (f *clusterRoleBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *clusterRoleBindingInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *clusterRoleBindingInformer) Lister() upstreamrbacv1listers.ClusterRoleBindingLister {
-	return f.lister
+func (i *clusterRoleBindingInformer) Lister() listersrbacv1.ClusterRoleBindingLister {
+	return i.lister
 }
diff --git a/informers/rbac/v1/interface.go b/informers/rbac/v1/interface.go
index 5ce5b368a..2a832130b 100644
--- a/informers/rbac/v1/interface.go
+++ b/informers/rbac/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,51 +14,51 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// Roles returns a RoleClusterInformer
-	Roles() RoleClusterInformer
-	// RoleBindings returns a RoleBindingClusterInformer
-	RoleBindings() RoleBindingClusterInformer
-	// ClusterRoles returns a ClusterRoleClusterInformer
+	// ClusterRoles returns a ClusterRoleClusterInformer.
 	ClusterRoles() ClusterRoleClusterInformer
-	// ClusterRoleBindings returns a ClusterRoleBindingClusterInformer
+	// ClusterRoleBindings returns a ClusterRoleBindingClusterInformer.
 	ClusterRoleBindings() ClusterRoleBindingClusterInformer
+	// Roles returns a RoleClusterInformer.
+	Roles() RoleClusterInformer
+	// RoleBindings returns a RoleBindingClusterInformer.
+	RoleBindings() RoleBindingClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// Roles returns a RoleClusterInformer
-func (v *version) Roles() RoleClusterInformer {
-	return &roleClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// RoleBindings returns a RoleBindingClusterInformer
-func (v *version) RoleBindings() RoleBindingClusterInformer {
-	return &roleBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// ClusterRoles returns a ClusterRoleClusterInformer
+// ClusterRoles returns a ClusterRoleClusterInformer.
 func (v *version) ClusterRoles() ClusterRoleClusterInformer {
 	return &clusterRoleClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ClusterRoleBindings returns a ClusterRoleBindingClusterInformer
+// ClusterRoleBindings returns a ClusterRoleBindingClusterInformer.
 func (v *version) ClusterRoleBindings() ClusterRoleBindingClusterInformer {
 	return &clusterRoleBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// Roles returns a RoleClusterInformer.
+func (v *version) Roles() RoleClusterInformer {
+	return &roleClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// RoleBindings returns a RoleBindingClusterInformer.
+func (v *version) RoleBindings() RoleBindingClusterInformer {
+	return &roleBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/rbac/v1/role.go b/informers/rbac/v1/role.go
index a3d956557..9526c16f3 100644
--- a/informers/rbac/v1/role.go
+++ b/informers/rbac/v1/role.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apirbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1 "k8s.io/client-go/informers/rbac/v1"
+	listersrbacv1 "k8s.io/client-go/listers/rbac/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamrbacv1informers "k8s.io/client-go/informers/rbac/v1"
-	upstreamrbacv1listers "k8s.io/client-go/listers/rbac/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	rbacv1listers "github.com/kcp-dev/client-go/listers/rbac/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/rbac/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // RoleClusterInformer provides access to a shared informer and lister for
 // Roles.
 type RoleClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamrbacv1informers.RoleInformer
+	Cluster(logicalcluster.Name) rbacv1.RoleInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) rbacv1.RoleInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() rbacv1listers.RoleClusterLister
+	Lister() kcpv1.RoleClusterLister
 }
 
 type roleClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewRoleClusterInformer constructs a new informer for Role type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewRoleClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewRoleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRoleClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredRoleClusterInformer constructs a new informer for Role type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredRoleClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredRoleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1().Roles().List(context.TODO(), options)
+				return client.RbacV1().Roles().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1().Roles().Watch(context.TODO(), options)
+				return client.RbacV1().Roles().Watch(context.Background(), options)
 			},
 		},
-		&rbacv1.Role{},
+		&apirbacv1.Role{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *roleClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *roleClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRoleClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *roleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apirbacv1.Role{}, i.defaultInformer)
 }
 
-func (f *roleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&rbacv1.Role{}, f.defaultInformer)
+func (i *roleClusterInformer) Lister() kcpv1.RoleClusterLister {
+	return kcpv1.NewRoleClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *roleClusterInformer) Lister() rbacv1listers.RoleClusterLister {
-	return rbacv1listers.NewRoleClusterLister(f.Informer().GetIndexer())
+func (i *roleClusterInformer) Cluster(clusterName logicalcluster.Name) rbacv1.RoleInformer {
+	return &roleInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *roleClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamrbacv1informers.RoleInformer {
+func (i *roleClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) rbacv1.RoleInformer {
 	return &roleInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type roleInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamrbacv1listers.RoleLister
+	lister   listersrbacv1.RoleLister
 }
 
-func (f *roleInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *roleInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *roleInformer) Lister() upstreamrbacv1listers.RoleLister {
-	return f.lister
+func (i *roleInformer) Lister() listersrbacv1.RoleLister {
+	return i.lister
 }
diff --git a/informers/rbac/v1/rolebinding.go b/informers/rbac/v1/rolebinding.go
index fbf55ea99..361e3d0c8 100644
--- a/informers/rbac/v1/rolebinding.go
+++ b/informers/rbac/v1/rolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apirbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1 "k8s.io/client-go/informers/rbac/v1"
+	listersrbacv1 "k8s.io/client-go/listers/rbac/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamrbacv1informers "k8s.io/client-go/informers/rbac/v1"
-	upstreamrbacv1listers "k8s.io/client-go/listers/rbac/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	rbacv1listers "github.com/kcp-dev/client-go/listers/rbac/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/rbac/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // RoleBindingClusterInformer provides access to a shared informer and lister for
 // RoleBindings.
 type RoleBindingClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamrbacv1informers.RoleBindingInformer
+	Cluster(logicalcluster.Name) rbacv1.RoleBindingInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) rbacv1.RoleBindingInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() rbacv1listers.RoleBindingClusterLister
+	Lister() kcpv1.RoleBindingClusterLister
 }
 
 type roleBindingClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewRoleBindingClusterInformer constructs a new informer for RoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewRoleBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewRoleBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRoleBindingClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredRoleBindingClusterInformer constructs a new informer for RoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredRoleBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredRoleBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1().RoleBindings().List(context.TODO(), options)
+				return client.RbacV1().RoleBindings().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1().RoleBindings().Watch(context.TODO(), options)
+				return client.RbacV1().RoleBindings().Watch(context.Background(), options)
 			},
 		},
-		&rbacv1.RoleBinding{},
+		&apirbacv1.RoleBinding{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *roleBindingClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *roleBindingClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRoleBindingClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *roleBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apirbacv1.RoleBinding{}, i.defaultInformer)
 }
 
-func (f *roleBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&rbacv1.RoleBinding{}, f.defaultInformer)
+func (i *roleBindingClusterInformer) Lister() kcpv1.RoleBindingClusterLister {
+	return kcpv1.NewRoleBindingClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *roleBindingClusterInformer) Lister() rbacv1listers.RoleBindingClusterLister {
-	return rbacv1listers.NewRoleBindingClusterLister(f.Informer().GetIndexer())
+func (i *roleBindingClusterInformer) Cluster(clusterName logicalcluster.Name) rbacv1.RoleBindingInformer {
+	return &roleBindingInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *roleBindingClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamrbacv1informers.RoleBindingInformer {
+func (i *roleBindingClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) rbacv1.RoleBindingInformer {
 	return &roleBindingInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type roleBindingInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamrbacv1listers.RoleBindingLister
+	lister   listersrbacv1.RoleBindingLister
 }
 
-func (f *roleBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *roleBindingInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *roleBindingInformer) Lister() upstreamrbacv1listers.RoleBindingLister {
-	return f.lister
+func (i *roleBindingInformer) Lister() listersrbacv1.RoleBindingLister {
+	return i.lister
 }
diff --git a/informers/rbac/v1alpha1/clusterrole.go b/informers/rbac/v1alpha1/clusterrole.go
index ff3f302cd..1d23dfd7f 100644
--- a/informers/rbac/v1alpha1/clusterrole.go
+++ b/informers/rbac/v1alpha1/clusterrole.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apirbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1alpha1 "k8s.io/client-go/informers/rbac/v1alpha1"
+	listersrbacv1alpha1 "k8s.io/client-go/listers/rbac/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamrbacv1alpha1informers "k8s.io/client-go/informers/rbac/v1alpha1"
-	upstreamrbacv1alpha1listers "k8s.io/client-go/listers/rbac/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	rbacv1alpha1listers "github.com/kcp-dev/client-go/listers/rbac/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/rbac/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ClusterRoleClusterInformer provides access to a shared informer and lister for
 // ClusterRoles.
 type ClusterRoleClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamrbacv1alpha1informers.ClusterRoleInformer
+	Cluster(logicalcluster.Name) rbacv1alpha1.ClusterRoleInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) rbacv1alpha1.ClusterRoleInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() rbacv1alpha1listers.ClusterRoleClusterLister
+	Lister() kcpv1alpha1.ClusterRoleClusterLister
 }
 
 type clusterRoleClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewClusterRoleClusterInformer constructs a new informer for ClusterRole type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewClusterRoleClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewClusterRoleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredClusterRoleClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredClusterRoleClusterInformer constructs a new informer for ClusterRole type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredClusterRoleClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredClusterRoleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1alpha1().ClusterRoles().List(context.TODO(), options)
+				return client.RbacV1alpha1().ClusterRoles().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1alpha1().ClusterRoles().Watch(context.TODO(), options)
+				return client.RbacV1alpha1().ClusterRoles().Watch(context.Background(), options)
 			},
 		},
-		&rbacv1alpha1.ClusterRole{},
+		&apirbacv1alpha1.ClusterRole{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *clusterRoleClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *clusterRoleClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredClusterRoleClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *clusterRoleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&rbacv1alpha1.ClusterRole{}, f.defaultInformer)
+func (i *clusterRoleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apirbacv1alpha1.ClusterRole{}, i.defaultInformer)
 }
 
-func (f *clusterRoleClusterInformer) Lister() rbacv1alpha1listers.ClusterRoleClusterLister {
-	return rbacv1alpha1listers.NewClusterRoleClusterLister(f.Informer().GetIndexer())
+func (i *clusterRoleClusterInformer) Lister() kcpv1alpha1.ClusterRoleClusterLister {
+	return kcpv1alpha1.NewClusterRoleClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *clusterRoleClusterInformer) Cluster(clusterName logicalcluster.Name) rbacv1alpha1.ClusterRoleInformer {
+	return &clusterRoleInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *clusterRoleClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamrbacv1alpha1informers.ClusterRoleInformer {
+func (i *clusterRoleClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) rbacv1alpha1.ClusterRoleInformer {
 	return &clusterRoleInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type clusterRoleInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamrbacv1alpha1listers.ClusterRoleLister
+	lister   listersrbacv1alpha1.ClusterRoleLister
 }
 
-func (f *clusterRoleInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *clusterRoleInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *clusterRoleInformer) Lister() upstreamrbacv1alpha1listers.ClusterRoleLister {
-	return f.lister
+func (i *clusterRoleInformer) Lister() listersrbacv1alpha1.ClusterRoleLister {
+	return i.lister
 }
diff --git a/informers/rbac/v1alpha1/clusterrolebinding.go b/informers/rbac/v1alpha1/clusterrolebinding.go
index 2559ab0d4..24c6054a2 100644
--- a/informers/rbac/v1alpha1/clusterrolebinding.go
+++ b/informers/rbac/v1alpha1/clusterrolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apirbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1alpha1 "k8s.io/client-go/informers/rbac/v1alpha1"
+	listersrbacv1alpha1 "k8s.io/client-go/listers/rbac/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamrbacv1alpha1informers "k8s.io/client-go/informers/rbac/v1alpha1"
-	upstreamrbacv1alpha1listers "k8s.io/client-go/listers/rbac/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	rbacv1alpha1listers "github.com/kcp-dev/client-go/listers/rbac/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/rbac/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ClusterRoleBindingClusterInformer provides access to a shared informer and lister for
 // ClusterRoleBindings.
 type ClusterRoleBindingClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamrbacv1alpha1informers.ClusterRoleBindingInformer
+	Cluster(logicalcluster.Name) rbacv1alpha1.ClusterRoleBindingInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) rbacv1alpha1.ClusterRoleBindingInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() rbacv1alpha1listers.ClusterRoleBindingClusterLister
+	Lister() kcpv1alpha1.ClusterRoleBindingClusterLister
 }
 
 type clusterRoleBindingClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewClusterRoleBindingClusterInformer constructs a new informer for ClusterRoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewClusterRoleBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewClusterRoleBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredClusterRoleBindingClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredClusterRoleBindingClusterInformer constructs a new informer for ClusterRoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredClusterRoleBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredClusterRoleBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1alpha1().ClusterRoleBindings().List(context.TODO(), options)
+				return client.RbacV1alpha1().ClusterRoleBindings().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1alpha1().ClusterRoleBindings().Watch(context.TODO(), options)
+				return client.RbacV1alpha1().ClusterRoleBindings().Watch(context.Background(), options)
 			},
 		},
-		&rbacv1alpha1.ClusterRoleBinding{},
+		&apirbacv1alpha1.ClusterRoleBinding{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *clusterRoleBindingClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *clusterRoleBindingClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredClusterRoleBindingClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *clusterRoleBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&rbacv1alpha1.ClusterRoleBinding{}, f.defaultInformer)
+func (i *clusterRoleBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apirbacv1alpha1.ClusterRoleBinding{}, i.defaultInformer)
 }
 
-func (f *clusterRoleBindingClusterInformer) Lister() rbacv1alpha1listers.ClusterRoleBindingClusterLister {
-	return rbacv1alpha1listers.NewClusterRoleBindingClusterLister(f.Informer().GetIndexer())
+func (i *clusterRoleBindingClusterInformer) Lister() kcpv1alpha1.ClusterRoleBindingClusterLister {
+	return kcpv1alpha1.NewClusterRoleBindingClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *clusterRoleBindingClusterInformer) Cluster(clusterName logicalcluster.Name) rbacv1alpha1.ClusterRoleBindingInformer {
+	return &clusterRoleBindingInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *clusterRoleBindingClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamrbacv1alpha1informers.ClusterRoleBindingInformer {
+func (i *clusterRoleBindingClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) rbacv1alpha1.ClusterRoleBindingInformer {
 	return &clusterRoleBindingInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type clusterRoleBindingInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamrbacv1alpha1listers.ClusterRoleBindingLister
+	lister   listersrbacv1alpha1.ClusterRoleBindingLister
 }
 
-func (f *clusterRoleBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *clusterRoleBindingInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *clusterRoleBindingInformer) Lister() upstreamrbacv1alpha1listers.ClusterRoleBindingLister {
-	return f.lister
+func (i *clusterRoleBindingInformer) Lister() listersrbacv1alpha1.ClusterRoleBindingLister {
+	return i.lister
 }
diff --git a/informers/rbac/v1alpha1/interface.go b/informers/rbac/v1alpha1/interface.go
index 68b568bb2..afcba9f22 100644
--- a/informers/rbac/v1alpha1/interface.go
+++ b/informers/rbac/v1alpha1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,51 +14,51 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// Roles returns a RoleClusterInformer
-	Roles() RoleClusterInformer
-	// RoleBindings returns a RoleBindingClusterInformer
-	RoleBindings() RoleBindingClusterInformer
-	// ClusterRoles returns a ClusterRoleClusterInformer
+	// ClusterRoles returns a ClusterRoleClusterInformer.
 	ClusterRoles() ClusterRoleClusterInformer
-	// ClusterRoleBindings returns a ClusterRoleBindingClusterInformer
+	// ClusterRoleBindings returns a ClusterRoleBindingClusterInformer.
 	ClusterRoleBindings() ClusterRoleBindingClusterInformer
+	// Roles returns a RoleClusterInformer.
+	Roles() RoleClusterInformer
+	// RoleBindings returns a RoleBindingClusterInformer.
+	RoleBindings() RoleBindingClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// Roles returns a RoleClusterInformer
-func (v *version) Roles() RoleClusterInformer {
-	return &roleClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// RoleBindings returns a RoleBindingClusterInformer
-func (v *version) RoleBindings() RoleBindingClusterInformer {
-	return &roleBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// ClusterRoles returns a ClusterRoleClusterInformer
+// ClusterRoles returns a ClusterRoleClusterInformer.
 func (v *version) ClusterRoles() ClusterRoleClusterInformer {
 	return &clusterRoleClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ClusterRoleBindings returns a ClusterRoleBindingClusterInformer
+// ClusterRoleBindings returns a ClusterRoleBindingClusterInformer.
 func (v *version) ClusterRoleBindings() ClusterRoleBindingClusterInformer {
 	return &clusterRoleBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// Roles returns a RoleClusterInformer.
+func (v *version) Roles() RoleClusterInformer {
+	return &roleClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// RoleBindings returns a RoleBindingClusterInformer.
+func (v *version) RoleBindings() RoleBindingClusterInformer {
+	return &roleBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/rbac/v1alpha1/role.go b/informers/rbac/v1alpha1/role.go
index 8988fd7f8..aa72a01e3 100644
--- a/informers/rbac/v1alpha1/role.go
+++ b/informers/rbac/v1alpha1/role.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apirbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1alpha1 "k8s.io/client-go/informers/rbac/v1alpha1"
+	listersrbacv1alpha1 "k8s.io/client-go/listers/rbac/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamrbacv1alpha1informers "k8s.io/client-go/informers/rbac/v1alpha1"
-	upstreamrbacv1alpha1listers "k8s.io/client-go/listers/rbac/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	rbacv1alpha1listers "github.com/kcp-dev/client-go/listers/rbac/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/rbac/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // RoleClusterInformer provides access to a shared informer and lister for
 // Roles.
 type RoleClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamrbacv1alpha1informers.RoleInformer
+	Cluster(logicalcluster.Name) rbacv1alpha1.RoleInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) rbacv1alpha1.RoleInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() rbacv1alpha1listers.RoleClusterLister
+	Lister() kcpv1alpha1.RoleClusterLister
 }
 
 type roleClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewRoleClusterInformer constructs a new informer for Role type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewRoleClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewRoleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRoleClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredRoleClusterInformer constructs a new informer for Role type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredRoleClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredRoleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1alpha1().Roles().List(context.TODO(), options)
+				return client.RbacV1alpha1().Roles().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1alpha1().Roles().Watch(context.TODO(), options)
+				return client.RbacV1alpha1().Roles().Watch(context.Background(), options)
 			},
 		},
-		&rbacv1alpha1.Role{},
+		&apirbacv1alpha1.Role{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *roleClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *roleClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRoleClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *roleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&rbacv1alpha1.Role{}, f.defaultInformer)
+func (i *roleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apirbacv1alpha1.Role{}, i.defaultInformer)
 }
 
-func (f *roleClusterInformer) Lister() rbacv1alpha1listers.RoleClusterLister {
-	return rbacv1alpha1listers.NewRoleClusterLister(f.Informer().GetIndexer())
+func (i *roleClusterInformer) Lister() kcpv1alpha1.RoleClusterLister {
+	return kcpv1alpha1.NewRoleClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *roleClusterInformer) Cluster(clusterName logicalcluster.Name) rbacv1alpha1.RoleInformer {
+	return &roleInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *roleClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamrbacv1alpha1informers.RoleInformer {
+func (i *roleClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) rbacv1alpha1.RoleInformer {
 	return &roleInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type roleInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamrbacv1alpha1listers.RoleLister
+	lister   listersrbacv1alpha1.RoleLister
 }
 
-func (f *roleInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *roleInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *roleInformer) Lister() upstreamrbacv1alpha1listers.RoleLister {
-	return f.lister
+func (i *roleInformer) Lister() listersrbacv1alpha1.RoleLister {
+	return i.lister
 }
diff --git a/informers/rbac/v1alpha1/rolebinding.go b/informers/rbac/v1alpha1/rolebinding.go
index f2e92f72d..0d29a8915 100644
--- a/informers/rbac/v1alpha1/rolebinding.go
+++ b/informers/rbac/v1alpha1/rolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apirbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1alpha1 "k8s.io/client-go/informers/rbac/v1alpha1"
+	listersrbacv1alpha1 "k8s.io/client-go/listers/rbac/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamrbacv1alpha1informers "k8s.io/client-go/informers/rbac/v1alpha1"
-	upstreamrbacv1alpha1listers "k8s.io/client-go/listers/rbac/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	rbacv1alpha1listers "github.com/kcp-dev/client-go/listers/rbac/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/rbac/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // RoleBindingClusterInformer provides access to a shared informer and lister for
 // RoleBindings.
 type RoleBindingClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamrbacv1alpha1informers.RoleBindingInformer
+	Cluster(logicalcluster.Name) rbacv1alpha1.RoleBindingInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) rbacv1alpha1.RoleBindingInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() rbacv1alpha1listers.RoleBindingClusterLister
+	Lister() kcpv1alpha1.RoleBindingClusterLister
 }
 
 type roleBindingClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewRoleBindingClusterInformer constructs a new informer for RoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewRoleBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewRoleBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRoleBindingClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredRoleBindingClusterInformer constructs a new informer for RoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredRoleBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredRoleBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1alpha1().RoleBindings().List(context.TODO(), options)
+				return client.RbacV1alpha1().RoleBindings().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1alpha1().RoleBindings().Watch(context.TODO(), options)
+				return client.RbacV1alpha1().RoleBindings().Watch(context.Background(), options)
 			},
 		},
-		&rbacv1alpha1.RoleBinding{},
+		&apirbacv1alpha1.RoleBinding{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *roleBindingClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *roleBindingClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRoleBindingClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *roleBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&rbacv1alpha1.RoleBinding{}, f.defaultInformer)
+func (i *roleBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apirbacv1alpha1.RoleBinding{}, i.defaultInformer)
 }
 
-func (f *roleBindingClusterInformer) Lister() rbacv1alpha1listers.RoleBindingClusterLister {
-	return rbacv1alpha1listers.NewRoleBindingClusterLister(f.Informer().GetIndexer())
+func (i *roleBindingClusterInformer) Lister() kcpv1alpha1.RoleBindingClusterLister {
+	return kcpv1alpha1.NewRoleBindingClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *roleBindingClusterInformer) Cluster(clusterName logicalcluster.Name) rbacv1alpha1.RoleBindingInformer {
+	return &roleBindingInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *roleBindingClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamrbacv1alpha1informers.RoleBindingInformer {
+func (i *roleBindingClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) rbacv1alpha1.RoleBindingInformer {
 	return &roleBindingInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type roleBindingInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamrbacv1alpha1listers.RoleBindingLister
+	lister   listersrbacv1alpha1.RoleBindingLister
 }
 
-func (f *roleBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *roleBindingInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *roleBindingInformer) Lister() upstreamrbacv1alpha1listers.RoleBindingLister {
-	return f.lister
+func (i *roleBindingInformer) Lister() listersrbacv1alpha1.RoleBindingLister {
+	return i.lister
 }
diff --git a/informers/rbac/v1beta1/clusterrole.go b/informers/rbac/v1beta1/clusterrole.go
index 14cd4f8cc..df8d1a00c 100644
--- a/informers/rbac/v1beta1/clusterrole.go
+++ b/informers/rbac/v1beta1/clusterrole.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apirbacv1beta1 "k8s.io/api/rbac/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1beta1 "k8s.io/client-go/informers/rbac/v1beta1"
+	listersrbacv1beta1 "k8s.io/client-go/listers/rbac/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamrbacv1beta1informers "k8s.io/client-go/informers/rbac/v1beta1"
-	upstreamrbacv1beta1listers "k8s.io/client-go/listers/rbac/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	rbacv1beta1listers "github.com/kcp-dev/client-go/listers/rbac/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/rbac/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ClusterRoleClusterInformer provides access to a shared informer and lister for
 // ClusterRoles.
 type ClusterRoleClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamrbacv1beta1informers.ClusterRoleInformer
+	Cluster(logicalcluster.Name) rbacv1beta1.ClusterRoleInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) rbacv1beta1.ClusterRoleInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() rbacv1beta1listers.ClusterRoleClusterLister
+	Lister() kcpv1beta1.ClusterRoleClusterLister
 }
 
 type clusterRoleClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewClusterRoleClusterInformer constructs a new informer for ClusterRole type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewClusterRoleClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewClusterRoleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredClusterRoleClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredClusterRoleClusterInformer constructs a new informer for ClusterRole type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredClusterRoleClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredClusterRoleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1beta1().ClusterRoles().List(context.TODO(), options)
+				return client.RbacV1beta1().ClusterRoles().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1beta1().ClusterRoles().Watch(context.TODO(), options)
+				return client.RbacV1beta1().ClusterRoles().Watch(context.Background(), options)
 			},
 		},
-		&rbacv1beta1.ClusterRole{},
+		&apirbacv1beta1.ClusterRole{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *clusterRoleClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *clusterRoleClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredClusterRoleClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *clusterRoleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&rbacv1beta1.ClusterRole{}, f.defaultInformer)
+func (i *clusterRoleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apirbacv1beta1.ClusterRole{}, i.defaultInformer)
 }
 
-func (f *clusterRoleClusterInformer) Lister() rbacv1beta1listers.ClusterRoleClusterLister {
-	return rbacv1beta1listers.NewClusterRoleClusterLister(f.Informer().GetIndexer())
+func (i *clusterRoleClusterInformer) Lister() kcpv1beta1.ClusterRoleClusterLister {
+	return kcpv1beta1.NewClusterRoleClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *clusterRoleClusterInformer) Cluster(clusterName logicalcluster.Name) rbacv1beta1.ClusterRoleInformer {
+	return &clusterRoleInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *clusterRoleClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamrbacv1beta1informers.ClusterRoleInformer {
+func (i *clusterRoleClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) rbacv1beta1.ClusterRoleInformer {
 	return &clusterRoleInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type clusterRoleInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamrbacv1beta1listers.ClusterRoleLister
+	lister   listersrbacv1beta1.ClusterRoleLister
 }
 
-func (f *clusterRoleInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *clusterRoleInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *clusterRoleInformer) Lister() upstreamrbacv1beta1listers.ClusterRoleLister {
-	return f.lister
+func (i *clusterRoleInformer) Lister() listersrbacv1beta1.ClusterRoleLister {
+	return i.lister
 }
diff --git a/informers/rbac/v1beta1/clusterrolebinding.go b/informers/rbac/v1beta1/clusterrolebinding.go
index 82335789f..a332d778d 100644
--- a/informers/rbac/v1beta1/clusterrolebinding.go
+++ b/informers/rbac/v1beta1/clusterrolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apirbacv1beta1 "k8s.io/api/rbac/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1beta1 "k8s.io/client-go/informers/rbac/v1beta1"
+	listersrbacv1beta1 "k8s.io/client-go/listers/rbac/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamrbacv1beta1informers "k8s.io/client-go/informers/rbac/v1beta1"
-	upstreamrbacv1beta1listers "k8s.io/client-go/listers/rbac/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	rbacv1beta1listers "github.com/kcp-dev/client-go/listers/rbac/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/rbac/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ClusterRoleBindingClusterInformer provides access to a shared informer and lister for
 // ClusterRoleBindings.
 type ClusterRoleBindingClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamrbacv1beta1informers.ClusterRoleBindingInformer
+	Cluster(logicalcluster.Name) rbacv1beta1.ClusterRoleBindingInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) rbacv1beta1.ClusterRoleBindingInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() rbacv1beta1listers.ClusterRoleBindingClusterLister
+	Lister() kcpv1beta1.ClusterRoleBindingClusterLister
 }
 
 type clusterRoleBindingClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewClusterRoleBindingClusterInformer constructs a new informer for ClusterRoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewClusterRoleBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewClusterRoleBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredClusterRoleBindingClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredClusterRoleBindingClusterInformer constructs a new informer for ClusterRoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredClusterRoleBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredClusterRoleBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1beta1().ClusterRoleBindings().List(context.TODO(), options)
+				return client.RbacV1beta1().ClusterRoleBindings().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1beta1().ClusterRoleBindings().Watch(context.TODO(), options)
+				return client.RbacV1beta1().ClusterRoleBindings().Watch(context.Background(), options)
 			},
 		},
-		&rbacv1beta1.ClusterRoleBinding{},
+		&apirbacv1beta1.ClusterRoleBinding{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *clusterRoleBindingClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *clusterRoleBindingClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredClusterRoleBindingClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *clusterRoleBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&rbacv1beta1.ClusterRoleBinding{}, f.defaultInformer)
+func (i *clusterRoleBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apirbacv1beta1.ClusterRoleBinding{}, i.defaultInformer)
 }
 
-func (f *clusterRoleBindingClusterInformer) Lister() rbacv1beta1listers.ClusterRoleBindingClusterLister {
-	return rbacv1beta1listers.NewClusterRoleBindingClusterLister(f.Informer().GetIndexer())
+func (i *clusterRoleBindingClusterInformer) Lister() kcpv1beta1.ClusterRoleBindingClusterLister {
+	return kcpv1beta1.NewClusterRoleBindingClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *clusterRoleBindingClusterInformer) Cluster(clusterName logicalcluster.Name) rbacv1beta1.ClusterRoleBindingInformer {
+	return &clusterRoleBindingInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *clusterRoleBindingClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamrbacv1beta1informers.ClusterRoleBindingInformer {
+func (i *clusterRoleBindingClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) rbacv1beta1.ClusterRoleBindingInformer {
 	return &clusterRoleBindingInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type clusterRoleBindingInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamrbacv1beta1listers.ClusterRoleBindingLister
+	lister   listersrbacv1beta1.ClusterRoleBindingLister
 }
 
-func (f *clusterRoleBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *clusterRoleBindingInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *clusterRoleBindingInformer) Lister() upstreamrbacv1beta1listers.ClusterRoleBindingLister {
-	return f.lister
+func (i *clusterRoleBindingInformer) Lister() listersrbacv1beta1.ClusterRoleBindingLister {
+	return i.lister
 }
diff --git a/informers/rbac/v1beta1/interface.go b/informers/rbac/v1beta1/interface.go
index 181d06f72..b01aca32b 100644
--- a/informers/rbac/v1beta1/interface.go
+++ b/informers/rbac/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,51 +14,51 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// Roles returns a RoleClusterInformer
-	Roles() RoleClusterInformer
-	// RoleBindings returns a RoleBindingClusterInformer
-	RoleBindings() RoleBindingClusterInformer
-	// ClusterRoles returns a ClusterRoleClusterInformer
+	// ClusterRoles returns a ClusterRoleClusterInformer.
 	ClusterRoles() ClusterRoleClusterInformer
-	// ClusterRoleBindings returns a ClusterRoleBindingClusterInformer
+	// ClusterRoleBindings returns a ClusterRoleBindingClusterInformer.
 	ClusterRoleBindings() ClusterRoleBindingClusterInformer
+	// Roles returns a RoleClusterInformer.
+	Roles() RoleClusterInformer
+	// RoleBindings returns a RoleBindingClusterInformer.
+	RoleBindings() RoleBindingClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// Roles returns a RoleClusterInformer
-func (v *version) Roles() RoleClusterInformer {
-	return &roleClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// RoleBindings returns a RoleBindingClusterInformer
-func (v *version) RoleBindings() RoleBindingClusterInformer {
-	return &roleBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// ClusterRoles returns a ClusterRoleClusterInformer
+// ClusterRoles returns a ClusterRoleClusterInformer.
 func (v *version) ClusterRoles() ClusterRoleClusterInformer {
 	return &clusterRoleClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ClusterRoleBindings returns a ClusterRoleBindingClusterInformer
+// ClusterRoleBindings returns a ClusterRoleBindingClusterInformer.
 func (v *version) ClusterRoleBindings() ClusterRoleBindingClusterInformer {
 	return &clusterRoleBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// Roles returns a RoleClusterInformer.
+func (v *version) Roles() RoleClusterInformer {
+	return &roleClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// RoleBindings returns a RoleBindingClusterInformer.
+func (v *version) RoleBindings() RoleBindingClusterInformer {
+	return &roleBindingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/rbac/v1beta1/role.go b/informers/rbac/v1beta1/role.go
index f4496fbdf..895cf4f0b 100644
--- a/informers/rbac/v1beta1/role.go
+++ b/informers/rbac/v1beta1/role.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apirbacv1beta1 "k8s.io/api/rbac/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1beta1 "k8s.io/client-go/informers/rbac/v1beta1"
+	listersrbacv1beta1 "k8s.io/client-go/listers/rbac/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamrbacv1beta1informers "k8s.io/client-go/informers/rbac/v1beta1"
-	upstreamrbacv1beta1listers "k8s.io/client-go/listers/rbac/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	rbacv1beta1listers "github.com/kcp-dev/client-go/listers/rbac/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/rbac/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // RoleClusterInformer provides access to a shared informer and lister for
 // Roles.
 type RoleClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamrbacv1beta1informers.RoleInformer
+	Cluster(logicalcluster.Name) rbacv1beta1.RoleInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) rbacv1beta1.RoleInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() rbacv1beta1listers.RoleClusterLister
+	Lister() kcpv1beta1.RoleClusterLister
 }
 
 type roleClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewRoleClusterInformer constructs a new informer for Role type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewRoleClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewRoleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRoleClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredRoleClusterInformer constructs a new informer for Role type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredRoleClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredRoleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1beta1().Roles().List(context.TODO(), options)
+				return client.RbacV1beta1().Roles().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1beta1().Roles().Watch(context.TODO(), options)
+				return client.RbacV1beta1().Roles().Watch(context.Background(), options)
 			},
 		},
-		&rbacv1beta1.Role{},
+		&apirbacv1beta1.Role{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *roleClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *roleClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRoleClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *roleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&rbacv1beta1.Role{}, f.defaultInformer)
+func (i *roleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apirbacv1beta1.Role{}, i.defaultInformer)
 }
 
-func (f *roleClusterInformer) Lister() rbacv1beta1listers.RoleClusterLister {
-	return rbacv1beta1listers.NewRoleClusterLister(f.Informer().GetIndexer())
+func (i *roleClusterInformer) Lister() kcpv1beta1.RoleClusterLister {
+	return kcpv1beta1.NewRoleClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *roleClusterInformer) Cluster(clusterName logicalcluster.Name) rbacv1beta1.RoleInformer {
+	return &roleInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *roleClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamrbacv1beta1informers.RoleInformer {
+func (i *roleClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) rbacv1beta1.RoleInformer {
 	return &roleInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type roleInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamrbacv1beta1listers.RoleLister
+	lister   listersrbacv1beta1.RoleLister
 }
 
-func (f *roleInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *roleInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *roleInformer) Lister() upstreamrbacv1beta1listers.RoleLister {
-	return f.lister
+func (i *roleInformer) Lister() listersrbacv1beta1.RoleLister {
+	return i.lister
 }
diff --git a/informers/rbac/v1beta1/rolebinding.go b/informers/rbac/v1beta1/rolebinding.go
index 488bf0a2e..58aa19b25 100644
--- a/informers/rbac/v1beta1/rolebinding.go
+++ b/informers/rbac/v1beta1/rolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apirbacv1beta1 "k8s.io/api/rbac/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1beta1 "k8s.io/client-go/informers/rbac/v1beta1"
+	listersrbacv1beta1 "k8s.io/client-go/listers/rbac/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamrbacv1beta1informers "k8s.io/client-go/informers/rbac/v1beta1"
-	upstreamrbacv1beta1listers "k8s.io/client-go/listers/rbac/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	rbacv1beta1listers "github.com/kcp-dev/client-go/listers/rbac/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/rbac/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // RoleBindingClusterInformer provides access to a shared informer and lister for
 // RoleBindings.
 type RoleBindingClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamrbacv1beta1informers.RoleBindingInformer
+	Cluster(logicalcluster.Name) rbacv1beta1.RoleBindingInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) rbacv1beta1.RoleBindingInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() rbacv1beta1listers.RoleBindingClusterLister
+	Lister() kcpv1beta1.RoleBindingClusterLister
 }
 
 type roleBindingClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewRoleBindingClusterInformer constructs a new informer for RoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewRoleBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewRoleBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRoleBindingClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredRoleBindingClusterInformer constructs a new informer for RoleBinding type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredRoleBindingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredRoleBindingClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1beta1().RoleBindings().List(context.TODO(), options)
+				return client.RbacV1beta1().RoleBindings().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.RbacV1beta1().RoleBindings().Watch(context.TODO(), options)
+				return client.RbacV1beta1().RoleBindings().Watch(context.Background(), options)
 			},
 		},
-		&rbacv1beta1.RoleBinding{},
+		&apirbacv1beta1.RoleBinding{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *roleBindingClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *roleBindingClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredRoleBindingClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *roleBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&rbacv1beta1.RoleBinding{}, f.defaultInformer)
+func (i *roleBindingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apirbacv1beta1.RoleBinding{}, i.defaultInformer)
 }
 
-func (f *roleBindingClusterInformer) Lister() rbacv1beta1listers.RoleBindingClusterLister {
-	return rbacv1beta1listers.NewRoleBindingClusterLister(f.Informer().GetIndexer())
+func (i *roleBindingClusterInformer) Lister() kcpv1beta1.RoleBindingClusterLister {
+	return kcpv1beta1.NewRoleBindingClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *roleBindingClusterInformer) Cluster(clusterName logicalcluster.Name) rbacv1beta1.RoleBindingInformer {
+	return &roleBindingInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *roleBindingClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamrbacv1beta1informers.RoleBindingInformer {
+func (i *roleBindingClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) rbacv1beta1.RoleBindingInformer {
 	return &roleBindingInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type roleBindingInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamrbacv1beta1listers.RoleBindingLister
+	lister   listersrbacv1beta1.RoleBindingLister
 }
 
-func (f *roleBindingInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *roleBindingInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *roleBindingInformer) Lister() upstreamrbacv1beta1listers.RoleBindingLister {
-	return f.lister
+func (i *roleBindingInformer) Lister() listersrbacv1beta1.RoleBindingLister {
+	return i.lister
 }
diff --git a/informers/resource/interface.go b/informers/resource/interface.go
index 9b3ad7267..7a5533849 100644
--- a/informers/resource/interface.go
+++ b/informers/resource/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,31 +14,48 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package resource
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	"github.com/kcp-dev/client-go/informers/resource/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1alpha3 "github.com/kcp-dev/client-go/informers/resource/v1alpha3"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/resource/v1beta1"
+	kcpv1beta2 "github.com/kcp-dev/client-go/informers/resource/v1beta2"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1alpha1 provides access to the shared informers in V1alpha1.
-	V1alpha1() v1alpha1.ClusterInterface
+	// V1alpha3 provides access to shared informers for resources in V1alpha3.
+	V1alpha3() kcpv1alpha3.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
+	// V1beta2 provides access to shared informers for resources in V1beta2.
+	V1beta2() kcpv1beta2.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1alpha1 returns a new v1alpha1.ClusterInterface.
-func (g *group) V1alpha1() v1alpha1.ClusterInterface {
-	return v1alpha1.New(g.factory, g.tweakListOptions)
+// V1alpha3 returns a new kcpv1alpha3.ClusterInterface.
+func (g *group) V1alpha3() kcpv1alpha3.ClusterInterface {
+	return kcpv1alpha3.New(g.factory, g.tweakListOptions)
+}
+
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
+}
+
+// V1beta2 returns a new kcpv1beta2.ClusterInterface.
+func (g *group) V1beta2() kcpv1beta2.ClusterInterface {
+	return kcpv1beta2.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/resource/v1alpha1/podscheduling.go b/informers/resource/v1alpha1/podscheduling.go
deleted file mode 100644
index 024ff2067..000000000
--- a/informers/resource/v1alpha1/podscheduling.go
+++ /dev/null
@@ -1,124 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamresourcev1alpha1informers "k8s.io/client-go/informers/resource/v1alpha1"
-	upstreamresourcev1alpha1listers "k8s.io/client-go/listers/resource/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	resourcev1alpha1listers "github.com/kcp-dev/client-go/listers/resource/v1alpha1"
-)
-
-// PodSchedulingClusterInformer provides access to a shared informer and lister for
-// PodSchedulings.
-type PodSchedulingClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamresourcev1alpha1informers.PodSchedulingInformer
-	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() resourcev1alpha1listers.PodSchedulingClusterLister
-}
-
-type podSchedulingClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// NewPodSchedulingClusterInformer constructs a new informer for PodScheduling type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewPodSchedulingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredPodSchedulingClusterInformer(client, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredPodSchedulingClusterInformer constructs a new informer for PodScheduling type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPodSchedulingClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
-	return kcpinformers.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.ResourceV1alpha1().PodSchedulings().List(context.TODO(), options)
-			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.ResourceV1alpha1().PodSchedulings().Watch(context.TODO(), options)
-			},
-		},
-		&resourcev1alpha1.PodScheduling{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *podSchedulingClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredPodSchedulingClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
-}
-
-func (f *podSchedulingClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&resourcev1alpha1.PodScheduling{}, f.defaultInformer)
-}
-
-func (f *podSchedulingClusterInformer) Lister() resourcev1alpha1listers.PodSchedulingClusterLister {
-	return resourcev1alpha1listers.NewPodSchedulingClusterLister(f.Informer().GetIndexer())
-}
-
-func (f *podSchedulingClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamresourcev1alpha1informers.PodSchedulingInformer {
-	return &podSchedulingInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
-	}
-}
-
-type podSchedulingInformer struct {
-	informer cache.SharedIndexInformer
-	lister   upstreamresourcev1alpha1listers.PodSchedulingLister
-}
-
-func (f *podSchedulingInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
-}
-
-func (f *podSchedulingInformer) Lister() upstreamresourcev1alpha1listers.PodSchedulingLister {
-	return f.lister
-}
diff --git a/informers/resource/v1alpha1/resourceclaim.go b/informers/resource/v1alpha1/resourceclaim.go
deleted file mode 100644
index 95e137e7a..000000000
--- a/informers/resource/v1alpha1/resourceclaim.go
+++ /dev/null
@@ -1,124 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamresourcev1alpha1informers "k8s.io/client-go/informers/resource/v1alpha1"
-	upstreamresourcev1alpha1listers "k8s.io/client-go/listers/resource/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	resourcev1alpha1listers "github.com/kcp-dev/client-go/listers/resource/v1alpha1"
-)
-
-// ResourceClaimClusterInformer provides access to a shared informer and lister for
-// ResourceClaims.
-type ResourceClaimClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamresourcev1alpha1informers.ResourceClaimInformer
-	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() resourcev1alpha1listers.ResourceClaimClusterLister
-}
-
-type resourceClaimClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// NewResourceClaimClusterInformer constructs a new informer for ResourceClaim type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewResourceClaimClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredResourceClaimClusterInformer(client, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredResourceClaimClusterInformer constructs a new informer for ResourceClaim type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredResourceClaimClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
-	return kcpinformers.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.ResourceV1alpha1().ResourceClaims().List(context.TODO(), options)
-			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.ResourceV1alpha1().ResourceClaims().Watch(context.TODO(), options)
-			},
-		},
-		&resourcev1alpha1.ResourceClaim{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *resourceClaimClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredResourceClaimClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
-}
-
-func (f *resourceClaimClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&resourcev1alpha1.ResourceClaim{}, f.defaultInformer)
-}
-
-func (f *resourceClaimClusterInformer) Lister() resourcev1alpha1listers.ResourceClaimClusterLister {
-	return resourcev1alpha1listers.NewResourceClaimClusterLister(f.Informer().GetIndexer())
-}
-
-func (f *resourceClaimClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamresourcev1alpha1informers.ResourceClaimInformer {
-	return &resourceClaimInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
-	}
-}
-
-type resourceClaimInformer struct {
-	informer cache.SharedIndexInformer
-	lister   upstreamresourcev1alpha1listers.ResourceClaimLister
-}
-
-func (f *resourceClaimInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
-}
-
-func (f *resourceClaimInformer) Lister() upstreamresourcev1alpha1listers.ResourceClaimLister {
-	return f.lister
-}
diff --git a/informers/resource/v1alpha1/resourceclaimtemplate.go b/informers/resource/v1alpha1/resourceclaimtemplate.go
deleted file mode 100644
index 388e27a95..000000000
--- a/informers/resource/v1alpha1/resourceclaimtemplate.go
+++ /dev/null
@@ -1,124 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamresourcev1alpha1informers "k8s.io/client-go/informers/resource/v1alpha1"
-	upstreamresourcev1alpha1listers "k8s.io/client-go/listers/resource/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	resourcev1alpha1listers "github.com/kcp-dev/client-go/listers/resource/v1alpha1"
-)
-
-// ResourceClaimTemplateClusterInformer provides access to a shared informer and lister for
-// ResourceClaimTemplates.
-type ResourceClaimTemplateClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamresourcev1alpha1informers.ResourceClaimTemplateInformer
-	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() resourcev1alpha1listers.ResourceClaimTemplateClusterLister
-}
-
-type resourceClaimTemplateClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// NewResourceClaimTemplateClusterInformer constructs a new informer for ResourceClaimTemplate type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewResourceClaimTemplateClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredResourceClaimTemplateClusterInformer(client, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredResourceClaimTemplateClusterInformer constructs a new informer for ResourceClaimTemplate type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredResourceClaimTemplateClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
-	return kcpinformers.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.ResourceV1alpha1().ResourceClaimTemplates().List(context.TODO(), options)
-			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.ResourceV1alpha1().ResourceClaimTemplates().Watch(context.TODO(), options)
-			},
-		},
-		&resourcev1alpha1.ResourceClaimTemplate{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *resourceClaimTemplateClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredResourceClaimTemplateClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
-}
-
-func (f *resourceClaimTemplateClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&resourcev1alpha1.ResourceClaimTemplate{}, f.defaultInformer)
-}
-
-func (f *resourceClaimTemplateClusterInformer) Lister() resourcev1alpha1listers.ResourceClaimTemplateClusterLister {
-	return resourcev1alpha1listers.NewResourceClaimTemplateClusterLister(f.Informer().GetIndexer())
-}
-
-func (f *resourceClaimTemplateClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamresourcev1alpha1informers.ResourceClaimTemplateInformer {
-	return &resourceClaimTemplateInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
-	}
-}
-
-type resourceClaimTemplateInformer struct {
-	informer cache.SharedIndexInformer
-	lister   upstreamresourcev1alpha1listers.ResourceClaimTemplateLister
-}
-
-func (f *resourceClaimTemplateInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
-}
-
-func (f *resourceClaimTemplateInformer) Lister() upstreamresourcev1alpha1listers.ResourceClaimTemplateLister {
-	return f.lister
-}
diff --git a/informers/resource/v1alpha1/resourceclass.go b/informers/resource/v1alpha1/resourceclass.go
deleted file mode 100644
index f1de33a89..000000000
--- a/informers/resource/v1alpha1/resourceclass.go
+++ /dev/null
@@ -1,124 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-	"time"
-
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamresourcev1alpha1informers "k8s.io/client-go/informers/resource/v1alpha1"
-	upstreamresourcev1alpha1listers "k8s.io/client-go/listers/resource/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	resourcev1alpha1listers "github.com/kcp-dev/client-go/listers/resource/v1alpha1"
-)
-
-// ResourceClassClusterInformer provides access to a shared informer and lister for
-// ResourceClasses.
-type ResourceClassClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamresourcev1alpha1informers.ResourceClassInformer
-	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() resourcev1alpha1listers.ResourceClassClusterLister
-}
-
-type resourceClassClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
-}
-
-// NewResourceClassClusterInformer constructs a new informer for ResourceClass type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewResourceClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredResourceClassClusterInformer(client, resyncPeriod, indexers, nil)
-}
-
-// NewFilteredResourceClassClusterInformer constructs a new informer for ResourceClass type.
-// Always prefer using an informer factory to get a shared informer instead of getting an independent
-// one. This reduces memory footprint and number of connections to the server.
-func NewFilteredResourceClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
-	return kcpinformers.NewSharedIndexInformer(
-		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.ResourceV1alpha1().ResourceClasses().List(context.TODO(), options)
-			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
-				if tweakListOptions != nil {
-					tweakListOptions(&options)
-				}
-				return client.ResourceV1alpha1().ResourceClasses().Watch(context.TODO(), options)
-			},
-		},
-		&resourcev1alpha1.ResourceClass{},
-		resyncPeriod,
-		indexers,
-	)
-}
-
-func (f *resourceClassClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
-	return NewFilteredResourceClassClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
-}
-
-func (f *resourceClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&resourcev1alpha1.ResourceClass{}, f.defaultInformer)
-}
-
-func (f *resourceClassClusterInformer) Lister() resourcev1alpha1listers.ResourceClassClusterLister {
-	return resourcev1alpha1listers.NewResourceClassClusterLister(f.Informer().GetIndexer())
-}
-
-func (f *resourceClassClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamresourcev1alpha1informers.ResourceClassInformer {
-	return &resourceClassInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
-	}
-}
-
-type resourceClassInformer struct {
-	informer cache.SharedIndexInformer
-	lister   upstreamresourcev1alpha1listers.ResourceClassLister
-}
-
-func (f *resourceClassInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
-}
-
-func (f *resourceClassInformer) Lister() upstreamresourcev1alpha1listers.ResourceClassLister {
-	return f.lister
-}
diff --git a/informers/resource/v1alpha3/deviceclass.go b/informers/resource/v1alpha3/deviceclass.go
new file mode 100644
index 000000000..255e5e04d
--- /dev/null
+++ b/informers/resource/v1alpha3/deviceclass.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1alpha3 "k8s.io/client-go/informers/resource/v1alpha3"
+	listersresourcev1alpha3 "k8s.io/client-go/listers/resource/v1alpha3"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha3 "github.com/kcp-dev/client-go/listers/resource/v1alpha3"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// DeviceClassClusterInformer provides access to a shared informer and lister for
+// DeviceClasses.
+type DeviceClassClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1alpha3.DeviceClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1alpha3.DeviceClassInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha3.DeviceClassClusterLister
+}
+
+type deviceClassClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewDeviceClassClusterInformer constructs a new informer for DeviceClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewDeviceClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredDeviceClassClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredDeviceClassClusterInformer constructs a new informer for DeviceClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredDeviceClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1alpha3().DeviceClasses().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1alpha3().DeviceClasses().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1alpha3.DeviceClass{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *deviceClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredDeviceClassClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *deviceClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1alpha3.DeviceClass{}, i.defaultInformer)
+}
+
+func (i *deviceClassClusterInformer) Lister() kcpv1alpha3.DeviceClassClusterLister {
+	return kcpv1alpha3.NewDeviceClassClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *deviceClassClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1alpha3.DeviceClassInformer {
+	return &deviceClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *deviceClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1alpha3.DeviceClassInformer {
+	return &deviceClassInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type deviceClassInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1alpha3.DeviceClassLister
+}
+
+func (i *deviceClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *deviceClassInformer) Lister() listersresourcev1alpha3.DeviceClassLister {
+	return i.lister
+}
diff --git a/informers/resource/v1alpha3/devicetaintrule.go b/informers/resource/v1alpha3/devicetaintrule.go
new file mode 100644
index 000000000..282db934c
--- /dev/null
+++ b/informers/resource/v1alpha3/devicetaintrule.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1alpha3 "k8s.io/client-go/informers/resource/v1alpha3"
+	listersresourcev1alpha3 "k8s.io/client-go/listers/resource/v1alpha3"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha3 "github.com/kcp-dev/client-go/listers/resource/v1alpha3"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// DeviceTaintRuleClusterInformer provides access to a shared informer and lister for
+// DeviceTaintRules.
+type DeviceTaintRuleClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1alpha3.DeviceTaintRuleInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1alpha3.DeviceTaintRuleInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha3.DeviceTaintRuleClusterLister
+}
+
+type deviceTaintRuleClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewDeviceTaintRuleClusterInformer constructs a new informer for DeviceTaintRule type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewDeviceTaintRuleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredDeviceTaintRuleClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredDeviceTaintRuleClusterInformer constructs a new informer for DeviceTaintRule type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredDeviceTaintRuleClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1alpha3().DeviceTaintRules().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1alpha3().DeviceTaintRules().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1alpha3.DeviceTaintRule{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *deviceTaintRuleClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredDeviceTaintRuleClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *deviceTaintRuleClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1alpha3.DeviceTaintRule{}, i.defaultInformer)
+}
+
+func (i *deviceTaintRuleClusterInformer) Lister() kcpv1alpha3.DeviceTaintRuleClusterLister {
+	return kcpv1alpha3.NewDeviceTaintRuleClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *deviceTaintRuleClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1alpha3.DeviceTaintRuleInformer {
+	return &deviceTaintRuleInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *deviceTaintRuleClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1alpha3.DeviceTaintRuleInformer {
+	return &deviceTaintRuleInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type deviceTaintRuleInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1alpha3.DeviceTaintRuleLister
+}
+
+func (i *deviceTaintRuleInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *deviceTaintRuleInformer) Lister() listersresourcev1alpha3.DeviceTaintRuleLister {
+	return i.lister
+}
diff --git a/informers/resource/v1alpha3/interface.go b/informers/resource/v1alpha3/interface.go
new file mode 100644
index 000000000..1200b6334
--- /dev/null
+++ b/informers/resource/v1alpha3/interface.go
@@ -0,0 +1,71 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+)
+
+type ClusterInterface interface {
+	// DeviceClasses returns a DeviceClassClusterInformer.
+	DeviceClasses() DeviceClassClusterInformer
+	// DeviceTaintRules returns a DeviceTaintRuleClusterInformer.
+	DeviceTaintRules() DeviceTaintRuleClusterInformer
+	// ResourceClaims returns a ResourceClaimClusterInformer.
+	ResourceClaims() ResourceClaimClusterInformer
+	// ResourceClaimTemplates returns a ResourceClaimTemplateClusterInformer.
+	ResourceClaimTemplates() ResourceClaimTemplateClusterInformer
+	// ResourceSlices returns a ResourceSliceClusterInformer.
+	ResourceSlices() ResourceSliceClusterInformer
+}
+
+type version struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
+	return &version{factory: f, tweakListOptions: tweakListOptions}
+}
+
+// DeviceClasses returns a DeviceClassClusterInformer.
+func (v *version) DeviceClasses() DeviceClassClusterInformer {
+	return &deviceClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// DeviceTaintRules returns a DeviceTaintRuleClusterInformer.
+func (v *version) DeviceTaintRules() DeviceTaintRuleClusterInformer {
+	return &deviceTaintRuleClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ResourceClaims returns a ResourceClaimClusterInformer.
+func (v *version) ResourceClaims() ResourceClaimClusterInformer {
+	return &resourceClaimClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ResourceClaimTemplates returns a ResourceClaimTemplateClusterInformer.
+func (v *version) ResourceClaimTemplates() ResourceClaimTemplateClusterInformer {
+	return &resourceClaimTemplateClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ResourceSlices returns a ResourceSliceClusterInformer.
+func (v *version) ResourceSlices() ResourceSliceClusterInformer {
+	return &resourceSliceClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/resource/v1alpha3/resourceclaim.go b/informers/resource/v1alpha3/resourceclaim.go
new file mode 100644
index 000000000..222e99c2a
--- /dev/null
+++ b/informers/resource/v1alpha3/resourceclaim.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1alpha3 "k8s.io/client-go/informers/resource/v1alpha3"
+	listersresourcev1alpha3 "k8s.io/client-go/listers/resource/v1alpha3"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha3 "github.com/kcp-dev/client-go/listers/resource/v1alpha3"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimClusterInformer provides access to a shared informer and lister for
+// ResourceClaims.
+type ResourceClaimClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1alpha3.ResourceClaimInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1alpha3.ResourceClaimInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha3.ResourceClaimClusterLister
+}
+
+type resourceClaimClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewResourceClaimClusterInformer constructs a new informer for ResourceClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewResourceClaimClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceClaimClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredResourceClaimClusterInformer constructs a new informer for ResourceClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredResourceClaimClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1alpha3().ResourceClaims().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1alpha3().ResourceClaims().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1alpha3.ResourceClaim{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *resourceClaimClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceClaimClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *resourceClaimClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1alpha3.ResourceClaim{}, i.defaultInformer)
+}
+
+func (i *resourceClaimClusterInformer) Lister() kcpv1alpha3.ResourceClaimClusterLister {
+	return kcpv1alpha3.NewResourceClaimClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *resourceClaimClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1alpha3.ResourceClaimInformer {
+	return &resourceClaimInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *resourceClaimClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1alpha3.ResourceClaimInformer {
+	return &resourceClaimInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type resourceClaimInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1alpha3.ResourceClaimLister
+}
+
+func (i *resourceClaimInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *resourceClaimInformer) Lister() listersresourcev1alpha3.ResourceClaimLister {
+	return i.lister
+}
diff --git a/informers/resource/v1alpha3/resourceclaimtemplate.go b/informers/resource/v1alpha3/resourceclaimtemplate.go
new file mode 100644
index 000000000..89133b456
--- /dev/null
+++ b/informers/resource/v1alpha3/resourceclaimtemplate.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1alpha3 "k8s.io/client-go/informers/resource/v1alpha3"
+	listersresourcev1alpha3 "k8s.io/client-go/listers/resource/v1alpha3"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha3 "github.com/kcp-dev/client-go/listers/resource/v1alpha3"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimTemplateClusterInformer provides access to a shared informer and lister for
+// ResourceClaimTemplates.
+type ResourceClaimTemplateClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1alpha3.ResourceClaimTemplateInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1alpha3.ResourceClaimTemplateInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha3.ResourceClaimTemplateClusterLister
+}
+
+type resourceClaimTemplateClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewResourceClaimTemplateClusterInformer constructs a new informer for ResourceClaimTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewResourceClaimTemplateClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceClaimTemplateClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredResourceClaimTemplateClusterInformer constructs a new informer for ResourceClaimTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredResourceClaimTemplateClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1alpha3().ResourceClaimTemplates().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1alpha3().ResourceClaimTemplates().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1alpha3.ResourceClaimTemplate{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *resourceClaimTemplateClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceClaimTemplateClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *resourceClaimTemplateClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1alpha3.ResourceClaimTemplate{}, i.defaultInformer)
+}
+
+func (i *resourceClaimTemplateClusterInformer) Lister() kcpv1alpha3.ResourceClaimTemplateClusterLister {
+	return kcpv1alpha3.NewResourceClaimTemplateClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *resourceClaimTemplateClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1alpha3.ResourceClaimTemplateInformer {
+	return &resourceClaimTemplateInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *resourceClaimTemplateClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1alpha3.ResourceClaimTemplateInformer {
+	return &resourceClaimTemplateInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type resourceClaimTemplateInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1alpha3.ResourceClaimTemplateLister
+}
+
+func (i *resourceClaimTemplateInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *resourceClaimTemplateInformer) Lister() listersresourcev1alpha3.ResourceClaimTemplateLister {
+	return i.lister
+}
diff --git a/informers/resource/v1alpha3/resourceslice.go b/informers/resource/v1alpha3/resourceslice.go
new file mode 100644
index 000000000..7997e801c
--- /dev/null
+++ b/informers/resource/v1alpha3/resourceslice.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1alpha3 "k8s.io/client-go/informers/resource/v1alpha3"
+	listersresourcev1alpha3 "k8s.io/client-go/listers/resource/v1alpha3"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha3 "github.com/kcp-dev/client-go/listers/resource/v1alpha3"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceSliceClusterInformer provides access to a shared informer and lister for
+// ResourceSlices.
+type ResourceSliceClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1alpha3.ResourceSliceInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1alpha3.ResourceSliceInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha3.ResourceSliceClusterLister
+}
+
+type resourceSliceClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewResourceSliceClusterInformer constructs a new informer for ResourceSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewResourceSliceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceSliceClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredResourceSliceClusterInformer constructs a new informer for ResourceSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredResourceSliceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1alpha3().ResourceSlices().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1alpha3().ResourceSlices().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1alpha3.ResourceSlice{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *resourceSliceClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceSliceClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *resourceSliceClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1alpha3.ResourceSlice{}, i.defaultInformer)
+}
+
+func (i *resourceSliceClusterInformer) Lister() kcpv1alpha3.ResourceSliceClusterLister {
+	return kcpv1alpha3.NewResourceSliceClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *resourceSliceClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1alpha3.ResourceSliceInformer {
+	return &resourceSliceInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *resourceSliceClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1alpha3.ResourceSliceInformer {
+	return &resourceSliceInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type resourceSliceInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1alpha3.ResourceSliceLister
+}
+
+func (i *resourceSliceInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *resourceSliceInformer) Lister() listersresourcev1alpha3.ResourceSliceLister {
+	return i.lister
+}
diff --git a/informers/resource/v1beta1/deviceclass.go b/informers/resource/v1beta1/deviceclass.go
new file mode 100644
index 000000000..b6d7be99f
--- /dev/null
+++ b/informers/resource/v1beta1/deviceclass.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1beta1 "k8s.io/api/resource/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1beta1 "k8s.io/client-go/informers/resource/v1beta1"
+	listersresourcev1beta1 "k8s.io/client-go/listers/resource/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/resource/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// DeviceClassClusterInformer provides access to a shared informer and lister for
+// DeviceClasses.
+type DeviceClassClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1beta1.DeviceClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1beta1.DeviceClassInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta1.DeviceClassClusterLister
+}
+
+type deviceClassClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewDeviceClassClusterInformer constructs a new informer for DeviceClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewDeviceClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredDeviceClassClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredDeviceClassClusterInformer constructs a new informer for DeviceClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredDeviceClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta1().DeviceClasses().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta1().DeviceClasses().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1beta1.DeviceClass{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *deviceClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredDeviceClassClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *deviceClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1beta1.DeviceClass{}, i.defaultInformer)
+}
+
+func (i *deviceClassClusterInformer) Lister() kcpv1beta1.DeviceClassClusterLister {
+	return kcpv1beta1.NewDeviceClassClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *deviceClassClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1beta1.DeviceClassInformer {
+	return &deviceClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *deviceClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1beta1.DeviceClassInformer {
+	return &deviceClassInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type deviceClassInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1beta1.DeviceClassLister
+}
+
+func (i *deviceClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *deviceClassInformer) Lister() listersresourcev1beta1.DeviceClassLister {
+	return i.lister
+}
diff --git a/informers/resource/v1alpha1/interface.go b/informers/resource/v1beta1/interface.go
similarity index 50%
rename from informers/resource/v1alpha1/interface.go
rename to informers/resource/v1beta1/interface.go
index de7a0820f..9766d4ba1 100644
--- a/informers/resource/v1alpha1/interface.go
+++ b/informers/resource/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,51 +14,51 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
-package v1alpha1
+package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// ResourceClaims returns a ResourceClaimClusterInformer
+	// DeviceClasses returns a DeviceClassClusterInformer.
+	DeviceClasses() DeviceClassClusterInformer
+	// ResourceClaims returns a ResourceClaimClusterInformer.
 	ResourceClaims() ResourceClaimClusterInformer
-	// PodSchedulings returns a PodSchedulingClusterInformer
-	PodSchedulings() PodSchedulingClusterInformer
-	// ResourceClasses returns a ResourceClassClusterInformer
-	ResourceClasses() ResourceClassClusterInformer
-	// ResourceClaimTemplates returns a ResourceClaimTemplateClusterInformer
+	// ResourceClaimTemplates returns a ResourceClaimTemplateClusterInformer.
 	ResourceClaimTemplates() ResourceClaimTemplateClusterInformer
+	// ResourceSlices returns a ResourceSliceClusterInformer.
+	ResourceSlices() ResourceSliceClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// ResourceClaims returns a ResourceClaimClusterInformer
-func (v *version) ResourceClaims() ResourceClaimClusterInformer {
-	return &resourceClaimClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// PodSchedulings returns a PodSchedulingClusterInformer
-func (v *version) PodSchedulings() PodSchedulingClusterInformer {
-	return &podSchedulingClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// DeviceClasses returns a DeviceClassClusterInformer.
+func (v *version) DeviceClasses() DeviceClassClusterInformer {
+	return &deviceClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceClasses returns a ResourceClassClusterInformer
-func (v *version) ResourceClasses() ResourceClassClusterInformer {
-	return &resourceClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// ResourceClaims returns a ResourceClaimClusterInformer.
+func (v *version) ResourceClaims() ResourceClaimClusterInformer {
+	return &resourceClaimClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// ResourceClaimTemplates returns a ResourceClaimTemplateClusterInformer
+// ResourceClaimTemplates returns a ResourceClaimTemplateClusterInformer.
 func (v *version) ResourceClaimTemplates() ResourceClaimTemplateClusterInformer {
 	return &resourceClaimTemplateClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// ResourceSlices returns a ResourceSliceClusterInformer.
+func (v *version) ResourceSlices() ResourceSliceClusterInformer {
+	return &resourceSliceClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/resource/v1beta1/resourceclaim.go b/informers/resource/v1beta1/resourceclaim.go
new file mode 100644
index 000000000..fa47be7dd
--- /dev/null
+++ b/informers/resource/v1beta1/resourceclaim.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1beta1 "k8s.io/api/resource/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1beta1 "k8s.io/client-go/informers/resource/v1beta1"
+	listersresourcev1beta1 "k8s.io/client-go/listers/resource/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/resource/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimClusterInformer provides access to a shared informer and lister for
+// ResourceClaims.
+type ResourceClaimClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1beta1.ResourceClaimInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1beta1.ResourceClaimInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta1.ResourceClaimClusterLister
+}
+
+type resourceClaimClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewResourceClaimClusterInformer constructs a new informer for ResourceClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewResourceClaimClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceClaimClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredResourceClaimClusterInformer constructs a new informer for ResourceClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredResourceClaimClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta1().ResourceClaims().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta1().ResourceClaims().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1beta1.ResourceClaim{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *resourceClaimClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceClaimClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *resourceClaimClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1beta1.ResourceClaim{}, i.defaultInformer)
+}
+
+func (i *resourceClaimClusterInformer) Lister() kcpv1beta1.ResourceClaimClusterLister {
+	return kcpv1beta1.NewResourceClaimClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *resourceClaimClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1beta1.ResourceClaimInformer {
+	return &resourceClaimInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *resourceClaimClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1beta1.ResourceClaimInformer {
+	return &resourceClaimInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type resourceClaimInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1beta1.ResourceClaimLister
+}
+
+func (i *resourceClaimInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *resourceClaimInformer) Lister() listersresourcev1beta1.ResourceClaimLister {
+	return i.lister
+}
diff --git a/informers/resource/v1beta1/resourceclaimtemplate.go b/informers/resource/v1beta1/resourceclaimtemplate.go
new file mode 100644
index 000000000..d0efad41b
--- /dev/null
+++ b/informers/resource/v1beta1/resourceclaimtemplate.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1beta1 "k8s.io/api/resource/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1beta1 "k8s.io/client-go/informers/resource/v1beta1"
+	listersresourcev1beta1 "k8s.io/client-go/listers/resource/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/resource/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimTemplateClusterInformer provides access to a shared informer and lister for
+// ResourceClaimTemplates.
+type ResourceClaimTemplateClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1beta1.ResourceClaimTemplateInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1beta1.ResourceClaimTemplateInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta1.ResourceClaimTemplateClusterLister
+}
+
+type resourceClaimTemplateClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewResourceClaimTemplateClusterInformer constructs a new informer for ResourceClaimTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewResourceClaimTemplateClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceClaimTemplateClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredResourceClaimTemplateClusterInformer constructs a new informer for ResourceClaimTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredResourceClaimTemplateClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta1().ResourceClaimTemplates().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta1().ResourceClaimTemplates().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1beta1.ResourceClaimTemplate{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *resourceClaimTemplateClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceClaimTemplateClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *resourceClaimTemplateClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1beta1.ResourceClaimTemplate{}, i.defaultInformer)
+}
+
+func (i *resourceClaimTemplateClusterInformer) Lister() kcpv1beta1.ResourceClaimTemplateClusterLister {
+	return kcpv1beta1.NewResourceClaimTemplateClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *resourceClaimTemplateClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1beta1.ResourceClaimTemplateInformer {
+	return &resourceClaimTemplateInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *resourceClaimTemplateClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1beta1.ResourceClaimTemplateInformer {
+	return &resourceClaimTemplateInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type resourceClaimTemplateInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1beta1.ResourceClaimTemplateLister
+}
+
+func (i *resourceClaimTemplateInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *resourceClaimTemplateInformer) Lister() listersresourcev1beta1.ResourceClaimTemplateLister {
+	return i.lister
+}
diff --git a/informers/resource/v1beta1/resourceslice.go b/informers/resource/v1beta1/resourceslice.go
new file mode 100644
index 000000000..8f063a5cd
--- /dev/null
+++ b/informers/resource/v1beta1/resourceslice.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1beta1 "k8s.io/api/resource/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1beta1 "k8s.io/client-go/informers/resource/v1beta1"
+	listersresourcev1beta1 "k8s.io/client-go/listers/resource/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/resource/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceSliceClusterInformer provides access to a shared informer and lister for
+// ResourceSlices.
+type ResourceSliceClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1beta1.ResourceSliceInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1beta1.ResourceSliceInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta1.ResourceSliceClusterLister
+}
+
+type resourceSliceClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewResourceSliceClusterInformer constructs a new informer for ResourceSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewResourceSliceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceSliceClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredResourceSliceClusterInformer constructs a new informer for ResourceSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredResourceSliceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta1().ResourceSlices().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta1().ResourceSlices().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1beta1.ResourceSlice{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *resourceSliceClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceSliceClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *resourceSliceClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1beta1.ResourceSlice{}, i.defaultInformer)
+}
+
+func (i *resourceSliceClusterInformer) Lister() kcpv1beta1.ResourceSliceClusterLister {
+	return kcpv1beta1.NewResourceSliceClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *resourceSliceClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1beta1.ResourceSliceInformer {
+	return &resourceSliceInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *resourceSliceClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1beta1.ResourceSliceInformer {
+	return &resourceSliceInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type resourceSliceInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1beta1.ResourceSliceLister
+}
+
+func (i *resourceSliceInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *resourceSliceInformer) Lister() listersresourcev1beta1.ResourceSliceLister {
+	return i.lister
+}
diff --git a/informers/resource/v1beta2/deviceclass.go b/informers/resource/v1beta2/deviceclass.go
new file mode 100644
index 000000000..0138eca87
--- /dev/null
+++ b/informers/resource/v1beta2/deviceclass.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1beta2 "k8s.io/api/resource/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1beta2 "k8s.io/client-go/informers/resource/v1beta2"
+	listersresourcev1beta2 "k8s.io/client-go/listers/resource/v1beta2"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta2 "github.com/kcp-dev/client-go/listers/resource/v1beta2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// DeviceClassClusterInformer provides access to a shared informer and lister for
+// DeviceClasses.
+type DeviceClassClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1beta2.DeviceClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1beta2.DeviceClassInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta2.DeviceClassClusterLister
+}
+
+type deviceClassClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewDeviceClassClusterInformer constructs a new informer for DeviceClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewDeviceClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredDeviceClassClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredDeviceClassClusterInformer constructs a new informer for DeviceClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredDeviceClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta2().DeviceClasses().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta2().DeviceClasses().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1beta2.DeviceClass{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *deviceClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredDeviceClassClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *deviceClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1beta2.DeviceClass{}, i.defaultInformer)
+}
+
+func (i *deviceClassClusterInformer) Lister() kcpv1beta2.DeviceClassClusterLister {
+	return kcpv1beta2.NewDeviceClassClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *deviceClassClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1beta2.DeviceClassInformer {
+	return &deviceClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *deviceClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1beta2.DeviceClassInformer {
+	return &deviceClassInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type deviceClassInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1beta2.DeviceClassLister
+}
+
+func (i *deviceClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *deviceClassInformer) Lister() listersresourcev1beta2.DeviceClassLister {
+	return i.lister
+}
diff --git a/informers/resource/v1beta2/interface.go b/informers/resource/v1beta2/interface.go
new file mode 100644
index 000000000..c400b7c4e
--- /dev/null
+++ b/informers/resource/v1beta2/interface.go
@@ -0,0 +1,64 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+)
+
+type ClusterInterface interface {
+	// DeviceClasses returns a DeviceClassClusterInformer.
+	DeviceClasses() DeviceClassClusterInformer
+	// ResourceClaims returns a ResourceClaimClusterInformer.
+	ResourceClaims() ResourceClaimClusterInformer
+	// ResourceClaimTemplates returns a ResourceClaimTemplateClusterInformer.
+	ResourceClaimTemplates() ResourceClaimTemplateClusterInformer
+	// ResourceSlices returns a ResourceSliceClusterInformer.
+	ResourceSlices() ResourceSliceClusterInformer
+}
+
+type version struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
+	return &version{factory: f, tweakListOptions: tweakListOptions}
+}
+
+// DeviceClasses returns a DeviceClassClusterInformer.
+func (v *version) DeviceClasses() DeviceClassClusterInformer {
+	return &deviceClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ResourceClaims returns a ResourceClaimClusterInformer.
+func (v *version) ResourceClaims() ResourceClaimClusterInformer {
+	return &resourceClaimClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ResourceClaimTemplates returns a ResourceClaimTemplateClusterInformer.
+func (v *version) ResourceClaimTemplates() ResourceClaimTemplateClusterInformer {
+	return &resourceClaimTemplateClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// ResourceSlices returns a ResourceSliceClusterInformer.
+func (v *version) ResourceSlices() ResourceSliceClusterInformer {
+	return &resourceSliceClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/resource/v1beta2/resourceclaim.go b/informers/resource/v1beta2/resourceclaim.go
new file mode 100644
index 000000000..9f379142e
--- /dev/null
+++ b/informers/resource/v1beta2/resourceclaim.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1beta2 "k8s.io/api/resource/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1beta2 "k8s.io/client-go/informers/resource/v1beta2"
+	listersresourcev1beta2 "k8s.io/client-go/listers/resource/v1beta2"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta2 "github.com/kcp-dev/client-go/listers/resource/v1beta2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimClusterInformer provides access to a shared informer and lister for
+// ResourceClaims.
+type ResourceClaimClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1beta2.ResourceClaimInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1beta2.ResourceClaimInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta2.ResourceClaimClusterLister
+}
+
+type resourceClaimClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewResourceClaimClusterInformer constructs a new informer for ResourceClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewResourceClaimClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceClaimClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredResourceClaimClusterInformer constructs a new informer for ResourceClaim type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredResourceClaimClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta2().ResourceClaims().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta2().ResourceClaims().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1beta2.ResourceClaim{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *resourceClaimClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceClaimClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *resourceClaimClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1beta2.ResourceClaim{}, i.defaultInformer)
+}
+
+func (i *resourceClaimClusterInformer) Lister() kcpv1beta2.ResourceClaimClusterLister {
+	return kcpv1beta2.NewResourceClaimClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *resourceClaimClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1beta2.ResourceClaimInformer {
+	return &resourceClaimInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *resourceClaimClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1beta2.ResourceClaimInformer {
+	return &resourceClaimInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type resourceClaimInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1beta2.ResourceClaimLister
+}
+
+func (i *resourceClaimInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *resourceClaimInformer) Lister() listersresourcev1beta2.ResourceClaimLister {
+	return i.lister
+}
diff --git a/informers/resource/v1beta2/resourceclaimtemplate.go b/informers/resource/v1beta2/resourceclaimtemplate.go
new file mode 100644
index 000000000..057228435
--- /dev/null
+++ b/informers/resource/v1beta2/resourceclaimtemplate.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1beta2 "k8s.io/api/resource/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1beta2 "k8s.io/client-go/informers/resource/v1beta2"
+	listersresourcev1beta2 "k8s.io/client-go/listers/resource/v1beta2"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta2 "github.com/kcp-dev/client-go/listers/resource/v1beta2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimTemplateClusterInformer provides access to a shared informer and lister for
+// ResourceClaimTemplates.
+type ResourceClaimTemplateClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1beta2.ResourceClaimTemplateInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1beta2.ResourceClaimTemplateInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta2.ResourceClaimTemplateClusterLister
+}
+
+type resourceClaimTemplateClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewResourceClaimTemplateClusterInformer constructs a new informer for ResourceClaimTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewResourceClaimTemplateClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceClaimTemplateClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredResourceClaimTemplateClusterInformer constructs a new informer for ResourceClaimTemplate type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredResourceClaimTemplateClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta2().ResourceClaimTemplates().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta2().ResourceClaimTemplates().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1beta2.ResourceClaimTemplate{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *resourceClaimTemplateClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceClaimTemplateClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *resourceClaimTemplateClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1beta2.ResourceClaimTemplate{}, i.defaultInformer)
+}
+
+func (i *resourceClaimTemplateClusterInformer) Lister() kcpv1beta2.ResourceClaimTemplateClusterLister {
+	return kcpv1beta2.NewResourceClaimTemplateClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *resourceClaimTemplateClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1beta2.ResourceClaimTemplateInformer {
+	return &resourceClaimTemplateInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *resourceClaimTemplateClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1beta2.ResourceClaimTemplateInformer {
+	return &resourceClaimTemplateInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type resourceClaimTemplateInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1beta2.ResourceClaimTemplateLister
+}
+
+func (i *resourceClaimTemplateInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *resourceClaimTemplateInformer) Lister() listersresourcev1beta2.ResourceClaimTemplateLister {
+	return i.lister
+}
diff --git a/informers/resource/v1beta2/resourceslice.go b/informers/resource/v1beta2/resourceslice.go
new file mode 100644
index 000000000..c53a86df7
--- /dev/null
+++ b/informers/resource/v1beta2/resourceslice.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	context "context"
+	time "time"
+
+	apiresourcev1beta2 "k8s.io/api/resource/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1beta2 "k8s.io/client-go/informers/resource/v1beta2"
+	listersresourcev1beta2 "k8s.io/client-go/listers/resource/v1beta2"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta2 "github.com/kcp-dev/client-go/listers/resource/v1beta2"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceSliceClusterInformer provides access to a shared informer and lister for
+// ResourceSlices.
+type ResourceSliceClusterInformer interface {
+	Cluster(logicalcluster.Name) resourcev1beta2.ResourceSliceInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) resourcev1beta2.ResourceSliceInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta2.ResourceSliceClusterLister
+}
+
+type resourceSliceClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewResourceSliceClusterInformer constructs a new informer for ResourceSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewResourceSliceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceSliceClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredResourceSliceClusterInformer constructs a new informer for ResourceSlice type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredResourceSliceClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta2().ResourceSlices().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.ResourceV1beta2().ResourceSlices().Watch(context.Background(), options)
+			},
+		},
+		&apiresourcev1beta2.ResourceSlice{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *resourceSliceClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredResourceSliceClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *resourceSliceClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apiresourcev1beta2.ResourceSlice{}, i.defaultInformer)
+}
+
+func (i *resourceSliceClusterInformer) Lister() kcpv1beta2.ResourceSliceClusterLister {
+	return kcpv1beta2.NewResourceSliceClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *resourceSliceClusterInformer) Cluster(clusterName logicalcluster.Name) resourcev1beta2.ResourceSliceInformer {
+	return &resourceSliceInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *resourceSliceClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) resourcev1beta2.ResourceSliceInformer {
+	return &resourceSliceInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type resourceSliceInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersresourcev1beta2.ResourceSliceLister
+}
+
+func (i *resourceSliceInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *resourceSliceInformer) Lister() listersresourcev1beta2.ResourceSliceLister {
+	return i.lister
+}
diff --git a/informers/scheduling/interface.go b/informers/scheduling/interface.go
index 41512e1f3..febcf3f2d 100644
--- a/informers/scheduling/interface.go
+++ b/informers/scheduling/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,47 +14,48 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package scheduling
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	"github.com/kcp-dev/client-go/informers/scheduling/v1"
-	"github.com/kcp-dev/client-go/informers/scheduling/v1alpha1"
-	"github.com/kcp-dev/client-go/informers/scheduling/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/scheduling/v1"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/informers/scheduling/v1alpha1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/scheduling/v1beta1"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1alpha1 provides access to the shared informers in V1alpha1.
-	V1alpha1() v1alpha1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() kcpv1alpha1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V1alpha1 returns a new v1alpha1.ClusterInterface.
-func (g *group) V1alpha1() v1alpha1.ClusterInterface {
-	return v1alpha1.New(g.factory, g.tweakListOptions)
+// V1alpha1 returns a new kcpv1alpha1.ClusterInterface.
+func (g *group) V1alpha1() kcpv1alpha1.ClusterInterface {
+	return kcpv1alpha1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/scheduling/v1/interface.go b/informers/scheduling/v1/interface.go
index 6b6562e0b..5cba2c63e 100644
--- a/informers/scheduling/v1/interface.go
+++ b/informers/scheduling/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// PriorityClasses returns a PriorityClassClusterInformer
+	// PriorityClasses returns a PriorityClassClusterInformer.
 	PriorityClasses() PriorityClassClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// PriorityClasses returns a PriorityClassClusterInformer
+// PriorityClasses returns a PriorityClassClusterInformer.
 func (v *version) PriorityClasses() PriorityClassClusterInformer {
 	return &priorityClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/scheduling/v1/priorityclass.go b/informers/scheduling/v1/priorityclass.go
index 7de0146ec..7989d40fb 100644
--- a/informers/scheduling/v1/priorityclass.go
+++ b/informers/scheduling/v1/priorityclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apischedulingv1 "k8s.io/api/scheduling/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	schedulingv1 "k8s.io/client-go/informers/scheduling/v1"
+	listersschedulingv1 "k8s.io/client-go/listers/scheduling/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	schedulingv1 "k8s.io/api/scheduling/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamschedulingv1informers "k8s.io/client-go/informers/scheduling/v1"
-	upstreamschedulingv1listers "k8s.io/client-go/listers/scheduling/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	schedulingv1listers "github.com/kcp-dev/client-go/listers/scheduling/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/scheduling/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PriorityClassClusterInformer provides access to a shared informer and lister for
 // PriorityClasses.
 type PriorityClassClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamschedulingv1informers.PriorityClassInformer
+	Cluster(logicalcluster.Name) schedulingv1.PriorityClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) schedulingv1.PriorityClassInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() schedulingv1listers.PriorityClassClusterLister
+	Lister() kcpv1.PriorityClassClusterLister
 }
 
 type priorityClassClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewPriorityClassClusterInformer constructs a new informer for PriorityClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPriorityClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewPriorityClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPriorityClassClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredPriorityClassClusterInformer constructs a new informer for PriorityClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPriorityClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredPriorityClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.SchedulingV1().PriorityClasses().List(context.TODO(), options)
+				return client.SchedulingV1().PriorityClasses().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.SchedulingV1().PriorityClasses().Watch(context.TODO(), options)
+				return client.SchedulingV1().PriorityClasses().Watch(context.Background(), options)
 			},
 		},
-		&schedulingv1.PriorityClass{},
+		&apischedulingv1.PriorityClass{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *priorityClassClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *priorityClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPriorityClassClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *priorityClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apischedulingv1.PriorityClass{}, i.defaultInformer)
 }
 
-func (f *priorityClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&schedulingv1.PriorityClass{}, f.defaultInformer)
+func (i *priorityClassClusterInformer) Lister() kcpv1.PriorityClassClusterLister {
+	return kcpv1.NewPriorityClassClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *priorityClassClusterInformer) Lister() schedulingv1listers.PriorityClassClusterLister {
-	return schedulingv1listers.NewPriorityClassClusterLister(f.Informer().GetIndexer())
+func (i *priorityClassClusterInformer) Cluster(clusterName logicalcluster.Name) schedulingv1.PriorityClassInformer {
+	return &priorityClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *priorityClassClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamschedulingv1informers.PriorityClassInformer {
+func (i *priorityClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) schedulingv1.PriorityClassInformer {
 	return &priorityClassInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type priorityClassInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamschedulingv1listers.PriorityClassLister
+	lister   listersschedulingv1.PriorityClassLister
 }
 
-func (f *priorityClassInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *priorityClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *priorityClassInformer) Lister() upstreamschedulingv1listers.PriorityClassLister {
-	return f.lister
+func (i *priorityClassInformer) Lister() listersschedulingv1.PriorityClassLister {
+	return i.lister
 }
diff --git a/informers/scheduling/v1alpha1/interface.go b/informers/scheduling/v1alpha1/interface.go
index 84f2e4327..d77bc7fab 100644
--- a/informers/scheduling/v1alpha1/interface.go
+++ b/informers/scheduling/v1alpha1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// PriorityClasses returns a PriorityClassClusterInformer
+	// PriorityClasses returns a PriorityClassClusterInformer.
 	PriorityClasses() PriorityClassClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// PriorityClasses returns a PriorityClassClusterInformer
+// PriorityClasses returns a PriorityClassClusterInformer.
 func (v *version) PriorityClasses() PriorityClassClusterInformer {
 	return &priorityClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/scheduling/v1alpha1/priorityclass.go b/informers/scheduling/v1alpha1/priorityclass.go
index 5ddcb20eb..a3f635655 100644
--- a/informers/scheduling/v1alpha1/priorityclass.go
+++ b/informers/scheduling/v1alpha1/priorityclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apischedulingv1alpha1 "k8s.io/api/scheduling/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	schedulingv1alpha1 "k8s.io/client-go/informers/scheduling/v1alpha1"
+	listersschedulingv1alpha1 "k8s.io/client-go/listers/scheduling/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	schedulingv1alpha1 "k8s.io/api/scheduling/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamschedulingv1alpha1informers "k8s.io/client-go/informers/scheduling/v1alpha1"
-	upstreamschedulingv1alpha1listers "k8s.io/client-go/listers/scheduling/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	schedulingv1alpha1listers "github.com/kcp-dev/client-go/listers/scheduling/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/scheduling/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PriorityClassClusterInformer provides access to a shared informer and lister for
 // PriorityClasses.
 type PriorityClassClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamschedulingv1alpha1informers.PriorityClassInformer
+	Cluster(logicalcluster.Name) schedulingv1alpha1.PriorityClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) schedulingv1alpha1.PriorityClassInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() schedulingv1alpha1listers.PriorityClassClusterLister
+	Lister() kcpv1alpha1.PriorityClassClusterLister
 }
 
 type priorityClassClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewPriorityClassClusterInformer constructs a new informer for PriorityClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPriorityClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewPriorityClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPriorityClassClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredPriorityClassClusterInformer constructs a new informer for PriorityClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPriorityClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredPriorityClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.SchedulingV1alpha1().PriorityClasses().List(context.TODO(), options)
+				return client.SchedulingV1alpha1().PriorityClasses().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.SchedulingV1alpha1().PriorityClasses().Watch(context.TODO(), options)
+				return client.SchedulingV1alpha1().PriorityClasses().Watch(context.Background(), options)
 			},
 		},
-		&schedulingv1alpha1.PriorityClass{},
+		&apischedulingv1alpha1.PriorityClass{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *priorityClassClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *priorityClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPriorityClassClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *priorityClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&schedulingv1alpha1.PriorityClass{}, f.defaultInformer)
+func (i *priorityClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apischedulingv1alpha1.PriorityClass{}, i.defaultInformer)
 }
 
-func (f *priorityClassClusterInformer) Lister() schedulingv1alpha1listers.PriorityClassClusterLister {
-	return schedulingv1alpha1listers.NewPriorityClassClusterLister(f.Informer().GetIndexer())
+func (i *priorityClassClusterInformer) Lister() kcpv1alpha1.PriorityClassClusterLister {
+	return kcpv1alpha1.NewPriorityClassClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *priorityClassClusterInformer) Cluster(clusterName logicalcluster.Name) schedulingv1alpha1.PriorityClassInformer {
+	return &priorityClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *priorityClassClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamschedulingv1alpha1informers.PriorityClassInformer {
+func (i *priorityClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) schedulingv1alpha1.PriorityClassInformer {
 	return &priorityClassInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type priorityClassInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamschedulingv1alpha1listers.PriorityClassLister
+	lister   listersschedulingv1alpha1.PriorityClassLister
 }
 
-func (f *priorityClassInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *priorityClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *priorityClassInformer) Lister() upstreamschedulingv1alpha1listers.PriorityClassLister {
-	return f.lister
+func (i *priorityClassInformer) Lister() listersschedulingv1alpha1.PriorityClassLister {
+	return i.lister
 }
diff --git a/informers/scheduling/v1beta1/interface.go b/informers/scheduling/v1beta1/interface.go
index 016a73403..9de5dce35 100644
--- a/informers/scheduling/v1beta1/interface.go
+++ b/informers/scheduling/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,30 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// PriorityClasses returns a PriorityClassClusterInformer
+	// PriorityClasses returns a PriorityClassClusterInformer.
 	PriorityClasses() PriorityClassClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// PriorityClasses returns a PriorityClassClusterInformer
+// PriorityClasses returns a PriorityClassClusterInformer.
 func (v *version) PriorityClasses() PriorityClassClusterInformer {
 	return &priorityClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/scheduling/v1beta1/priorityclass.go b/informers/scheduling/v1beta1/priorityclass.go
index e9388b32d..0e7eb5803 100644
--- a/informers/scheduling/v1beta1/priorityclass.go
+++ b/informers/scheduling/v1beta1/priorityclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apischedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	schedulingv1beta1 "k8s.io/client-go/informers/scheduling/v1beta1"
+	listersschedulingv1beta1 "k8s.io/client-go/listers/scheduling/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamschedulingv1beta1informers "k8s.io/client-go/informers/scheduling/v1beta1"
-	upstreamschedulingv1beta1listers "k8s.io/client-go/listers/scheduling/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	schedulingv1beta1listers "github.com/kcp-dev/client-go/listers/scheduling/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/scheduling/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PriorityClassClusterInformer provides access to a shared informer and lister for
 // PriorityClasses.
 type PriorityClassClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamschedulingv1beta1informers.PriorityClassInformer
+	Cluster(logicalcluster.Name) schedulingv1beta1.PriorityClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) schedulingv1beta1.PriorityClassInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() schedulingv1beta1listers.PriorityClassClusterLister
+	Lister() kcpv1beta1.PriorityClassClusterLister
 }
 
 type priorityClassClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewPriorityClassClusterInformer constructs a new informer for PriorityClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPriorityClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewPriorityClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPriorityClassClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredPriorityClassClusterInformer constructs a new informer for PriorityClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPriorityClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredPriorityClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.SchedulingV1beta1().PriorityClasses().List(context.TODO(), options)
+				return client.SchedulingV1beta1().PriorityClasses().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.SchedulingV1beta1().PriorityClasses().Watch(context.TODO(), options)
+				return client.SchedulingV1beta1().PriorityClasses().Watch(context.Background(), options)
 			},
 		},
-		&schedulingv1beta1.PriorityClass{},
+		&apischedulingv1beta1.PriorityClass{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *priorityClassClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *priorityClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredPriorityClassClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *priorityClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&schedulingv1beta1.PriorityClass{}, f.defaultInformer)
+func (i *priorityClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apischedulingv1beta1.PriorityClass{}, i.defaultInformer)
 }
 
-func (f *priorityClassClusterInformer) Lister() schedulingv1beta1listers.PriorityClassClusterLister {
-	return schedulingv1beta1listers.NewPriorityClassClusterLister(f.Informer().GetIndexer())
+func (i *priorityClassClusterInformer) Lister() kcpv1beta1.PriorityClassClusterLister {
+	return kcpv1beta1.NewPriorityClassClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *priorityClassClusterInformer) Cluster(clusterName logicalcluster.Name) schedulingv1beta1.PriorityClassInformer {
+	return &priorityClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *priorityClassClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamschedulingv1beta1informers.PriorityClassInformer {
+func (i *priorityClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) schedulingv1beta1.PriorityClassInformer {
 	return &priorityClassInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type priorityClassInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamschedulingv1beta1listers.PriorityClassLister
+	lister   listersschedulingv1beta1.PriorityClassLister
 }
 
-func (f *priorityClassInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *priorityClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *priorityClassInformer) Lister() upstreamschedulingv1beta1listers.PriorityClassLister {
-	return f.lister
+func (i *priorityClassInformer) Lister() listersschedulingv1beta1.PriorityClassLister {
+	return i.lister
 }
diff --git a/informers/storage/interface.go b/informers/storage/interface.go
index 164cc9a2a..c9bc8271f 100644
--- a/informers/storage/interface.go
+++ b/informers/storage/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,47 +14,48 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package storage
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	"github.com/kcp-dev/client-go/informers/storage/v1"
-	"github.com/kcp-dev/client-go/informers/storage/v1alpha1"
-	"github.com/kcp-dev/client-go/informers/storage/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1 "github.com/kcp-dev/client-go/informers/storage/v1"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/informers/storage/v1alpha1"
+	kcpv1beta1 "github.com/kcp-dev/client-go/informers/storage/v1beta1"
 )
 
+// ClusterInterface provides access to each of this group's versions.
 type ClusterInterface interface {
-	// V1 provides access to the shared informers in V1.
-	V1() v1.ClusterInterface
-	// V1alpha1 provides access to the shared informers in V1alpha1.
-	V1alpha1() v1alpha1.ClusterInterface
-	// V1beta1 provides access to the shared informers in V1beta1.
-	V1beta1() v1beta1.ClusterInterface
+	// V1 provides access to shared informers for resources in V1.
+	V1() kcpv1.ClusterInterface
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() kcpv1alpha1.ClusterInterface
+	// V1beta1 provides access to shared informers for resources in V1beta1.
+	V1beta1() kcpv1beta1.ClusterInterface
 }
 
 type group struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &group{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// V1 returns a new v1.ClusterInterface.
-func (g *group) V1() v1.ClusterInterface {
-	return v1.New(g.factory, g.tweakListOptions)
+// V1 returns a new kcpv1.ClusterInterface.
+func (g *group) V1() kcpv1.ClusterInterface {
+	return kcpv1.New(g.factory, g.tweakListOptions)
 }
 
-// V1alpha1 returns a new v1alpha1.ClusterInterface.
-func (g *group) V1alpha1() v1alpha1.ClusterInterface {
-	return v1alpha1.New(g.factory, g.tweakListOptions)
+// V1alpha1 returns a new kcpv1alpha1.ClusterInterface.
+func (g *group) V1alpha1() kcpv1alpha1.ClusterInterface {
+	return kcpv1alpha1.New(g.factory, g.tweakListOptions)
 }
 
-// V1beta1 returns a new v1beta1.ClusterInterface.
-func (g *group) V1beta1() v1beta1.ClusterInterface {
-	return v1beta1.New(g.factory, g.tweakListOptions)
+// V1beta1 returns a new kcpv1beta1.ClusterInterface.
+func (g *group) V1beta1() kcpv1beta1.ClusterInterface {
+	return kcpv1beta1.New(g.factory, g.tweakListOptions)
 }
diff --git a/informers/storage/v1/csidriver.go b/informers/storage/v1/csidriver.go
index 7a6b485f2..11b4024db 100644
--- a/informers/storage/v1/csidriver.go
+++ b/informers/storage/v1/csidriver.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apistoragev1 "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1 "k8s.io/client-go/informers/storage/v1"
+	listersstoragev1 "k8s.io/client-go/listers/storage/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamstoragev1informers "k8s.io/client-go/informers/storage/v1"
-	upstreamstoragev1listers "k8s.io/client-go/listers/storage/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	storagev1listers "github.com/kcp-dev/client-go/listers/storage/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/storage/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CSIDriverClusterInformer provides access to a shared informer and lister for
 // CSIDrivers.
 type CSIDriverClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamstoragev1informers.CSIDriverInformer
+	Cluster(logicalcluster.Name) storagev1.CSIDriverInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1.CSIDriverInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() storagev1listers.CSIDriverClusterLister
+	Lister() kcpv1.CSIDriverClusterLister
 }
 
 type cSIDriverClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewCSIDriverClusterInformer constructs a new informer for CSIDriver type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewCSIDriverClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewCSIDriverClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSIDriverClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredCSIDriverClusterInformer constructs a new informer for CSIDriver type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredCSIDriverClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredCSIDriverClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1().CSIDrivers().List(context.TODO(), options)
+				return client.StorageV1().CSIDrivers().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1().CSIDrivers().Watch(context.TODO(), options)
+				return client.StorageV1().CSIDrivers().Watch(context.Background(), options)
 			},
 		},
-		&storagev1.CSIDriver{},
+		&apistoragev1.CSIDriver{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *cSIDriverClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *cSIDriverClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSIDriverClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *cSIDriverClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1.CSIDriver{}, i.defaultInformer)
 }
 
-func (f *cSIDriverClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&storagev1.CSIDriver{}, f.defaultInformer)
+func (i *cSIDriverClusterInformer) Lister() kcpv1.CSIDriverClusterLister {
+	return kcpv1.NewCSIDriverClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *cSIDriverClusterInformer) Lister() storagev1listers.CSIDriverClusterLister {
-	return storagev1listers.NewCSIDriverClusterLister(f.Informer().GetIndexer())
+func (i *cSIDriverClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1.CSIDriverInformer {
+	return &cSIDriverInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *cSIDriverClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamstoragev1informers.CSIDriverInformer {
+func (i *cSIDriverClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1.CSIDriverInformer {
 	return &cSIDriverInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type cSIDriverInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamstoragev1listers.CSIDriverLister
+	lister   listersstoragev1.CSIDriverLister
 }
 
-func (f *cSIDriverInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *cSIDriverInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *cSIDriverInformer) Lister() upstreamstoragev1listers.CSIDriverLister {
-	return f.lister
+func (i *cSIDriverInformer) Lister() listersstoragev1.CSIDriverLister {
+	return i.lister
 }
diff --git a/informers/storage/v1/csinode.go b/informers/storage/v1/csinode.go
index 264002fcb..f5a9d0929 100644
--- a/informers/storage/v1/csinode.go
+++ b/informers/storage/v1/csinode.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apistoragev1 "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1 "k8s.io/client-go/informers/storage/v1"
+	listersstoragev1 "k8s.io/client-go/listers/storage/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamstoragev1informers "k8s.io/client-go/informers/storage/v1"
-	upstreamstoragev1listers "k8s.io/client-go/listers/storage/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	storagev1listers "github.com/kcp-dev/client-go/listers/storage/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/storage/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CSINodeClusterInformer provides access to a shared informer and lister for
 // CSINodes.
 type CSINodeClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamstoragev1informers.CSINodeInformer
+	Cluster(logicalcluster.Name) storagev1.CSINodeInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1.CSINodeInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() storagev1listers.CSINodeClusterLister
+	Lister() kcpv1.CSINodeClusterLister
 }
 
 type cSINodeClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewCSINodeClusterInformer constructs a new informer for CSINode type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewCSINodeClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewCSINodeClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSINodeClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredCSINodeClusterInformer constructs a new informer for CSINode type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredCSINodeClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredCSINodeClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1().CSINodes().List(context.TODO(), options)
+				return client.StorageV1().CSINodes().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1().CSINodes().Watch(context.TODO(), options)
+				return client.StorageV1().CSINodes().Watch(context.Background(), options)
 			},
 		},
-		&storagev1.CSINode{},
+		&apistoragev1.CSINode{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *cSINodeClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *cSINodeClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSINodeClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *cSINodeClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1.CSINode{}, i.defaultInformer)
 }
 
-func (f *cSINodeClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&storagev1.CSINode{}, f.defaultInformer)
+func (i *cSINodeClusterInformer) Lister() kcpv1.CSINodeClusterLister {
+	return kcpv1.NewCSINodeClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *cSINodeClusterInformer) Lister() storagev1listers.CSINodeClusterLister {
-	return storagev1listers.NewCSINodeClusterLister(f.Informer().GetIndexer())
+func (i *cSINodeClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1.CSINodeInformer {
+	return &cSINodeInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *cSINodeClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamstoragev1informers.CSINodeInformer {
+func (i *cSINodeClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1.CSINodeInformer {
 	return &cSINodeInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type cSINodeInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamstoragev1listers.CSINodeLister
+	lister   listersstoragev1.CSINodeLister
 }
 
-func (f *cSINodeInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *cSINodeInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *cSINodeInformer) Lister() upstreamstoragev1listers.CSINodeLister {
-	return f.lister
+func (i *cSINodeInformer) Lister() listersstoragev1.CSINodeLister {
+	return i.lister
 }
diff --git a/informers/storage/v1/csistoragecapacity.go b/informers/storage/v1/csistoragecapacity.go
index 7e0d19620..d6ff7dbdc 100644
--- a/informers/storage/v1/csistoragecapacity.go
+++ b/informers/storage/v1/csistoragecapacity.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apistoragev1 "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1 "k8s.io/client-go/informers/storage/v1"
+	listersstoragev1 "k8s.io/client-go/listers/storage/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamstoragev1informers "k8s.io/client-go/informers/storage/v1"
-	upstreamstoragev1listers "k8s.io/client-go/listers/storage/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	storagev1listers "github.com/kcp-dev/client-go/listers/storage/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/storage/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CSIStorageCapacityClusterInformer provides access to a shared informer and lister for
 // CSIStorageCapacities.
 type CSIStorageCapacityClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamstoragev1informers.CSIStorageCapacityInformer
+	Cluster(logicalcluster.Name) storagev1.CSIStorageCapacityInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1.CSIStorageCapacityInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() storagev1listers.CSIStorageCapacityClusterLister
+	Lister() kcpv1.CSIStorageCapacityClusterLister
 }
 
 type cSIStorageCapacityClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewCSIStorageCapacityClusterInformer constructs a new informer for CSIStorageCapacity type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewCSIStorageCapacityClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewCSIStorageCapacityClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSIStorageCapacityClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredCSIStorageCapacityClusterInformer constructs a new informer for CSIStorageCapacity type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredCSIStorageCapacityClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredCSIStorageCapacityClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1().CSIStorageCapacities().List(context.TODO(), options)
+				return client.StorageV1().CSIStorageCapacities().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1().CSIStorageCapacities().Watch(context.TODO(), options)
+				return client.StorageV1().CSIStorageCapacities().Watch(context.Background(), options)
 			},
 		},
-		&storagev1.CSIStorageCapacity{},
+		&apistoragev1.CSIStorageCapacity{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *cSIStorageCapacityClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *cSIStorageCapacityClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSIStorageCapacityClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *cSIStorageCapacityClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1.CSIStorageCapacity{}, i.defaultInformer)
 }
 
-func (f *cSIStorageCapacityClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&storagev1.CSIStorageCapacity{}, f.defaultInformer)
+func (i *cSIStorageCapacityClusterInformer) Lister() kcpv1.CSIStorageCapacityClusterLister {
+	return kcpv1.NewCSIStorageCapacityClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *cSIStorageCapacityClusterInformer) Lister() storagev1listers.CSIStorageCapacityClusterLister {
-	return storagev1listers.NewCSIStorageCapacityClusterLister(f.Informer().GetIndexer())
+func (i *cSIStorageCapacityClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1.CSIStorageCapacityInformer {
+	return &cSIStorageCapacityInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *cSIStorageCapacityClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamstoragev1informers.CSIStorageCapacityInformer {
+func (i *cSIStorageCapacityClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1.CSIStorageCapacityInformer {
 	return &cSIStorageCapacityInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type cSIStorageCapacityInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamstoragev1listers.CSIStorageCapacityLister
+	lister   listersstoragev1.CSIStorageCapacityLister
 }
 
-func (f *cSIStorageCapacityInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *cSIStorageCapacityInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *cSIStorageCapacityInformer) Lister() upstreamstoragev1listers.CSIStorageCapacityLister {
-	return f.lister
+func (i *cSIStorageCapacityInformer) Lister() listersstoragev1.CSIStorageCapacityLister {
+	return i.lister
 }
diff --git a/informers/storage/v1/interface.go b/informers/storage/v1/interface.go
index 866ad7a5c..a64dffb37 100644
--- a/informers/storage/v1/interface.go
+++ b/informers/storage/v1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,58 +14,58 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// StorageClasses returns a StorageClassClusterInformer
-	StorageClasses() StorageClassClusterInformer
-	// VolumeAttachments returns a VolumeAttachmentClusterInformer
-	VolumeAttachments() VolumeAttachmentClusterInformer
-	// CSIDrivers returns a CSIDriverClusterInformer
+	// CSIDrivers returns a CSIDriverClusterInformer.
 	CSIDrivers() CSIDriverClusterInformer
-	// CSINodes returns a CSINodeClusterInformer
+	// CSINodes returns a CSINodeClusterInformer.
 	CSINodes() CSINodeClusterInformer
-	// CSIStorageCapacities returns a CSIStorageCapacityClusterInformer
+	// CSIStorageCapacities returns a CSIStorageCapacityClusterInformer.
 	CSIStorageCapacities() CSIStorageCapacityClusterInformer
+	// StorageClasses returns a StorageClassClusterInformer.
+	StorageClasses() StorageClassClusterInformer
+	// VolumeAttachments returns a VolumeAttachmentClusterInformer.
+	VolumeAttachments() VolumeAttachmentClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// StorageClasses returns a StorageClassClusterInformer
-func (v *version) StorageClasses() StorageClassClusterInformer {
-	return &storageClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// VolumeAttachments returns a VolumeAttachmentClusterInformer
-func (v *version) VolumeAttachments() VolumeAttachmentClusterInformer {
-	return &volumeAttachmentClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// CSIDrivers returns a CSIDriverClusterInformer
+// CSIDrivers returns a CSIDriverClusterInformer.
 func (v *version) CSIDrivers() CSIDriverClusterInformer {
 	return &cSIDriverClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// CSINodes returns a CSINodeClusterInformer
+// CSINodes returns a CSINodeClusterInformer.
 func (v *version) CSINodes() CSINodeClusterInformer {
 	return &cSINodeClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// CSIStorageCapacities returns a CSIStorageCapacityClusterInformer
+// CSIStorageCapacities returns a CSIStorageCapacityClusterInformer.
 func (v *version) CSIStorageCapacities() CSIStorageCapacityClusterInformer {
 	return &cSIStorageCapacityClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// StorageClasses returns a StorageClassClusterInformer.
+func (v *version) StorageClasses() StorageClassClusterInformer {
+	return &storageClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// VolumeAttachments returns a VolumeAttachmentClusterInformer.
+func (v *version) VolumeAttachments() VolumeAttachmentClusterInformer {
+	return &volumeAttachmentClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/storage/v1/storageclass.go b/informers/storage/v1/storageclass.go
index 3da07fe27..4f279795d 100644
--- a/informers/storage/v1/storageclass.go
+++ b/informers/storage/v1/storageclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apistoragev1 "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1 "k8s.io/client-go/informers/storage/v1"
+	listersstoragev1 "k8s.io/client-go/listers/storage/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamstoragev1informers "k8s.io/client-go/informers/storage/v1"
-	upstreamstoragev1listers "k8s.io/client-go/listers/storage/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	storagev1listers "github.com/kcp-dev/client-go/listers/storage/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/storage/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // StorageClassClusterInformer provides access to a shared informer and lister for
 // StorageClasses.
 type StorageClassClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamstoragev1informers.StorageClassInformer
+	Cluster(logicalcluster.Name) storagev1.StorageClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1.StorageClassInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() storagev1listers.StorageClassClusterLister
+	Lister() kcpv1.StorageClassClusterLister
 }
 
 type storageClassClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewStorageClassClusterInformer constructs a new informer for StorageClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewStorageClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewStorageClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredStorageClassClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredStorageClassClusterInformer constructs a new informer for StorageClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredStorageClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredStorageClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1().StorageClasses().List(context.TODO(), options)
+				return client.StorageV1().StorageClasses().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1().StorageClasses().Watch(context.TODO(), options)
+				return client.StorageV1().StorageClasses().Watch(context.Background(), options)
 			},
 		},
-		&storagev1.StorageClass{},
+		&apistoragev1.StorageClass{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *storageClassClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *storageClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredStorageClassClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *storageClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1.StorageClass{}, i.defaultInformer)
 }
 
-func (f *storageClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&storagev1.StorageClass{}, f.defaultInformer)
+func (i *storageClassClusterInformer) Lister() kcpv1.StorageClassClusterLister {
+	return kcpv1.NewStorageClassClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *storageClassClusterInformer) Lister() storagev1listers.StorageClassClusterLister {
-	return storagev1listers.NewStorageClassClusterLister(f.Informer().GetIndexer())
+func (i *storageClassClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1.StorageClassInformer {
+	return &storageClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *storageClassClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamstoragev1informers.StorageClassInformer {
+func (i *storageClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1.StorageClassInformer {
 	return &storageClassInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type storageClassInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamstoragev1listers.StorageClassLister
+	lister   listersstoragev1.StorageClassLister
 }
 
-func (f *storageClassInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *storageClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *storageClassInformer) Lister() upstreamstoragev1listers.StorageClassLister {
-	return f.lister
+func (i *storageClassInformer) Lister() listersstoragev1.StorageClassLister {
+	return i.lister
 }
diff --git a/informers/storage/v1/volumeattachment.go b/informers/storage/v1/volumeattachment.go
index 5cd69405f..a02b1182b 100644
--- a/informers/storage/v1/volumeattachment.go
+++ b/informers/storage/v1/volumeattachment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apistoragev1 "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1 "k8s.io/client-go/informers/storage/v1"
+	listersstoragev1 "k8s.io/client-go/listers/storage/v1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamstoragev1informers "k8s.io/client-go/informers/storage/v1"
-	upstreamstoragev1listers "k8s.io/client-go/listers/storage/v1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	storagev1listers "github.com/kcp-dev/client-go/listers/storage/v1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1 "github.com/kcp-dev/client-go/listers/storage/v1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // VolumeAttachmentClusterInformer provides access to a shared informer and lister for
 // VolumeAttachments.
 type VolumeAttachmentClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamstoragev1informers.VolumeAttachmentInformer
+	Cluster(logicalcluster.Name) storagev1.VolumeAttachmentInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1.VolumeAttachmentInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() storagev1listers.VolumeAttachmentClusterLister
+	Lister() kcpv1.VolumeAttachmentClusterLister
 }
 
 type volumeAttachmentClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewVolumeAttachmentClusterInformer constructs a new informer for VolumeAttachment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewVolumeAttachmentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewVolumeAttachmentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredVolumeAttachmentClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredVolumeAttachmentClusterInformer constructs a new informer for VolumeAttachment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredVolumeAttachmentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredVolumeAttachmentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1().VolumeAttachments().List(context.TODO(), options)
+				return client.StorageV1().VolumeAttachments().List(context.Background(), options)
 			},
 			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1().VolumeAttachments().Watch(context.TODO(), options)
+				return client.StorageV1().VolumeAttachments().Watch(context.Background(), options)
 			},
 		},
-		&storagev1.VolumeAttachment{},
+		&apistoragev1.VolumeAttachment{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *volumeAttachmentClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *volumeAttachmentClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredVolumeAttachmentClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *volumeAttachmentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1.VolumeAttachment{}, i.defaultInformer)
 }
 
-func (f *volumeAttachmentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&storagev1.VolumeAttachment{}, f.defaultInformer)
+func (i *volumeAttachmentClusterInformer) Lister() kcpv1.VolumeAttachmentClusterLister {
+	return kcpv1.NewVolumeAttachmentClusterLister(i.Informer().GetIndexer())
 }
 
-func (f *volumeAttachmentClusterInformer) Lister() storagev1listers.VolumeAttachmentClusterLister {
-	return storagev1listers.NewVolumeAttachmentClusterLister(f.Informer().GetIndexer())
+func (i *volumeAttachmentClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1.VolumeAttachmentInformer {
+	return &volumeAttachmentInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *volumeAttachmentClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamstoragev1informers.VolumeAttachmentInformer {
+func (i *volumeAttachmentClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1.VolumeAttachmentInformer {
 	return &volumeAttachmentInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type volumeAttachmentInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamstoragev1listers.VolumeAttachmentLister
+	lister   listersstoragev1.VolumeAttachmentLister
 }
 
-func (f *volumeAttachmentInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *volumeAttachmentInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *volumeAttachmentInformer) Lister() upstreamstoragev1listers.VolumeAttachmentLister {
-	return f.lister
+func (i *volumeAttachmentInformer) Lister() listersstoragev1.VolumeAttachmentLister {
+	return i.lister
 }
diff --git a/informers/storage/v1alpha1/csistoragecapacity.go b/informers/storage/v1alpha1/csistoragecapacity.go
index 7b75a461b..753fbbb7f 100644
--- a/informers/storage/v1alpha1/csistoragecapacity.go
+++ b/informers/storage/v1alpha1/csistoragecapacity.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apistoragev1alpha1 "k8s.io/api/storage/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1alpha1 "k8s.io/client-go/informers/storage/v1alpha1"
+	listersstoragev1alpha1 "k8s.io/client-go/listers/storage/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamstoragev1alpha1informers "k8s.io/client-go/informers/storage/v1alpha1"
-	upstreamstoragev1alpha1listers "k8s.io/client-go/listers/storage/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	storagev1alpha1listers "github.com/kcp-dev/client-go/listers/storage/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/storage/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CSIStorageCapacityClusterInformer provides access to a shared informer and lister for
 // CSIStorageCapacities.
 type CSIStorageCapacityClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamstoragev1alpha1informers.CSIStorageCapacityInformer
+	Cluster(logicalcluster.Name) storagev1alpha1.CSIStorageCapacityInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1alpha1.CSIStorageCapacityInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() storagev1alpha1listers.CSIStorageCapacityClusterLister
+	Lister() kcpv1alpha1.CSIStorageCapacityClusterLister
 }
 
 type cSIStorageCapacityClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewCSIStorageCapacityClusterInformer constructs a new informer for CSIStorageCapacity type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewCSIStorageCapacityClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewCSIStorageCapacityClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSIStorageCapacityClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredCSIStorageCapacityClusterInformer constructs a new informer for CSIStorageCapacity type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredCSIStorageCapacityClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredCSIStorageCapacityClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1alpha1().CSIStorageCapacities().List(context.TODO(), options)
+				return client.StorageV1alpha1().CSIStorageCapacities().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1alpha1().CSIStorageCapacities().Watch(context.TODO(), options)
+				return client.StorageV1alpha1().CSIStorageCapacities().Watch(context.Background(), options)
 			},
 		},
-		&storagev1alpha1.CSIStorageCapacity{},
+		&apistoragev1alpha1.CSIStorageCapacity{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *cSIStorageCapacityClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *cSIStorageCapacityClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSIStorageCapacityClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *cSIStorageCapacityClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&storagev1alpha1.CSIStorageCapacity{}, f.defaultInformer)
+func (i *cSIStorageCapacityClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1alpha1.CSIStorageCapacity{}, i.defaultInformer)
 }
 
-func (f *cSIStorageCapacityClusterInformer) Lister() storagev1alpha1listers.CSIStorageCapacityClusterLister {
-	return storagev1alpha1listers.NewCSIStorageCapacityClusterLister(f.Informer().GetIndexer())
+func (i *cSIStorageCapacityClusterInformer) Lister() kcpv1alpha1.CSIStorageCapacityClusterLister {
+	return kcpv1alpha1.NewCSIStorageCapacityClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *cSIStorageCapacityClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1alpha1.CSIStorageCapacityInformer {
+	return &cSIStorageCapacityInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *cSIStorageCapacityClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamstoragev1alpha1informers.CSIStorageCapacityInformer {
+func (i *cSIStorageCapacityClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1alpha1.CSIStorageCapacityInformer {
 	return &cSIStorageCapacityInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type cSIStorageCapacityInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamstoragev1alpha1listers.CSIStorageCapacityLister
+	lister   listersstoragev1alpha1.CSIStorageCapacityLister
 }
 
-func (f *cSIStorageCapacityInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *cSIStorageCapacityInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *cSIStorageCapacityInformer) Lister() upstreamstoragev1alpha1listers.CSIStorageCapacityLister {
-	return f.lister
+func (i *cSIStorageCapacityInformer) Lister() listersstoragev1alpha1.CSIStorageCapacityLister {
+	return i.lister
 }
diff --git a/informers/storage/v1alpha1/interface.go b/informers/storage/v1alpha1/interface.go
index 342634ea4..fddc5fcb2 100644
--- a/informers/storage/v1alpha1/interface.go
+++ b/informers/storage/v1alpha1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,37 +14,44 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// VolumeAttachments returns a VolumeAttachmentClusterInformer
-	VolumeAttachments() VolumeAttachmentClusterInformer
-	// CSIStorageCapacities returns a CSIStorageCapacityClusterInformer
+	// CSIStorageCapacities returns a CSIStorageCapacityClusterInformer.
 	CSIStorageCapacities() CSIStorageCapacityClusterInformer
+	// VolumeAttachments returns a VolumeAttachmentClusterInformer.
+	VolumeAttachments() VolumeAttachmentClusterInformer
+	// VolumeAttributesClasses returns a VolumeAttributesClassClusterInformer.
+	VolumeAttributesClasses() VolumeAttributesClassClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// VolumeAttachments returns a VolumeAttachmentClusterInformer
+// CSIStorageCapacities returns a CSIStorageCapacityClusterInformer.
+func (v *version) CSIStorageCapacities() CSIStorageCapacityClusterInformer {
+	return &cSIStorageCapacityClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// VolumeAttachments returns a VolumeAttachmentClusterInformer.
 func (v *version) VolumeAttachments() VolumeAttachmentClusterInformer {
 	return &volumeAttachmentClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// CSIStorageCapacities returns a CSIStorageCapacityClusterInformer
-func (v *version) CSIStorageCapacities() CSIStorageCapacityClusterInformer {
-	return &cSIStorageCapacityClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+// VolumeAttributesClasses returns a VolumeAttributesClassClusterInformer.
+func (v *version) VolumeAttributesClasses() VolumeAttributesClassClusterInformer {
+	return &volumeAttributesClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
diff --git a/informers/storage/v1alpha1/volumeattachment.go b/informers/storage/v1alpha1/volumeattachment.go
index 460bc59d8..99dfe8dde 100644
--- a/informers/storage/v1alpha1/volumeattachment.go
+++ b/informers/storage/v1alpha1/volumeattachment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apistoragev1alpha1 "k8s.io/api/storage/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1alpha1 "k8s.io/client-go/informers/storage/v1alpha1"
+	listersstoragev1alpha1 "k8s.io/client-go/listers/storage/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamstoragev1alpha1informers "k8s.io/client-go/informers/storage/v1alpha1"
-	upstreamstoragev1alpha1listers "k8s.io/client-go/listers/storage/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	storagev1alpha1listers "github.com/kcp-dev/client-go/listers/storage/v1alpha1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/storage/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // VolumeAttachmentClusterInformer provides access to a shared informer and lister for
 // VolumeAttachments.
 type VolumeAttachmentClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamstoragev1alpha1informers.VolumeAttachmentInformer
+	Cluster(logicalcluster.Name) storagev1alpha1.VolumeAttachmentInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1alpha1.VolumeAttachmentInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() storagev1alpha1listers.VolumeAttachmentClusterLister
+	Lister() kcpv1alpha1.VolumeAttachmentClusterLister
 }
 
 type volumeAttachmentClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewVolumeAttachmentClusterInformer constructs a new informer for VolumeAttachment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewVolumeAttachmentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewVolumeAttachmentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredVolumeAttachmentClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredVolumeAttachmentClusterInformer constructs a new informer for VolumeAttachment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredVolumeAttachmentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredVolumeAttachmentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1alpha1().VolumeAttachments().List(context.TODO(), options)
+				return client.StorageV1alpha1().VolumeAttachments().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1alpha1().VolumeAttachments().Watch(context.TODO(), options)
+				return client.StorageV1alpha1().VolumeAttachments().Watch(context.Background(), options)
 			},
 		},
-		&storagev1alpha1.VolumeAttachment{},
+		&apistoragev1alpha1.VolumeAttachment{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *volumeAttachmentClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *volumeAttachmentClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredVolumeAttachmentClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *volumeAttachmentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&storagev1alpha1.VolumeAttachment{}, f.defaultInformer)
+func (i *volumeAttachmentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1alpha1.VolumeAttachment{}, i.defaultInformer)
 }
 
-func (f *volumeAttachmentClusterInformer) Lister() storagev1alpha1listers.VolumeAttachmentClusterLister {
-	return storagev1alpha1listers.NewVolumeAttachmentClusterLister(f.Informer().GetIndexer())
+func (i *volumeAttachmentClusterInformer) Lister() kcpv1alpha1.VolumeAttachmentClusterLister {
+	return kcpv1alpha1.NewVolumeAttachmentClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *volumeAttachmentClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1alpha1.VolumeAttachmentInformer {
+	return &volumeAttachmentInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *volumeAttachmentClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamstoragev1alpha1informers.VolumeAttachmentInformer {
+func (i *volumeAttachmentClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1alpha1.VolumeAttachmentInformer {
 	return &volumeAttachmentInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type volumeAttachmentInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamstoragev1alpha1listers.VolumeAttachmentLister
+	lister   listersstoragev1alpha1.VolumeAttachmentLister
 }
 
-func (f *volumeAttachmentInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *volumeAttachmentInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *volumeAttachmentInformer) Lister() upstreamstoragev1alpha1listers.VolumeAttachmentLister {
-	return f.lister
+func (i *volumeAttachmentInformer) Lister() listersstoragev1alpha1.VolumeAttachmentLister {
+	return i.lister
 }
diff --git a/informers/storage/v1alpha1/volumeattributesclass.go b/informers/storage/v1alpha1/volumeattributesclass.go
new file mode 100644
index 000000000..e4d3975b5
--- /dev/null
+++ b/informers/storage/v1alpha1/volumeattributesclass.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+	time "time"
+
+	apistoragev1alpha1 "k8s.io/api/storage/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1alpha1 "k8s.io/client-go/informers/storage/v1alpha1"
+	listersstoragev1alpha1 "k8s.io/client-go/listers/storage/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/storage/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// VolumeAttributesClassClusterInformer provides access to a shared informer and lister for
+// VolumeAttributesClasses.
+type VolumeAttributesClassClusterInformer interface {
+	Cluster(logicalcluster.Name) storagev1alpha1.VolumeAttributesClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1alpha1.VolumeAttributesClassInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha1.VolumeAttributesClassClusterLister
+}
+
+type volumeAttributesClassClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewVolumeAttributesClassClusterInformer constructs a new informer for VolumeAttributesClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewVolumeAttributesClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredVolumeAttributesClassClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredVolumeAttributesClassClusterInformer constructs a new informer for VolumeAttributesClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredVolumeAttributesClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.StorageV1alpha1().VolumeAttributesClasses().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.StorageV1alpha1().VolumeAttributesClasses().Watch(context.Background(), options)
+			},
+		},
+		&apistoragev1alpha1.VolumeAttributesClass{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *volumeAttributesClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredVolumeAttributesClassClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *volumeAttributesClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1alpha1.VolumeAttributesClass{}, i.defaultInformer)
+}
+
+func (i *volumeAttributesClassClusterInformer) Lister() kcpv1alpha1.VolumeAttributesClassClusterLister {
+	return kcpv1alpha1.NewVolumeAttributesClassClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *volumeAttributesClassClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1alpha1.VolumeAttributesClassInformer {
+	return &volumeAttributesClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *volumeAttributesClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1alpha1.VolumeAttributesClassInformer {
+	return &volumeAttributesClassInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type volumeAttributesClassInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersstoragev1alpha1.VolumeAttributesClassLister
+}
+
+func (i *volumeAttributesClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *volumeAttributesClassInformer) Lister() listersstoragev1alpha1.VolumeAttributesClassLister {
+	return i.lister
+}
diff --git a/informers/storage/v1beta1/csidriver.go b/informers/storage/v1beta1/csidriver.go
index bab9a242a..26feb6fb9 100644
--- a/informers/storage/v1beta1/csidriver.go
+++ b/informers/storage/v1beta1/csidriver.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apistoragev1beta1 "k8s.io/api/storage/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1beta1 "k8s.io/client-go/informers/storage/v1beta1"
+	listersstoragev1beta1 "k8s.io/client-go/listers/storage/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamstoragev1beta1informers "k8s.io/client-go/informers/storage/v1beta1"
-	upstreamstoragev1beta1listers "k8s.io/client-go/listers/storage/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	storagev1beta1listers "github.com/kcp-dev/client-go/listers/storage/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/storage/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CSIDriverClusterInformer provides access to a shared informer and lister for
 // CSIDrivers.
 type CSIDriverClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamstoragev1beta1informers.CSIDriverInformer
+	Cluster(logicalcluster.Name) storagev1beta1.CSIDriverInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1beta1.CSIDriverInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() storagev1beta1listers.CSIDriverClusterLister
+	Lister() kcpv1beta1.CSIDriverClusterLister
 }
 
 type cSIDriverClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewCSIDriverClusterInformer constructs a new informer for CSIDriver type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewCSIDriverClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewCSIDriverClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSIDriverClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredCSIDriverClusterInformer constructs a new informer for CSIDriver type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredCSIDriverClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredCSIDriverClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1beta1().CSIDrivers().List(context.TODO(), options)
+				return client.StorageV1beta1().CSIDrivers().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1beta1().CSIDrivers().Watch(context.TODO(), options)
+				return client.StorageV1beta1().CSIDrivers().Watch(context.Background(), options)
 			},
 		},
-		&storagev1beta1.CSIDriver{},
+		&apistoragev1beta1.CSIDriver{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *cSIDriverClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *cSIDriverClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSIDriverClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *cSIDriverClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&storagev1beta1.CSIDriver{}, f.defaultInformer)
+func (i *cSIDriverClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1beta1.CSIDriver{}, i.defaultInformer)
 }
 
-func (f *cSIDriverClusterInformer) Lister() storagev1beta1listers.CSIDriverClusterLister {
-	return storagev1beta1listers.NewCSIDriverClusterLister(f.Informer().GetIndexer())
+func (i *cSIDriverClusterInformer) Lister() kcpv1beta1.CSIDriverClusterLister {
+	return kcpv1beta1.NewCSIDriverClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *cSIDriverClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1beta1.CSIDriverInformer {
+	return &cSIDriverInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *cSIDriverClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamstoragev1beta1informers.CSIDriverInformer {
+func (i *cSIDriverClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1beta1.CSIDriverInformer {
 	return &cSIDriverInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type cSIDriverInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamstoragev1beta1listers.CSIDriverLister
+	lister   listersstoragev1beta1.CSIDriverLister
 }
 
-func (f *cSIDriverInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *cSIDriverInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *cSIDriverInformer) Lister() upstreamstoragev1beta1listers.CSIDriverLister {
-	return f.lister
+func (i *cSIDriverInformer) Lister() listersstoragev1beta1.CSIDriverLister {
+	return i.lister
 }
diff --git a/informers/storage/v1beta1/csinode.go b/informers/storage/v1beta1/csinode.go
index 5430e34b1..05bdab6b2 100644
--- a/informers/storage/v1beta1/csinode.go
+++ b/informers/storage/v1beta1/csinode.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apistoragev1beta1 "k8s.io/api/storage/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1beta1 "k8s.io/client-go/informers/storage/v1beta1"
+	listersstoragev1beta1 "k8s.io/client-go/listers/storage/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamstoragev1beta1informers "k8s.io/client-go/informers/storage/v1beta1"
-	upstreamstoragev1beta1listers "k8s.io/client-go/listers/storage/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	storagev1beta1listers "github.com/kcp-dev/client-go/listers/storage/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/storage/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CSINodeClusterInformer provides access to a shared informer and lister for
 // CSINodes.
 type CSINodeClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamstoragev1beta1informers.CSINodeInformer
+	Cluster(logicalcluster.Name) storagev1beta1.CSINodeInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1beta1.CSINodeInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() storagev1beta1listers.CSINodeClusterLister
+	Lister() kcpv1beta1.CSINodeClusterLister
 }
 
 type cSINodeClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewCSINodeClusterInformer constructs a new informer for CSINode type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewCSINodeClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewCSINodeClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSINodeClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredCSINodeClusterInformer constructs a new informer for CSINode type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredCSINodeClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredCSINodeClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1beta1().CSINodes().List(context.TODO(), options)
+				return client.StorageV1beta1().CSINodes().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1beta1().CSINodes().Watch(context.TODO(), options)
+				return client.StorageV1beta1().CSINodes().Watch(context.Background(), options)
 			},
 		},
-		&storagev1beta1.CSINode{},
+		&apistoragev1beta1.CSINode{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *cSINodeClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *cSINodeClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSINodeClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *cSINodeClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&storagev1beta1.CSINode{}, f.defaultInformer)
+func (i *cSINodeClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1beta1.CSINode{}, i.defaultInformer)
 }
 
-func (f *cSINodeClusterInformer) Lister() storagev1beta1listers.CSINodeClusterLister {
-	return storagev1beta1listers.NewCSINodeClusterLister(f.Informer().GetIndexer())
+func (i *cSINodeClusterInformer) Lister() kcpv1beta1.CSINodeClusterLister {
+	return kcpv1beta1.NewCSINodeClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *cSINodeClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1beta1.CSINodeInformer {
+	return &cSINodeInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *cSINodeClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamstoragev1beta1informers.CSINodeInformer {
+func (i *cSINodeClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1beta1.CSINodeInformer {
 	return &cSINodeInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type cSINodeInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamstoragev1beta1listers.CSINodeLister
+	lister   listersstoragev1beta1.CSINodeLister
 }
 
-func (f *cSINodeInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *cSINodeInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *cSINodeInformer) Lister() upstreamstoragev1beta1listers.CSINodeLister {
-	return f.lister
+func (i *cSINodeInformer) Lister() listersstoragev1beta1.CSINodeLister {
+	return i.lister
 }
diff --git a/informers/storage/v1beta1/csistoragecapacity.go b/informers/storage/v1beta1/csistoragecapacity.go
index 56420081d..5eaf0836a 100644
--- a/informers/storage/v1beta1/csistoragecapacity.go
+++ b/informers/storage/v1beta1/csistoragecapacity.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apistoragev1beta1 "k8s.io/api/storage/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1beta1 "k8s.io/client-go/informers/storage/v1beta1"
+	listersstoragev1beta1 "k8s.io/client-go/listers/storage/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamstoragev1beta1informers "k8s.io/client-go/informers/storage/v1beta1"
-	upstreamstoragev1beta1listers "k8s.io/client-go/listers/storage/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	storagev1beta1listers "github.com/kcp-dev/client-go/listers/storage/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/storage/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CSIStorageCapacityClusterInformer provides access to a shared informer and lister for
 // CSIStorageCapacities.
 type CSIStorageCapacityClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamstoragev1beta1informers.CSIStorageCapacityInformer
+	Cluster(logicalcluster.Name) storagev1beta1.CSIStorageCapacityInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1beta1.CSIStorageCapacityInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() storagev1beta1listers.CSIStorageCapacityClusterLister
+	Lister() kcpv1beta1.CSIStorageCapacityClusterLister
 }
 
 type cSIStorageCapacityClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewCSIStorageCapacityClusterInformer constructs a new informer for CSIStorageCapacity type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewCSIStorageCapacityClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewCSIStorageCapacityClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSIStorageCapacityClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredCSIStorageCapacityClusterInformer constructs a new informer for CSIStorageCapacity type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredCSIStorageCapacityClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredCSIStorageCapacityClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1beta1().CSIStorageCapacities().List(context.TODO(), options)
+				return client.StorageV1beta1().CSIStorageCapacities().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1beta1().CSIStorageCapacities().Watch(context.TODO(), options)
+				return client.StorageV1beta1().CSIStorageCapacities().Watch(context.Background(), options)
 			},
 		},
-		&storagev1beta1.CSIStorageCapacity{},
+		&apistoragev1beta1.CSIStorageCapacity{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *cSIStorageCapacityClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *cSIStorageCapacityClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredCSIStorageCapacityClusterInformer(client, resyncPeriod, cache.Indexers{
 		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
-		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *cSIStorageCapacityClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&storagev1beta1.CSIStorageCapacity{}, f.defaultInformer)
+func (i *cSIStorageCapacityClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1beta1.CSIStorageCapacity{}, i.defaultInformer)
 }
 
-func (f *cSIStorageCapacityClusterInformer) Lister() storagev1beta1listers.CSIStorageCapacityClusterLister {
-	return storagev1beta1listers.NewCSIStorageCapacityClusterLister(f.Informer().GetIndexer())
+func (i *cSIStorageCapacityClusterInformer) Lister() kcpv1beta1.CSIStorageCapacityClusterLister {
+	return kcpv1beta1.NewCSIStorageCapacityClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *cSIStorageCapacityClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1beta1.CSIStorageCapacityInformer {
+	return &cSIStorageCapacityInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *cSIStorageCapacityClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamstoragev1beta1informers.CSIStorageCapacityInformer {
+func (i *cSIStorageCapacityClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1beta1.CSIStorageCapacityInformer {
 	return &cSIStorageCapacityInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type cSIStorageCapacityInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamstoragev1beta1listers.CSIStorageCapacityLister
+	lister   listersstoragev1beta1.CSIStorageCapacityLister
 }
 
-func (f *cSIStorageCapacityInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *cSIStorageCapacityInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *cSIStorageCapacityInformer) Lister() upstreamstoragev1beta1listers.CSIStorageCapacityLister {
-	return f.lister
+func (i *cSIStorageCapacityInformer) Lister() listersstoragev1beta1.CSIStorageCapacityLister {
+	return i.lister
 }
diff --git a/informers/storage/v1beta1/interface.go b/informers/storage/v1beta1/interface.go
index 6e61be7ec..46fe4b1bd 100644
--- a/informers/storage/v1beta1/interface.go
+++ b/informers/storage/v1beta1/interface.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,58 +14,65 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
 )
 
 type ClusterInterface interface {
-	// StorageClasses returns a StorageClassClusterInformer
-	StorageClasses() StorageClassClusterInformer
-	// VolumeAttachments returns a VolumeAttachmentClusterInformer
-	VolumeAttachments() VolumeAttachmentClusterInformer
-	// CSIDrivers returns a CSIDriverClusterInformer
+	// CSIDrivers returns a CSIDriverClusterInformer.
 	CSIDrivers() CSIDriverClusterInformer
-	// CSINodes returns a CSINodeClusterInformer
+	// CSINodes returns a CSINodeClusterInformer.
 	CSINodes() CSINodeClusterInformer
-	// CSIStorageCapacities returns a CSIStorageCapacityClusterInformer
+	// CSIStorageCapacities returns a CSIStorageCapacityClusterInformer.
 	CSIStorageCapacities() CSIStorageCapacityClusterInformer
+	// StorageClasses returns a StorageClassClusterInformer.
+	StorageClasses() StorageClassClusterInformer
+	// VolumeAttachments returns a VolumeAttachmentClusterInformer.
+	VolumeAttachments() VolumeAttachmentClusterInformer
+	// VolumeAttributesClasses returns a VolumeAttributesClassClusterInformer.
+	VolumeAttributesClasses() VolumeAttributesClassClusterInformer
 }
 
 type version struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
-// New returns a new ClusterInterface.
-func New(f internalinterfaces.SharedInformerFactory, tweakListOptions internalinterfaces.TweakListOptionsFunc) ClusterInterface {
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
 	return &version{factory: f, tweakListOptions: tweakListOptions}
 }
 
-// StorageClasses returns a StorageClassClusterInformer
-func (v *version) StorageClasses() StorageClassClusterInformer {
-	return &storageClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// VolumeAttachments returns a VolumeAttachmentClusterInformer
-func (v *version) VolumeAttachments() VolumeAttachmentClusterInformer {
-	return &volumeAttachmentClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
-}
-
-// CSIDrivers returns a CSIDriverClusterInformer
+// CSIDrivers returns a CSIDriverClusterInformer.
 func (v *version) CSIDrivers() CSIDriverClusterInformer {
 	return &cSIDriverClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// CSINodes returns a CSINodeClusterInformer
+// CSINodes returns a CSINodeClusterInformer.
 func (v *version) CSINodes() CSINodeClusterInformer {
 	return &cSINodeClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
 
-// CSIStorageCapacities returns a CSIStorageCapacityClusterInformer
+// CSIStorageCapacities returns a CSIStorageCapacityClusterInformer.
 func (v *version) CSIStorageCapacities() CSIStorageCapacityClusterInformer {
 	return &cSIStorageCapacityClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
 }
+
+// StorageClasses returns a StorageClassClusterInformer.
+func (v *version) StorageClasses() StorageClassClusterInformer {
+	return &storageClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// VolumeAttachments returns a VolumeAttachmentClusterInformer.
+func (v *version) VolumeAttachments() VolumeAttachmentClusterInformer {
+	return &volumeAttachmentClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
+
+// VolumeAttributesClasses returns a VolumeAttributesClassClusterInformer.
+func (v *version) VolumeAttributesClasses() VolumeAttributesClassClusterInformer {
+	return &volumeAttributesClassClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/storage/v1beta1/storageclass.go b/informers/storage/v1beta1/storageclass.go
index c63cc193a..b4fed8c4d 100644
--- a/informers/storage/v1beta1/storageclass.go
+++ b/informers/storage/v1beta1/storageclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apistoragev1beta1 "k8s.io/api/storage/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1beta1 "k8s.io/client-go/informers/storage/v1beta1"
+	listersstoragev1beta1 "k8s.io/client-go/listers/storage/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamstoragev1beta1informers "k8s.io/client-go/informers/storage/v1beta1"
-	upstreamstoragev1beta1listers "k8s.io/client-go/listers/storage/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	storagev1beta1listers "github.com/kcp-dev/client-go/listers/storage/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/storage/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // StorageClassClusterInformer provides access to a shared informer and lister for
 // StorageClasses.
 type StorageClassClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamstoragev1beta1informers.StorageClassInformer
+	Cluster(logicalcluster.Name) storagev1beta1.StorageClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1beta1.StorageClassInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() storagev1beta1listers.StorageClassClusterLister
+	Lister() kcpv1beta1.StorageClassClusterLister
 }
 
 type storageClassClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewStorageClassClusterInformer constructs a new informer for StorageClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewStorageClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewStorageClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredStorageClassClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredStorageClassClusterInformer constructs a new informer for StorageClass type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredStorageClassClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredStorageClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1beta1().StorageClasses().List(context.TODO(), options)
+				return client.StorageV1beta1().StorageClasses().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1beta1().StorageClasses().Watch(context.TODO(), options)
+				return client.StorageV1beta1().StorageClasses().Watch(context.Background(), options)
 			},
 		},
-		&storagev1beta1.StorageClass{},
+		&apistoragev1beta1.StorageClass{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *storageClassClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *storageClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredStorageClassClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *storageClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&storagev1beta1.StorageClass{}, f.defaultInformer)
+func (i *storageClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1beta1.StorageClass{}, i.defaultInformer)
 }
 
-func (f *storageClassClusterInformer) Lister() storagev1beta1listers.StorageClassClusterLister {
-	return storagev1beta1listers.NewStorageClassClusterLister(f.Informer().GetIndexer())
+func (i *storageClassClusterInformer) Lister() kcpv1beta1.StorageClassClusterLister {
+	return kcpv1beta1.NewStorageClassClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *storageClassClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1beta1.StorageClassInformer {
+	return &storageClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *storageClassClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamstoragev1beta1informers.StorageClassInformer {
+func (i *storageClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1beta1.StorageClassInformer {
 	return &storageClassInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type storageClassInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamstoragev1beta1listers.StorageClassLister
+	lister   listersstoragev1beta1.StorageClassLister
 }
 
-func (f *storageClassInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *storageClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *storageClassInformer) Lister() upstreamstoragev1beta1listers.StorageClassLister {
-	return f.lister
+func (i *storageClassInformer) Lister() listersstoragev1beta1.StorageClassLister {
+	return i.lister
 }
diff --git a/informers/storage/v1beta1/volumeattachment.go b/informers/storage/v1beta1/volumeattachment.go
index 0d58c0ae9..604340f16 100644
--- a/informers/storage/v1beta1/volumeattachment.go
+++ b/informers/storage/v1beta1/volumeattachment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,108 +14,114 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-informer-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
-	"time"
+	context "context"
+	time "time"
+
+	apistoragev1beta1 "k8s.io/api/storage/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1beta1 "k8s.io/client-go/informers/storage/v1beta1"
+	listersstoragev1beta1 "k8s.io/client-go/listers/storage/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
 
 	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
 	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/watch"
-	upstreamstoragev1beta1informers "k8s.io/client-go/informers/storage/v1beta1"
-	upstreamstoragev1beta1listers "k8s.io/client-go/listers/storage/v1beta1"
-	"k8s.io/client-go/tools/cache"
-
-	"github.com/kcp-dev/client-go/informers/internalinterfaces"
-	clientset "github.com/kcp-dev/client-go/kubernetes"
-	storagev1beta1listers "github.com/kcp-dev/client-go/listers/storage/v1beta1"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/storage/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
 )
 
 // VolumeAttachmentClusterInformer provides access to a shared informer and lister for
 // VolumeAttachments.
 type VolumeAttachmentClusterInformer interface {
-	Cluster(logicalcluster.Name) upstreamstoragev1beta1informers.VolumeAttachmentInformer
+	Cluster(logicalcluster.Name) storagev1beta1.VolumeAttachmentInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1beta1.VolumeAttachmentInformer
 	Informer() kcpcache.ScopeableSharedIndexInformer
-	Lister() storagev1beta1listers.VolumeAttachmentClusterLister
+	Lister() kcpv1beta1.VolumeAttachmentClusterLister
 }
 
 type volumeAttachmentClusterInformer struct {
-	factory          internalinterfaces.SharedInformerFactory
-	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
 }
 
 // NewVolumeAttachmentClusterInformer constructs a new informer for VolumeAttachment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewVolumeAttachmentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+func NewVolumeAttachmentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredVolumeAttachmentClusterInformer(client, resyncPeriod, indexers, nil)
 }
 
 // NewFilteredVolumeAttachmentClusterInformer constructs a new informer for VolumeAttachment type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredVolumeAttachmentClusterInformer(client clientset.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+func NewFilteredVolumeAttachmentClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
 	return kcpinformers.NewSharedIndexInformer(
 		&cache.ListWatch{
-			ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1beta1().VolumeAttachments().List(context.TODO(), options)
+				return client.StorageV1beta1().VolumeAttachments().List(context.Background(), options)
 			},
-			WatchFunc: func(options metav1.ListOptions) (watch.Interface, error) {
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.StorageV1beta1().VolumeAttachments().Watch(context.TODO(), options)
+				return client.StorageV1beta1().VolumeAttachments().Watch(context.Background(), options)
 			},
 		},
-		&storagev1beta1.VolumeAttachment{},
+		&apistoragev1beta1.VolumeAttachment{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *volumeAttachmentClusterInformer) defaultInformer(client clientset.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+func (i *volumeAttachmentClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
 	return NewFilteredVolumeAttachmentClusterInformer(client, resyncPeriod, cache.Indexers{
-		kcpcache.ClusterIndexName: kcpcache.ClusterIndexFunc,
-	},
-		f.tweakListOptions,
-	)
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
 }
 
-func (f *volumeAttachmentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
-	return f.factory.InformerFor(&storagev1beta1.VolumeAttachment{}, f.defaultInformer)
+func (i *volumeAttachmentClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1beta1.VolumeAttachment{}, i.defaultInformer)
 }
 
-func (f *volumeAttachmentClusterInformer) Lister() storagev1beta1listers.VolumeAttachmentClusterLister {
-	return storagev1beta1listers.NewVolumeAttachmentClusterLister(f.Informer().GetIndexer())
+func (i *volumeAttachmentClusterInformer) Lister() kcpv1beta1.VolumeAttachmentClusterLister {
+	return kcpv1beta1.NewVolumeAttachmentClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *volumeAttachmentClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1beta1.VolumeAttachmentInformer {
+	return &volumeAttachmentInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
 }
 
-func (f *volumeAttachmentClusterInformer) Cluster(clusterName logicalcluster.Name) upstreamstoragev1beta1informers.VolumeAttachmentInformer {
+func (i *volumeAttachmentClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1beta1.VolumeAttachmentInformer {
 	return &volumeAttachmentInformer{
-		informer: f.Informer().Cluster(clusterName),
-		lister:   f.Lister().Cluster(clusterName),
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
 	}
 }
 
 type volumeAttachmentInformer struct {
 	informer cache.SharedIndexInformer
-	lister   upstreamstoragev1beta1listers.VolumeAttachmentLister
+	lister   listersstoragev1beta1.VolumeAttachmentLister
 }
 
-func (f *volumeAttachmentInformer) Informer() cache.SharedIndexInformer {
-	return f.informer
+func (i *volumeAttachmentInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
 }
 
-func (f *volumeAttachmentInformer) Lister() upstreamstoragev1beta1listers.VolumeAttachmentLister {
-	return f.lister
+func (i *volumeAttachmentInformer) Lister() listersstoragev1beta1.VolumeAttachmentLister {
+	return i.lister
 }
diff --git a/informers/storage/v1beta1/volumeattributesclass.go b/informers/storage/v1beta1/volumeattributesclass.go
new file mode 100644
index 000000000..705f4f50f
--- /dev/null
+++ b/informers/storage/v1beta1/volumeattributesclass.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+	time "time"
+
+	apistoragev1beta1 "k8s.io/api/storage/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1beta1 "k8s.io/client-go/informers/storage/v1beta1"
+	listersstoragev1beta1 "k8s.io/client-go/listers/storage/v1beta1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1beta1 "github.com/kcp-dev/client-go/listers/storage/v1beta1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// VolumeAttributesClassClusterInformer provides access to a shared informer and lister for
+// VolumeAttributesClasses.
+type VolumeAttributesClassClusterInformer interface {
+	Cluster(logicalcluster.Name) storagev1beta1.VolumeAttributesClassInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagev1beta1.VolumeAttributesClassInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1beta1.VolumeAttributesClassClusterLister
+}
+
+type volumeAttributesClassClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewVolumeAttributesClassClusterInformer constructs a new informer for VolumeAttributesClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewVolumeAttributesClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredVolumeAttributesClassClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredVolumeAttributesClassClusterInformer constructs a new informer for VolumeAttributesClass type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredVolumeAttributesClassClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.StorageV1beta1().VolumeAttributesClasses().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.StorageV1beta1().VolumeAttributesClasses().Watch(context.Background(), options)
+			},
+		},
+		&apistoragev1beta1.VolumeAttributesClass{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *volumeAttributesClassClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredVolumeAttributesClassClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *volumeAttributesClassClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragev1beta1.VolumeAttributesClass{}, i.defaultInformer)
+}
+
+func (i *volumeAttributesClassClusterInformer) Lister() kcpv1beta1.VolumeAttributesClassClusterLister {
+	return kcpv1beta1.NewVolumeAttributesClassClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *volumeAttributesClassClusterInformer) Cluster(clusterName logicalcluster.Name) storagev1beta1.VolumeAttributesClassInformer {
+	return &volumeAttributesClassInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *volumeAttributesClassClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagev1beta1.VolumeAttributesClassInformer {
+	return &volumeAttributesClassInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type volumeAttributesClassInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersstoragev1beta1.VolumeAttributesClassLister
+}
+
+func (i *volumeAttributesClassInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *volumeAttributesClassInformer) Lister() listersstoragev1beta1.VolumeAttributesClassLister {
+	return i.lister
+}
diff --git a/informers/storagemigration/interface.go b/informers/storagemigration/interface.go
new file mode 100644
index 000000000..efe2fb45f
--- /dev/null
+++ b/informers/storagemigration/interface.go
@@ -0,0 +1,45 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package storagemigration
+
+import (
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/informers/storagemigration/v1alpha1"
+)
+
+// ClusterInterface provides access to each of this group's versions.
+type ClusterInterface interface {
+	// V1alpha1 provides access to shared informers for resources in V1alpha1.
+	V1alpha1() kcpv1alpha1.ClusterInterface
+}
+
+type group struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new ClusterInterface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
+	return &group{factory: f, tweakListOptions: tweakListOptions}
+}
+
+// V1alpha1 returns a new kcpv1alpha1.ClusterInterface.
+func (g *group) V1alpha1() kcpv1alpha1.ClusterInterface {
+	return kcpv1alpha1.New(g.factory, g.tweakListOptions)
+}
diff --git a/informers/storagemigration/v1alpha1/interface.go b/informers/storagemigration/v1alpha1/interface.go
new file mode 100644
index 000000000..662e605e5
--- /dev/null
+++ b/informers/storagemigration/v1alpha1/interface.go
@@ -0,0 +1,43 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+)
+
+type ClusterInterface interface {
+	// StorageVersionMigrations returns a StorageVersionMigrationClusterInformer.
+	StorageVersionMigrations() StorageVersionMigrationClusterInformer
+}
+
+type version struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f kcpinternalinterfaces.SharedInformerFactory, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) ClusterInterface {
+	return &version{factory: f, tweakListOptions: tweakListOptions}
+}
+
+// StorageVersionMigrations returns a StorageVersionMigrationClusterInformer.
+func (v *version) StorageVersionMigrations() StorageVersionMigrationClusterInformer {
+	return &storageVersionMigrationClusterInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}
diff --git a/informers/storagemigration/v1alpha1/storageversionmigration.go b/informers/storagemigration/v1alpha1/storageversionmigration.go
new file mode 100644
index 000000000..71d9e955c
--- /dev/null
+++ b/informers/storagemigration/v1alpha1/storageversionmigration.go
@@ -0,0 +1,127 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+	time "time"
+
+	apistoragemigrationv1alpha1 "k8s.io/api/storagemigration/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagemigrationv1alpha1 "k8s.io/client-go/informers/storagemigration/v1alpha1"
+	listersstoragemigrationv1alpha1 "k8s.io/client-go/listers/storagemigration/v1alpha1"
+	cache "k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	kcpinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
+	kcpinternalinterfaces "github.com/kcp-dev/client-go/informers/internalinterfaces"
+	kcpkubernetes "github.com/kcp-dev/client-go/kubernetes"
+	kcpv1alpha1 "github.com/kcp-dev/client-go/listers/storagemigration/v1alpha1"
+	logicalcluster "github.com/kcp-dev/logicalcluster/v3"
+)
+
+// StorageVersionMigrationClusterInformer provides access to a shared informer and lister for
+// StorageVersionMigrations.
+type StorageVersionMigrationClusterInformer interface {
+	Cluster(logicalcluster.Name) storagemigrationv1alpha1.StorageVersionMigrationInformer
+	ClusterWithContext(context.Context, logicalcluster.Name) storagemigrationv1alpha1.StorageVersionMigrationInformer
+	Informer() kcpcache.ScopeableSharedIndexInformer
+	Lister() kcpv1alpha1.StorageVersionMigrationClusterLister
+}
+
+type storageVersionMigrationClusterInformer struct {
+	factory          kcpinternalinterfaces.SharedInformerFactory
+	tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc
+}
+
+// NewStorageVersionMigrationClusterInformer constructs a new informer for StorageVersionMigration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewStorageVersionMigrationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredStorageVersionMigrationClusterInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredStorageVersionMigrationClusterInformer constructs a new informer for StorageVersionMigration type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredStorageVersionMigrationClusterInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions kcpinternalinterfaces.TweakListOptionsFunc) kcpcache.ScopeableSharedIndexInformer {
+	return kcpinformers.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.StoragemigrationV1alpha1().StorageVersionMigrations().List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.StoragemigrationV1alpha1().StorageVersionMigrations().Watch(context.Background(), options)
+			},
+		},
+		&apistoragemigrationv1alpha1.StorageVersionMigration{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (i *storageVersionMigrationClusterInformer) defaultInformer(client kcpkubernetes.ClusterInterface, resyncPeriod time.Duration) kcpcache.ScopeableSharedIndexInformer {
+	return NewFilteredStorageVersionMigrationClusterInformer(client, resyncPeriod, cache.Indexers{
+		kcpcache.ClusterIndexName:             kcpcache.ClusterIndexFunc,
+		kcpcache.ClusterAndNamespaceIndexName: kcpcache.ClusterAndNamespaceIndexFunc,
+	}, i.tweakListOptions)
+}
+
+func (i *storageVersionMigrationClusterInformer) Informer() kcpcache.ScopeableSharedIndexInformer {
+	return i.factory.InformerFor(&apistoragemigrationv1alpha1.StorageVersionMigration{}, i.defaultInformer)
+}
+
+func (i *storageVersionMigrationClusterInformer) Lister() kcpv1alpha1.StorageVersionMigrationClusterLister {
+	return kcpv1alpha1.NewStorageVersionMigrationClusterLister(i.Informer().GetIndexer())
+}
+
+func (i *storageVersionMigrationClusterInformer) Cluster(clusterName logicalcluster.Name) storagemigrationv1alpha1.StorageVersionMigrationInformer {
+	return &storageVersionMigrationInformer{
+		informer: i.Informer().Cluster(clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+func (i *storageVersionMigrationClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) storagemigrationv1alpha1.StorageVersionMigrationInformer {
+	return &storageVersionMigrationInformer{
+		informer: i.Informer().ClusterWithContext(ctx, clusterName),
+		lister:   i.Lister().Cluster(clusterName),
+	}
+}
+
+type storageVersionMigrationInformer struct {
+	informer cache.SharedIndexInformer
+	lister   listersstoragemigrationv1alpha1.StorageVersionMigrationLister
+}
+
+func (i *storageVersionMigrationInformer) Informer() cache.SharedIndexInformer {
+	return i.informer
+}
+
+func (i *storageVersionMigrationInformer) Lister() listersstoragemigrationv1alpha1.StorageVersionMigrationLister {
+	return i.lister
+}
diff --git a/kubernetes/clientset.go b/kubernetes/clientset.go
index 2eddb399e..64169563f 100644
--- a/kubernetes/clientset.go
+++ b/kubernetes/clientset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,22 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package kubernetes
 
 import (
-	"fmt"
-	"net/http"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	fmt "fmt"
+	http "net/http"
 
-	"k8s.io/client-go/discovery"
+	discovery "k8s.io/client-go/discovery"
 	client "k8s.io/client-go/kubernetes"
-	"k8s.io/client-go/rest"
-	"k8s.io/client-go/util/flowcontrol"
+	rest "k8s.io/client-go/rest"
+	flowcontrol "k8s.io/client-go/util/flowcontrol"
 
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	admissionregistrationv1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1"
 	admissionregistrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1alpha1"
 	admissionregistrationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1beta1"
@@ -52,8 +47,10 @@ import (
 	batchv1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1"
 	batchv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1beta1"
 	certificatesv1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1"
+	certificatesv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1alpha1"
 	certificatesv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1beta1"
 	coordinationv1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1"
+	coordinationv1alpha2 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1alpha2"
 	coordinationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1beta1"
 	corev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
 	discoveryv1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1"
@@ -61,7 +58,7 @@ import (
 	eventsv1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1"
 	eventsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1beta1"
 	extensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
-	flowcontrolv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1alpha1"
+	flowcontrolv1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1"
 	flowcontrolv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta1"
 	flowcontrolv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta2"
 	flowcontrolv1beta3 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta3"
@@ -76,13 +73,17 @@ import (
 	rbacv1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1"
 	rbacv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1alpha1"
 	rbacv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1beta1"
-	resourcev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha1"
+	resourcev1alpha3 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha3"
+	resourcev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta1"
+	resourcev1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta2"
 	schedulingv1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1"
 	schedulingv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1alpha1"
 	schedulingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1beta1"
 	storagev1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1"
 	storagev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1alpha1"
 	storagev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1beta1"
+	storagemigrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storagemigration/v1alpha1"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 type ClusterInterface interface {
@@ -91,6 +92,7 @@ type ClusterInterface interface {
 	AdmissionregistrationV1() admissionregistrationv1.AdmissionregistrationV1ClusterInterface
 	AdmissionregistrationV1alpha1() admissionregistrationv1alpha1.AdmissionregistrationV1alpha1ClusterInterface
 	AdmissionregistrationV1beta1() admissionregistrationv1beta1.AdmissionregistrationV1beta1ClusterInterface
+	InternalV1alpha1() internalv1alpha1.InternalV1alpha1ClusterInterface
 	AppsV1() appsv1.AppsV1ClusterInterface
 	AppsV1beta1() appsv1beta1.AppsV1beta1ClusterInterface
 	AppsV1beta2() appsv1beta2.AppsV1beta2ClusterInterface
@@ -106,8 +108,10 @@ type ClusterInterface interface {
 	BatchV1() batchv1.BatchV1ClusterInterface
 	BatchV1beta1() batchv1beta1.BatchV1beta1ClusterInterface
 	CertificatesV1() certificatesv1.CertificatesV1ClusterInterface
+	CertificatesV1alpha1() certificatesv1alpha1.CertificatesV1alpha1ClusterInterface
 	CertificatesV1beta1() certificatesv1beta1.CertificatesV1beta1ClusterInterface
 	CoordinationV1() coordinationv1.CoordinationV1ClusterInterface
+	CoordinationV1alpha2() coordinationv1alpha2.CoordinationV1alpha2ClusterInterface
 	CoordinationV1beta1() coordinationv1beta1.CoordinationV1beta1ClusterInterface
 	CoreV1() corev1.CoreV1ClusterInterface
 	DiscoveryV1() discoveryv1.DiscoveryV1ClusterInterface
@@ -115,11 +119,10 @@ type ClusterInterface interface {
 	EventsV1() eventsv1.EventsV1ClusterInterface
 	EventsV1beta1() eventsv1beta1.EventsV1beta1ClusterInterface
 	ExtensionsV1beta1() extensionsv1beta1.ExtensionsV1beta1ClusterInterface
-	FlowcontrolV1alpha1() flowcontrolv1alpha1.FlowcontrolV1alpha1ClusterInterface
+	FlowcontrolV1() flowcontrolv1.FlowcontrolV1ClusterInterface
 	FlowcontrolV1beta1() flowcontrolv1beta1.FlowcontrolV1beta1ClusterInterface
 	FlowcontrolV1beta2() flowcontrolv1beta2.FlowcontrolV1beta2ClusterInterface
 	FlowcontrolV1beta3() flowcontrolv1beta3.FlowcontrolV1beta3ClusterInterface
-	InternalV1alpha1() internalv1alpha1.InternalV1alpha1ClusterInterface
 	NetworkingV1() networkingv1.NetworkingV1ClusterInterface
 	NetworkingV1alpha1() networkingv1alpha1.NetworkingV1alpha1ClusterInterface
 	NetworkingV1beta1() networkingv1beta1.NetworkingV1beta1ClusterInterface
@@ -131,22 +134,26 @@ type ClusterInterface interface {
 	RbacV1() rbacv1.RbacV1ClusterInterface
 	RbacV1alpha1() rbacv1alpha1.RbacV1alpha1ClusterInterface
 	RbacV1beta1() rbacv1beta1.RbacV1beta1ClusterInterface
-	ResourceV1alpha1() resourcev1alpha1.ResourceV1alpha1ClusterInterface
+	ResourceV1alpha3() resourcev1alpha3.ResourceV1alpha3ClusterInterface
+	ResourceV1beta1() resourcev1beta1.ResourceV1beta1ClusterInterface
+	ResourceV1beta2() resourcev1beta2.ResourceV1beta2ClusterInterface
 	SchedulingV1() schedulingv1.SchedulingV1ClusterInterface
 	SchedulingV1alpha1() schedulingv1alpha1.SchedulingV1alpha1ClusterInterface
 	SchedulingV1beta1() schedulingv1beta1.SchedulingV1beta1ClusterInterface
 	StorageV1() storagev1.StorageV1ClusterInterface
 	StorageV1alpha1() storagev1alpha1.StorageV1alpha1ClusterInterface
 	StorageV1beta1() storagev1beta1.StorageV1beta1ClusterInterface
+	StoragemigrationV1alpha1() storagemigrationv1alpha1.StoragemigrationV1alpha1ClusterInterface
 }
 
-// ClusterClientset contains the clients for groups.
+// ClusterClientset contains the cluster clients for groups.
 type ClusterClientset struct {
 	*discovery.DiscoveryClient
 	clientCache                   kcpclient.Cache[*client.Clientset]
 	admissionregistrationV1       *admissionregistrationv1.AdmissionregistrationV1ClusterClient
 	admissionregistrationV1alpha1 *admissionregistrationv1alpha1.AdmissionregistrationV1alpha1ClusterClient
 	admissionregistrationV1beta1  *admissionregistrationv1beta1.AdmissionregistrationV1beta1ClusterClient
+	internalV1alpha1              *internalv1alpha1.InternalV1alpha1ClusterClient
 	appsV1                        *appsv1.AppsV1ClusterClient
 	appsV1beta1                   *appsv1beta1.AppsV1beta1ClusterClient
 	appsV1beta2                   *appsv1beta2.AppsV1beta2ClusterClient
@@ -162,8 +169,10 @@ type ClusterClientset struct {
 	batchV1                       *batchv1.BatchV1ClusterClient
 	batchV1beta1                  *batchv1beta1.BatchV1beta1ClusterClient
 	certificatesV1                *certificatesv1.CertificatesV1ClusterClient
+	certificatesV1alpha1          *certificatesv1alpha1.CertificatesV1alpha1ClusterClient
 	certificatesV1beta1           *certificatesv1beta1.CertificatesV1beta1ClusterClient
 	coordinationV1                *coordinationv1.CoordinationV1ClusterClient
+	coordinationV1alpha2          *coordinationv1alpha2.CoordinationV1alpha2ClusterClient
 	coordinationV1beta1           *coordinationv1beta1.CoordinationV1beta1ClusterClient
 	coreV1                        *corev1.CoreV1ClusterClient
 	discoveryV1                   *discoveryv1.DiscoveryV1ClusterClient
@@ -171,11 +180,10 @@ type ClusterClientset struct {
 	eventsV1                      *eventsv1.EventsV1ClusterClient
 	eventsV1beta1                 *eventsv1beta1.EventsV1beta1ClusterClient
 	extensionsV1beta1             *extensionsv1beta1.ExtensionsV1beta1ClusterClient
-	flowcontrolV1alpha1           *flowcontrolv1alpha1.FlowcontrolV1alpha1ClusterClient
+	flowcontrolV1                 *flowcontrolv1.FlowcontrolV1ClusterClient
 	flowcontrolV1beta1            *flowcontrolv1beta1.FlowcontrolV1beta1ClusterClient
 	flowcontrolV1beta2            *flowcontrolv1beta2.FlowcontrolV1beta2ClusterClient
 	flowcontrolV1beta3            *flowcontrolv1beta3.FlowcontrolV1beta3ClusterClient
-	internalV1alpha1              *internalv1alpha1.InternalV1alpha1ClusterClient
 	networkingV1                  *networkingv1.NetworkingV1ClusterClient
 	networkingV1alpha1            *networkingv1alpha1.NetworkingV1alpha1ClusterClient
 	networkingV1beta1             *networkingv1beta1.NetworkingV1beta1ClusterClient
@@ -187,16 +195,19 @@ type ClusterClientset struct {
 	rbacV1                        *rbacv1.RbacV1ClusterClient
 	rbacV1alpha1                  *rbacv1alpha1.RbacV1alpha1ClusterClient
 	rbacV1beta1                   *rbacv1beta1.RbacV1beta1ClusterClient
-	resourceV1alpha1              *resourcev1alpha1.ResourceV1alpha1ClusterClient
+	resourceV1alpha3              *resourcev1alpha3.ResourceV1alpha3ClusterClient
+	resourceV1beta1               *resourcev1beta1.ResourceV1beta1ClusterClient
+	resourceV1beta2               *resourcev1beta2.ResourceV1beta2ClusterClient
 	schedulingV1                  *schedulingv1.SchedulingV1ClusterClient
 	schedulingV1alpha1            *schedulingv1alpha1.SchedulingV1alpha1ClusterClient
 	schedulingV1beta1             *schedulingv1beta1.SchedulingV1beta1ClusterClient
 	storageV1                     *storagev1.StorageV1ClusterClient
 	storageV1alpha1               *storagev1alpha1.StorageV1alpha1ClusterClient
 	storageV1beta1                *storagev1beta1.StorageV1beta1ClusterClient
+	storagemigrationV1alpha1      *storagemigrationv1alpha1.StoragemigrationV1alpha1ClusterClient
 }
 
-// Discovery retrieves the DiscoveryClient
+// Discovery retrieves the DiscoveryClient.
 func (c *ClusterClientset) Discovery() discovery.DiscoveryInterface {
 	if c == nil {
 		return nil
@@ -219,6 +230,11 @@ func (c *ClusterClientset) AdmissionregistrationV1beta1() admissionregistrationv
 	return c.admissionregistrationV1beta1
 }
 
+// InternalV1alpha1 retrieves the InternalV1alpha1ClusterClient.
+func (c *ClusterClientset) InternalV1alpha1() internalv1alpha1.InternalV1alpha1ClusterInterface {
+	return c.internalV1alpha1
+}
+
 // AppsV1 retrieves the AppsV1ClusterClient.
 func (c *ClusterClientset) AppsV1() appsv1.AppsV1ClusterInterface {
 	return c.appsV1
@@ -294,6 +310,11 @@ func (c *ClusterClientset) CertificatesV1() certificatesv1.CertificatesV1Cluster
 	return c.certificatesV1
 }
 
+// CertificatesV1alpha1 retrieves the CertificatesV1alpha1ClusterClient.
+func (c *ClusterClientset) CertificatesV1alpha1() certificatesv1alpha1.CertificatesV1alpha1ClusterInterface {
+	return c.certificatesV1alpha1
+}
+
 // CertificatesV1beta1 retrieves the CertificatesV1beta1ClusterClient.
 func (c *ClusterClientset) CertificatesV1beta1() certificatesv1beta1.CertificatesV1beta1ClusterInterface {
 	return c.certificatesV1beta1
@@ -304,6 +325,11 @@ func (c *ClusterClientset) CoordinationV1() coordinationv1.CoordinationV1Cluster
 	return c.coordinationV1
 }
 
+// CoordinationV1alpha2 retrieves the CoordinationV1alpha2ClusterClient.
+func (c *ClusterClientset) CoordinationV1alpha2() coordinationv1alpha2.CoordinationV1alpha2ClusterInterface {
+	return c.coordinationV1alpha2
+}
+
 // CoordinationV1beta1 retrieves the CoordinationV1beta1ClusterClient.
 func (c *ClusterClientset) CoordinationV1beta1() coordinationv1beta1.CoordinationV1beta1ClusterInterface {
 	return c.coordinationV1beta1
@@ -339,9 +365,9 @@ func (c *ClusterClientset) ExtensionsV1beta1() extensionsv1beta1.ExtensionsV1bet
 	return c.extensionsV1beta1
 }
 
-// FlowcontrolV1alpha1 retrieves the FlowcontrolV1alpha1ClusterClient.
-func (c *ClusterClientset) FlowcontrolV1alpha1() flowcontrolv1alpha1.FlowcontrolV1alpha1ClusterInterface {
-	return c.flowcontrolV1alpha1
+// FlowcontrolV1 retrieves the FlowcontrolV1ClusterClient.
+func (c *ClusterClientset) FlowcontrolV1() flowcontrolv1.FlowcontrolV1ClusterInterface {
+	return c.flowcontrolV1
 }
 
 // FlowcontrolV1beta1 retrieves the FlowcontrolV1beta1ClusterClient.
@@ -359,11 +385,6 @@ func (c *ClusterClientset) FlowcontrolV1beta3() flowcontrolv1beta3.FlowcontrolV1
 	return c.flowcontrolV1beta3
 }
 
-// InternalV1alpha1 retrieves the InternalV1alpha1ClusterClient.
-func (c *ClusterClientset) InternalV1alpha1() internalv1alpha1.InternalV1alpha1ClusterInterface {
-	return c.internalV1alpha1
-}
-
 // NetworkingV1 retrieves the NetworkingV1ClusterClient.
 func (c *ClusterClientset) NetworkingV1() networkingv1.NetworkingV1ClusterInterface {
 	return c.networkingV1
@@ -419,9 +440,19 @@ func (c *ClusterClientset) RbacV1beta1() rbacv1beta1.RbacV1beta1ClusterInterface
 	return c.rbacV1beta1
 }
 
-// ResourceV1alpha1 retrieves the ResourceV1alpha1ClusterClient.
-func (c *ClusterClientset) ResourceV1alpha1() resourcev1alpha1.ResourceV1alpha1ClusterInterface {
-	return c.resourceV1alpha1
+// ResourceV1alpha3 retrieves the ResourceV1alpha3ClusterClient.
+func (c *ClusterClientset) ResourceV1alpha3() resourcev1alpha3.ResourceV1alpha3ClusterInterface {
+	return c.resourceV1alpha3
+}
+
+// ResourceV1beta1 retrieves the ResourceV1beta1ClusterClient.
+func (c *ClusterClientset) ResourceV1beta1() resourcev1beta1.ResourceV1beta1ClusterInterface {
+	return c.resourceV1beta1
+}
+
+// ResourceV1beta2 retrieves the ResourceV1beta2ClusterClient.
+func (c *ClusterClientset) ResourceV1beta2() resourcev1beta2.ResourceV1beta2ClusterInterface {
+	return c.resourceV1beta2
 }
 
 // SchedulingV1 retrieves the SchedulingV1ClusterClient.
@@ -454,6 +485,11 @@ func (c *ClusterClientset) StorageV1beta1() storagev1beta1.StorageV1beta1Cluster
 	return c.storageV1beta1
 }
 
+// StoragemigrationV1alpha1 retrieves the StoragemigrationV1alpha1ClusterClient.
+func (c *ClusterClientset) StoragemigrationV1alpha1() storagemigrationv1alpha1.StoragemigrationV1alpha1ClusterInterface {
+	return c.storagemigrationV1alpha1
+}
+
 // Cluster scopes this clientset to one cluster.
 func (c *ClusterClientset) Cluster(clusterPath logicalcluster.Path) client.Interface {
 	if clusterPath == logicalcluster.Wildcard {
@@ -518,6 +554,10 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*ClusterCli
 	if err != nil {
 		return nil, err
 	}
+	cs.internalV1alpha1, err = internalv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
 	cs.appsV1, err = appsv1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
@@ -578,6 +618,10 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*ClusterCli
 	if err != nil {
 		return nil, err
 	}
+	cs.certificatesV1alpha1, err = certificatesv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
 	cs.certificatesV1beta1, err = certificatesv1beta1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
@@ -586,6 +630,10 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*ClusterCli
 	if err != nil {
 		return nil, err
 	}
+	cs.coordinationV1alpha2, err = coordinationv1alpha2.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
 	cs.coordinationV1beta1, err = coordinationv1beta1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
@@ -614,7 +662,7 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*ClusterCli
 	if err != nil {
 		return nil, err
 	}
-	cs.flowcontrolV1alpha1, err = flowcontrolv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	cs.flowcontrolV1, err = flowcontrolv1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
@@ -630,10 +678,6 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*ClusterCli
 	if err != nil {
 		return nil, err
 	}
-	cs.internalV1alpha1, err = internalv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
-	if err != nil {
-		return nil, err
-	}
 	cs.networkingV1, err = networkingv1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
@@ -678,7 +722,15 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*ClusterCli
 	if err != nil {
 		return nil, err
 	}
-	cs.resourceV1alpha1, err = resourcev1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	cs.resourceV1alpha3, err = resourcev1alpha3.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	cs.resourceV1beta1, err = resourcev1beta1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	cs.resourceV1beta2, err = resourcev1beta2.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
@@ -706,6 +758,10 @@ func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*ClusterCli
 	if err != nil {
 		return nil, err
 	}
+	cs.storagemigrationV1alpha1, err = storagemigrationv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
 
 	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
@@ -723,3 +779,66 @@ func NewForConfigOrDie(c *rest.Config) *ClusterClientset {
 	}
 	return cs
 }
+
+// New creates a new ClusterClientset for the given RESTClient.
+func New(c *rest.Config) *ClusterClientset {
+	var cs ClusterClientset
+	cs.admissionregistrationV1 = admissionregistrationv1.NewForConfigOrDie(c)
+	cs.admissionregistrationV1alpha1 = admissionregistrationv1alpha1.NewForConfigOrDie(c)
+	cs.admissionregistrationV1beta1 = admissionregistrationv1beta1.NewForConfigOrDie(c)
+	cs.internalV1alpha1 = internalv1alpha1.NewForConfigOrDie(c)
+	cs.appsV1 = appsv1.NewForConfigOrDie(c)
+	cs.appsV1beta1 = appsv1beta1.NewForConfigOrDie(c)
+	cs.appsV1beta2 = appsv1beta2.NewForConfigOrDie(c)
+	cs.authenticationV1 = authenticationv1.NewForConfigOrDie(c)
+	cs.authenticationV1alpha1 = authenticationv1alpha1.NewForConfigOrDie(c)
+	cs.authenticationV1beta1 = authenticationv1beta1.NewForConfigOrDie(c)
+	cs.authorizationV1 = authorizationv1.NewForConfigOrDie(c)
+	cs.authorizationV1beta1 = authorizationv1beta1.NewForConfigOrDie(c)
+	cs.autoscalingV1 = autoscalingv1.NewForConfigOrDie(c)
+	cs.autoscalingV2 = autoscalingv2.NewForConfigOrDie(c)
+	cs.autoscalingV2beta1 = autoscalingv2beta1.NewForConfigOrDie(c)
+	cs.autoscalingV2beta2 = autoscalingv2beta2.NewForConfigOrDie(c)
+	cs.batchV1 = batchv1.NewForConfigOrDie(c)
+	cs.batchV1beta1 = batchv1beta1.NewForConfigOrDie(c)
+	cs.certificatesV1 = certificatesv1.NewForConfigOrDie(c)
+	cs.certificatesV1alpha1 = certificatesv1alpha1.NewForConfigOrDie(c)
+	cs.certificatesV1beta1 = certificatesv1beta1.NewForConfigOrDie(c)
+	cs.coordinationV1 = coordinationv1.NewForConfigOrDie(c)
+	cs.coordinationV1alpha2 = coordinationv1alpha2.NewForConfigOrDie(c)
+	cs.coordinationV1beta1 = coordinationv1beta1.NewForConfigOrDie(c)
+	cs.coreV1 = corev1.NewForConfigOrDie(c)
+	cs.discoveryV1 = discoveryv1.NewForConfigOrDie(c)
+	cs.discoveryV1beta1 = discoveryv1beta1.NewForConfigOrDie(c)
+	cs.eventsV1 = eventsv1.NewForConfigOrDie(c)
+	cs.eventsV1beta1 = eventsv1beta1.NewForConfigOrDie(c)
+	cs.extensionsV1beta1 = extensionsv1beta1.NewForConfigOrDie(c)
+	cs.flowcontrolV1 = flowcontrolv1.NewForConfigOrDie(c)
+	cs.flowcontrolV1beta1 = flowcontrolv1beta1.NewForConfigOrDie(c)
+	cs.flowcontrolV1beta2 = flowcontrolv1beta2.NewForConfigOrDie(c)
+	cs.flowcontrolV1beta3 = flowcontrolv1beta3.NewForConfigOrDie(c)
+	cs.networkingV1 = networkingv1.NewForConfigOrDie(c)
+	cs.networkingV1alpha1 = networkingv1alpha1.NewForConfigOrDie(c)
+	cs.networkingV1beta1 = networkingv1beta1.NewForConfigOrDie(c)
+	cs.nodeV1 = nodev1.NewForConfigOrDie(c)
+	cs.nodeV1alpha1 = nodev1alpha1.NewForConfigOrDie(c)
+	cs.nodeV1beta1 = nodev1beta1.NewForConfigOrDie(c)
+	cs.policyV1 = policyv1.NewForConfigOrDie(c)
+	cs.policyV1beta1 = policyv1beta1.NewForConfigOrDie(c)
+	cs.rbacV1 = rbacv1.NewForConfigOrDie(c)
+	cs.rbacV1alpha1 = rbacv1alpha1.NewForConfigOrDie(c)
+	cs.rbacV1beta1 = rbacv1beta1.NewForConfigOrDie(c)
+	cs.resourceV1alpha3 = resourcev1alpha3.NewForConfigOrDie(c)
+	cs.resourceV1beta1 = resourcev1beta1.NewForConfigOrDie(c)
+	cs.resourceV1beta2 = resourcev1beta2.NewForConfigOrDie(c)
+	cs.schedulingV1 = schedulingv1.NewForConfigOrDie(c)
+	cs.schedulingV1alpha1 = schedulingv1alpha1.NewForConfigOrDie(c)
+	cs.schedulingV1beta1 = schedulingv1beta1.NewForConfigOrDie(c)
+	cs.storageV1 = storagev1.NewForConfigOrDie(c)
+	cs.storageV1alpha1 = storagev1alpha1.NewForConfigOrDie(c)
+	cs.storageV1beta1 = storagev1beta1.NewForConfigOrDie(c)
+	cs.storagemigrationV1alpha1 = storagemigrationv1alpha1.NewForConfigOrDie(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c)
+	return &cs
+}
diff --git a/kubernetes/fake/clientset.go b/kubernetes/fake/clientset.go
index 32878b597..29ca15296 100644
--- a/kubernetes/fake/clientset.go
+++ b/kubernetes/fake/clientset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,17 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	"k8s.io/apimachinery/pkg/runtime"
+	applyconfigurations "k8s.io/client-go/applyconfigurations"
 	"k8s.io/client-go/discovery"
-	client "k8s.io/client-go/kubernetes"
-	clientscheme "k8s.io/client-go/kubernetes/scheme"
+	clientset "k8s.io/client-go/kubernetes"
 	admissionregistrationv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
 	admissionregistrationv1alpha1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
 	admissionregistrationv1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
@@ -47,8 +42,10 @@ import (
 	batchv1 "k8s.io/client-go/kubernetes/typed/batch/v1"
 	batchv1beta1 "k8s.io/client-go/kubernetes/typed/batch/v1beta1"
 	certificatesv1 "k8s.io/client-go/kubernetes/typed/certificates/v1"
+	certificatesv1alpha1 "k8s.io/client-go/kubernetes/typed/certificates/v1alpha1"
 	certificatesv1beta1 "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
 	coordinationv1 "k8s.io/client-go/kubernetes/typed/coordination/v1"
+	coordinationv1alpha2 "k8s.io/client-go/kubernetes/typed/coordination/v1alpha2"
 	coordinationv1beta1 "k8s.io/client-go/kubernetes/typed/coordination/v1beta1"
 	corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 	discoveryv1 "k8s.io/client-go/kubernetes/typed/discovery/v1"
@@ -56,7 +53,7 @@ import (
 	eventsv1 "k8s.io/client-go/kubernetes/typed/events/v1"
 	eventsv1beta1 "k8s.io/client-go/kubernetes/typed/events/v1beta1"
 	extensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
-	flowcontrolv1alpha1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1alpha1"
+	flowcontrolv1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1"
 	flowcontrolv1beta1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
 	flowcontrolv1beta2 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
 	flowcontrolv1beta3 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
@@ -71,144 +68,163 @@ import (
 	rbacv1 "k8s.io/client-go/kubernetes/typed/rbac/v1"
 	rbacv1alpha1 "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 	rbacv1beta1 "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
-	resourcev1alpha1 "k8s.io/client-go/kubernetes/typed/resource/v1alpha1"
+	resourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
+	resourcev1beta1 "k8s.io/client-go/kubernetes/typed/resource/v1beta1"
+	resourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2"
 	schedulingv1 "k8s.io/client-go/kubernetes/typed/scheduling/v1"
 	schedulingv1alpha1 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha1"
 	schedulingv1beta1 "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1"
 	storagev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
 	storagev1alpha1 "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
 	storagev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
+	storagemigrationv1alpha1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1alpha1"
 
-	kcpclient "github.com/kcp-dev/client-go/kubernetes"
+	kcpclientset "github.com/kcp-dev/client-go/kubernetes"
+	kcpclientscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	kcpadmissionregistrationv1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1"
-	fakeadmissionregistrationv1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1/fake"
+	kcpfakeadmissionregistrationv1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1/fake"
 	kcpadmissionregistrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1alpha1"
-	fakeadmissionregistrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1alpha1/fake"
+	kcpfakeadmissionregistrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1alpha1/fake"
 	kcpadmissionregistrationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1beta1"
-	fakeadmissionregistrationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1beta1/fake"
+	kcpfakeadmissionregistrationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1beta1/fake"
 	kcpinternalv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/apiserverinternal/v1alpha1"
-	fakeinternalv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/apiserverinternal/v1alpha1/fake"
+	kcpfakeinternalv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/apiserverinternal/v1alpha1/fake"
 	kcpappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1"
-	fakeappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1/fake"
+	kcpfakeappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1/fake"
 	kcpappsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta1"
-	fakeappsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta1/fake"
+	kcpfakeappsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta1/fake"
 	kcpappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2"
-	fakeappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2/fake"
+	kcpfakeappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2/fake"
 	kcpauthenticationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1"
-	fakeauthenticationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1/fake"
+	kcpfakeauthenticationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1/fake"
 	kcpauthenticationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1alpha1"
-	fakeauthenticationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1alpha1/fake"
+	kcpfakeauthenticationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1alpha1/fake"
 	kcpauthenticationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1beta1"
-	fakeauthenticationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1beta1/fake"
+	kcpfakeauthenticationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1beta1/fake"
 	kcpauthorizationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1"
-	fakeauthorizationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1/fake"
+	kcpfakeauthorizationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1/fake"
 	kcpauthorizationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1beta1"
-	fakeauthorizationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1beta1/fake"
+	kcpfakeauthorizationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1beta1/fake"
 	kcpautoscalingv1 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v1"
-	fakeautoscalingv1 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v1/fake"
+	kcpfakeautoscalingv1 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v1/fake"
 	kcpautoscalingv2 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2"
-	fakeautoscalingv2 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2/fake"
+	kcpfakeautoscalingv2 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2/fake"
 	kcpautoscalingv2beta1 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2beta1"
-	fakeautoscalingv2beta1 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2beta1/fake"
+	kcpfakeautoscalingv2beta1 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2beta1/fake"
 	kcpautoscalingv2beta2 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2beta2"
-	fakeautoscalingv2beta2 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2beta2/fake"
+	kcpfakeautoscalingv2beta2 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2beta2/fake"
 	kcpbatchv1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1"
-	fakebatchv1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1/fake"
+	kcpfakebatchv1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1/fake"
 	kcpbatchv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1beta1"
-	fakebatchv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1beta1/fake"
+	kcpfakebatchv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1beta1/fake"
 	kcpcertificatesv1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1"
-	fakecertificatesv1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1/fake"
+	kcpfakecertificatesv1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1/fake"
+	kcpcertificatesv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1alpha1"
+	kcpfakecertificatesv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1alpha1/fake"
 	kcpcertificatesv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1beta1"
-	fakecertificatesv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1beta1/fake"
+	kcpfakecertificatesv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1beta1/fake"
 	kcpcoordinationv1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1"
-	fakecoordinationv1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1/fake"
+	kcpfakecoordinationv1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1/fake"
+	kcpcoordinationv1alpha2 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1alpha2"
+	kcpfakecoordinationv1alpha2 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1alpha2/fake"
 	kcpcoordinationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1beta1"
-	fakecoordinationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1beta1/fake"
+	kcpfakecoordinationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1beta1/fake"
 	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
-	fakecorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1/fake"
+	kcpfakecorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1/fake"
 	kcpdiscoveryv1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1"
-	fakediscoveryv1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1/fake"
+	kcpfakediscoveryv1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1/fake"
 	kcpdiscoveryv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1beta1"
-	fakediscoveryv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1beta1/fake"
+	kcpfakediscoveryv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1beta1/fake"
 	kcpeventsv1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1"
-	fakeeventsv1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1/fake"
+	kcpfakeeventsv1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1/fake"
 	kcpeventsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1beta1"
-	fakeeventsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1beta1/fake"
+	kcpfakeeventsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1beta1/fake"
 	kcpextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
-	fakeextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1/fake"
-	kcpflowcontrolv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1alpha1"
-	fakeflowcontrolv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1alpha1/fake"
+	kcpfakeextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1/fake"
+	kcpflowcontrolv1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1"
+	kcpfakeflowcontrolv1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1/fake"
 	kcpflowcontrolv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta1"
-	fakeflowcontrolv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta1/fake"
+	kcpfakeflowcontrolv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta1/fake"
 	kcpflowcontrolv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta2"
-	fakeflowcontrolv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta2/fake"
+	kcpfakeflowcontrolv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta2/fake"
 	kcpflowcontrolv1beta3 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta3"
-	fakeflowcontrolv1beta3 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta3/fake"
+	kcpfakeflowcontrolv1beta3 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta3/fake"
 	kcpnetworkingv1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1"
-	fakenetworkingv1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1/fake"
+	kcpfakenetworkingv1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1/fake"
 	kcpnetworkingv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1alpha1"
-	fakenetworkingv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1alpha1/fake"
+	kcpfakenetworkingv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1alpha1/fake"
 	kcpnetworkingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1beta1"
-	fakenetworkingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1beta1/fake"
+	kcpfakenetworkingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1beta1/fake"
 	kcpnodev1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1"
-	fakenodev1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1/fake"
+	kcpfakenodev1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1/fake"
 	kcpnodev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1alpha1"
-	fakenodev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1alpha1/fake"
+	kcpfakenodev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1alpha1/fake"
 	kcpnodev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1beta1"
-	fakenodev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1beta1/fake"
+	kcpfakenodev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1beta1/fake"
 	kcppolicyv1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1"
-	fakepolicyv1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1/fake"
+	kcpfakepolicyv1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1/fake"
 	kcppolicyv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1beta1"
-	fakepolicyv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1beta1/fake"
+	kcpfakepolicyv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1beta1/fake"
 	kcprbacv1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1"
-	fakerbacv1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1/fake"
+	kcpfakerbacv1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1/fake"
 	kcprbacv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1alpha1"
-	fakerbacv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1alpha1/fake"
+	kcpfakerbacv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1alpha1/fake"
 	kcprbacv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1beta1"
-	fakerbacv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1beta1/fake"
-	kcpresourcev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha1"
-	fakeresourcev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha1/fake"
+	kcpfakerbacv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1beta1/fake"
+	kcpresourcev1alpha3 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha3"
+	kcpfakeresourcev1alpha3 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha3/fake"
+	kcpresourcev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta1"
+	kcpfakeresourcev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta1/fake"
+	kcpresourcev1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta2"
+	kcpfakeresourcev1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta2/fake"
 	kcpschedulingv1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1"
-	fakeschedulingv1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1/fake"
+	kcpfakeschedulingv1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1/fake"
 	kcpschedulingv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1alpha1"
-	fakeschedulingv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1alpha1/fake"
+	kcpfakeschedulingv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1alpha1/fake"
 	kcpschedulingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1beta1"
-	fakeschedulingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1beta1/fake"
+	kcpfakeschedulingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1beta1/fake"
 	kcpstoragev1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1"
-	fakestoragev1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1/fake"
+	kcpfakestoragev1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1/fake"
 	kcpstoragev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1alpha1"
-	fakestoragev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1alpha1/fake"
+	kcpfakestoragev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1alpha1/fake"
 	kcpstoragev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1beta1"
-	fakestoragev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1beta1/fake"
+	kcpfakestoragev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1beta1/fake"
+	kcpstoragemigrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storagemigration/v1alpha1"
+	kcpfakestoragemigrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storagemigration/v1alpha1/fake"
 	kcpfakediscovery "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/discovery/fake"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // NewSimpleClientset returns a clientset that will respond with the provided objects.
 // It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
-// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// without applying any field management, validations and/or defaults. It shouldn't be considered a replacement
 // for a real clientset and is mostly useful in simple unit tests.
+//
+// DEPRECATED: NewClientset replaces this with support for field management, which significantly improves
+// server side apply testing. NewClientset is only available when apply configurations are generated (e.g.
+// via --with-applyconfig).
 func NewSimpleClientset(objects ...runtime.Object) *ClusterClientset {
-	o := kcptesting.NewObjectTracker(clientscheme.Scheme, clientscheme.Codecs.UniversalDecoder())
+	o := kcptesting.NewObjectTracker(kcpclientscheme.Scheme, kcpclientscheme.Codecs.UniversalDecoder())
 	o.AddAll(objects...)
 
-	cs := &ClusterClientset{Fake: &kcptesting.Fake{}, tracker: o}
-	cs.discovery = &kcpfakediscovery.FakeDiscovery{Fake: cs.Fake, ClusterPath: logicalcluster.Wildcard}
+	cs := &ClusterClientset{Fake: kcptesting.Fake{}, tracker: o}
+	cs.discovery = &kcpfakediscovery.FakeDiscovery{Fake: &cs.Fake, ClusterPath: logicalcluster.Wildcard}
 	cs.AddReactor("*", "*", kcptesting.ObjectReaction(o))
 	cs.AddWatchReactor("*", kcptesting.WatchReaction(o))
 
 	return cs
 }
 
-var _ kcpclient.ClusterInterface = (*ClusterClientset)(nil)
-
 // ClusterClientset contains the clients for groups.
 type ClusterClientset struct {
-	*kcptesting.Fake
+	kcptesting.Fake
 	discovery *kcpfakediscovery.FakeDiscovery
 	tracker   kcptesting.ObjectTracker
 }
 
+var _ kcpclientset.ClusterInterface = (*ClusterClientset)(nil)
+
 // Discovery retrieves the DiscoveryClient
 func (c *ClusterClientset) Discovery() discovery.DiscoveryInterface {
 	return c.discovery
@@ -218,272 +234,297 @@ func (c *ClusterClientset) Tracker() kcptesting.ObjectTracker {
 	return c.tracker
 }
 
-// AdmissionregistrationV1 retrieves the AdmissionregistrationV1ClusterClient.
+// Cluster scopes this clientset to one cluster.
+func (c *ClusterClientset) Cluster(clusterPath logicalcluster.Path) clientset.Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return &Clientset{
+		Fake:        &c.Fake,
+		discovery:   &kcpfakediscovery.FakeDiscovery{Fake: &c.Fake, ClusterPath: clusterPath},
+		tracker:     c.tracker.Cluster(clusterPath),
+		clusterPath: clusterPath,
+	}
+}
+
+// AdmissionregistrationV1 retrieves the AdmissionregistrationV1ClusterClient
 func (c *ClusterClientset) AdmissionregistrationV1() kcpadmissionregistrationv1.AdmissionregistrationV1ClusterInterface {
-	return &fakeadmissionregistrationv1.AdmissionregistrationV1ClusterClient{Fake: c.Fake}
+	return &kcpfakeadmissionregistrationv1.AdmissionregistrationV1ClusterClient{Fake: &c.Fake}
 }
 
-// AdmissionregistrationV1alpha1 retrieves the AdmissionregistrationV1alpha1ClusterClient.
+// AdmissionregistrationV1alpha1 retrieves the AdmissionregistrationV1alpha1ClusterClient
 func (c *ClusterClientset) AdmissionregistrationV1alpha1() kcpadmissionregistrationv1alpha1.AdmissionregistrationV1alpha1ClusterInterface {
-	return &fakeadmissionregistrationv1alpha1.AdmissionregistrationV1alpha1ClusterClient{Fake: c.Fake}
+	return &kcpfakeadmissionregistrationv1alpha1.AdmissionregistrationV1alpha1ClusterClient{Fake: &c.Fake}
 }
 
-// AdmissionregistrationV1beta1 retrieves the AdmissionregistrationV1beta1ClusterClient.
+// AdmissionregistrationV1beta1 retrieves the AdmissionregistrationV1beta1ClusterClient
 func (c *ClusterClientset) AdmissionregistrationV1beta1() kcpadmissionregistrationv1beta1.AdmissionregistrationV1beta1ClusterInterface {
-	return &fakeadmissionregistrationv1beta1.AdmissionregistrationV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakeadmissionregistrationv1beta1.AdmissionregistrationV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// AppsV1 retrieves the AppsV1ClusterClient.
+// InternalV1alpha1 retrieves the InternalV1alpha1ClusterClient
+func (c *ClusterClientset) InternalV1alpha1() kcpinternalv1alpha1.InternalV1alpha1ClusterInterface {
+	return &kcpfakeinternalv1alpha1.InternalV1alpha1ClusterClient{Fake: &c.Fake}
+}
+
+// AppsV1 retrieves the AppsV1ClusterClient
 func (c *ClusterClientset) AppsV1() kcpappsv1.AppsV1ClusterInterface {
-	return &fakeappsv1.AppsV1ClusterClient{Fake: c.Fake}
+	return &kcpfakeappsv1.AppsV1ClusterClient{Fake: &c.Fake}
 }
 
-// AppsV1beta1 retrieves the AppsV1beta1ClusterClient.
+// AppsV1beta1 retrieves the AppsV1beta1ClusterClient
 func (c *ClusterClientset) AppsV1beta1() kcpappsv1beta1.AppsV1beta1ClusterInterface {
-	return &fakeappsv1beta1.AppsV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakeappsv1beta1.AppsV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// AppsV1beta2 retrieves the AppsV1beta2ClusterClient.
+// AppsV1beta2 retrieves the AppsV1beta2ClusterClient
 func (c *ClusterClientset) AppsV1beta2() kcpappsv1beta2.AppsV1beta2ClusterInterface {
-	return &fakeappsv1beta2.AppsV1beta2ClusterClient{Fake: c.Fake}
+	return &kcpfakeappsv1beta2.AppsV1beta2ClusterClient{Fake: &c.Fake}
 }
 
-// AuthenticationV1 retrieves the AuthenticationV1ClusterClient.
+// AuthenticationV1 retrieves the AuthenticationV1ClusterClient
 func (c *ClusterClientset) AuthenticationV1() kcpauthenticationv1.AuthenticationV1ClusterInterface {
-	return &fakeauthenticationv1.AuthenticationV1ClusterClient{Fake: c.Fake}
+	return &kcpfakeauthenticationv1.AuthenticationV1ClusterClient{Fake: &c.Fake}
 }
 
-// AuthenticationV1alpha1 retrieves the AuthenticationV1alpha1ClusterClient.
+// AuthenticationV1alpha1 retrieves the AuthenticationV1alpha1ClusterClient
 func (c *ClusterClientset) AuthenticationV1alpha1() kcpauthenticationv1alpha1.AuthenticationV1alpha1ClusterInterface {
-	return &fakeauthenticationv1alpha1.AuthenticationV1alpha1ClusterClient{Fake: c.Fake}
+	return &kcpfakeauthenticationv1alpha1.AuthenticationV1alpha1ClusterClient{Fake: &c.Fake}
 }
 
-// AuthenticationV1beta1 retrieves the AuthenticationV1beta1ClusterClient.
+// AuthenticationV1beta1 retrieves the AuthenticationV1beta1ClusterClient
 func (c *ClusterClientset) AuthenticationV1beta1() kcpauthenticationv1beta1.AuthenticationV1beta1ClusterInterface {
-	return &fakeauthenticationv1beta1.AuthenticationV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakeauthenticationv1beta1.AuthenticationV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// AuthorizationV1 retrieves the AuthorizationV1ClusterClient.
+// AuthorizationV1 retrieves the AuthorizationV1ClusterClient
 func (c *ClusterClientset) AuthorizationV1() kcpauthorizationv1.AuthorizationV1ClusterInterface {
-	return &fakeauthorizationv1.AuthorizationV1ClusterClient{Fake: c.Fake}
+	return &kcpfakeauthorizationv1.AuthorizationV1ClusterClient{Fake: &c.Fake}
 }
 
-// AuthorizationV1beta1 retrieves the AuthorizationV1beta1ClusterClient.
+// AuthorizationV1beta1 retrieves the AuthorizationV1beta1ClusterClient
 func (c *ClusterClientset) AuthorizationV1beta1() kcpauthorizationv1beta1.AuthorizationV1beta1ClusterInterface {
-	return &fakeauthorizationv1beta1.AuthorizationV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakeauthorizationv1beta1.AuthorizationV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// AutoscalingV1 retrieves the AutoscalingV1ClusterClient.
+// AutoscalingV1 retrieves the AutoscalingV1ClusterClient
 func (c *ClusterClientset) AutoscalingV1() kcpautoscalingv1.AutoscalingV1ClusterInterface {
-	return &fakeautoscalingv1.AutoscalingV1ClusterClient{Fake: c.Fake}
+	return &kcpfakeautoscalingv1.AutoscalingV1ClusterClient{Fake: &c.Fake}
 }
 
-// AutoscalingV2 retrieves the AutoscalingV2ClusterClient.
+// AutoscalingV2 retrieves the AutoscalingV2ClusterClient
 func (c *ClusterClientset) AutoscalingV2() kcpautoscalingv2.AutoscalingV2ClusterInterface {
-	return &fakeautoscalingv2.AutoscalingV2ClusterClient{Fake: c.Fake}
+	return &kcpfakeautoscalingv2.AutoscalingV2ClusterClient{Fake: &c.Fake}
 }
 
-// AutoscalingV2beta1 retrieves the AutoscalingV2beta1ClusterClient.
+// AutoscalingV2beta1 retrieves the AutoscalingV2beta1ClusterClient
 func (c *ClusterClientset) AutoscalingV2beta1() kcpautoscalingv2beta1.AutoscalingV2beta1ClusterInterface {
-	return &fakeautoscalingv2beta1.AutoscalingV2beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakeautoscalingv2beta1.AutoscalingV2beta1ClusterClient{Fake: &c.Fake}
 }
 
-// AutoscalingV2beta2 retrieves the AutoscalingV2beta2ClusterClient.
+// AutoscalingV2beta2 retrieves the AutoscalingV2beta2ClusterClient
 func (c *ClusterClientset) AutoscalingV2beta2() kcpautoscalingv2beta2.AutoscalingV2beta2ClusterInterface {
-	return &fakeautoscalingv2beta2.AutoscalingV2beta2ClusterClient{Fake: c.Fake}
+	return &kcpfakeautoscalingv2beta2.AutoscalingV2beta2ClusterClient{Fake: &c.Fake}
 }
 
-// BatchV1 retrieves the BatchV1ClusterClient.
+// BatchV1 retrieves the BatchV1ClusterClient
 func (c *ClusterClientset) BatchV1() kcpbatchv1.BatchV1ClusterInterface {
-	return &fakebatchv1.BatchV1ClusterClient{Fake: c.Fake}
+	return &kcpfakebatchv1.BatchV1ClusterClient{Fake: &c.Fake}
 }
 
-// BatchV1beta1 retrieves the BatchV1beta1ClusterClient.
+// BatchV1beta1 retrieves the BatchV1beta1ClusterClient
 func (c *ClusterClientset) BatchV1beta1() kcpbatchv1beta1.BatchV1beta1ClusterInterface {
-	return &fakebatchv1beta1.BatchV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakebatchv1beta1.BatchV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// CertificatesV1 retrieves the CertificatesV1ClusterClient.
+// CertificatesV1 retrieves the CertificatesV1ClusterClient
 func (c *ClusterClientset) CertificatesV1() kcpcertificatesv1.CertificatesV1ClusterInterface {
-	return &fakecertificatesv1.CertificatesV1ClusterClient{Fake: c.Fake}
+	return &kcpfakecertificatesv1.CertificatesV1ClusterClient{Fake: &c.Fake}
+}
+
+// CertificatesV1alpha1 retrieves the CertificatesV1alpha1ClusterClient
+func (c *ClusterClientset) CertificatesV1alpha1() kcpcertificatesv1alpha1.CertificatesV1alpha1ClusterInterface {
+	return &kcpfakecertificatesv1alpha1.CertificatesV1alpha1ClusterClient{Fake: &c.Fake}
 }
 
-// CertificatesV1beta1 retrieves the CertificatesV1beta1ClusterClient.
+// CertificatesV1beta1 retrieves the CertificatesV1beta1ClusterClient
 func (c *ClusterClientset) CertificatesV1beta1() kcpcertificatesv1beta1.CertificatesV1beta1ClusterInterface {
-	return &fakecertificatesv1beta1.CertificatesV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakecertificatesv1beta1.CertificatesV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// CoordinationV1 retrieves the CoordinationV1ClusterClient.
+// CoordinationV1 retrieves the CoordinationV1ClusterClient
 func (c *ClusterClientset) CoordinationV1() kcpcoordinationv1.CoordinationV1ClusterInterface {
-	return &fakecoordinationv1.CoordinationV1ClusterClient{Fake: c.Fake}
+	return &kcpfakecoordinationv1.CoordinationV1ClusterClient{Fake: &c.Fake}
 }
 
-// CoordinationV1beta1 retrieves the CoordinationV1beta1ClusterClient.
+// CoordinationV1alpha2 retrieves the CoordinationV1alpha2ClusterClient
+func (c *ClusterClientset) CoordinationV1alpha2() kcpcoordinationv1alpha2.CoordinationV1alpha2ClusterInterface {
+	return &kcpfakecoordinationv1alpha2.CoordinationV1alpha2ClusterClient{Fake: &c.Fake}
+}
+
+// CoordinationV1beta1 retrieves the CoordinationV1beta1ClusterClient
 func (c *ClusterClientset) CoordinationV1beta1() kcpcoordinationv1beta1.CoordinationV1beta1ClusterInterface {
-	return &fakecoordinationv1beta1.CoordinationV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakecoordinationv1beta1.CoordinationV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// CoreV1 retrieves the CoreV1ClusterClient.
+// CoreV1 retrieves the CoreV1ClusterClient
 func (c *ClusterClientset) CoreV1() kcpcorev1.CoreV1ClusterInterface {
-	return &fakecorev1.CoreV1ClusterClient{Fake: c.Fake}
+	return &kcpfakecorev1.CoreV1ClusterClient{Fake: &c.Fake}
 }
 
-// DiscoveryV1 retrieves the DiscoveryV1ClusterClient.
+// DiscoveryV1 retrieves the DiscoveryV1ClusterClient
 func (c *ClusterClientset) DiscoveryV1() kcpdiscoveryv1.DiscoveryV1ClusterInterface {
-	return &fakediscoveryv1.DiscoveryV1ClusterClient{Fake: c.Fake}
+	return &kcpfakediscoveryv1.DiscoveryV1ClusterClient{Fake: &c.Fake}
 }
 
-// DiscoveryV1beta1 retrieves the DiscoveryV1beta1ClusterClient.
+// DiscoveryV1beta1 retrieves the DiscoveryV1beta1ClusterClient
 func (c *ClusterClientset) DiscoveryV1beta1() kcpdiscoveryv1beta1.DiscoveryV1beta1ClusterInterface {
-	return &fakediscoveryv1beta1.DiscoveryV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakediscoveryv1beta1.DiscoveryV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// EventsV1 retrieves the EventsV1ClusterClient.
+// EventsV1 retrieves the EventsV1ClusterClient
 func (c *ClusterClientset) EventsV1() kcpeventsv1.EventsV1ClusterInterface {
-	return &fakeeventsv1.EventsV1ClusterClient{Fake: c.Fake}
+	return &kcpfakeeventsv1.EventsV1ClusterClient{Fake: &c.Fake}
 }
 
-// EventsV1beta1 retrieves the EventsV1beta1ClusterClient.
+// EventsV1beta1 retrieves the EventsV1beta1ClusterClient
 func (c *ClusterClientset) EventsV1beta1() kcpeventsv1beta1.EventsV1beta1ClusterInterface {
-	return &fakeeventsv1beta1.EventsV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakeeventsv1beta1.EventsV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// ExtensionsV1beta1 retrieves the ExtensionsV1beta1ClusterClient.
+// ExtensionsV1beta1 retrieves the ExtensionsV1beta1ClusterClient
 func (c *ClusterClientset) ExtensionsV1beta1() kcpextensionsv1beta1.ExtensionsV1beta1ClusterInterface {
-	return &fakeextensionsv1beta1.ExtensionsV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakeextensionsv1beta1.ExtensionsV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// FlowcontrolV1alpha1 retrieves the FlowcontrolV1alpha1ClusterClient.
-func (c *ClusterClientset) FlowcontrolV1alpha1() kcpflowcontrolv1alpha1.FlowcontrolV1alpha1ClusterInterface {
-	return &fakeflowcontrolv1alpha1.FlowcontrolV1alpha1ClusterClient{Fake: c.Fake}
+// FlowcontrolV1 retrieves the FlowcontrolV1ClusterClient
+func (c *ClusterClientset) FlowcontrolV1() kcpflowcontrolv1.FlowcontrolV1ClusterInterface {
+	return &kcpfakeflowcontrolv1.FlowcontrolV1ClusterClient{Fake: &c.Fake}
 }
 
-// FlowcontrolV1beta1 retrieves the FlowcontrolV1beta1ClusterClient.
+// FlowcontrolV1beta1 retrieves the FlowcontrolV1beta1ClusterClient
 func (c *ClusterClientset) FlowcontrolV1beta1() kcpflowcontrolv1beta1.FlowcontrolV1beta1ClusterInterface {
-	return &fakeflowcontrolv1beta1.FlowcontrolV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakeflowcontrolv1beta1.FlowcontrolV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// FlowcontrolV1beta2 retrieves the FlowcontrolV1beta2ClusterClient.
+// FlowcontrolV1beta2 retrieves the FlowcontrolV1beta2ClusterClient
 func (c *ClusterClientset) FlowcontrolV1beta2() kcpflowcontrolv1beta2.FlowcontrolV1beta2ClusterInterface {
-	return &fakeflowcontrolv1beta2.FlowcontrolV1beta2ClusterClient{Fake: c.Fake}
+	return &kcpfakeflowcontrolv1beta2.FlowcontrolV1beta2ClusterClient{Fake: &c.Fake}
 }
 
-// FlowcontrolV1beta3 retrieves the FlowcontrolV1beta3ClusterClient.
+// FlowcontrolV1beta3 retrieves the FlowcontrolV1beta3ClusterClient
 func (c *ClusterClientset) FlowcontrolV1beta3() kcpflowcontrolv1beta3.FlowcontrolV1beta3ClusterInterface {
-	return &fakeflowcontrolv1beta3.FlowcontrolV1beta3ClusterClient{Fake: c.Fake}
-}
-
-// InternalV1alpha1 retrieves the InternalV1alpha1ClusterClient.
-func (c *ClusterClientset) InternalV1alpha1() kcpinternalv1alpha1.InternalV1alpha1ClusterInterface {
-	return &fakeinternalv1alpha1.InternalV1alpha1ClusterClient{Fake: c.Fake}
+	return &kcpfakeflowcontrolv1beta3.FlowcontrolV1beta3ClusterClient{Fake: &c.Fake}
 }
 
-// NetworkingV1 retrieves the NetworkingV1ClusterClient.
+// NetworkingV1 retrieves the NetworkingV1ClusterClient
 func (c *ClusterClientset) NetworkingV1() kcpnetworkingv1.NetworkingV1ClusterInterface {
-	return &fakenetworkingv1.NetworkingV1ClusterClient{Fake: c.Fake}
+	return &kcpfakenetworkingv1.NetworkingV1ClusterClient{Fake: &c.Fake}
 }
 
-// NetworkingV1alpha1 retrieves the NetworkingV1alpha1ClusterClient.
+// NetworkingV1alpha1 retrieves the NetworkingV1alpha1ClusterClient
 func (c *ClusterClientset) NetworkingV1alpha1() kcpnetworkingv1alpha1.NetworkingV1alpha1ClusterInterface {
-	return &fakenetworkingv1alpha1.NetworkingV1alpha1ClusterClient{Fake: c.Fake}
+	return &kcpfakenetworkingv1alpha1.NetworkingV1alpha1ClusterClient{Fake: &c.Fake}
 }
 
-// NetworkingV1beta1 retrieves the NetworkingV1beta1ClusterClient.
+// NetworkingV1beta1 retrieves the NetworkingV1beta1ClusterClient
 func (c *ClusterClientset) NetworkingV1beta1() kcpnetworkingv1beta1.NetworkingV1beta1ClusterInterface {
-	return &fakenetworkingv1beta1.NetworkingV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakenetworkingv1beta1.NetworkingV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// NodeV1 retrieves the NodeV1ClusterClient.
+// NodeV1 retrieves the NodeV1ClusterClient
 func (c *ClusterClientset) NodeV1() kcpnodev1.NodeV1ClusterInterface {
-	return &fakenodev1.NodeV1ClusterClient{Fake: c.Fake}
+	return &kcpfakenodev1.NodeV1ClusterClient{Fake: &c.Fake}
 }
 
-// NodeV1alpha1 retrieves the NodeV1alpha1ClusterClient.
+// NodeV1alpha1 retrieves the NodeV1alpha1ClusterClient
 func (c *ClusterClientset) NodeV1alpha1() kcpnodev1alpha1.NodeV1alpha1ClusterInterface {
-	return &fakenodev1alpha1.NodeV1alpha1ClusterClient{Fake: c.Fake}
+	return &kcpfakenodev1alpha1.NodeV1alpha1ClusterClient{Fake: &c.Fake}
 }
 
-// NodeV1beta1 retrieves the NodeV1beta1ClusterClient.
+// NodeV1beta1 retrieves the NodeV1beta1ClusterClient
 func (c *ClusterClientset) NodeV1beta1() kcpnodev1beta1.NodeV1beta1ClusterInterface {
-	return &fakenodev1beta1.NodeV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakenodev1beta1.NodeV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// PolicyV1 retrieves the PolicyV1ClusterClient.
+// PolicyV1 retrieves the PolicyV1ClusterClient
 func (c *ClusterClientset) PolicyV1() kcppolicyv1.PolicyV1ClusterInterface {
-	return &fakepolicyv1.PolicyV1ClusterClient{Fake: c.Fake}
+	return &kcpfakepolicyv1.PolicyV1ClusterClient{Fake: &c.Fake}
 }
 
-// PolicyV1beta1 retrieves the PolicyV1beta1ClusterClient.
+// PolicyV1beta1 retrieves the PolicyV1beta1ClusterClient
 func (c *ClusterClientset) PolicyV1beta1() kcppolicyv1beta1.PolicyV1beta1ClusterInterface {
-	return &fakepolicyv1beta1.PolicyV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakepolicyv1beta1.PolicyV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// RbacV1 retrieves the RbacV1ClusterClient.
+// RbacV1 retrieves the RbacV1ClusterClient
 func (c *ClusterClientset) RbacV1() kcprbacv1.RbacV1ClusterInterface {
-	return &fakerbacv1.RbacV1ClusterClient{Fake: c.Fake}
+	return &kcpfakerbacv1.RbacV1ClusterClient{Fake: &c.Fake}
 }
 
-// RbacV1alpha1 retrieves the RbacV1alpha1ClusterClient.
+// RbacV1alpha1 retrieves the RbacV1alpha1ClusterClient
 func (c *ClusterClientset) RbacV1alpha1() kcprbacv1alpha1.RbacV1alpha1ClusterInterface {
-	return &fakerbacv1alpha1.RbacV1alpha1ClusterClient{Fake: c.Fake}
+	return &kcpfakerbacv1alpha1.RbacV1alpha1ClusterClient{Fake: &c.Fake}
 }
 
-// RbacV1beta1 retrieves the RbacV1beta1ClusterClient.
+// RbacV1beta1 retrieves the RbacV1beta1ClusterClient
 func (c *ClusterClientset) RbacV1beta1() kcprbacv1beta1.RbacV1beta1ClusterInterface {
-	return &fakerbacv1beta1.RbacV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakerbacv1beta1.RbacV1beta1ClusterClient{Fake: &c.Fake}
+}
+
+// ResourceV1alpha3 retrieves the ResourceV1alpha3ClusterClient
+func (c *ClusterClientset) ResourceV1alpha3() kcpresourcev1alpha3.ResourceV1alpha3ClusterInterface {
+	return &kcpfakeresourcev1alpha3.ResourceV1alpha3ClusterClient{Fake: &c.Fake}
+}
+
+// ResourceV1beta1 retrieves the ResourceV1beta1ClusterClient
+func (c *ClusterClientset) ResourceV1beta1() kcpresourcev1beta1.ResourceV1beta1ClusterInterface {
+	return &kcpfakeresourcev1beta1.ResourceV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// ResourceV1alpha1 retrieves the ResourceV1alpha1ClusterClient.
-func (c *ClusterClientset) ResourceV1alpha1() kcpresourcev1alpha1.ResourceV1alpha1ClusterInterface {
-	return &fakeresourcev1alpha1.ResourceV1alpha1ClusterClient{Fake: c.Fake}
+// ResourceV1beta2 retrieves the ResourceV1beta2ClusterClient
+func (c *ClusterClientset) ResourceV1beta2() kcpresourcev1beta2.ResourceV1beta2ClusterInterface {
+	return &kcpfakeresourcev1beta2.ResourceV1beta2ClusterClient{Fake: &c.Fake}
 }
 
-// SchedulingV1 retrieves the SchedulingV1ClusterClient.
+// SchedulingV1 retrieves the SchedulingV1ClusterClient
 func (c *ClusterClientset) SchedulingV1() kcpschedulingv1.SchedulingV1ClusterInterface {
-	return &fakeschedulingv1.SchedulingV1ClusterClient{Fake: c.Fake}
+	return &kcpfakeschedulingv1.SchedulingV1ClusterClient{Fake: &c.Fake}
 }
 
-// SchedulingV1alpha1 retrieves the SchedulingV1alpha1ClusterClient.
+// SchedulingV1alpha1 retrieves the SchedulingV1alpha1ClusterClient
 func (c *ClusterClientset) SchedulingV1alpha1() kcpschedulingv1alpha1.SchedulingV1alpha1ClusterInterface {
-	return &fakeschedulingv1alpha1.SchedulingV1alpha1ClusterClient{Fake: c.Fake}
+	return &kcpfakeschedulingv1alpha1.SchedulingV1alpha1ClusterClient{Fake: &c.Fake}
 }
 
-// SchedulingV1beta1 retrieves the SchedulingV1beta1ClusterClient.
+// SchedulingV1beta1 retrieves the SchedulingV1beta1ClusterClient
 func (c *ClusterClientset) SchedulingV1beta1() kcpschedulingv1beta1.SchedulingV1beta1ClusterInterface {
-	return &fakeschedulingv1beta1.SchedulingV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakeschedulingv1beta1.SchedulingV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// StorageV1 retrieves the StorageV1ClusterClient.
+// StorageV1 retrieves the StorageV1ClusterClient
 func (c *ClusterClientset) StorageV1() kcpstoragev1.StorageV1ClusterInterface {
-	return &fakestoragev1.StorageV1ClusterClient{Fake: c.Fake}
+	return &kcpfakestoragev1.StorageV1ClusterClient{Fake: &c.Fake}
 }
 
-// StorageV1alpha1 retrieves the StorageV1alpha1ClusterClient.
+// StorageV1alpha1 retrieves the StorageV1alpha1ClusterClient
 func (c *ClusterClientset) StorageV1alpha1() kcpstoragev1alpha1.StorageV1alpha1ClusterInterface {
-	return &fakestoragev1alpha1.StorageV1alpha1ClusterClient{Fake: c.Fake}
+	return &kcpfakestoragev1alpha1.StorageV1alpha1ClusterClient{Fake: &c.Fake}
 }
 
-// StorageV1beta1 retrieves the StorageV1beta1ClusterClient.
+// StorageV1beta1 retrieves the StorageV1beta1ClusterClient
 func (c *ClusterClientset) StorageV1beta1() kcpstoragev1beta1.StorageV1beta1ClusterInterface {
-	return &fakestoragev1beta1.StorageV1beta1ClusterClient{Fake: c.Fake}
+	return &kcpfakestoragev1beta1.StorageV1beta1ClusterClient{Fake: &c.Fake}
 }
 
-// Cluster scopes this clientset to one cluster.
-func (c *ClusterClientset) Cluster(clusterPath logicalcluster.Path) client.Interface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-	return &Clientset{
-		Fake:        c.Fake,
-		discovery:   &kcpfakediscovery.FakeDiscovery{Fake: c.Fake, ClusterPath: clusterPath},
-		tracker:     c.tracker.Cluster(clusterPath),
-		clusterPath: clusterPath,
-	}
+// StoragemigrationV1alpha1 retrieves the StoragemigrationV1alpha1ClusterClient
+func (c *ClusterClientset) StoragemigrationV1alpha1() kcpstoragemigrationv1alpha1.StoragemigrationV1alpha1ClusterInterface {
+	return &kcpfakestoragemigrationv1alpha1.StoragemigrationV1alpha1ClusterClient{Fake: &c.Fake}
 }
 
-var _ client.Interface = (*Clientset)(nil)
-
-// Clientset contains the clients for groups.
+// Clientset implements clientset.Interface. Meant to be embedded into a
+// struct to get a default implementation. This makes faking out just the method
+// you want to test easier.
 type Clientset struct {
 	*kcptesting.Fake
 	discovery   *kcpfakediscovery.FakeDiscovery
@@ -491,7 +532,11 @@ type Clientset struct {
 	clusterPath logicalcluster.Path
 }
 
-// Discovery retrieves the DiscoveryClient
+var (
+	_ clientset.Interface         = &Clientset{}
+	_ kcptesting.FakeScopedClient = &Clientset{}
+)
+
 func (c *Clientset) Discovery() discovery.DiscoveryInterface {
 	return c.discovery
 }
@@ -500,252 +545,297 @@ func (c *Clientset) Tracker() kcptesting.ScopedObjectTracker {
 	return c.tracker
 }
 
-// AdmissionregistrationV1 retrieves the AdmissionregistrationV1Client.
+// NewClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewClientset(objects ...runtime.Object) *ClusterClientset {
+	o := kcptesting.NewFieldManagedObjectTracker(
+		kcpclientscheme.Scheme,
+		kcpclientscheme.Codecs.UniversalDecoder(),
+		applyconfigurations.NewTypeConverter(kcpclientscheme.Scheme),
+	)
+	o.AddAll(objects...)
+
+	cs := &ClusterClientset{Fake: kcptesting.Fake{}, tracker: o}
+	cs.discovery = &kcpfakediscovery.FakeDiscovery{Fake: &cs.Fake, ClusterPath: logicalcluster.Wildcard}
+	cs.AddReactor("*", "*", kcptesting.ObjectReaction(o))
+	cs.AddWatchReactor("*", kcptesting.WatchReaction(o))
+
+	return cs
+}
+
+// AdmissionregistrationV1 retrieves the AdmissionregistrationV1Client
 func (c *Clientset) AdmissionregistrationV1() admissionregistrationv1.AdmissionregistrationV1Interface {
-	return &fakeadmissionregistrationv1.AdmissionregistrationV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeadmissionregistrationv1.AdmissionregistrationV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AdmissionregistrationV1alpha1 retrieves the AdmissionregistrationV1alpha1Client.
+// AdmissionregistrationV1alpha1 retrieves the AdmissionregistrationV1alpha1Client
 func (c *Clientset) AdmissionregistrationV1alpha1() admissionregistrationv1alpha1.AdmissionregistrationV1alpha1Interface {
-	return &fakeadmissionregistrationv1alpha1.AdmissionregistrationV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeadmissionregistrationv1alpha1.AdmissionregistrationV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AdmissionregistrationV1beta1 retrieves the AdmissionregistrationV1beta1Client.
+// AdmissionregistrationV1beta1 retrieves the AdmissionregistrationV1beta1Client
 func (c *Clientset) AdmissionregistrationV1beta1() admissionregistrationv1beta1.AdmissionregistrationV1beta1Interface {
-	return &fakeadmissionregistrationv1beta1.AdmissionregistrationV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeadmissionregistrationv1beta1.AdmissionregistrationV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AppsV1 retrieves the AppsV1Client.
+// InternalV1alpha1 retrieves the InternalV1alpha1Client
+func (c *Clientset) InternalV1alpha1() internalv1alpha1.InternalV1alpha1Interface {
+	return &kcpfakeinternalv1alpha1.InternalV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+}
+
+// AppsV1 retrieves the AppsV1Client
 func (c *Clientset) AppsV1() appsv1.AppsV1Interface {
-	return &fakeappsv1.AppsV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeappsv1.AppsV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AppsV1beta1 retrieves the AppsV1beta1Client.
+// AppsV1beta1 retrieves the AppsV1beta1Client
 func (c *Clientset) AppsV1beta1() appsv1beta1.AppsV1beta1Interface {
-	return &fakeappsv1beta1.AppsV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeappsv1beta1.AppsV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AppsV1beta2 retrieves the AppsV1beta2Client.
+// AppsV1beta2 retrieves the AppsV1beta2Client
 func (c *Clientset) AppsV1beta2() appsv1beta2.AppsV1beta2Interface {
-	return &fakeappsv1beta2.AppsV1beta2Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeappsv1beta2.AppsV1beta2Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AuthenticationV1 retrieves the AuthenticationV1Client.
+// AuthenticationV1 retrieves the AuthenticationV1Client
 func (c *Clientset) AuthenticationV1() authenticationv1.AuthenticationV1Interface {
-	return &fakeauthenticationv1.AuthenticationV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeauthenticationv1.AuthenticationV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AuthenticationV1alpha1 retrieves the AuthenticationV1alpha1Client.
+// AuthenticationV1alpha1 retrieves the AuthenticationV1alpha1Client
 func (c *Clientset) AuthenticationV1alpha1() authenticationv1alpha1.AuthenticationV1alpha1Interface {
-	return &fakeauthenticationv1alpha1.AuthenticationV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeauthenticationv1alpha1.AuthenticationV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AuthenticationV1beta1 retrieves the AuthenticationV1beta1Client.
+// AuthenticationV1beta1 retrieves the AuthenticationV1beta1Client
 func (c *Clientset) AuthenticationV1beta1() authenticationv1beta1.AuthenticationV1beta1Interface {
-	return &fakeauthenticationv1beta1.AuthenticationV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeauthenticationv1beta1.AuthenticationV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AuthorizationV1 retrieves the AuthorizationV1Client.
+// AuthorizationV1 retrieves the AuthorizationV1Client
 func (c *Clientset) AuthorizationV1() authorizationv1.AuthorizationV1Interface {
-	return &fakeauthorizationv1.AuthorizationV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeauthorizationv1.AuthorizationV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AuthorizationV1beta1 retrieves the AuthorizationV1beta1Client.
+// AuthorizationV1beta1 retrieves the AuthorizationV1beta1Client
 func (c *Clientset) AuthorizationV1beta1() authorizationv1beta1.AuthorizationV1beta1Interface {
-	return &fakeauthorizationv1beta1.AuthorizationV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeauthorizationv1beta1.AuthorizationV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AutoscalingV1 retrieves the AutoscalingV1Client.
+// AutoscalingV1 retrieves the AutoscalingV1Client
 func (c *Clientset) AutoscalingV1() autoscalingv1.AutoscalingV1Interface {
-	return &fakeautoscalingv1.AutoscalingV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeautoscalingv1.AutoscalingV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AutoscalingV2 retrieves the AutoscalingV2Client.
+// AutoscalingV2 retrieves the AutoscalingV2Client
 func (c *Clientset) AutoscalingV2() autoscalingv2.AutoscalingV2Interface {
-	return &fakeautoscalingv2.AutoscalingV2Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeautoscalingv2.AutoscalingV2Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AutoscalingV2beta1 retrieves the AutoscalingV2beta1Client.
+// AutoscalingV2beta1 retrieves the AutoscalingV2beta1Client
 func (c *Clientset) AutoscalingV2beta1() autoscalingv2beta1.AutoscalingV2beta1Interface {
-	return &fakeautoscalingv2beta1.AutoscalingV2beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeautoscalingv2beta1.AutoscalingV2beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// AutoscalingV2beta2 retrieves the AutoscalingV2beta2Client.
+// AutoscalingV2beta2 retrieves the AutoscalingV2beta2Client
 func (c *Clientset) AutoscalingV2beta2() autoscalingv2beta2.AutoscalingV2beta2Interface {
-	return &fakeautoscalingv2beta2.AutoscalingV2beta2Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeautoscalingv2beta2.AutoscalingV2beta2Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// BatchV1 retrieves the BatchV1Client.
+// BatchV1 retrieves the BatchV1Client
 func (c *Clientset) BatchV1() batchv1.BatchV1Interface {
-	return &fakebatchv1.BatchV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakebatchv1.BatchV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// BatchV1beta1 retrieves the BatchV1beta1Client.
+// BatchV1beta1 retrieves the BatchV1beta1Client
 func (c *Clientset) BatchV1beta1() batchv1beta1.BatchV1beta1Interface {
-	return &fakebatchv1beta1.BatchV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakebatchv1beta1.BatchV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// CertificatesV1 retrieves the CertificatesV1Client.
+// CertificatesV1 retrieves the CertificatesV1Client
 func (c *Clientset) CertificatesV1() certificatesv1.CertificatesV1Interface {
-	return &fakecertificatesv1.CertificatesV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakecertificatesv1.CertificatesV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// CertificatesV1beta1 retrieves the CertificatesV1beta1Client.
+// CertificatesV1alpha1 retrieves the CertificatesV1alpha1Client
+func (c *Clientset) CertificatesV1alpha1() certificatesv1alpha1.CertificatesV1alpha1Interface {
+	return &kcpfakecertificatesv1alpha1.CertificatesV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+}
+
+// CertificatesV1beta1 retrieves the CertificatesV1beta1Client
 func (c *Clientset) CertificatesV1beta1() certificatesv1beta1.CertificatesV1beta1Interface {
-	return &fakecertificatesv1beta1.CertificatesV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakecertificatesv1beta1.CertificatesV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// CoordinationV1 retrieves the CoordinationV1Client.
+// CoordinationV1 retrieves the CoordinationV1Client
 func (c *Clientset) CoordinationV1() coordinationv1.CoordinationV1Interface {
-	return &fakecoordinationv1.CoordinationV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakecoordinationv1.CoordinationV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+}
+
+// CoordinationV1alpha2 retrieves the CoordinationV1alpha2Client
+func (c *Clientset) CoordinationV1alpha2() coordinationv1alpha2.CoordinationV1alpha2Interface {
+	return &kcpfakecoordinationv1alpha2.CoordinationV1alpha2Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// CoordinationV1beta1 retrieves the CoordinationV1beta1Client.
+// CoordinationV1beta1 retrieves the CoordinationV1beta1Client
 func (c *Clientset) CoordinationV1beta1() coordinationv1beta1.CoordinationV1beta1Interface {
-	return &fakecoordinationv1beta1.CoordinationV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakecoordinationv1beta1.CoordinationV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// CoreV1 retrieves the CoreV1Client.
+// CoreV1 retrieves the CoreV1Client
 func (c *Clientset) CoreV1() corev1.CoreV1Interface {
-	return &fakecorev1.CoreV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakecorev1.CoreV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// DiscoveryV1 retrieves the DiscoveryV1Client.
+// DiscoveryV1 retrieves the DiscoveryV1Client
 func (c *Clientset) DiscoveryV1() discoveryv1.DiscoveryV1Interface {
-	return &fakediscoveryv1.DiscoveryV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakediscoveryv1.DiscoveryV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// DiscoveryV1beta1 retrieves the DiscoveryV1beta1Client.
+// DiscoveryV1beta1 retrieves the DiscoveryV1beta1Client
 func (c *Clientset) DiscoveryV1beta1() discoveryv1beta1.DiscoveryV1beta1Interface {
-	return &fakediscoveryv1beta1.DiscoveryV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakediscoveryv1beta1.DiscoveryV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// EventsV1 retrieves the EventsV1Client.
+// EventsV1 retrieves the EventsV1Client
 func (c *Clientset) EventsV1() eventsv1.EventsV1Interface {
-	return &fakeeventsv1.EventsV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeeventsv1.EventsV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// EventsV1beta1 retrieves the EventsV1beta1Client.
+// EventsV1beta1 retrieves the EventsV1beta1Client
 func (c *Clientset) EventsV1beta1() eventsv1beta1.EventsV1beta1Interface {
-	return &fakeeventsv1beta1.EventsV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeeventsv1beta1.EventsV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// ExtensionsV1beta1 retrieves the ExtensionsV1beta1Client.
+// ExtensionsV1beta1 retrieves the ExtensionsV1beta1Client
 func (c *Clientset) ExtensionsV1beta1() extensionsv1beta1.ExtensionsV1beta1Interface {
-	return &fakeextensionsv1beta1.ExtensionsV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeextensionsv1beta1.ExtensionsV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// FlowcontrolV1alpha1 retrieves the FlowcontrolV1alpha1Client.
-func (c *Clientset) FlowcontrolV1alpha1() flowcontrolv1alpha1.FlowcontrolV1alpha1Interface {
-	return &fakeflowcontrolv1alpha1.FlowcontrolV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+// FlowcontrolV1 retrieves the FlowcontrolV1Client
+func (c *Clientset) FlowcontrolV1() flowcontrolv1.FlowcontrolV1Interface {
+	return &kcpfakeflowcontrolv1.FlowcontrolV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// FlowcontrolV1beta1 retrieves the FlowcontrolV1beta1Client.
+// FlowcontrolV1beta1 retrieves the FlowcontrolV1beta1Client
 func (c *Clientset) FlowcontrolV1beta1() flowcontrolv1beta1.FlowcontrolV1beta1Interface {
-	return &fakeflowcontrolv1beta1.FlowcontrolV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeflowcontrolv1beta1.FlowcontrolV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// FlowcontrolV1beta2 retrieves the FlowcontrolV1beta2Client.
+// FlowcontrolV1beta2 retrieves the FlowcontrolV1beta2Client
 func (c *Clientset) FlowcontrolV1beta2() flowcontrolv1beta2.FlowcontrolV1beta2Interface {
-	return &fakeflowcontrolv1beta2.FlowcontrolV1beta2Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeflowcontrolv1beta2.FlowcontrolV1beta2Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// FlowcontrolV1beta3 retrieves the FlowcontrolV1beta3Client.
+// FlowcontrolV1beta3 retrieves the FlowcontrolV1beta3Client
 func (c *Clientset) FlowcontrolV1beta3() flowcontrolv1beta3.FlowcontrolV1beta3Interface {
-	return &fakeflowcontrolv1beta3.FlowcontrolV1beta3Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeflowcontrolv1beta3.FlowcontrolV1beta3Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// InternalV1alpha1 retrieves the InternalV1alpha1Client.
-func (c *Clientset) InternalV1alpha1() internalv1alpha1.InternalV1alpha1Interface {
-	return &fakeinternalv1alpha1.InternalV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
-}
-
-// NetworkingV1 retrieves the NetworkingV1Client.
+// NetworkingV1 retrieves the NetworkingV1Client
 func (c *Clientset) NetworkingV1() networkingv1.NetworkingV1Interface {
-	return &fakenetworkingv1.NetworkingV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakenetworkingv1.NetworkingV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// NetworkingV1alpha1 retrieves the NetworkingV1alpha1Client.
+// NetworkingV1alpha1 retrieves the NetworkingV1alpha1Client
 func (c *Clientset) NetworkingV1alpha1() networkingv1alpha1.NetworkingV1alpha1Interface {
-	return &fakenetworkingv1alpha1.NetworkingV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakenetworkingv1alpha1.NetworkingV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// NetworkingV1beta1 retrieves the NetworkingV1beta1Client.
+// NetworkingV1beta1 retrieves the NetworkingV1beta1Client
 func (c *Clientset) NetworkingV1beta1() networkingv1beta1.NetworkingV1beta1Interface {
-	return &fakenetworkingv1beta1.NetworkingV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakenetworkingv1beta1.NetworkingV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// NodeV1 retrieves the NodeV1Client.
+// NodeV1 retrieves the NodeV1Client
 func (c *Clientset) NodeV1() nodev1.NodeV1Interface {
-	return &fakenodev1.NodeV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakenodev1.NodeV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// NodeV1alpha1 retrieves the NodeV1alpha1Client.
+// NodeV1alpha1 retrieves the NodeV1alpha1Client
 func (c *Clientset) NodeV1alpha1() nodev1alpha1.NodeV1alpha1Interface {
-	return &fakenodev1alpha1.NodeV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakenodev1alpha1.NodeV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// NodeV1beta1 retrieves the NodeV1beta1Client.
+// NodeV1beta1 retrieves the NodeV1beta1Client
 func (c *Clientset) NodeV1beta1() nodev1beta1.NodeV1beta1Interface {
-	return &fakenodev1beta1.NodeV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakenodev1beta1.NodeV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// PolicyV1 retrieves the PolicyV1Client.
+// PolicyV1 retrieves the PolicyV1Client
 func (c *Clientset) PolicyV1() policyv1.PolicyV1Interface {
-	return &fakepolicyv1.PolicyV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakepolicyv1.PolicyV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// PolicyV1beta1 retrieves the PolicyV1beta1Client.
+// PolicyV1beta1 retrieves the PolicyV1beta1Client
 func (c *Clientset) PolicyV1beta1() policyv1beta1.PolicyV1beta1Interface {
-	return &fakepolicyv1beta1.PolicyV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakepolicyv1beta1.PolicyV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// RbacV1 retrieves the RbacV1Client.
+// RbacV1 retrieves the RbacV1Client
 func (c *Clientset) RbacV1() rbacv1.RbacV1Interface {
-	return &fakerbacv1.RbacV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakerbacv1.RbacV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// RbacV1alpha1 retrieves the RbacV1alpha1Client.
+// RbacV1alpha1 retrieves the RbacV1alpha1Client
 func (c *Clientset) RbacV1alpha1() rbacv1alpha1.RbacV1alpha1Interface {
-	return &fakerbacv1alpha1.RbacV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakerbacv1alpha1.RbacV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// RbacV1beta1 retrieves the RbacV1beta1Client.
+// RbacV1beta1 retrieves the RbacV1beta1Client
 func (c *Clientset) RbacV1beta1() rbacv1beta1.RbacV1beta1Interface {
-	return &fakerbacv1beta1.RbacV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakerbacv1beta1.RbacV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+}
+
+// ResourceV1alpha3 retrieves the ResourceV1alpha3Client
+func (c *Clientset) ResourceV1alpha3() resourcev1alpha3.ResourceV1alpha3Interface {
+	return &kcpfakeresourcev1alpha3.ResourceV1alpha3Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// ResourceV1alpha1 retrieves the ResourceV1alpha1Client.
-func (c *Clientset) ResourceV1alpha1() resourcev1alpha1.ResourceV1alpha1Interface {
-	return &fakeresourcev1alpha1.ResourceV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+// ResourceV1beta1 retrieves the ResourceV1beta1Client
+func (c *Clientset) ResourceV1beta1() resourcev1beta1.ResourceV1beta1Interface {
+	return &kcpfakeresourcev1beta1.ResourceV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// SchedulingV1 retrieves the SchedulingV1Client.
+// ResourceV1beta2 retrieves the ResourceV1beta2Client
+func (c *Clientset) ResourceV1beta2() resourcev1beta2.ResourceV1beta2Interface {
+	return &kcpfakeresourcev1beta2.ResourceV1beta2Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+}
+
+// SchedulingV1 retrieves the SchedulingV1Client
 func (c *Clientset) SchedulingV1() schedulingv1.SchedulingV1Interface {
-	return &fakeschedulingv1.SchedulingV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeschedulingv1.SchedulingV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// SchedulingV1alpha1 retrieves the SchedulingV1alpha1Client.
+// SchedulingV1alpha1 retrieves the SchedulingV1alpha1Client
 func (c *Clientset) SchedulingV1alpha1() schedulingv1alpha1.SchedulingV1alpha1Interface {
-	return &fakeschedulingv1alpha1.SchedulingV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeschedulingv1alpha1.SchedulingV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// SchedulingV1beta1 retrieves the SchedulingV1beta1Client.
+// SchedulingV1beta1 retrieves the SchedulingV1beta1Client
 func (c *Clientset) SchedulingV1beta1() schedulingv1beta1.SchedulingV1beta1Interface {
-	return &fakeschedulingv1beta1.SchedulingV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakeschedulingv1beta1.SchedulingV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// StorageV1 retrieves the StorageV1Client.
+// StorageV1 retrieves the StorageV1Client
 func (c *Clientset) StorageV1() storagev1.StorageV1Interface {
-	return &fakestoragev1.StorageV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakestoragev1.StorageV1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// StorageV1alpha1 retrieves the StorageV1alpha1Client.
+// StorageV1alpha1 retrieves the StorageV1alpha1Client
 func (c *Clientset) StorageV1alpha1() storagev1alpha1.StorageV1alpha1Interface {
-	return &fakestoragev1alpha1.StorageV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakestoragev1alpha1.StorageV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
 
-// StorageV1beta1 retrieves the StorageV1beta1Client.
+// StorageV1beta1 retrieves the StorageV1beta1Client
 func (c *Clientset) StorageV1beta1() storagev1beta1.StorageV1beta1Interface {
-	return &fakestoragev1beta1.StorageV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+	return &kcpfakestoragev1beta1.StorageV1beta1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
+}
+
+// StoragemigrationV1alpha1 retrieves the StoragemigrationV1alpha1Client
+func (c *Clientset) StoragemigrationV1alpha1() storagemigrationv1alpha1.StoragemigrationV1alpha1Interface {
+	return &kcpfakestoragemigrationv1alpha1.StoragemigrationV1alpha1Client{Fake: c.Fake, ClusterPath: c.clusterPath}
 }
diff --git a/kubernetes/fake/doc.go b/kubernetes/fake/doc.go
new file mode 100644
index 000000000..05690c918
--- /dev/null
+++ b/kubernetes/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated fake clientset.
+package fake
diff --git a/kubernetes/fake/register.go b/kubernetes/fake/register.go
new file mode 100644
index 000000000..f6e3ca535
--- /dev/null
+++ b/kubernetes/fake/register.go
@@ -0,0 +1,164 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	internalv1alpha1 "k8s.io/api/apiserverinternal/v1alpha1"
+	appsv1 "k8s.io/api/apps/v1"
+	appsv1beta1 "k8s.io/api/apps/v1beta1"
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	authenticationv1 "k8s.io/api/authentication/v1"
+	authenticationv1alpha1 "k8s.io/api/authentication/v1alpha1"
+	authenticationv1beta1 "k8s.io/api/authentication/v1beta1"
+	authorizationv1 "k8s.io/api/authorization/v1"
+	authorizationv1beta1 "k8s.io/api/authorization/v1beta1"
+	autoscalingv1 "k8s.io/api/autoscaling/v1"
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	autoscalingv2beta1 "k8s.io/api/autoscaling/v2beta1"
+	autoscalingv2beta2 "k8s.io/api/autoscaling/v2beta2"
+	batchv1 "k8s.io/api/batch/v1"
+	batchv1beta1 "k8s.io/api/batch/v1beta1"
+	certificatesv1 "k8s.io/api/certificates/v1"
+	certificatesv1alpha1 "k8s.io/api/certificates/v1alpha1"
+	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
+	coordinationv1 "k8s.io/api/coordination/v1"
+	coordinationv1alpha2 "k8s.io/api/coordination/v1alpha2"
+	coordinationv1beta1 "k8s.io/api/coordination/v1beta1"
+	corev1 "k8s.io/api/core/v1"
+	discoveryv1 "k8s.io/api/discovery/v1"
+	discoveryv1beta1 "k8s.io/api/discovery/v1beta1"
+	eventsv1 "k8s.io/api/events/v1"
+	eventsv1beta1 "k8s.io/api/events/v1beta1"
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	flowcontrolv1 "k8s.io/api/flowcontrol/v1"
+	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
+	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
+	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
+	networkingv1 "k8s.io/api/networking/v1"
+	networkingv1alpha1 "k8s.io/api/networking/v1alpha1"
+	networkingv1beta1 "k8s.io/api/networking/v1beta1"
+	nodev1 "k8s.io/api/node/v1"
+	nodev1alpha1 "k8s.io/api/node/v1alpha1"
+	nodev1beta1 "k8s.io/api/node/v1beta1"
+	policyv1 "k8s.io/api/policy/v1"
+	policyv1beta1 "k8s.io/api/policy/v1beta1"
+	rbacv1 "k8s.io/api/rbac/v1"
+	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
+	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+	schedulingv1 "k8s.io/api/scheduling/v1"
+	schedulingv1alpha1 "k8s.io/api/scheduling/v1alpha1"
+	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+	storagev1 "k8s.io/api/storage/v1"
+	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
+	storagev1beta1 "k8s.io/api/storage/v1beta1"
+	storagemigrationv1alpha1 "k8s.io/api/storagemigration/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+var scheme = runtime.NewScheme()
+var codecs = serializer.NewCodecFactory(scheme)
+
+var localSchemeBuilder = runtime.SchemeBuilder{
+	admissionregistrationv1.AddToScheme,
+	admissionregistrationv1alpha1.AddToScheme,
+	admissionregistrationv1beta1.AddToScheme,
+	internalv1alpha1.AddToScheme,
+	appsv1.AddToScheme,
+	appsv1beta1.AddToScheme,
+	appsv1beta2.AddToScheme,
+	authenticationv1.AddToScheme,
+	authenticationv1alpha1.AddToScheme,
+	authenticationv1beta1.AddToScheme,
+	authorizationv1.AddToScheme,
+	authorizationv1beta1.AddToScheme,
+	autoscalingv1.AddToScheme,
+	autoscalingv2.AddToScheme,
+	autoscalingv2beta1.AddToScheme,
+	autoscalingv2beta2.AddToScheme,
+	batchv1.AddToScheme,
+	batchv1beta1.AddToScheme,
+	certificatesv1.AddToScheme,
+	certificatesv1alpha1.AddToScheme,
+	certificatesv1beta1.AddToScheme,
+	coordinationv1.AddToScheme,
+	coordinationv1alpha2.AddToScheme,
+	coordinationv1beta1.AddToScheme,
+	corev1.AddToScheme,
+	discoveryv1.AddToScheme,
+	discoveryv1beta1.AddToScheme,
+	eventsv1.AddToScheme,
+	eventsv1beta1.AddToScheme,
+	extensionsv1beta1.AddToScheme,
+	flowcontrolv1.AddToScheme,
+	flowcontrolv1beta1.AddToScheme,
+	flowcontrolv1beta2.AddToScheme,
+	flowcontrolv1beta3.AddToScheme,
+	networkingv1.AddToScheme,
+	networkingv1alpha1.AddToScheme,
+	networkingv1beta1.AddToScheme,
+	nodev1.AddToScheme,
+	nodev1alpha1.AddToScheme,
+	nodev1beta1.AddToScheme,
+	policyv1.AddToScheme,
+	policyv1beta1.AddToScheme,
+	rbacv1.AddToScheme,
+	rbacv1alpha1.AddToScheme,
+	rbacv1beta1.AddToScheme,
+	resourcev1alpha3.AddToScheme,
+	resourcev1beta1.AddToScheme,
+	resourcev1beta2.AddToScheme,
+	schedulingv1.AddToScheme,
+	schedulingv1alpha1.AddToScheme,
+	schedulingv1beta1.AddToScheme,
+	storagev1.AddToScheme,
+	storagev1alpha1.AddToScheme,
+	storagev1beta1.AddToScheme,
+	storagemigrationv1alpha1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
+//
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(scheme))
+}
diff --git a/kubernetes/scheme/doc.go b/kubernetes/scheme/doc.go
new file mode 100644
index 000000000..65ba12554
--- /dev/null
+++ b/kubernetes/scheme/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package contains the scheme of the automatically generated clientset.
+package scheme
diff --git a/kubernetes/scheme/register.go b/kubernetes/scheme/register.go
index f49d68f77..69bd02525 100644
--- a/kubernetes/scheme/register.go
+++ b/kubernetes/scheme/register.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package scheme
 
@@ -41,8 +38,10 @@ import (
 	batchv1 "k8s.io/api/batch/v1"
 	batchv1beta1 "k8s.io/api/batch/v1beta1"
 	certificatesv1 "k8s.io/api/certificates/v1"
+	certificatesv1alpha1 "k8s.io/api/certificates/v1alpha1"
 	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
 	coordinationv1 "k8s.io/api/coordination/v1"
+	coordinationv1alpha2 "k8s.io/api/coordination/v1alpha2"
 	coordinationv1beta1 "k8s.io/api/coordination/v1beta1"
 	corev1 "k8s.io/api/core/v1"
 	discoveryv1 "k8s.io/api/discovery/v1"
@@ -50,7 +49,7 @@ import (
 	eventsv1 "k8s.io/api/events/v1"
 	eventsv1beta1 "k8s.io/api/events/v1beta1"
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	flowcontrolv1alpha1 "k8s.io/api/flowcontrol/v1alpha1"
+	flowcontrolv1 "k8s.io/api/flowcontrol/v1"
 	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
 	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
 	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
@@ -65,17 +64,20 @@ import (
 	rbacv1 "k8s.io/api/rbac/v1"
 	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
 	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
 	schedulingv1 "k8s.io/api/scheduling/v1"
 	schedulingv1alpha1 "k8s.io/api/scheduling/v1alpha1"
 	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
 	storagev1 "k8s.io/api/storage/v1"
 	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/runtime/serializer"
+	storagemigrationv1alpha1 "k8s.io/api/storagemigration/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 )
 
@@ -86,6 +88,7 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 	admissionregistrationv1.AddToScheme,
 	admissionregistrationv1alpha1.AddToScheme,
 	admissionregistrationv1beta1.AddToScheme,
+	internalv1alpha1.AddToScheme,
 	appsv1.AddToScheme,
 	appsv1beta1.AddToScheme,
 	appsv1beta2.AddToScheme,
@@ -101,8 +104,10 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 	batchv1.AddToScheme,
 	batchv1beta1.AddToScheme,
 	certificatesv1.AddToScheme,
+	certificatesv1alpha1.AddToScheme,
 	certificatesv1beta1.AddToScheme,
 	coordinationv1.AddToScheme,
+	coordinationv1alpha2.AddToScheme,
 	coordinationv1beta1.AddToScheme,
 	corev1.AddToScheme,
 	discoveryv1.AddToScheme,
@@ -110,11 +115,10 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 	eventsv1.AddToScheme,
 	eventsv1beta1.AddToScheme,
 	extensionsv1beta1.AddToScheme,
-	flowcontrolv1alpha1.AddToScheme,
+	flowcontrolv1.AddToScheme,
 	flowcontrolv1beta1.AddToScheme,
 	flowcontrolv1beta2.AddToScheme,
 	flowcontrolv1beta3.AddToScheme,
-	internalv1alpha1.AddToScheme,
 	networkingv1.AddToScheme,
 	networkingv1alpha1.AddToScheme,
 	networkingv1beta1.AddToScheme,
@@ -126,13 +130,16 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 	rbacv1.AddToScheme,
 	rbacv1alpha1.AddToScheme,
 	rbacv1beta1.AddToScheme,
-	resourcev1alpha1.AddToScheme,
+	resourcev1alpha3.AddToScheme,
+	resourcev1beta1.AddToScheme,
+	resourcev1beta2.AddToScheme,
 	schedulingv1.AddToScheme,
 	schedulingv1alpha1.AddToScheme,
 	schedulingv1beta1.AddToScheme,
 	storagev1.AddToScheme,
 	storagev1alpha1.AddToScheme,
 	storagev1beta1.AddToScheme,
+	storagemigrationv1alpha1.AddToScheme,
 }
 
 // AddToScheme adds all types of this clientset into the given scheme. This allows composition
@@ -152,6 +159,6 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 var AddToScheme = localSchemeBuilder.AddToScheme
 
 func init() {
-	metav1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
 	utilruntime.Must(AddToScheme(Scheme))
 }
diff --git a/kubernetes/typed/admissionregistration/v1/admissionregistration_client.go b/kubernetes/typed/admissionregistration/v1/admissionregistration_client.go
index 7ac93ba8d..38ffa54cc 100644
--- a/kubernetes/typed/admissionregistration/v1/admissionregistration_client.go
+++ b/kubernetes/typed/admissionregistration/v1/admissionregistration_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,35 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiadmissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	admissionregistrationv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
-	"k8s.io/client-go/rest"
 )
 
 type AdmissionregistrationV1ClusterInterface interface {
 	AdmissionregistrationV1ClusterScoper
-	ValidatingWebhookConfigurationsClusterGetter
 	MutatingWebhookConfigurationsClusterGetter
+	ValidatingAdmissionPoliciesClusterGetter
+	ValidatingAdmissionPolicyBindingsClusterGetter
+	ValidatingWebhookConfigurationsClusterGetter
 }
 
 type AdmissionregistrationV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) admissionregistrationv1.AdmissionregistrationV1Interface
 }
 
+// AdmissionregistrationV1ClusterClient is used to interact with features provided by the admissionregistration.k8s.io group.
 type AdmissionregistrationV1ClusterClient struct {
 	clientCache kcpclient.Cache[*admissionregistrationv1.AdmissionregistrationV1Client]
 }
@@ -52,23 +54,33 @@ func (c *AdmissionregistrationV1ClusterClient) Cluster(clusterPath logicalcluste
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *AdmissionregistrationV1ClusterClient) ValidatingWebhookConfigurations() ValidatingWebhookConfigurationClusterInterface {
-	return &validatingWebhookConfigurationsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *AdmissionregistrationV1ClusterClient) MutatingWebhookConfigurations() MutatingWebhookConfigurationClusterInterface {
 	return &mutatingWebhookConfigurationsClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *AdmissionregistrationV1ClusterClient) ValidatingAdmissionPolicies() ValidatingAdmissionPolicyClusterInterface {
+	return &validatingAdmissionPoliciesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *AdmissionregistrationV1ClusterClient) ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingClusterInterface {
+	return &validatingAdmissionPolicyBindingsClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *AdmissionregistrationV1ClusterClient) ValidatingWebhookConfigurations() ValidatingWebhookConfigurationClusterInterface {
+	return &validatingWebhookConfigurationsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new AdmissionregistrationV1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AdmissionregistrationV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AdmissionregistrationV1ClusterClient for the given config and http client.
@@ -80,6 +92,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*Admissionregistrati
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AdmissionregistrationV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -92,3 +105,14 @@ func NewForConfigOrDie(c *rest.Config) *AdmissionregistrationV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiadmissionregistrationv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/admissionregistration/v1/doc.go b/kubernetes/typed/admissionregistration/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/admissionregistration/v1/fake/admissionregistration_client.go b/kubernetes/typed/admissionregistration/v1/fake/admissionregistration_client.go
index a2bb24c2f..91191ee80 100644
--- a/kubernetes/typed/admissionregistration/v1/fake/admissionregistration_client.go
+++ b/kubernetes/typed/admissionregistration/v1/fake/admissionregistration_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpadmissionregistrationv1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpadmissionregistrationv1.AdmissionregistrationV1ClusterInterface = (*AdmissionregistrationV1ClusterClient)(nil)
@@ -44,30 +40,46 @@ func (c *AdmissionregistrationV1ClusterClient) Cluster(clusterPath logicalcluste
 	return &AdmissionregistrationV1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *AdmissionregistrationV1ClusterClient) ValidatingWebhookConfigurations() kcpadmissionregistrationv1.ValidatingWebhookConfigurationClusterInterface {
-	return &validatingWebhookConfigurationsClusterClient{Fake: c.Fake}
+func (c *AdmissionregistrationV1ClusterClient) MutatingWebhookConfigurations() kcpadmissionregistrationv1.MutatingWebhookConfigurationClusterInterface {
+	return newFakeMutatingWebhookConfigurationClusterClient(c)
 }
 
-func (c *AdmissionregistrationV1ClusterClient) MutatingWebhookConfigurations() kcpadmissionregistrationv1.MutatingWebhookConfigurationClusterInterface {
-	return &mutatingWebhookConfigurationsClusterClient{Fake: c.Fake}
+func (c *AdmissionregistrationV1ClusterClient) ValidatingAdmissionPolicies() kcpadmissionregistrationv1.ValidatingAdmissionPolicyClusterInterface {
+	return newFakeValidatingAdmissionPolicyClusterClient(c)
+}
+
+func (c *AdmissionregistrationV1ClusterClient) ValidatingAdmissionPolicyBindings() kcpadmissionregistrationv1.ValidatingAdmissionPolicyBindingClusterInterface {
+	return newFakeValidatingAdmissionPolicyBindingClusterClient(c)
 }
 
-var _ admissionregistrationv1.AdmissionregistrationV1Interface = (*AdmissionregistrationV1Client)(nil)
+func (c *AdmissionregistrationV1ClusterClient) ValidatingWebhookConfigurations() kcpadmissionregistrationv1.ValidatingWebhookConfigurationClusterInterface {
+	return newFakeValidatingWebhookConfigurationClusterClient(c)
+}
 
 type AdmissionregistrationV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *AdmissionregistrationV1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *AdmissionregistrationV1Client) MutatingWebhookConfigurations() admissionregistrationv1.MutatingWebhookConfigurationInterface {
+	return newFakeMutatingWebhookConfigurationClient(c.Fake, c.ClusterPath)
+}
+
+func (c *AdmissionregistrationV1Client) ValidatingAdmissionPolicies() admissionregistrationv1.ValidatingAdmissionPolicyInterface {
+	return newFakeValidatingAdmissionPolicyClient(c.Fake, c.ClusterPath)
+}
+
+func (c *AdmissionregistrationV1Client) ValidatingAdmissionPolicyBindings() admissionregistrationv1.ValidatingAdmissionPolicyBindingInterface {
+	return newFakeValidatingAdmissionPolicyBindingClient(c.Fake, c.ClusterPath)
 }
 
 func (c *AdmissionregistrationV1Client) ValidatingWebhookConfigurations() admissionregistrationv1.ValidatingWebhookConfigurationInterface {
-	return &validatingWebhookConfigurationsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakeValidatingWebhookConfigurationClient(c.Fake, c.ClusterPath)
 }
 
-func (c *AdmissionregistrationV1Client) MutatingWebhookConfigurations() admissionregistrationv1.MutatingWebhookConfigurationInterface {
-	return &mutatingWebhookConfigurationsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AdmissionregistrationV1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/admissionregistration/v1/fake/doc.go b/kubernetes/typed/admissionregistration/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/admissionregistration/v1/fake/mutatingwebhookconfiguration.go b/kubernetes/typed/admissionregistration/v1/fake/mutatingwebhookconfiguration.go
index 84fede068..53391761f 100644
--- a/kubernetes/typed/admissionregistration/v1/fake/mutatingwebhookconfiguration.go
+++ b/kubernetes/typed/admissionregistration/v1/fake/mutatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,85 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsadmissionregistrationv1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1"
-	admissionregistrationv1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1"
+	typedadmissionregistrationv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
 
+	typedkcpadmissionregistrationv1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var mutatingWebhookConfigurationsResource = schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1", Resource: "mutatingwebhookconfigurations"}
-var mutatingWebhookConfigurationsKind = schema.GroupVersionKind{Group: "admissionregistration.k8s.io", Version: "v1", Kind: "MutatingWebhookConfiguration"}
-
-type mutatingWebhookConfigurationsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *mutatingWebhookConfigurationsClusterClient) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1client.MutatingWebhookConfigurationInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &mutatingWebhookConfigurationsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of MutatingWebhookConfigurations that match those selectors across all clusters.
-func (c *mutatingWebhookConfigurationsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1.MutatingWebhookConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(mutatingWebhookConfigurationsResource, mutatingWebhookConfigurationsKind, logicalcluster.Wildcard, opts), &admissionregistrationv1.MutatingWebhookConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &admissionregistrationv1.MutatingWebhookConfigurationList{ListMeta: obj.(*admissionregistrationv1.MutatingWebhookConfigurationList).ListMeta}
-	for _, item := range obj.(*admissionregistrationv1.MutatingWebhookConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested MutatingWebhookConfigurations across all clusters.
-func (c *mutatingWebhookConfigurationsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(mutatingWebhookConfigurationsResource, logicalcluster.Wildcard, opts))
-}
-
-type mutatingWebhookConfigurationsClient struct {
-	*kcptesting.Fake
+// mutatingWebhookConfigurationClusterClient implements MutatingWebhookConfigurationClusterInterface
+type mutatingWebhookConfigurationClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*admissionregistrationv1.MutatingWebhookConfiguration, *admissionregistrationv1.MutatingWebhookConfigurationList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeMutatingWebhookConfigurationClusterClient(fake *AdmissionregistrationV1ClusterClient) typedkcpadmissionregistrationv1.MutatingWebhookConfigurationClusterInterface {
+	return &mutatingWebhookConfigurationClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*admissionregistrationv1.MutatingWebhookConfiguration, *admissionregistrationv1.MutatingWebhookConfigurationList](
+			fake.Fake,
+			admissionregistrationv1.SchemeGroupVersion.WithResource("mutatingwebhookconfigurations"),
+			admissionregistrationv1.SchemeGroupVersion.WithKind("MutatingWebhookConfiguration"),
+			func() *admissionregistrationv1.MutatingWebhookConfiguration {
+				return &admissionregistrationv1.MutatingWebhookConfiguration{}
+			},
+			func() *admissionregistrationv1.MutatingWebhookConfigurationList {
+				return &admissionregistrationv1.MutatingWebhookConfigurationList{}
+			},
+			func(dst, src *admissionregistrationv1.MutatingWebhookConfigurationList) { dst.ListMeta = src.ListMeta },
+			func(list *admissionregistrationv1.MutatingWebhookConfigurationList) []*admissionregistrationv1.MutatingWebhookConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1.MutatingWebhookConfigurationList, items []*admissionregistrationv1.MutatingWebhookConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *mutatingWebhookConfigurationClusterClient) Cluster(cluster logicalcluster.Path) typedadmissionregistrationv1.MutatingWebhookConfigurationInterface {
+	return newFakeMutatingWebhookConfigurationClient(c.Fake, cluster)
+}
+
+// mutatingWebhookConfigurationScopedClient implements MutatingWebhookConfigurationInterface
+type mutatingWebhookConfigurationScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*admissionregistrationv1.MutatingWebhookConfiguration, *admissionregistrationv1.MutatingWebhookConfigurationList, *v1.MutatingWebhookConfigurationApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *mutatingWebhookConfigurationsClient) Create(ctx context.Context, mutatingWebhookConfiguration *admissionregistrationv1.MutatingWebhookConfiguration, opts metav1.CreateOptions) (*admissionregistrationv1.MutatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(mutatingWebhookConfigurationsResource, c.ClusterPath, mutatingWebhookConfiguration), &admissionregistrationv1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1.MutatingWebhookConfiguration), err
-}
-
-func (c *mutatingWebhookConfigurationsClient) Update(ctx context.Context, mutatingWebhookConfiguration *admissionregistrationv1.MutatingWebhookConfiguration, opts metav1.UpdateOptions) (*admissionregistrationv1.MutatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(mutatingWebhookConfigurationsResource, c.ClusterPath, mutatingWebhookConfiguration), &admissionregistrationv1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1.MutatingWebhookConfiguration), err
-}
-
-func (c *mutatingWebhookConfigurationsClient) UpdateStatus(ctx context.Context, mutatingWebhookConfiguration *admissionregistrationv1.MutatingWebhookConfiguration, opts metav1.UpdateOptions) (*admissionregistrationv1.MutatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(mutatingWebhookConfigurationsResource, c.ClusterPath, "status", mutatingWebhookConfiguration), &admissionregistrationv1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1.MutatingWebhookConfiguration), err
-}
-
-func (c *mutatingWebhookConfigurationsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(mutatingWebhookConfigurationsResource, c.ClusterPath, name, opts), &admissionregistrationv1.MutatingWebhookConfiguration{})
-	return err
-}
-
-func (c *mutatingWebhookConfigurationsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(mutatingWebhookConfigurationsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &admissionregistrationv1.MutatingWebhookConfigurationList{})
-	return err
-}
-
-func (c *mutatingWebhookConfigurationsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*admissionregistrationv1.MutatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(mutatingWebhookConfigurationsResource, c.ClusterPath, name), &admissionregistrationv1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1.MutatingWebhookConfiguration), err
-}
-
-// List takes label and field selectors, and returns the list of MutatingWebhookConfigurations that match those selectors.
-func (c *mutatingWebhookConfigurationsClient) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1.MutatingWebhookConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(mutatingWebhookConfigurationsResource, mutatingWebhookConfigurationsKind, c.ClusterPath, opts), &admissionregistrationv1.MutatingWebhookConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &admissionregistrationv1.MutatingWebhookConfigurationList{ListMeta: obj.(*admissionregistrationv1.MutatingWebhookConfigurationList).ListMeta}
-	for _, item := range obj.(*admissionregistrationv1.MutatingWebhookConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *mutatingWebhookConfigurationsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(mutatingWebhookConfigurationsResource, c.ClusterPath, opts))
-}
-
-func (c *mutatingWebhookConfigurationsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*admissionregistrationv1.MutatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(mutatingWebhookConfigurationsResource, c.ClusterPath, name, pt, data, subresources...), &admissionregistrationv1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1.MutatingWebhookConfiguration), err
-}
-
-func (c *mutatingWebhookConfigurationsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsadmissionregistrationv1.MutatingWebhookConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*admissionregistrationv1.MutatingWebhookConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(mutatingWebhookConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &admissionregistrationv1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1.MutatingWebhookConfiguration), err
-}
-
-func (c *mutatingWebhookConfigurationsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsadmissionregistrationv1.MutatingWebhookConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*admissionregistrationv1.MutatingWebhookConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(mutatingWebhookConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &admissionregistrationv1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
+func newFakeMutatingWebhookConfigurationClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedadmissionregistrationv1.MutatingWebhookConfigurationInterface {
+	return &mutatingWebhookConfigurationScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*admissionregistrationv1.MutatingWebhookConfiguration, *admissionregistrationv1.MutatingWebhookConfigurationList, *v1.MutatingWebhookConfigurationApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			admissionregistrationv1.SchemeGroupVersion.WithResource("mutatingwebhookconfigurations"),
+			admissionregistrationv1.SchemeGroupVersion.WithKind("MutatingWebhookConfiguration"),
+			func() *admissionregistrationv1.MutatingWebhookConfiguration {
+				return &admissionregistrationv1.MutatingWebhookConfiguration{}
+			},
+			func() *admissionregistrationv1.MutatingWebhookConfigurationList {
+				return &admissionregistrationv1.MutatingWebhookConfigurationList{}
+			},
+			func(dst, src *admissionregistrationv1.MutatingWebhookConfigurationList) { dst.ListMeta = src.ListMeta },
+			func(list *admissionregistrationv1.MutatingWebhookConfigurationList) []*admissionregistrationv1.MutatingWebhookConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1.MutatingWebhookConfigurationList, items []*admissionregistrationv1.MutatingWebhookConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*admissionregistrationv1.MutatingWebhookConfiguration), err
 }
diff --git a/kubernetes/typed/admissionregistration/v1/fake/validatingadmissionpolicy.go b/kubernetes/typed/admissionregistration/v1/fake/validatingadmissionpolicy.go
new file mode 100644
index 000000000..663727183
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1/fake/validatingadmissionpolicy.go
@@ -0,0 +1,98 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	v1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1"
+	typedadmissionregistrationv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
+
+	typedkcpadmissionregistrationv1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// validatingAdmissionPolicyClusterClient implements ValidatingAdmissionPolicyClusterInterface
+type validatingAdmissionPolicyClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*admissionregistrationv1.ValidatingAdmissionPolicy, *admissionregistrationv1.ValidatingAdmissionPolicyList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeValidatingAdmissionPolicyClusterClient(fake *AdmissionregistrationV1ClusterClient) typedkcpadmissionregistrationv1.ValidatingAdmissionPolicyClusterInterface {
+	return &validatingAdmissionPolicyClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*admissionregistrationv1.ValidatingAdmissionPolicy, *admissionregistrationv1.ValidatingAdmissionPolicyList](
+			fake.Fake,
+			admissionregistrationv1.SchemeGroupVersion.WithResource("validatingadmissionpolicies"),
+			admissionregistrationv1.SchemeGroupVersion.WithKind("ValidatingAdmissionPolicy"),
+			func() *admissionregistrationv1.ValidatingAdmissionPolicy {
+				return &admissionregistrationv1.ValidatingAdmissionPolicy{}
+			},
+			func() *admissionregistrationv1.ValidatingAdmissionPolicyList {
+				return &admissionregistrationv1.ValidatingAdmissionPolicyList{}
+			},
+			func(dst, src *admissionregistrationv1.ValidatingAdmissionPolicyList) { dst.ListMeta = src.ListMeta },
+			func(list *admissionregistrationv1.ValidatingAdmissionPolicyList) []*admissionregistrationv1.ValidatingAdmissionPolicy {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1.ValidatingAdmissionPolicyList, items []*admissionregistrationv1.ValidatingAdmissionPolicy) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *validatingAdmissionPolicyClusterClient) Cluster(cluster logicalcluster.Path) typedadmissionregistrationv1.ValidatingAdmissionPolicyInterface {
+	return newFakeValidatingAdmissionPolicyClient(c.Fake, cluster)
+}
+
+// validatingAdmissionPolicyScopedClient implements ValidatingAdmissionPolicyInterface
+type validatingAdmissionPolicyScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*admissionregistrationv1.ValidatingAdmissionPolicy, *admissionregistrationv1.ValidatingAdmissionPolicyList, *v1.ValidatingAdmissionPolicyApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeValidatingAdmissionPolicyClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedadmissionregistrationv1.ValidatingAdmissionPolicyInterface {
+	return &validatingAdmissionPolicyScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*admissionregistrationv1.ValidatingAdmissionPolicy, *admissionregistrationv1.ValidatingAdmissionPolicyList, *v1.ValidatingAdmissionPolicyApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			admissionregistrationv1.SchemeGroupVersion.WithResource("validatingadmissionpolicies"),
+			admissionregistrationv1.SchemeGroupVersion.WithKind("ValidatingAdmissionPolicy"),
+			func() *admissionregistrationv1.ValidatingAdmissionPolicy {
+				return &admissionregistrationv1.ValidatingAdmissionPolicy{}
+			},
+			func() *admissionregistrationv1.ValidatingAdmissionPolicyList {
+				return &admissionregistrationv1.ValidatingAdmissionPolicyList{}
+			},
+			func(dst, src *admissionregistrationv1.ValidatingAdmissionPolicyList) { dst.ListMeta = src.ListMeta },
+			func(list *admissionregistrationv1.ValidatingAdmissionPolicyList) []*admissionregistrationv1.ValidatingAdmissionPolicy {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1.ValidatingAdmissionPolicyList, items []*admissionregistrationv1.ValidatingAdmissionPolicy) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/admissionregistration/v1/fake/validatingadmissionpolicybinding.go b/kubernetes/typed/admissionregistration/v1/fake/validatingadmissionpolicybinding.go
new file mode 100644
index 000000000..6b6b75c3b
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1/fake/validatingadmissionpolicybinding.go
@@ -0,0 +1,102 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	v1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1"
+	typedadmissionregistrationv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
+
+	typedkcpadmissionregistrationv1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// validatingAdmissionPolicyBindingClusterClient implements ValidatingAdmissionPolicyBindingClusterInterface
+type validatingAdmissionPolicyBindingClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*admissionregistrationv1.ValidatingAdmissionPolicyBinding, *admissionregistrationv1.ValidatingAdmissionPolicyBindingList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeValidatingAdmissionPolicyBindingClusterClient(fake *AdmissionregistrationV1ClusterClient) typedkcpadmissionregistrationv1.ValidatingAdmissionPolicyBindingClusterInterface {
+	return &validatingAdmissionPolicyBindingClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*admissionregistrationv1.ValidatingAdmissionPolicyBinding, *admissionregistrationv1.ValidatingAdmissionPolicyBindingList](
+			fake.Fake,
+			admissionregistrationv1.SchemeGroupVersion.WithResource("validatingadmissionpolicybindings"),
+			admissionregistrationv1.SchemeGroupVersion.WithKind("ValidatingAdmissionPolicyBinding"),
+			func() *admissionregistrationv1.ValidatingAdmissionPolicyBinding {
+				return &admissionregistrationv1.ValidatingAdmissionPolicyBinding{}
+			},
+			func() *admissionregistrationv1.ValidatingAdmissionPolicyBindingList {
+				return &admissionregistrationv1.ValidatingAdmissionPolicyBindingList{}
+			},
+			func(dst, src *admissionregistrationv1.ValidatingAdmissionPolicyBindingList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1.ValidatingAdmissionPolicyBindingList) []*admissionregistrationv1.ValidatingAdmissionPolicyBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1.ValidatingAdmissionPolicyBindingList, items []*admissionregistrationv1.ValidatingAdmissionPolicyBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *validatingAdmissionPolicyBindingClusterClient) Cluster(cluster logicalcluster.Path) typedadmissionregistrationv1.ValidatingAdmissionPolicyBindingInterface {
+	return newFakeValidatingAdmissionPolicyBindingClient(c.Fake, cluster)
+}
+
+// validatingAdmissionPolicyBindingScopedClient implements ValidatingAdmissionPolicyBindingInterface
+type validatingAdmissionPolicyBindingScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*admissionregistrationv1.ValidatingAdmissionPolicyBinding, *admissionregistrationv1.ValidatingAdmissionPolicyBindingList, *v1.ValidatingAdmissionPolicyBindingApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeValidatingAdmissionPolicyBindingClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedadmissionregistrationv1.ValidatingAdmissionPolicyBindingInterface {
+	return &validatingAdmissionPolicyBindingScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*admissionregistrationv1.ValidatingAdmissionPolicyBinding, *admissionregistrationv1.ValidatingAdmissionPolicyBindingList, *v1.ValidatingAdmissionPolicyBindingApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			admissionregistrationv1.SchemeGroupVersion.WithResource("validatingadmissionpolicybindings"),
+			admissionregistrationv1.SchemeGroupVersion.WithKind("ValidatingAdmissionPolicyBinding"),
+			func() *admissionregistrationv1.ValidatingAdmissionPolicyBinding {
+				return &admissionregistrationv1.ValidatingAdmissionPolicyBinding{}
+			},
+			func() *admissionregistrationv1.ValidatingAdmissionPolicyBindingList {
+				return &admissionregistrationv1.ValidatingAdmissionPolicyBindingList{}
+			},
+			func(dst, src *admissionregistrationv1.ValidatingAdmissionPolicyBindingList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1.ValidatingAdmissionPolicyBindingList) []*admissionregistrationv1.ValidatingAdmissionPolicyBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1.ValidatingAdmissionPolicyBindingList, items []*admissionregistrationv1.ValidatingAdmissionPolicyBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/admissionregistration/v1/fake/validatingwebhookconfiguration.go b/kubernetes/typed/admissionregistration/v1/fake/validatingwebhookconfiguration.go
index 78df35006..36196b111 100644
--- a/kubernetes/typed/admissionregistration/v1/fake/validatingwebhookconfiguration.go
+++ b/kubernetes/typed/admissionregistration/v1/fake/validatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,89 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsadmissionregistrationv1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1"
-	admissionregistrationv1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1"
+	typedadmissionregistrationv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
 
+	typedkcpadmissionregistrationv1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var validatingWebhookConfigurationsResource = schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1", Resource: "validatingwebhookconfigurations"}
-var validatingWebhookConfigurationsKind = schema.GroupVersionKind{Group: "admissionregistration.k8s.io", Version: "v1", Kind: "ValidatingWebhookConfiguration"}
-
-type validatingWebhookConfigurationsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *validatingWebhookConfigurationsClusterClient) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1client.ValidatingWebhookConfigurationInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &validatingWebhookConfigurationsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ValidatingWebhookConfigurations that match those selectors across all clusters.
-func (c *validatingWebhookConfigurationsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1.ValidatingWebhookConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(validatingWebhookConfigurationsResource, validatingWebhookConfigurationsKind, logicalcluster.Wildcard, opts), &admissionregistrationv1.ValidatingWebhookConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &admissionregistrationv1.ValidatingWebhookConfigurationList{ListMeta: obj.(*admissionregistrationv1.ValidatingWebhookConfigurationList).ListMeta}
-	for _, item := range obj.(*admissionregistrationv1.ValidatingWebhookConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested ValidatingWebhookConfigurations across all clusters.
-func (c *validatingWebhookConfigurationsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(validatingWebhookConfigurationsResource, logicalcluster.Wildcard, opts))
-}
-
-type validatingWebhookConfigurationsClient struct {
-	*kcptesting.Fake
+// validatingWebhookConfigurationClusterClient implements ValidatingWebhookConfigurationClusterInterface
+type validatingWebhookConfigurationClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*admissionregistrationv1.ValidatingWebhookConfiguration, *admissionregistrationv1.ValidatingWebhookConfigurationList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeValidatingWebhookConfigurationClusterClient(fake *AdmissionregistrationV1ClusterClient) typedkcpadmissionregistrationv1.ValidatingWebhookConfigurationClusterInterface {
+	return &validatingWebhookConfigurationClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*admissionregistrationv1.ValidatingWebhookConfiguration, *admissionregistrationv1.ValidatingWebhookConfigurationList](
+			fake.Fake,
+			admissionregistrationv1.SchemeGroupVersion.WithResource("validatingwebhookconfigurations"),
+			admissionregistrationv1.SchemeGroupVersion.WithKind("ValidatingWebhookConfiguration"),
+			func() *admissionregistrationv1.ValidatingWebhookConfiguration {
+				return &admissionregistrationv1.ValidatingWebhookConfiguration{}
+			},
+			func() *admissionregistrationv1.ValidatingWebhookConfigurationList {
+				return &admissionregistrationv1.ValidatingWebhookConfigurationList{}
+			},
+			func(dst, src *admissionregistrationv1.ValidatingWebhookConfigurationList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1.ValidatingWebhookConfigurationList) []*admissionregistrationv1.ValidatingWebhookConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1.ValidatingWebhookConfigurationList, items []*admissionregistrationv1.ValidatingWebhookConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *validatingWebhookConfigurationClusterClient) Cluster(cluster logicalcluster.Path) typedadmissionregistrationv1.ValidatingWebhookConfigurationInterface {
+	return newFakeValidatingWebhookConfigurationClient(c.Fake, cluster)
+}
+
+// validatingWebhookConfigurationScopedClient implements ValidatingWebhookConfigurationInterface
+type validatingWebhookConfigurationScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*admissionregistrationv1.ValidatingWebhookConfiguration, *admissionregistrationv1.ValidatingWebhookConfigurationList, *v1.ValidatingWebhookConfigurationApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *validatingWebhookConfigurationsClient) Create(ctx context.Context, validatingWebhookConfiguration *admissionregistrationv1.ValidatingWebhookConfiguration, opts metav1.CreateOptions) (*admissionregistrationv1.ValidatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(validatingWebhookConfigurationsResource, c.ClusterPath, validatingWebhookConfiguration), &admissionregistrationv1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1.ValidatingWebhookConfiguration), err
-}
-
-func (c *validatingWebhookConfigurationsClient) Update(ctx context.Context, validatingWebhookConfiguration *admissionregistrationv1.ValidatingWebhookConfiguration, opts metav1.UpdateOptions) (*admissionregistrationv1.ValidatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(validatingWebhookConfigurationsResource, c.ClusterPath, validatingWebhookConfiguration), &admissionregistrationv1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1.ValidatingWebhookConfiguration), err
-}
-
-func (c *validatingWebhookConfigurationsClient) UpdateStatus(ctx context.Context, validatingWebhookConfiguration *admissionregistrationv1.ValidatingWebhookConfiguration, opts metav1.UpdateOptions) (*admissionregistrationv1.ValidatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(validatingWebhookConfigurationsResource, c.ClusterPath, "status", validatingWebhookConfiguration), &admissionregistrationv1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1.ValidatingWebhookConfiguration), err
-}
-
-func (c *validatingWebhookConfigurationsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(validatingWebhookConfigurationsResource, c.ClusterPath, name, opts), &admissionregistrationv1.ValidatingWebhookConfiguration{})
-	return err
-}
-
-func (c *validatingWebhookConfigurationsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(validatingWebhookConfigurationsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &admissionregistrationv1.ValidatingWebhookConfigurationList{})
-	return err
-}
-
-func (c *validatingWebhookConfigurationsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*admissionregistrationv1.ValidatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(validatingWebhookConfigurationsResource, c.ClusterPath, name), &admissionregistrationv1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1.ValidatingWebhookConfiguration), err
-}
-
-// List takes label and field selectors, and returns the list of ValidatingWebhookConfigurations that match those selectors.
-func (c *validatingWebhookConfigurationsClient) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1.ValidatingWebhookConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(validatingWebhookConfigurationsResource, validatingWebhookConfigurationsKind, c.ClusterPath, opts), &admissionregistrationv1.ValidatingWebhookConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &admissionregistrationv1.ValidatingWebhookConfigurationList{ListMeta: obj.(*admissionregistrationv1.ValidatingWebhookConfigurationList).ListMeta}
-	for _, item := range obj.(*admissionregistrationv1.ValidatingWebhookConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *validatingWebhookConfigurationsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(validatingWebhookConfigurationsResource, c.ClusterPath, opts))
-}
-
-func (c *validatingWebhookConfigurationsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*admissionregistrationv1.ValidatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(validatingWebhookConfigurationsResource, c.ClusterPath, name, pt, data, subresources...), &admissionregistrationv1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1.ValidatingWebhookConfiguration), err
-}
-
-func (c *validatingWebhookConfigurationsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsadmissionregistrationv1.ValidatingWebhookConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*admissionregistrationv1.ValidatingWebhookConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(validatingWebhookConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &admissionregistrationv1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1.ValidatingWebhookConfiguration), err
-}
-
-func (c *validatingWebhookConfigurationsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsadmissionregistrationv1.ValidatingWebhookConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*admissionregistrationv1.ValidatingWebhookConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(validatingWebhookConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &admissionregistrationv1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
+func newFakeValidatingWebhookConfigurationClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedadmissionregistrationv1.ValidatingWebhookConfigurationInterface {
+	return &validatingWebhookConfigurationScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*admissionregistrationv1.ValidatingWebhookConfiguration, *admissionregistrationv1.ValidatingWebhookConfigurationList, *v1.ValidatingWebhookConfigurationApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			admissionregistrationv1.SchemeGroupVersion.WithResource("validatingwebhookconfigurations"),
+			admissionregistrationv1.SchemeGroupVersion.WithKind("ValidatingWebhookConfiguration"),
+			func() *admissionregistrationv1.ValidatingWebhookConfiguration {
+				return &admissionregistrationv1.ValidatingWebhookConfiguration{}
+			},
+			func() *admissionregistrationv1.ValidatingWebhookConfigurationList {
+				return &admissionregistrationv1.ValidatingWebhookConfigurationList{}
+			},
+			func(dst, src *admissionregistrationv1.ValidatingWebhookConfigurationList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1.ValidatingWebhookConfigurationList) []*admissionregistrationv1.ValidatingWebhookConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1.ValidatingWebhookConfigurationList, items []*admissionregistrationv1.ValidatingWebhookConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*admissionregistrationv1.ValidatingWebhookConfiguration), err
 }
diff --git a/kubernetes/typed/admissionregistration/v1/generated_expansion.go b/kubernetes/typed/admissionregistration/v1/generated_expansion.go
new file mode 100644
index 000000000..f00116bd8
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1/generated_expansion.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type MutatingWebhookConfigurationClusterExpansion interface{}
+
+type ValidatingAdmissionPolicyClusterExpansion interface{}
+
+type ValidatingAdmissionPolicyBindingClusterExpansion interface{}
+
+type ValidatingWebhookConfigurationClusterExpansion interface{}
diff --git a/kubernetes/typed/admissionregistration/v1/mutatingwebhookconfiguration.go b/kubernetes/typed/admissionregistration/v1/mutatingwebhookconfiguration.go
index 6048dc340..79301570d 100644
--- a/kubernetes/typed/admissionregistration/v1/mutatingwebhookconfiguration.go
+++ b/kubernetes/typed/admissionregistration/v1/mutatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apiadmissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	admissionregistrationv1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
 )
 
 // MutatingWebhookConfigurationsClusterGetter has a method to return a MutatingWebhookConfigurationClusterInterface.
@@ -40,19 +37,20 @@ type MutatingWebhookConfigurationsClusterGetter interface {
 }
 
 // MutatingWebhookConfigurationClusterInterface can operate on MutatingWebhookConfigurations across all clusters,
-// or scope down to one cluster and return a admissionregistrationv1client.MutatingWebhookConfigurationInterface.
+// or scope down to one cluster and return a admissionregistrationv1.MutatingWebhookConfigurationInterface.
 type MutatingWebhookConfigurationClusterInterface interface {
-	Cluster(logicalcluster.Path) admissionregistrationv1client.MutatingWebhookConfigurationInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1.MutatingWebhookConfigurationList, error)
+	Cluster(logicalcluster.Path) admissionregistrationv1.MutatingWebhookConfigurationInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apiadmissionregistrationv1.MutatingWebhookConfigurationList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	MutatingWebhookConfigurationClusterExpansion
 }
 
 type mutatingWebhookConfigurationsClusterInterface struct {
-	clientCache kcpclient.Cache[*admissionregistrationv1client.AdmissionregistrationV1Client]
+	clientCache kcpclient.Cache[*admissionregistrationv1.AdmissionregistrationV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *mutatingWebhookConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1client.MutatingWebhookConfigurationInterface {
+func (c *mutatingWebhookConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1.MutatingWebhookConfigurationInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *mutatingWebhookConfigurationsClusterInterface) Cluster(clusterPath logi
 }
 
 // List returns the entire collection of all MutatingWebhookConfigurations across all clusters.
-func (c *mutatingWebhookConfigurationsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1.MutatingWebhookConfigurationList, error) {
+func (c *mutatingWebhookConfigurationsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apiadmissionregistrationv1.MutatingWebhookConfigurationList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).MutatingWebhookConfigurations().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/admissionregistration/v1/validatingadmissionpolicy.go b/kubernetes/typed/admissionregistration/v1/validatingadmissionpolicy.go
new file mode 100644
index 000000000..bc5557e61
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1/validatingadmissionpolicy.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	apiadmissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ValidatingAdmissionPoliciesClusterGetter has a method to return a ValidatingAdmissionPolicyClusterInterface.
+// A group's cluster client should implement this interface.
+type ValidatingAdmissionPoliciesClusterGetter interface {
+	ValidatingAdmissionPolicies() ValidatingAdmissionPolicyClusterInterface
+}
+
+// ValidatingAdmissionPolicyClusterInterface can operate on ValidatingAdmissionPolicies across all clusters,
+// or scope down to one cluster and return a admissionregistrationv1.ValidatingAdmissionPolicyInterface.
+type ValidatingAdmissionPolicyClusterInterface interface {
+	Cluster(logicalcluster.Path) admissionregistrationv1.ValidatingAdmissionPolicyInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apiadmissionregistrationv1.ValidatingAdmissionPolicyList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ValidatingAdmissionPolicyClusterExpansion
+}
+
+type validatingAdmissionPoliciesClusterInterface struct {
+	clientCache kcpclient.Cache[*admissionregistrationv1.AdmissionregistrationV1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *validatingAdmissionPoliciesClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1.ValidatingAdmissionPolicyInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).ValidatingAdmissionPolicies()
+}
+
+// List returns the entire collection of all ValidatingAdmissionPolicies across all clusters.
+func (c *validatingAdmissionPoliciesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apiadmissionregistrationv1.ValidatingAdmissionPolicyList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingAdmissionPolicies().List(ctx, opts)
+}
+
+// Watch begins to watch all ValidatingAdmissionPolicies across all clusters.
+func (c *validatingAdmissionPoliciesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingAdmissionPolicies().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/admissionregistration/v1/validatingadmissionpolicybinding.go b/kubernetes/typed/admissionregistration/v1/validatingadmissionpolicybinding.go
new file mode 100644
index 000000000..bf32d9cb1
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1/validatingadmissionpolicybinding.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	apiadmissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ValidatingAdmissionPolicyBindingsClusterGetter has a method to return a ValidatingAdmissionPolicyBindingClusterInterface.
+// A group's cluster client should implement this interface.
+type ValidatingAdmissionPolicyBindingsClusterGetter interface {
+	ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingClusterInterface
+}
+
+// ValidatingAdmissionPolicyBindingClusterInterface can operate on ValidatingAdmissionPolicyBindings across all clusters,
+// or scope down to one cluster and return a admissionregistrationv1.ValidatingAdmissionPolicyBindingInterface.
+type ValidatingAdmissionPolicyBindingClusterInterface interface {
+	Cluster(logicalcluster.Path) admissionregistrationv1.ValidatingAdmissionPolicyBindingInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apiadmissionregistrationv1.ValidatingAdmissionPolicyBindingList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ValidatingAdmissionPolicyBindingClusterExpansion
+}
+
+type validatingAdmissionPolicyBindingsClusterInterface struct {
+	clientCache kcpclient.Cache[*admissionregistrationv1.AdmissionregistrationV1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *validatingAdmissionPolicyBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1.ValidatingAdmissionPolicyBindingInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).ValidatingAdmissionPolicyBindings()
+}
+
+// List returns the entire collection of all ValidatingAdmissionPolicyBindings across all clusters.
+func (c *validatingAdmissionPolicyBindingsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apiadmissionregistrationv1.ValidatingAdmissionPolicyBindingList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingAdmissionPolicyBindings().List(ctx, opts)
+}
+
+// Watch begins to watch all ValidatingAdmissionPolicyBindings across all clusters.
+func (c *validatingAdmissionPolicyBindingsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingAdmissionPolicyBindings().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/admissionregistration/v1/validatingwebhookconfiguration.go b/kubernetes/typed/admissionregistration/v1/validatingwebhookconfiguration.go
index ab4c0aaab..f3f1e5de4 100644
--- a/kubernetes/typed/admissionregistration/v1/validatingwebhookconfiguration.go
+++ b/kubernetes/typed/admissionregistration/v1/validatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apiadmissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	admissionregistrationv1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1"
 )
 
 // ValidatingWebhookConfigurationsClusterGetter has a method to return a ValidatingWebhookConfigurationClusterInterface.
@@ -40,19 +37,20 @@ type ValidatingWebhookConfigurationsClusterGetter interface {
 }
 
 // ValidatingWebhookConfigurationClusterInterface can operate on ValidatingWebhookConfigurations across all clusters,
-// or scope down to one cluster and return a admissionregistrationv1client.ValidatingWebhookConfigurationInterface.
+// or scope down to one cluster and return a admissionregistrationv1.ValidatingWebhookConfigurationInterface.
 type ValidatingWebhookConfigurationClusterInterface interface {
-	Cluster(logicalcluster.Path) admissionregistrationv1client.ValidatingWebhookConfigurationInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1.ValidatingWebhookConfigurationList, error)
+	Cluster(logicalcluster.Path) admissionregistrationv1.ValidatingWebhookConfigurationInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apiadmissionregistrationv1.ValidatingWebhookConfigurationList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ValidatingWebhookConfigurationClusterExpansion
 }
 
 type validatingWebhookConfigurationsClusterInterface struct {
-	clientCache kcpclient.Cache[*admissionregistrationv1client.AdmissionregistrationV1Client]
+	clientCache kcpclient.Cache[*admissionregistrationv1.AdmissionregistrationV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *validatingWebhookConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1client.ValidatingWebhookConfigurationInterface {
+func (c *validatingWebhookConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1.ValidatingWebhookConfigurationInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *validatingWebhookConfigurationsClusterInterface) Cluster(clusterPath lo
 }
 
 // List returns the entire collection of all ValidatingWebhookConfigurations across all clusters.
-func (c *validatingWebhookConfigurationsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1.ValidatingWebhookConfigurationList, error) {
+func (c *validatingWebhookConfigurationsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apiadmissionregistrationv1.ValidatingWebhookConfigurationList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingWebhookConfigurations().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/admissionregistration_client.go b/kubernetes/typed/admissionregistration/v1alpha1/admissionregistration_client.go
index b41cf65d4..36d73b495 100644
--- a/kubernetes/typed/admissionregistration/v1alpha1/admissionregistration_client.go
+++ b/kubernetes/typed/admissionregistration/v1alpha1/admissionregistration_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,22 +14,26 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiadmissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	admissionregistrationv1alpha1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1alpha1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
-	"k8s.io/client-go/rest"
 )
 
 type AdmissionregistrationV1alpha1ClusterInterface interface {
 	AdmissionregistrationV1alpha1ClusterScoper
+	MutatingAdmissionPoliciesClusterGetter
+	MutatingAdmissionPolicyBindingsClusterGetter
 	ValidatingAdmissionPoliciesClusterGetter
 	ValidatingAdmissionPolicyBindingsClusterGetter
 }
@@ -41,6 +42,7 @@ type AdmissionregistrationV1alpha1ClusterScoper interface {
 	Cluster(logicalcluster.Path) admissionregistrationv1alpha1.AdmissionregistrationV1alpha1Interface
 }
 
+// AdmissionregistrationV1alpha1ClusterClient is used to interact with features provided by the admissionregistration.k8s.io group.
 type AdmissionregistrationV1alpha1ClusterClient struct {
 	clientCache kcpclient.Cache[*admissionregistrationv1alpha1.AdmissionregistrationV1alpha1Client]
 }
@@ -52,6 +54,14 @@ func (c *AdmissionregistrationV1alpha1ClusterClient) Cluster(clusterPath logical
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
+func (c *AdmissionregistrationV1alpha1ClusterClient) MutatingAdmissionPolicies() MutatingAdmissionPolicyClusterInterface {
+	return &mutatingAdmissionPoliciesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *AdmissionregistrationV1alpha1ClusterClient) MutatingAdmissionPolicyBindings() MutatingAdmissionPolicyBindingClusterInterface {
+	return &mutatingAdmissionPolicyBindingsClusterInterface{clientCache: c.clientCache}
+}
+
 func (c *AdmissionregistrationV1alpha1ClusterClient) ValidatingAdmissionPolicies() ValidatingAdmissionPolicyClusterInterface {
 	return &validatingAdmissionPoliciesClusterInterface{clientCache: c.clientCache}
 }
@@ -64,11 +74,13 @@ func (c *AdmissionregistrationV1alpha1ClusterClient) ValidatingAdmissionPolicyBi
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AdmissionregistrationV1alpha1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AdmissionregistrationV1alpha1ClusterClient for the given config and http client.
@@ -80,6 +92,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*Admissionregistrati
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AdmissionregistrationV1alpha1ClusterClient{clientCache: cache}, nil
 }
 
@@ -92,3 +105,14 @@ func NewForConfigOrDie(c *rest.Config) *AdmissionregistrationV1alpha1ClusterClie
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiadmissionregistrationv1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/doc.go b/kubernetes/typed/admissionregistration/v1alpha1/doc.go
new file mode 100644
index 000000000..08b80237c
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/fake/admissionregistration_client.go b/kubernetes/typed/admissionregistration/v1alpha1/fake/admissionregistration_client.go
index 8177fd3bf..86b24aa5d 100644
--- a/kubernetes/typed/admissionregistration/v1alpha1/fake/admissionregistration_client.go
+++ b/kubernetes/typed/admissionregistration/v1alpha1/fake/admissionregistration_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1alpha1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpadmissionregistrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1alpha1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpadmissionregistrationv1alpha1.AdmissionregistrationV1alpha1ClusterInterface = (*AdmissionregistrationV1alpha1ClusterClient)(nil)
@@ -44,30 +40,46 @@ func (c *AdmissionregistrationV1alpha1ClusterClient) Cluster(clusterPath logical
 	return &AdmissionregistrationV1alpha1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
+func (c *AdmissionregistrationV1alpha1ClusterClient) MutatingAdmissionPolicies() kcpadmissionregistrationv1alpha1.MutatingAdmissionPolicyClusterInterface {
+	return newFakeMutatingAdmissionPolicyClusterClient(c)
+}
+
+func (c *AdmissionregistrationV1alpha1ClusterClient) MutatingAdmissionPolicyBindings() kcpadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingClusterInterface {
+	return newFakeMutatingAdmissionPolicyBindingClusterClient(c)
+}
+
 func (c *AdmissionregistrationV1alpha1ClusterClient) ValidatingAdmissionPolicies() kcpadmissionregistrationv1alpha1.ValidatingAdmissionPolicyClusterInterface {
-	return &validatingAdmissionPoliciesClusterClient{Fake: c.Fake}
+	return newFakeValidatingAdmissionPolicyClusterClient(c)
 }
 
 func (c *AdmissionregistrationV1alpha1ClusterClient) ValidatingAdmissionPolicyBindings() kcpadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingClusterInterface {
-	return &validatingAdmissionPolicyBindingsClusterClient{Fake: c.Fake}
+	return newFakeValidatingAdmissionPolicyBindingClusterClient(c)
 }
 
-var _ admissionregistrationv1alpha1.AdmissionregistrationV1alpha1Interface = (*AdmissionregistrationV1alpha1Client)(nil)
-
 type AdmissionregistrationV1alpha1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *AdmissionregistrationV1alpha1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *AdmissionregistrationV1alpha1Client) MutatingAdmissionPolicies() admissionregistrationv1alpha1.MutatingAdmissionPolicyInterface {
+	return newFakeMutatingAdmissionPolicyClient(c.Fake, c.ClusterPath)
+}
+
+func (c *AdmissionregistrationV1alpha1Client) MutatingAdmissionPolicyBindings() admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingInterface {
+	return newFakeMutatingAdmissionPolicyBindingClient(c.Fake, c.ClusterPath)
 }
 
 func (c *AdmissionregistrationV1alpha1Client) ValidatingAdmissionPolicies() admissionregistrationv1alpha1.ValidatingAdmissionPolicyInterface {
-	return &validatingAdmissionPoliciesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakeValidatingAdmissionPolicyClient(c.Fake, c.ClusterPath)
 }
 
 func (c *AdmissionregistrationV1alpha1Client) ValidatingAdmissionPolicyBindings() admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingInterface {
-	return &validatingAdmissionPolicyBindingsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakeValidatingAdmissionPolicyBindingClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AdmissionregistrationV1alpha1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/fake/doc.go b/kubernetes/typed/admissionregistration/v1alpha1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/fake/mutatingadmissionpolicy.go b/kubernetes/typed/admissionregistration/v1alpha1/fake/mutatingadmissionpolicy.go
new file mode 100644
index 000000000..7959ad470
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1alpha1/fake/mutatingadmissionpolicy.go
@@ -0,0 +1,98 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1"
+	typedadmissionregistrationv1alpha1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
+
+	typedkcpadmissionregistrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// mutatingAdmissionPolicyClusterClient implements MutatingAdmissionPolicyClusterInterface
+type mutatingAdmissionPolicyClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*admissionregistrationv1alpha1.MutatingAdmissionPolicy, *admissionregistrationv1alpha1.MutatingAdmissionPolicyList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeMutatingAdmissionPolicyClusterClient(fake *AdmissionregistrationV1alpha1ClusterClient) typedkcpadmissionregistrationv1alpha1.MutatingAdmissionPolicyClusterInterface {
+	return &mutatingAdmissionPolicyClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*admissionregistrationv1alpha1.MutatingAdmissionPolicy, *admissionregistrationv1alpha1.MutatingAdmissionPolicyList](
+			fake.Fake,
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithResource("mutatingadmissionpolicies"),
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithKind("MutatingAdmissionPolicy"),
+			func() *admissionregistrationv1alpha1.MutatingAdmissionPolicy {
+				return &admissionregistrationv1alpha1.MutatingAdmissionPolicy{}
+			},
+			func() *admissionregistrationv1alpha1.MutatingAdmissionPolicyList {
+				return &admissionregistrationv1alpha1.MutatingAdmissionPolicyList{}
+			},
+			func(dst, src *admissionregistrationv1alpha1.MutatingAdmissionPolicyList) { dst.ListMeta = src.ListMeta },
+			func(list *admissionregistrationv1alpha1.MutatingAdmissionPolicyList) []*admissionregistrationv1alpha1.MutatingAdmissionPolicy {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1alpha1.MutatingAdmissionPolicyList, items []*admissionregistrationv1alpha1.MutatingAdmissionPolicy) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *mutatingAdmissionPolicyClusterClient) Cluster(cluster logicalcluster.Path) typedadmissionregistrationv1alpha1.MutatingAdmissionPolicyInterface {
+	return newFakeMutatingAdmissionPolicyClient(c.Fake, cluster)
+}
+
+// mutatingAdmissionPolicyScopedClient implements MutatingAdmissionPolicyInterface
+type mutatingAdmissionPolicyScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*admissionregistrationv1alpha1.MutatingAdmissionPolicy, *admissionregistrationv1alpha1.MutatingAdmissionPolicyList, *v1alpha1.MutatingAdmissionPolicyApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeMutatingAdmissionPolicyClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedadmissionregistrationv1alpha1.MutatingAdmissionPolicyInterface {
+	return &mutatingAdmissionPolicyScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*admissionregistrationv1alpha1.MutatingAdmissionPolicy, *admissionregistrationv1alpha1.MutatingAdmissionPolicyList, *v1alpha1.MutatingAdmissionPolicyApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithResource("mutatingadmissionpolicies"),
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithKind("MutatingAdmissionPolicy"),
+			func() *admissionregistrationv1alpha1.MutatingAdmissionPolicy {
+				return &admissionregistrationv1alpha1.MutatingAdmissionPolicy{}
+			},
+			func() *admissionregistrationv1alpha1.MutatingAdmissionPolicyList {
+				return &admissionregistrationv1alpha1.MutatingAdmissionPolicyList{}
+			},
+			func(dst, src *admissionregistrationv1alpha1.MutatingAdmissionPolicyList) { dst.ListMeta = src.ListMeta },
+			func(list *admissionregistrationv1alpha1.MutatingAdmissionPolicyList) []*admissionregistrationv1alpha1.MutatingAdmissionPolicy {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1alpha1.MutatingAdmissionPolicyList, items []*admissionregistrationv1alpha1.MutatingAdmissionPolicy) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/fake/mutatingadmissionpolicybinding.go b/kubernetes/typed/admissionregistration/v1alpha1/fake/mutatingadmissionpolicybinding.go
new file mode 100644
index 000000000..2476c32a9
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1alpha1/fake/mutatingadmissionpolicybinding.go
@@ -0,0 +1,102 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1"
+	typedadmissionregistrationv1alpha1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
+
+	typedkcpadmissionregistrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// mutatingAdmissionPolicyBindingClusterClient implements MutatingAdmissionPolicyBindingClusterInterface
+type mutatingAdmissionPolicyBindingClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding, *admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeMutatingAdmissionPolicyBindingClusterClient(fake *AdmissionregistrationV1alpha1ClusterClient) typedkcpadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingClusterInterface {
+	return &mutatingAdmissionPolicyBindingClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding, *admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList](
+			fake.Fake,
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithResource("mutatingadmissionpolicybindings"),
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithKind("MutatingAdmissionPolicyBinding"),
+			func() *admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding {
+				return &admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding{}
+			},
+			func() *admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList {
+				return &admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList{}
+			},
+			func(dst, src *admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList) []*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList, items []*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *mutatingAdmissionPolicyBindingClusterClient) Cluster(cluster logicalcluster.Path) typedadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingInterface {
+	return newFakeMutatingAdmissionPolicyBindingClient(c.Fake, cluster)
+}
+
+// mutatingAdmissionPolicyBindingScopedClient implements MutatingAdmissionPolicyBindingInterface
+type mutatingAdmissionPolicyBindingScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding, *admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList, *v1alpha1.MutatingAdmissionPolicyBindingApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeMutatingAdmissionPolicyBindingClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingInterface {
+	return &mutatingAdmissionPolicyBindingScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding, *admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList, *v1alpha1.MutatingAdmissionPolicyBindingApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithResource("mutatingadmissionpolicybindings"),
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithKind("MutatingAdmissionPolicyBinding"),
+			func() *admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding {
+				return &admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding{}
+			},
+			func() *admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList {
+				return &admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList{}
+			},
+			func(dst, src *admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList) []*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList, items []*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/fake/validatingadmissionpolicy.go b/kubernetes/typed/admissionregistration/v1alpha1/fake/validatingadmissionpolicy.go
index fde5a535e..8b75b2aa8 100644
--- a/kubernetes/typed/admissionregistration/v1alpha1/fake/validatingadmissionpolicy.go
+++ b/kubernetes/typed/admissionregistration/v1alpha1/fake/validatingadmissionpolicy.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,89 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsadmissionregistrationv1alpha1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1"
-	admissionregistrationv1alpha1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
-	"k8s.io/client-go/testing"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1"
+	typedadmissionregistrationv1alpha1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
 
+	typedkcpadmissionregistrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var validatingAdmissionPoliciesResource = schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1alpha1", Resource: "validatingadmissionpolicies"}
-var validatingAdmissionPoliciesKind = schema.GroupVersionKind{Group: "admissionregistration.k8s.io", Version: "v1alpha1", Kind: "ValidatingAdmissionPolicy"}
-
-type validatingAdmissionPoliciesClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *validatingAdmissionPoliciesClusterClient) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1alpha1client.ValidatingAdmissionPolicyInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &validatingAdmissionPoliciesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ValidatingAdmissionPolicies that match those selectors across all clusters.
-func (c *validatingAdmissionPoliciesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(validatingAdmissionPoliciesResource, validatingAdmissionPoliciesKind, logicalcluster.Wildcard, opts), &admissionregistrationv1alpha1.ValidatingAdmissionPolicyList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &admissionregistrationv1alpha1.ValidatingAdmissionPolicyList{ListMeta: obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyList).ListMeta}
-	for _, item := range obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested ValidatingAdmissionPolicies across all clusters.
-func (c *validatingAdmissionPoliciesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(validatingAdmissionPoliciesResource, logicalcluster.Wildcard, opts))
-}
-
-type validatingAdmissionPoliciesClient struct {
-	*kcptesting.Fake
+// validatingAdmissionPolicyClusterClient implements ValidatingAdmissionPolicyClusterInterface
+type validatingAdmissionPolicyClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, *admissionregistrationv1alpha1.ValidatingAdmissionPolicyList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeValidatingAdmissionPolicyClusterClient(fake *AdmissionregistrationV1alpha1ClusterClient) typedkcpadmissionregistrationv1alpha1.ValidatingAdmissionPolicyClusterInterface {
+	return &validatingAdmissionPolicyClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, *admissionregistrationv1alpha1.ValidatingAdmissionPolicyList](
+			fake.Fake,
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithResource("validatingadmissionpolicies"),
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithKind("ValidatingAdmissionPolicy"),
+			func() *admissionregistrationv1alpha1.ValidatingAdmissionPolicy {
+				return &admissionregistrationv1alpha1.ValidatingAdmissionPolicy{}
+			},
+			func() *admissionregistrationv1alpha1.ValidatingAdmissionPolicyList {
+				return &admissionregistrationv1alpha1.ValidatingAdmissionPolicyList{}
+			},
+			func(dst, src *admissionregistrationv1alpha1.ValidatingAdmissionPolicyList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1alpha1.ValidatingAdmissionPolicyList) []*admissionregistrationv1alpha1.ValidatingAdmissionPolicy {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1alpha1.ValidatingAdmissionPolicyList, items []*admissionregistrationv1alpha1.ValidatingAdmissionPolicy) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *validatingAdmissionPolicyClusterClient) Cluster(cluster logicalcluster.Path) typedadmissionregistrationv1alpha1.ValidatingAdmissionPolicyInterface {
+	return newFakeValidatingAdmissionPolicyClient(c.Fake, cluster)
+}
+
+// validatingAdmissionPolicyScopedClient implements ValidatingAdmissionPolicyInterface
+type validatingAdmissionPolicyScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, *admissionregistrationv1alpha1.ValidatingAdmissionPolicyList, *v1alpha1.ValidatingAdmissionPolicyApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *validatingAdmissionPoliciesClient) Create(ctx context.Context, validatingAdmissionPolicy *admissionregistrationv1alpha1.ValidatingAdmissionPolicy, opts metav1.CreateOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(validatingAdmissionPoliciesResource, c.ClusterPath, validatingAdmissionPolicy), &admissionregistrationv1alpha1.ValidatingAdmissionPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicy), err
-}
-
-func (c *validatingAdmissionPoliciesClient) Update(ctx context.Context, validatingAdmissionPolicy *admissionregistrationv1alpha1.ValidatingAdmissionPolicy, opts metav1.UpdateOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(validatingAdmissionPoliciesResource, c.ClusterPath, validatingAdmissionPolicy), &admissionregistrationv1alpha1.ValidatingAdmissionPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicy), err
-}
-
-func (c *validatingAdmissionPoliciesClient) UpdateStatus(ctx context.Context, validatingAdmissionPolicy *admissionregistrationv1alpha1.ValidatingAdmissionPolicy, opts metav1.UpdateOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(validatingAdmissionPoliciesResource, c.ClusterPath, "status", validatingAdmissionPolicy), &admissionregistrationv1alpha1.ValidatingAdmissionPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicy), err
-}
-
-func (c *validatingAdmissionPoliciesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(validatingAdmissionPoliciesResource, c.ClusterPath, name, opts), &admissionregistrationv1alpha1.ValidatingAdmissionPolicy{})
-	return err
-}
-
-func (c *validatingAdmissionPoliciesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(validatingAdmissionPoliciesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &admissionregistrationv1alpha1.ValidatingAdmissionPolicyList{})
-	return err
-}
-
-func (c *validatingAdmissionPoliciesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(validatingAdmissionPoliciesResource, c.ClusterPath, name), &admissionregistrationv1alpha1.ValidatingAdmissionPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicy), err
-}
-
-// List takes label and field selectors, and returns the list of ValidatingAdmissionPolicies that match those selectors.
-func (c *validatingAdmissionPoliciesClient) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(validatingAdmissionPoliciesResource, validatingAdmissionPoliciesKind, c.ClusterPath, opts), &admissionregistrationv1alpha1.ValidatingAdmissionPolicyList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &admissionregistrationv1alpha1.ValidatingAdmissionPolicyList{ListMeta: obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyList).ListMeta}
-	for _, item := range obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *validatingAdmissionPoliciesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(validatingAdmissionPoliciesResource, c.ClusterPath, opts))
-}
-
-func (c *validatingAdmissionPoliciesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(validatingAdmissionPoliciesResource, c.ClusterPath, name, pt, data, subresources...), &admissionregistrationv1alpha1.ValidatingAdmissionPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicy), err
-}
-
-func (c *validatingAdmissionPoliciesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsadmissionregistrationv1alpha1.ValidatingAdmissionPolicyApplyConfiguration, opts metav1.ApplyOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(validatingAdmissionPoliciesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &admissionregistrationv1alpha1.ValidatingAdmissionPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicy), err
-}
-
-func (c *validatingAdmissionPoliciesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsadmissionregistrationv1alpha1.ValidatingAdmissionPolicyApplyConfiguration, opts metav1.ApplyOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(validatingAdmissionPoliciesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &admissionregistrationv1alpha1.ValidatingAdmissionPolicy{})
-	if obj == nil {
-		return nil, err
+func newFakeValidatingAdmissionPolicyClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedadmissionregistrationv1alpha1.ValidatingAdmissionPolicyInterface {
+	return &validatingAdmissionPolicyScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, *admissionregistrationv1alpha1.ValidatingAdmissionPolicyList, *v1alpha1.ValidatingAdmissionPolicyApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithResource("validatingadmissionpolicies"),
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithKind("ValidatingAdmissionPolicy"),
+			func() *admissionregistrationv1alpha1.ValidatingAdmissionPolicy {
+				return &admissionregistrationv1alpha1.ValidatingAdmissionPolicy{}
+			},
+			func() *admissionregistrationv1alpha1.ValidatingAdmissionPolicyList {
+				return &admissionregistrationv1alpha1.ValidatingAdmissionPolicyList{}
+			},
+			func(dst, src *admissionregistrationv1alpha1.ValidatingAdmissionPolicyList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1alpha1.ValidatingAdmissionPolicyList) []*admissionregistrationv1alpha1.ValidatingAdmissionPolicy {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1alpha1.ValidatingAdmissionPolicyList, items []*admissionregistrationv1alpha1.ValidatingAdmissionPolicy) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicy), err
 }
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/fake/validatingadmissionpolicybinding.go b/kubernetes/typed/admissionregistration/v1alpha1/fake/validatingadmissionpolicybinding.go
index c1e6d8a9f..c38bdeba9 100644
--- a/kubernetes/typed/admissionregistration/v1alpha1/fake/validatingadmissionpolicybinding.go
+++ b/kubernetes/typed/admissionregistration/v1alpha1/fake/validatingadmissionpolicybinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,89 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsadmissionregistrationv1alpha1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1"
-	admissionregistrationv1alpha1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
-	"k8s.io/client-go/testing"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1alpha1"
+	typedadmissionregistrationv1alpha1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
 
+	typedkcpadmissionregistrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var validatingAdmissionPolicyBindingsResource = schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1alpha1", Resource: "validatingadmissionpolicybindings"}
-var validatingAdmissionPolicyBindingsKind = schema.GroupVersionKind{Group: "admissionregistration.k8s.io", Version: "v1alpha1", Kind: "ValidatingAdmissionPolicyBinding"}
-
-type validatingAdmissionPolicyBindingsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *validatingAdmissionPolicyBindingsClusterClient) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1alpha1client.ValidatingAdmissionPolicyBindingInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &validatingAdmissionPolicyBindingsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ValidatingAdmissionPolicyBindings that match those selectors across all clusters.
-func (c *validatingAdmissionPolicyBindingsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(validatingAdmissionPolicyBindingsResource, validatingAdmissionPolicyBindingsKind, logicalcluster.Wildcard, opts), &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList{ListMeta: obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList).ListMeta}
-	for _, item := range obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested ValidatingAdmissionPolicyBindings across all clusters.
-func (c *validatingAdmissionPolicyBindingsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(validatingAdmissionPolicyBindingsResource, logicalcluster.Wildcard, opts))
-}
-
-type validatingAdmissionPolicyBindingsClient struct {
-	*kcptesting.Fake
+// validatingAdmissionPolicyBindingClusterClient implements ValidatingAdmissionPolicyBindingClusterInterface
+type validatingAdmissionPolicyBindingClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeValidatingAdmissionPolicyBindingClusterClient(fake *AdmissionregistrationV1alpha1ClusterClient) typedkcpadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingClusterInterface {
+	return &validatingAdmissionPolicyBindingClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList](
+			fake.Fake,
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithResource("validatingadmissionpolicybindings"),
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithKind("ValidatingAdmissionPolicyBinding"),
+			func() *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding {
+				return &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{}
+			},
+			func() *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList {
+				return &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList{}
+			},
+			func(dst, src *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList) []*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList, items []*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *validatingAdmissionPolicyBindingClusterClient) Cluster(cluster logicalcluster.Path) typedadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingInterface {
+	return newFakeValidatingAdmissionPolicyBindingClient(c.Fake, cluster)
+}
+
+// validatingAdmissionPolicyBindingScopedClient implements ValidatingAdmissionPolicyBindingInterface
+type validatingAdmissionPolicyBindingScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList, *v1alpha1.ValidatingAdmissionPolicyBindingApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *validatingAdmissionPolicyBindingsClient) Create(ctx context.Context, validatingAdmissionPolicyBinding *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, opts metav1.CreateOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(validatingAdmissionPolicyBindingsResource, c.ClusterPath, validatingAdmissionPolicyBinding), &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding), err
-}
-
-func (c *validatingAdmissionPolicyBindingsClient) Update(ctx context.Context, validatingAdmissionPolicyBinding *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, opts metav1.UpdateOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(validatingAdmissionPolicyBindingsResource, c.ClusterPath, validatingAdmissionPolicyBinding), &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding), err
-}
-
-func (c *validatingAdmissionPolicyBindingsClient) UpdateStatus(ctx context.Context, validatingAdmissionPolicyBinding *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, opts metav1.UpdateOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(validatingAdmissionPolicyBindingsResource, c.ClusterPath, "status", validatingAdmissionPolicyBinding), &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding), err
-}
-
-func (c *validatingAdmissionPolicyBindingsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(validatingAdmissionPolicyBindingsResource, c.ClusterPath, name, opts), &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{})
-	return err
-}
-
-func (c *validatingAdmissionPolicyBindingsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(validatingAdmissionPolicyBindingsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList{})
-	return err
-}
-
-func (c *validatingAdmissionPolicyBindingsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(validatingAdmissionPolicyBindingsResource, c.ClusterPath, name), &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding), err
-}
-
-// List takes label and field selectors, and returns the list of ValidatingAdmissionPolicyBindings that match those selectors.
-func (c *validatingAdmissionPolicyBindingsClient) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(validatingAdmissionPolicyBindingsResource, validatingAdmissionPolicyBindingsKind, c.ClusterPath, opts), &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList{ListMeta: obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList).ListMeta}
-	for _, item := range obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *validatingAdmissionPolicyBindingsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(validatingAdmissionPolicyBindingsResource, c.ClusterPath, opts))
-}
-
-func (c *validatingAdmissionPolicyBindingsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(validatingAdmissionPolicyBindingsResource, c.ClusterPath, name, pt, data, subresources...), &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding), err
-}
-
-func (c *validatingAdmissionPolicyBindingsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingApplyConfiguration, opts metav1.ApplyOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(validatingAdmissionPolicyBindingsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding), err
-}
-
-func (c *validatingAdmissionPolicyBindingsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingApplyConfiguration, opts metav1.ApplyOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(validatingAdmissionPolicyBindingsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{})
-	if obj == nil {
-		return nil, err
+func newFakeValidatingAdmissionPolicyBindingClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingInterface {
+	return &validatingAdmissionPolicyBindingScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList, *v1alpha1.ValidatingAdmissionPolicyBindingApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithResource("validatingadmissionpolicybindings"),
+			admissionregistrationv1alpha1.SchemeGroupVersion.WithKind("ValidatingAdmissionPolicyBinding"),
+			func() *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding {
+				return &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{}
+			},
+			func() *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList {
+				return &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList{}
+			},
+			func(dst, src *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList) []*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList, items []*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding), err
 }
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/generated_expansion.go b/kubernetes/typed/admissionregistration/v1alpha1/generated_expansion.go
new file mode 100644
index 000000000..4bab38212
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1alpha1/generated_expansion.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type MutatingAdmissionPolicyClusterExpansion interface{}
+
+type MutatingAdmissionPolicyBindingClusterExpansion interface{}
+
+type ValidatingAdmissionPolicyClusterExpansion interface{}
+
+type ValidatingAdmissionPolicyBindingClusterExpansion interface{}
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/mutatingadmissionpolicy.go b/kubernetes/typed/admissionregistration/v1alpha1/mutatingadmissionpolicy.go
new file mode 100644
index 000000000..4cd1d7098
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1alpha1/mutatingadmissionpolicy.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	apiadmissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1alpha1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// MutatingAdmissionPoliciesClusterGetter has a method to return a MutatingAdmissionPolicyClusterInterface.
+// A group's cluster client should implement this interface.
+type MutatingAdmissionPoliciesClusterGetter interface {
+	MutatingAdmissionPolicies() MutatingAdmissionPolicyClusterInterface
+}
+
+// MutatingAdmissionPolicyClusterInterface can operate on MutatingAdmissionPolicies across all clusters,
+// or scope down to one cluster and return a admissionregistrationv1alpha1.MutatingAdmissionPolicyInterface.
+type MutatingAdmissionPolicyClusterInterface interface {
+	Cluster(logicalcluster.Path) admissionregistrationv1alpha1.MutatingAdmissionPolicyInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	MutatingAdmissionPolicyClusterExpansion
+}
+
+type mutatingAdmissionPoliciesClusterInterface struct {
+	clientCache kcpclient.Cache[*admissionregistrationv1alpha1.AdmissionregistrationV1alpha1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *mutatingAdmissionPoliciesClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1alpha1.MutatingAdmissionPolicyInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).MutatingAdmissionPolicies()
+}
+
+// List returns the entire collection of all MutatingAdmissionPolicies across all clusters.
+func (c *mutatingAdmissionPoliciesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).MutatingAdmissionPolicies().List(ctx, opts)
+}
+
+// Watch begins to watch all MutatingAdmissionPolicies across all clusters.
+func (c *mutatingAdmissionPoliciesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).MutatingAdmissionPolicies().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go b/kubernetes/typed/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go
new file mode 100644
index 000000000..b41017d2f
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	apiadmissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1alpha1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// MutatingAdmissionPolicyBindingsClusterGetter has a method to return a MutatingAdmissionPolicyBindingClusterInterface.
+// A group's cluster client should implement this interface.
+type MutatingAdmissionPolicyBindingsClusterGetter interface {
+	MutatingAdmissionPolicyBindings() MutatingAdmissionPolicyBindingClusterInterface
+}
+
+// MutatingAdmissionPolicyBindingClusterInterface can operate on MutatingAdmissionPolicyBindings across all clusters,
+// or scope down to one cluster and return a admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingInterface.
+type MutatingAdmissionPolicyBindingClusterInterface interface {
+	Cluster(logicalcluster.Path) admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	MutatingAdmissionPolicyBindingClusterExpansion
+}
+
+type mutatingAdmissionPolicyBindingsClusterInterface struct {
+	clientCache kcpclient.Cache[*admissionregistrationv1alpha1.AdmissionregistrationV1alpha1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *mutatingAdmissionPolicyBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1alpha1.MutatingAdmissionPolicyBindingInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).MutatingAdmissionPolicyBindings()
+}
+
+// List returns the entire collection of all MutatingAdmissionPolicyBindings across all clusters.
+func (c *mutatingAdmissionPolicyBindingsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).MutatingAdmissionPolicyBindings().List(ctx, opts)
+}
+
+// Watch begins to watch all MutatingAdmissionPolicyBindings across all clusters.
+func (c *mutatingAdmissionPolicyBindingsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).MutatingAdmissionPolicyBindings().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/validatingadmissionpolicy.go b/kubernetes/typed/admissionregistration/v1alpha1/validatingadmissionpolicy.go
index 9ff5e688f..36d23974a 100644
--- a/kubernetes/typed/admissionregistration/v1alpha1/validatingadmissionpolicy.go
+++ b/kubernetes/typed/admissionregistration/v1alpha1/validatingadmissionpolicy.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
+	context "context"
+
+	apiadmissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1alpha1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	admissionregistrationv1alpha1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
 )
 
 // ValidatingAdmissionPoliciesClusterGetter has a method to return a ValidatingAdmissionPolicyClusterInterface.
@@ -40,19 +37,20 @@ type ValidatingAdmissionPoliciesClusterGetter interface {
 }
 
 // ValidatingAdmissionPolicyClusterInterface can operate on ValidatingAdmissionPolicies across all clusters,
-// or scope down to one cluster and return a admissionregistrationv1alpha1client.ValidatingAdmissionPolicyInterface.
+// or scope down to one cluster and return a admissionregistrationv1alpha1.ValidatingAdmissionPolicyInterface.
 type ValidatingAdmissionPolicyClusterInterface interface {
-	Cluster(logicalcluster.Path) admissionregistrationv1alpha1client.ValidatingAdmissionPolicyInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) admissionregistrationv1alpha1.ValidatingAdmissionPolicyInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ValidatingAdmissionPolicyClusterExpansion
 }
 
 type validatingAdmissionPoliciesClusterInterface struct {
-	clientCache kcpclient.Cache[*admissionregistrationv1alpha1client.AdmissionregistrationV1alpha1Client]
+	clientCache kcpclient.Cache[*admissionregistrationv1alpha1.AdmissionregistrationV1alpha1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *validatingAdmissionPoliciesClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1alpha1client.ValidatingAdmissionPolicyInterface {
+func (c *validatingAdmissionPoliciesClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1alpha1.ValidatingAdmissionPolicyInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *validatingAdmissionPoliciesClusterInterface) Cluster(clusterPath logica
 }
 
 // List returns the entire collection of all ValidatingAdmissionPolicies across all clusters.
-func (c *validatingAdmissionPoliciesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyList, error) {
+func (c *validatingAdmissionPoliciesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingAdmissionPolicies().List(ctx, opts)
 }
 
 // Watch begins to watch all ValidatingAdmissionPolicies across all clusters.
-func (c *validatingAdmissionPoliciesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *validatingAdmissionPoliciesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingAdmissionPolicies().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go b/kubernetes/typed/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
index 0d6c0c098..6981a7101 100644
--- a/kubernetes/typed/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
+++ b/kubernetes/typed/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
+	context "context"
+
+	apiadmissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1alpha1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	admissionregistrationv1alpha1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1alpha1"
 )
 
 // ValidatingAdmissionPolicyBindingsClusterGetter has a method to return a ValidatingAdmissionPolicyBindingClusterInterface.
@@ -40,19 +37,20 @@ type ValidatingAdmissionPolicyBindingsClusterGetter interface {
 }
 
 // ValidatingAdmissionPolicyBindingClusterInterface can operate on ValidatingAdmissionPolicyBindings across all clusters,
-// or scope down to one cluster and return a admissionregistrationv1alpha1client.ValidatingAdmissionPolicyBindingInterface.
+// or scope down to one cluster and return a admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingInterface.
 type ValidatingAdmissionPolicyBindingClusterInterface interface {
-	Cluster(logicalcluster.Path) admissionregistrationv1alpha1client.ValidatingAdmissionPolicyBindingInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ValidatingAdmissionPolicyBindingClusterExpansion
 }
 
 type validatingAdmissionPolicyBindingsClusterInterface struct {
-	clientCache kcpclient.Cache[*admissionregistrationv1alpha1client.AdmissionregistrationV1alpha1Client]
+	clientCache kcpclient.Cache[*admissionregistrationv1alpha1.AdmissionregistrationV1alpha1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *validatingAdmissionPolicyBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1alpha1client.ValidatingAdmissionPolicyBindingInterface {
+func (c *validatingAdmissionPolicyBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *validatingAdmissionPolicyBindingsClusterInterface) Cluster(clusterPath
 }
 
 // List returns the entire collection of all ValidatingAdmissionPolicyBindings across all clusters.
-func (c *validatingAdmissionPolicyBindingsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList, error) {
+func (c *validatingAdmissionPolicyBindingsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingAdmissionPolicyBindings().List(ctx, opts)
 }
 
 // Watch begins to watch all ValidatingAdmissionPolicyBindings across all clusters.
-func (c *validatingAdmissionPolicyBindingsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *validatingAdmissionPolicyBindingsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingAdmissionPolicyBindings().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/admissionregistration/v1beta1/admissionregistration_client.go b/kubernetes/typed/admissionregistration/v1beta1/admissionregistration_client.go
index 2bb825fbb..4acec3133 100644
--- a/kubernetes/typed/admissionregistration/v1beta1/admissionregistration_client.go
+++ b/kubernetes/typed/admissionregistration/v1beta1/admissionregistration_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,35 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiadmissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	admissionregistrationv1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type AdmissionregistrationV1beta1ClusterInterface interface {
 	AdmissionregistrationV1beta1ClusterScoper
-	ValidatingWebhookConfigurationsClusterGetter
 	MutatingWebhookConfigurationsClusterGetter
+	ValidatingAdmissionPoliciesClusterGetter
+	ValidatingAdmissionPolicyBindingsClusterGetter
+	ValidatingWebhookConfigurationsClusterGetter
 }
 
 type AdmissionregistrationV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) admissionregistrationv1beta1.AdmissionregistrationV1beta1Interface
 }
 
+// AdmissionregistrationV1beta1ClusterClient is used to interact with features provided by the admissionregistration.k8s.io group.
 type AdmissionregistrationV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*admissionregistrationv1beta1.AdmissionregistrationV1beta1Client]
 }
@@ -52,23 +54,33 @@ func (c *AdmissionregistrationV1beta1ClusterClient) Cluster(clusterPath logicalc
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *AdmissionregistrationV1beta1ClusterClient) ValidatingWebhookConfigurations() ValidatingWebhookConfigurationClusterInterface {
-	return &validatingWebhookConfigurationsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *AdmissionregistrationV1beta1ClusterClient) MutatingWebhookConfigurations() MutatingWebhookConfigurationClusterInterface {
 	return &mutatingWebhookConfigurationsClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *AdmissionregistrationV1beta1ClusterClient) ValidatingAdmissionPolicies() ValidatingAdmissionPolicyClusterInterface {
+	return &validatingAdmissionPoliciesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *AdmissionregistrationV1beta1ClusterClient) ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingClusterInterface {
+	return &validatingAdmissionPolicyBindingsClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *AdmissionregistrationV1beta1ClusterClient) ValidatingWebhookConfigurations() ValidatingWebhookConfigurationClusterInterface {
+	return &validatingWebhookConfigurationsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new AdmissionregistrationV1beta1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AdmissionregistrationV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AdmissionregistrationV1beta1ClusterClient for the given config and http client.
@@ -80,6 +92,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*Admissionregistrati
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AdmissionregistrationV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -92,3 +105,14 @@ func NewForConfigOrDie(c *rest.Config) *AdmissionregistrationV1beta1ClusterClien
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiadmissionregistrationv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/admissionregistration/v1beta1/doc.go b/kubernetes/typed/admissionregistration/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/admissionregistration/v1beta1/fake/admissionregistration_client.go b/kubernetes/typed/admissionregistration/v1beta1/fake/admissionregistration_client.go
index 29c5df9c5..e8cf6ea6f 100644
--- a/kubernetes/typed/admissionregistration/v1beta1/fake/admissionregistration_client.go
+++ b/kubernetes/typed/admissionregistration/v1beta1/fake/admissionregistration_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpadmissionregistrationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpadmissionregistrationv1beta1.AdmissionregistrationV1beta1ClusterInterface = (*AdmissionregistrationV1beta1ClusterClient)(nil)
@@ -44,30 +40,46 @@ func (c *AdmissionregistrationV1beta1ClusterClient) Cluster(clusterPath logicalc
 	return &AdmissionregistrationV1beta1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *AdmissionregistrationV1beta1ClusterClient) ValidatingWebhookConfigurations() kcpadmissionregistrationv1beta1.ValidatingWebhookConfigurationClusterInterface {
-	return &validatingWebhookConfigurationsClusterClient{Fake: c.Fake}
+func (c *AdmissionregistrationV1beta1ClusterClient) MutatingWebhookConfigurations() kcpadmissionregistrationv1beta1.MutatingWebhookConfigurationClusterInterface {
+	return newFakeMutatingWebhookConfigurationClusterClient(c)
 }
 
-func (c *AdmissionregistrationV1beta1ClusterClient) MutatingWebhookConfigurations() kcpadmissionregistrationv1beta1.MutatingWebhookConfigurationClusterInterface {
-	return &mutatingWebhookConfigurationsClusterClient{Fake: c.Fake}
+func (c *AdmissionregistrationV1beta1ClusterClient) ValidatingAdmissionPolicies() kcpadmissionregistrationv1beta1.ValidatingAdmissionPolicyClusterInterface {
+	return newFakeValidatingAdmissionPolicyClusterClient(c)
+}
+
+func (c *AdmissionregistrationV1beta1ClusterClient) ValidatingAdmissionPolicyBindings() kcpadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingClusterInterface {
+	return newFakeValidatingAdmissionPolicyBindingClusterClient(c)
 }
 
-var _ admissionregistrationv1beta1.AdmissionregistrationV1beta1Interface = (*AdmissionregistrationV1beta1Client)(nil)
+func (c *AdmissionregistrationV1beta1ClusterClient) ValidatingWebhookConfigurations() kcpadmissionregistrationv1beta1.ValidatingWebhookConfigurationClusterInterface {
+	return newFakeValidatingWebhookConfigurationClusterClient(c)
+}
 
 type AdmissionregistrationV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *AdmissionregistrationV1beta1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *AdmissionregistrationV1beta1Client) MutatingWebhookConfigurations() admissionregistrationv1beta1.MutatingWebhookConfigurationInterface {
+	return newFakeMutatingWebhookConfigurationClient(c.Fake, c.ClusterPath)
+}
+
+func (c *AdmissionregistrationV1beta1Client) ValidatingAdmissionPolicies() admissionregistrationv1beta1.ValidatingAdmissionPolicyInterface {
+	return newFakeValidatingAdmissionPolicyClient(c.Fake, c.ClusterPath)
+}
+
+func (c *AdmissionregistrationV1beta1Client) ValidatingAdmissionPolicyBindings() admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingInterface {
+	return newFakeValidatingAdmissionPolicyBindingClient(c.Fake, c.ClusterPath)
 }
 
 func (c *AdmissionregistrationV1beta1Client) ValidatingWebhookConfigurations() admissionregistrationv1beta1.ValidatingWebhookConfigurationInterface {
-	return &validatingWebhookConfigurationsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakeValidatingWebhookConfigurationClient(c.Fake, c.ClusterPath)
 }
 
-func (c *AdmissionregistrationV1beta1Client) MutatingWebhookConfigurations() admissionregistrationv1beta1.MutatingWebhookConfigurationInterface {
-	return &mutatingWebhookConfigurationsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AdmissionregistrationV1beta1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/admissionregistration/v1beta1/fake/doc.go b/kubernetes/typed/admissionregistration/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/admissionregistration/v1beta1/fake/mutatingwebhookconfiguration.go b/kubernetes/typed/admissionregistration/v1beta1/fake/mutatingwebhookconfiguration.go
index ac0d44d44..4eb43342b 100644
--- a/kubernetes/typed/admissionregistration/v1beta1/fake/mutatingwebhookconfiguration.go
+++ b/kubernetes/typed/admissionregistration/v1beta1/fake/mutatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,89 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsadmissionregistrationv1beta1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1"
-	admissionregistrationv1beta1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1"
+	typedadmissionregistrationv1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
 
+	typedkcpadmissionregistrationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var mutatingWebhookConfigurationsResource = schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1beta1", Resource: "mutatingwebhookconfigurations"}
-var mutatingWebhookConfigurationsKind = schema.GroupVersionKind{Group: "admissionregistration.k8s.io", Version: "v1beta1", Kind: "MutatingWebhookConfiguration"}
-
-type mutatingWebhookConfigurationsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *mutatingWebhookConfigurationsClusterClient) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1beta1client.MutatingWebhookConfigurationInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &mutatingWebhookConfigurationsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of MutatingWebhookConfigurations that match those selectors across all clusters.
-func (c *mutatingWebhookConfigurationsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1beta1.MutatingWebhookConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(mutatingWebhookConfigurationsResource, mutatingWebhookConfigurationsKind, logicalcluster.Wildcard, opts), &admissionregistrationv1beta1.MutatingWebhookConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &admissionregistrationv1beta1.MutatingWebhookConfigurationList{ListMeta: obj.(*admissionregistrationv1beta1.MutatingWebhookConfigurationList).ListMeta}
-	for _, item := range obj.(*admissionregistrationv1beta1.MutatingWebhookConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested MutatingWebhookConfigurations across all clusters.
-func (c *mutatingWebhookConfigurationsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(mutatingWebhookConfigurationsResource, logicalcluster.Wildcard, opts))
-}
-
-type mutatingWebhookConfigurationsClient struct {
-	*kcptesting.Fake
+// mutatingWebhookConfigurationClusterClient implements MutatingWebhookConfigurationClusterInterface
+type mutatingWebhookConfigurationClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*admissionregistrationv1beta1.MutatingWebhookConfiguration, *admissionregistrationv1beta1.MutatingWebhookConfigurationList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeMutatingWebhookConfigurationClusterClient(fake *AdmissionregistrationV1beta1ClusterClient) typedkcpadmissionregistrationv1beta1.MutatingWebhookConfigurationClusterInterface {
+	return &mutatingWebhookConfigurationClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*admissionregistrationv1beta1.MutatingWebhookConfiguration, *admissionregistrationv1beta1.MutatingWebhookConfigurationList](
+			fake.Fake,
+			admissionregistrationv1beta1.SchemeGroupVersion.WithResource("mutatingwebhookconfigurations"),
+			admissionregistrationv1beta1.SchemeGroupVersion.WithKind("MutatingWebhookConfiguration"),
+			func() *admissionregistrationv1beta1.MutatingWebhookConfiguration {
+				return &admissionregistrationv1beta1.MutatingWebhookConfiguration{}
+			},
+			func() *admissionregistrationv1beta1.MutatingWebhookConfigurationList {
+				return &admissionregistrationv1beta1.MutatingWebhookConfigurationList{}
+			},
+			func(dst, src *admissionregistrationv1beta1.MutatingWebhookConfigurationList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1beta1.MutatingWebhookConfigurationList) []*admissionregistrationv1beta1.MutatingWebhookConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1beta1.MutatingWebhookConfigurationList, items []*admissionregistrationv1beta1.MutatingWebhookConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *mutatingWebhookConfigurationClusterClient) Cluster(cluster logicalcluster.Path) typedadmissionregistrationv1beta1.MutatingWebhookConfigurationInterface {
+	return newFakeMutatingWebhookConfigurationClient(c.Fake, cluster)
+}
+
+// mutatingWebhookConfigurationScopedClient implements MutatingWebhookConfigurationInterface
+type mutatingWebhookConfigurationScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*admissionregistrationv1beta1.MutatingWebhookConfiguration, *admissionregistrationv1beta1.MutatingWebhookConfigurationList, *v1beta1.MutatingWebhookConfigurationApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *mutatingWebhookConfigurationsClient) Create(ctx context.Context, mutatingWebhookConfiguration *admissionregistrationv1beta1.MutatingWebhookConfiguration, opts metav1.CreateOptions) (*admissionregistrationv1beta1.MutatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(mutatingWebhookConfigurationsResource, c.ClusterPath, mutatingWebhookConfiguration), &admissionregistrationv1beta1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1beta1.MutatingWebhookConfiguration), err
-}
-
-func (c *mutatingWebhookConfigurationsClient) Update(ctx context.Context, mutatingWebhookConfiguration *admissionregistrationv1beta1.MutatingWebhookConfiguration, opts metav1.UpdateOptions) (*admissionregistrationv1beta1.MutatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(mutatingWebhookConfigurationsResource, c.ClusterPath, mutatingWebhookConfiguration), &admissionregistrationv1beta1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1beta1.MutatingWebhookConfiguration), err
-}
-
-func (c *mutatingWebhookConfigurationsClient) UpdateStatus(ctx context.Context, mutatingWebhookConfiguration *admissionregistrationv1beta1.MutatingWebhookConfiguration, opts metav1.UpdateOptions) (*admissionregistrationv1beta1.MutatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(mutatingWebhookConfigurationsResource, c.ClusterPath, "status", mutatingWebhookConfiguration), &admissionregistrationv1beta1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1beta1.MutatingWebhookConfiguration), err
-}
-
-func (c *mutatingWebhookConfigurationsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(mutatingWebhookConfigurationsResource, c.ClusterPath, name, opts), &admissionregistrationv1beta1.MutatingWebhookConfiguration{})
-	return err
-}
-
-func (c *mutatingWebhookConfigurationsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(mutatingWebhookConfigurationsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &admissionregistrationv1beta1.MutatingWebhookConfigurationList{})
-	return err
-}
-
-func (c *mutatingWebhookConfigurationsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*admissionregistrationv1beta1.MutatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(mutatingWebhookConfigurationsResource, c.ClusterPath, name), &admissionregistrationv1beta1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1beta1.MutatingWebhookConfiguration), err
-}
-
-// List takes label and field selectors, and returns the list of MutatingWebhookConfigurations that match those selectors.
-func (c *mutatingWebhookConfigurationsClient) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1beta1.MutatingWebhookConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(mutatingWebhookConfigurationsResource, mutatingWebhookConfigurationsKind, c.ClusterPath, opts), &admissionregistrationv1beta1.MutatingWebhookConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &admissionregistrationv1beta1.MutatingWebhookConfigurationList{ListMeta: obj.(*admissionregistrationv1beta1.MutatingWebhookConfigurationList).ListMeta}
-	for _, item := range obj.(*admissionregistrationv1beta1.MutatingWebhookConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *mutatingWebhookConfigurationsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(mutatingWebhookConfigurationsResource, c.ClusterPath, opts))
-}
-
-func (c *mutatingWebhookConfigurationsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*admissionregistrationv1beta1.MutatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(mutatingWebhookConfigurationsResource, c.ClusterPath, name, pt, data, subresources...), &admissionregistrationv1beta1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1beta1.MutatingWebhookConfiguration), err
-}
-
-func (c *mutatingWebhookConfigurationsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsadmissionregistrationv1beta1.MutatingWebhookConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*admissionregistrationv1beta1.MutatingWebhookConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(mutatingWebhookConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &admissionregistrationv1beta1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1beta1.MutatingWebhookConfiguration), err
-}
-
-func (c *mutatingWebhookConfigurationsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsadmissionregistrationv1beta1.MutatingWebhookConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*admissionregistrationv1beta1.MutatingWebhookConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(mutatingWebhookConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &admissionregistrationv1beta1.MutatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
+func newFakeMutatingWebhookConfigurationClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedadmissionregistrationv1beta1.MutatingWebhookConfigurationInterface {
+	return &mutatingWebhookConfigurationScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*admissionregistrationv1beta1.MutatingWebhookConfiguration, *admissionregistrationv1beta1.MutatingWebhookConfigurationList, *v1beta1.MutatingWebhookConfigurationApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			admissionregistrationv1beta1.SchemeGroupVersion.WithResource("mutatingwebhookconfigurations"),
+			admissionregistrationv1beta1.SchemeGroupVersion.WithKind("MutatingWebhookConfiguration"),
+			func() *admissionregistrationv1beta1.MutatingWebhookConfiguration {
+				return &admissionregistrationv1beta1.MutatingWebhookConfiguration{}
+			},
+			func() *admissionregistrationv1beta1.MutatingWebhookConfigurationList {
+				return &admissionregistrationv1beta1.MutatingWebhookConfigurationList{}
+			},
+			func(dst, src *admissionregistrationv1beta1.MutatingWebhookConfigurationList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1beta1.MutatingWebhookConfigurationList) []*admissionregistrationv1beta1.MutatingWebhookConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1beta1.MutatingWebhookConfigurationList, items []*admissionregistrationv1beta1.MutatingWebhookConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*admissionregistrationv1beta1.MutatingWebhookConfiguration), err
 }
diff --git a/kubernetes/typed/admissionregistration/v1beta1/fake/validatingadmissionpolicy.go b/kubernetes/typed/admissionregistration/v1beta1/fake/validatingadmissionpolicy.go
new file mode 100644
index 000000000..590116e1c
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1beta1/fake/validatingadmissionpolicy.go
@@ -0,0 +1,102 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	v1beta1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1"
+	typedadmissionregistrationv1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
+
+	typedkcpadmissionregistrationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// validatingAdmissionPolicyClusterClient implements ValidatingAdmissionPolicyClusterInterface
+type validatingAdmissionPolicyClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*admissionregistrationv1beta1.ValidatingAdmissionPolicy, *admissionregistrationv1beta1.ValidatingAdmissionPolicyList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeValidatingAdmissionPolicyClusterClient(fake *AdmissionregistrationV1beta1ClusterClient) typedkcpadmissionregistrationv1beta1.ValidatingAdmissionPolicyClusterInterface {
+	return &validatingAdmissionPolicyClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*admissionregistrationv1beta1.ValidatingAdmissionPolicy, *admissionregistrationv1beta1.ValidatingAdmissionPolicyList](
+			fake.Fake,
+			admissionregistrationv1beta1.SchemeGroupVersion.WithResource("validatingadmissionpolicies"),
+			admissionregistrationv1beta1.SchemeGroupVersion.WithKind("ValidatingAdmissionPolicy"),
+			func() *admissionregistrationv1beta1.ValidatingAdmissionPolicy {
+				return &admissionregistrationv1beta1.ValidatingAdmissionPolicy{}
+			},
+			func() *admissionregistrationv1beta1.ValidatingAdmissionPolicyList {
+				return &admissionregistrationv1beta1.ValidatingAdmissionPolicyList{}
+			},
+			func(dst, src *admissionregistrationv1beta1.ValidatingAdmissionPolicyList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1beta1.ValidatingAdmissionPolicyList) []*admissionregistrationv1beta1.ValidatingAdmissionPolicy {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1beta1.ValidatingAdmissionPolicyList, items []*admissionregistrationv1beta1.ValidatingAdmissionPolicy) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *validatingAdmissionPolicyClusterClient) Cluster(cluster logicalcluster.Path) typedadmissionregistrationv1beta1.ValidatingAdmissionPolicyInterface {
+	return newFakeValidatingAdmissionPolicyClient(c.Fake, cluster)
+}
+
+// validatingAdmissionPolicyScopedClient implements ValidatingAdmissionPolicyInterface
+type validatingAdmissionPolicyScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*admissionregistrationv1beta1.ValidatingAdmissionPolicy, *admissionregistrationv1beta1.ValidatingAdmissionPolicyList, *v1beta1.ValidatingAdmissionPolicyApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeValidatingAdmissionPolicyClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedadmissionregistrationv1beta1.ValidatingAdmissionPolicyInterface {
+	return &validatingAdmissionPolicyScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*admissionregistrationv1beta1.ValidatingAdmissionPolicy, *admissionregistrationv1beta1.ValidatingAdmissionPolicyList, *v1beta1.ValidatingAdmissionPolicyApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			admissionregistrationv1beta1.SchemeGroupVersion.WithResource("validatingadmissionpolicies"),
+			admissionregistrationv1beta1.SchemeGroupVersion.WithKind("ValidatingAdmissionPolicy"),
+			func() *admissionregistrationv1beta1.ValidatingAdmissionPolicy {
+				return &admissionregistrationv1beta1.ValidatingAdmissionPolicy{}
+			},
+			func() *admissionregistrationv1beta1.ValidatingAdmissionPolicyList {
+				return &admissionregistrationv1beta1.ValidatingAdmissionPolicyList{}
+			},
+			func(dst, src *admissionregistrationv1beta1.ValidatingAdmissionPolicyList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1beta1.ValidatingAdmissionPolicyList) []*admissionregistrationv1beta1.ValidatingAdmissionPolicy {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1beta1.ValidatingAdmissionPolicyList, items []*admissionregistrationv1beta1.ValidatingAdmissionPolicy) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/admissionregistration/v1beta1/fake/validatingadmissionpolicybinding.go b/kubernetes/typed/admissionregistration/v1beta1/fake/validatingadmissionpolicybinding.go
new file mode 100644
index 000000000..9a24df77a
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1beta1/fake/validatingadmissionpolicybinding.go
@@ -0,0 +1,102 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	v1beta1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1"
+	typedadmissionregistrationv1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
+
+	typedkcpadmissionregistrationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// validatingAdmissionPolicyBindingClusterClient implements ValidatingAdmissionPolicyBindingClusterInterface
+type validatingAdmissionPolicyBindingClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding, *admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeValidatingAdmissionPolicyBindingClusterClient(fake *AdmissionregistrationV1beta1ClusterClient) typedkcpadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingClusterInterface {
+	return &validatingAdmissionPolicyBindingClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding, *admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList](
+			fake.Fake,
+			admissionregistrationv1beta1.SchemeGroupVersion.WithResource("validatingadmissionpolicybindings"),
+			admissionregistrationv1beta1.SchemeGroupVersion.WithKind("ValidatingAdmissionPolicyBinding"),
+			func() *admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding {
+				return &admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding{}
+			},
+			func() *admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList {
+				return &admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList{}
+			},
+			func(dst, src *admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList) []*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList, items []*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *validatingAdmissionPolicyBindingClusterClient) Cluster(cluster logicalcluster.Path) typedadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingInterface {
+	return newFakeValidatingAdmissionPolicyBindingClient(c.Fake, cluster)
+}
+
+// validatingAdmissionPolicyBindingScopedClient implements ValidatingAdmissionPolicyBindingInterface
+type validatingAdmissionPolicyBindingScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding, *admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList, *v1beta1.ValidatingAdmissionPolicyBindingApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeValidatingAdmissionPolicyBindingClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingInterface {
+	return &validatingAdmissionPolicyBindingScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding, *admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList, *v1beta1.ValidatingAdmissionPolicyBindingApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			admissionregistrationv1beta1.SchemeGroupVersion.WithResource("validatingadmissionpolicybindings"),
+			admissionregistrationv1beta1.SchemeGroupVersion.WithKind("ValidatingAdmissionPolicyBinding"),
+			func() *admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding {
+				return &admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding{}
+			},
+			func() *admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList {
+				return &admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList{}
+			},
+			func(dst, src *admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList) []*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList, items []*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/admissionregistration/v1beta1/fake/validatingwebhookconfiguration.go b/kubernetes/typed/admissionregistration/v1beta1/fake/validatingwebhookconfiguration.go
index 992f1b482..d824df5a7 100644
--- a/kubernetes/typed/admissionregistration/v1beta1/fake/validatingwebhookconfiguration.go
+++ b/kubernetes/typed/admissionregistration/v1beta1/fake/validatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,89 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsadmissionregistrationv1beta1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1"
-	admissionregistrationv1beta1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/admissionregistration/v1beta1"
+	typedadmissionregistrationv1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
 
+	typedkcpadmissionregistrationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/admissionregistration/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var validatingWebhookConfigurationsResource = schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1beta1", Resource: "validatingwebhookconfigurations"}
-var validatingWebhookConfigurationsKind = schema.GroupVersionKind{Group: "admissionregistration.k8s.io", Version: "v1beta1", Kind: "ValidatingWebhookConfiguration"}
-
-type validatingWebhookConfigurationsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *validatingWebhookConfigurationsClusterClient) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1beta1client.ValidatingWebhookConfigurationInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &validatingWebhookConfigurationsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ValidatingWebhookConfigurations that match those selectors across all clusters.
-func (c *validatingWebhookConfigurationsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1beta1.ValidatingWebhookConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(validatingWebhookConfigurationsResource, validatingWebhookConfigurationsKind, logicalcluster.Wildcard, opts), &admissionregistrationv1beta1.ValidatingWebhookConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &admissionregistrationv1beta1.ValidatingWebhookConfigurationList{ListMeta: obj.(*admissionregistrationv1beta1.ValidatingWebhookConfigurationList).ListMeta}
-	for _, item := range obj.(*admissionregistrationv1beta1.ValidatingWebhookConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested ValidatingWebhookConfigurations across all clusters.
-func (c *validatingWebhookConfigurationsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(validatingWebhookConfigurationsResource, logicalcluster.Wildcard, opts))
-}
-
-type validatingWebhookConfigurationsClient struct {
-	*kcptesting.Fake
+// validatingWebhookConfigurationClusterClient implements ValidatingWebhookConfigurationClusterInterface
+type validatingWebhookConfigurationClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*admissionregistrationv1beta1.ValidatingWebhookConfiguration, *admissionregistrationv1beta1.ValidatingWebhookConfigurationList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeValidatingWebhookConfigurationClusterClient(fake *AdmissionregistrationV1beta1ClusterClient) typedkcpadmissionregistrationv1beta1.ValidatingWebhookConfigurationClusterInterface {
+	return &validatingWebhookConfigurationClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*admissionregistrationv1beta1.ValidatingWebhookConfiguration, *admissionregistrationv1beta1.ValidatingWebhookConfigurationList](
+			fake.Fake,
+			admissionregistrationv1beta1.SchemeGroupVersion.WithResource("validatingwebhookconfigurations"),
+			admissionregistrationv1beta1.SchemeGroupVersion.WithKind("ValidatingWebhookConfiguration"),
+			func() *admissionregistrationv1beta1.ValidatingWebhookConfiguration {
+				return &admissionregistrationv1beta1.ValidatingWebhookConfiguration{}
+			},
+			func() *admissionregistrationv1beta1.ValidatingWebhookConfigurationList {
+				return &admissionregistrationv1beta1.ValidatingWebhookConfigurationList{}
+			},
+			func(dst, src *admissionregistrationv1beta1.ValidatingWebhookConfigurationList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1beta1.ValidatingWebhookConfigurationList) []*admissionregistrationv1beta1.ValidatingWebhookConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1beta1.ValidatingWebhookConfigurationList, items []*admissionregistrationv1beta1.ValidatingWebhookConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *validatingWebhookConfigurationClusterClient) Cluster(cluster logicalcluster.Path) typedadmissionregistrationv1beta1.ValidatingWebhookConfigurationInterface {
+	return newFakeValidatingWebhookConfigurationClient(c.Fake, cluster)
+}
+
+// validatingWebhookConfigurationScopedClient implements ValidatingWebhookConfigurationInterface
+type validatingWebhookConfigurationScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*admissionregistrationv1beta1.ValidatingWebhookConfiguration, *admissionregistrationv1beta1.ValidatingWebhookConfigurationList, *v1beta1.ValidatingWebhookConfigurationApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *validatingWebhookConfigurationsClient) Create(ctx context.Context, validatingWebhookConfiguration *admissionregistrationv1beta1.ValidatingWebhookConfiguration, opts metav1.CreateOptions) (*admissionregistrationv1beta1.ValidatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(validatingWebhookConfigurationsResource, c.ClusterPath, validatingWebhookConfiguration), &admissionregistrationv1beta1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1beta1.ValidatingWebhookConfiguration), err
-}
-
-func (c *validatingWebhookConfigurationsClient) Update(ctx context.Context, validatingWebhookConfiguration *admissionregistrationv1beta1.ValidatingWebhookConfiguration, opts metav1.UpdateOptions) (*admissionregistrationv1beta1.ValidatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(validatingWebhookConfigurationsResource, c.ClusterPath, validatingWebhookConfiguration), &admissionregistrationv1beta1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1beta1.ValidatingWebhookConfiguration), err
-}
-
-func (c *validatingWebhookConfigurationsClient) UpdateStatus(ctx context.Context, validatingWebhookConfiguration *admissionregistrationv1beta1.ValidatingWebhookConfiguration, opts metav1.UpdateOptions) (*admissionregistrationv1beta1.ValidatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(validatingWebhookConfigurationsResource, c.ClusterPath, "status", validatingWebhookConfiguration), &admissionregistrationv1beta1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1beta1.ValidatingWebhookConfiguration), err
-}
-
-func (c *validatingWebhookConfigurationsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(validatingWebhookConfigurationsResource, c.ClusterPath, name, opts), &admissionregistrationv1beta1.ValidatingWebhookConfiguration{})
-	return err
-}
-
-func (c *validatingWebhookConfigurationsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(validatingWebhookConfigurationsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &admissionregistrationv1beta1.ValidatingWebhookConfigurationList{})
-	return err
-}
-
-func (c *validatingWebhookConfigurationsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*admissionregistrationv1beta1.ValidatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(validatingWebhookConfigurationsResource, c.ClusterPath, name), &admissionregistrationv1beta1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1beta1.ValidatingWebhookConfiguration), err
-}
-
-// List takes label and field selectors, and returns the list of ValidatingWebhookConfigurations that match those selectors.
-func (c *validatingWebhookConfigurationsClient) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1beta1.ValidatingWebhookConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(validatingWebhookConfigurationsResource, validatingWebhookConfigurationsKind, c.ClusterPath, opts), &admissionregistrationv1beta1.ValidatingWebhookConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &admissionregistrationv1beta1.ValidatingWebhookConfigurationList{ListMeta: obj.(*admissionregistrationv1beta1.ValidatingWebhookConfigurationList).ListMeta}
-	for _, item := range obj.(*admissionregistrationv1beta1.ValidatingWebhookConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *validatingWebhookConfigurationsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(validatingWebhookConfigurationsResource, c.ClusterPath, opts))
-}
-
-func (c *validatingWebhookConfigurationsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*admissionregistrationv1beta1.ValidatingWebhookConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(validatingWebhookConfigurationsResource, c.ClusterPath, name, pt, data, subresources...), &admissionregistrationv1beta1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1beta1.ValidatingWebhookConfiguration), err
-}
-
-func (c *validatingWebhookConfigurationsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsadmissionregistrationv1beta1.ValidatingWebhookConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*admissionregistrationv1beta1.ValidatingWebhookConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(validatingWebhookConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &admissionregistrationv1beta1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*admissionregistrationv1beta1.ValidatingWebhookConfiguration), err
-}
-
-func (c *validatingWebhookConfigurationsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsadmissionregistrationv1beta1.ValidatingWebhookConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*admissionregistrationv1beta1.ValidatingWebhookConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(validatingWebhookConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &admissionregistrationv1beta1.ValidatingWebhookConfiguration{})
-	if obj == nil {
-		return nil, err
+func newFakeValidatingWebhookConfigurationClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedadmissionregistrationv1beta1.ValidatingWebhookConfigurationInterface {
+	return &validatingWebhookConfigurationScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*admissionregistrationv1beta1.ValidatingWebhookConfiguration, *admissionregistrationv1beta1.ValidatingWebhookConfigurationList, *v1beta1.ValidatingWebhookConfigurationApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			admissionregistrationv1beta1.SchemeGroupVersion.WithResource("validatingwebhookconfigurations"),
+			admissionregistrationv1beta1.SchemeGroupVersion.WithKind("ValidatingWebhookConfiguration"),
+			func() *admissionregistrationv1beta1.ValidatingWebhookConfiguration {
+				return &admissionregistrationv1beta1.ValidatingWebhookConfiguration{}
+			},
+			func() *admissionregistrationv1beta1.ValidatingWebhookConfigurationList {
+				return &admissionregistrationv1beta1.ValidatingWebhookConfigurationList{}
+			},
+			func(dst, src *admissionregistrationv1beta1.ValidatingWebhookConfigurationList) {
+				dst.ListMeta = src.ListMeta
+			},
+			func(list *admissionregistrationv1beta1.ValidatingWebhookConfigurationList) []*admissionregistrationv1beta1.ValidatingWebhookConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *admissionregistrationv1beta1.ValidatingWebhookConfigurationList, items []*admissionregistrationv1beta1.ValidatingWebhookConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*admissionregistrationv1beta1.ValidatingWebhookConfiguration), err
 }
diff --git a/kubernetes/typed/admissionregistration/v1beta1/generated_expansion.go b/kubernetes/typed/admissionregistration/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..b5348cea7
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1beta1/generated_expansion.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type MutatingWebhookConfigurationClusterExpansion interface{}
+
+type ValidatingAdmissionPolicyClusterExpansion interface{}
+
+type ValidatingAdmissionPolicyBindingClusterExpansion interface{}
+
+type ValidatingWebhookConfigurationClusterExpansion interface{}
diff --git a/kubernetes/typed/admissionregistration/v1beta1/mutatingwebhookconfiguration.go b/kubernetes/typed/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
index a83d87cf5..abedb7ad5 100644
--- a/kubernetes/typed/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
+++ b/kubernetes/typed/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apiadmissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	admissionregistrationv1beta1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
 )
 
 // MutatingWebhookConfigurationsClusterGetter has a method to return a MutatingWebhookConfigurationClusterInterface.
@@ -40,19 +37,20 @@ type MutatingWebhookConfigurationsClusterGetter interface {
 }
 
 // MutatingWebhookConfigurationClusterInterface can operate on MutatingWebhookConfigurations across all clusters,
-// or scope down to one cluster and return a admissionregistrationv1beta1client.MutatingWebhookConfigurationInterface.
+// or scope down to one cluster and return a admissionregistrationv1beta1.MutatingWebhookConfigurationInterface.
 type MutatingWebhookConfigurationClusterInterface interface {
-	Cluster(logicalcluster.Path) admissionregistrationv1beta1client.MutatingWebhookConfigurationInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1beta1.MutatingWebhookConfigurationList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) admissionregistrationv1beta1.MutatingWebhookConfigurationInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1beta1.MutatingWebhookConfigurationList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	MutatingWebhookConfigurationClusterExpansion
 }
 
 type mutatingWebhookConfigurationsClusterInterface struct {
-	clientCache kcpclient.Cache[*admissionregistrationv1beta1client.AdmissionregistrationV1beta1Client]
+	clientCache kcpclient.Cache[*admissionregistrationv1beta1.AdmissionregistrationV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *mutatingWebhookConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1beta1client.MutatingWebhookConfigurationInterface {
+func (c *mutatingWebhookConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1beta1.MutatingWebhookConfigurationInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *mutatingWebhookConfigurationsClusterInterface) Cluster(clusterPath logi
 }
 
 // List returns the entire collection of all MutatingWebhookConfigurations across all clusters.
-func (c *mutatingWebhookConfigurationsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1beta1.MutatingWebhookConfigurationList, error) {
+func (c *mutatingWebhookConfigurationsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1beta1.MutatingWebhookConfigurationList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).MutatingWebhookConfigurations().List(ctx, opts)
 }
 
 // Watch begins to watch all MutatingWebhookConfigurations across all clusters.
-func (c *mutatingWebhookConfigurationsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *mutatingWebhookConfigurationsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).MutatingWebhookConfigurations().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/admissionregistration/v1beta1/validatingadmissionpolicy.go b/kubernetes/typed/admissionregistration/v1beta1/validatingadmissionpolicy.go
new file mode 100644
index 000000000..79e75f885
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1beta1/validatingadmissionpolicy.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	apiadmissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ValidatingAdmissionPoliciesClusterGetter has a method to return a ValidatingAdmissionPolicyClusterInterface.
+// A group's cluster client should implement this interface.
+type ValidatingAdmissionPoliciesClusterGetter interface {
+	ValidatingAdmissionPolicies() ValidatingAdmissionPolicyClusterInterface
+}
+
+// ValidatingAdmissionPolicyClusterInterface can operate on ValidatingAdmissionPolicies across all clusters,
+// or scope down to one cluster and return a admissionregistrationv1beta1.ValidatingAdmissionPolicyInterface.
+type ValidatingAdmissionPolicyClusterInterface interface {
+	Cluster(logicalcluster.Path) admissionregistrationv1beta1.ValidatingAdmissionPolicyInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ValidatingAdmissionPolicyClusterExpansion
+}
+
+type validatingAdmissionPoliciesClusterInterface struct {
+	clientCache kcpclient.Cache[*admissionregistrationv1beta1.AdmissionregistrationV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *validatingAdmissionPoliciesClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1beta1.ValidatingAdmissionPolicyInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).ValidatingAdmissionPolicies()
+}
+
+// List returns the entire collection of all ValidatingAdmissionPolicies across all clusters.
+func (c *validatingAdmissionPoliciesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingAdmissionPolicies().List(ctx, opts)
+}
+
+// Watch begins to watch all ValidatingAdmissionPolicies across all clusters.
+func (c *validatingAdmissionPoliciesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingAdmissionPolicies().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/admissionregistration/v1beta1/validatingadmissionpolicybinding.go b/kubernetes/typed/admissionregistration/v1beta1/validatingadmissionpolicybinding.go
new file mode 100644
index 000000000..d71da4aed
--- /dev/null
+++ b/kubernetes/typed/admissionregistration/v1beta1/validatingadmissionpolicybinding.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	apiadmissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ValidatingAdmissionPolicyBindingsClusterGetter has a method to return a ValidatingAdmissionPolicyBindingClusterInterface.
+// A group's cluster client should implement this interface.
+type ValidatingAdmissionPolicyBindingsClusterGetter interface {
+	ValidatingAdmissionPolicyBindings() ValidatingAdmissionPolicyBindingClusterInterface
+}
+
+// ValidatingAdmissionPolicyBindingClusterInterface can operate on ValidatingAdmissionPolicyBindings across all clusters,
+// or scope down to one cluster and return a admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingInterface.
+type ValidatingAdmissionPolicyBindingClusterInterface interface {
+	Cluster(logicalcluster.Path) admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ValidatingAdmissionPolicyBindingClusterExpansion
+}
+
+type validatingAdmissionPolicyBindingsClusterInterface struct {
+	clientCache kcpclient.Cache[*admissionregistrationv1beta1.AdmissionregistrationV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *validatingAdmissionPolicyBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1beta1.ValidatingAdmissionPolicyBindingInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).ValidatingAdmissionPolicyBindings()
+}
+
+// List returns the entire collection of all ValidatingAdmissionPolicyBindings across all clusters.
+func (c *validatingAdmissionPolicyBindingsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingAdmissionPolicyBindings().List(ctx, opts)
+}
+
+// Watch begins to watch all ValidatingAdmissionPolicyBindings across all clusters.
+func (c *validatingAdmissionPolicyBindingsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingAdmissionPolicyBindings().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/admissionregistration/v1beta1/validatingwebhookconfiguration.go b/kubernetes/typed/admissionregistration/v1beta1/validatingwebhookconfiguration.go
index 5a4133e96..d87950908 100644
--- a/kubernetes/typed/admissionregistration/v1beta1/validatingwebhookconfiguration.go
+++ b/kubernetes/typed/admissionregistration/v1beta1/validatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apiadmissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	admissionregistrationv1beta1 "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	admissionregistrationv1beta1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
 )
 
 // ValidatingWebhookConfigurationsClusterGetter has a method to return a ValidatingWebhookConfigurationClusterInterface.
@@ -40,19 +37,20 @@ type ValidatingWebhookConfigurationsClusterGetter interface {
 }
 
 // ValidatingWebhookConfigurationClusterInterface can operate on ValidatingWebhookConfigurations across all clusters,
-// or scope down to one cluster and return a admissionregistrationv1beta1client.ValidatingWebhookConfigurationInterface.
+// or scope down to one cluster and return a admissionregistrationv1beta1.ValidatingWebhookConfigurationInterface.
 type ValidatingWebhookConfigurationClusterInterface interface {
-	Cluster(logicalcluster.Path) admissionregistrationv1beta1client.ValidatingWebhookConfigurationInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1beta1.ValidatingWebhookConfigurationList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) admissionregistrationv1beta1.ValidatingWebhookConfigurationInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1beta1.ValidatingWebhookConfigurationList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ValidatingWebhookConfigurationClusterExpansion
 }
 
 type validatingWebhookConfigurationsClusterInterface struct {
-	clientCache kcpclient.Cache[*admissionregistrationv1beta1client.AdmissionregistrationV1beta1Client]
+	clientCache kcpclient.Cache[*admissionregistrationv1beta1.AdmissionregistrationV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *validatingWebhookConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1beta1client.ValidatingWebhookConfigurationInterface {
+func (c *validatingWebhookConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) admissionregistrationv1beta1.ValidatingWebhookConfigurationInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *validatingWebhookConfigurationsClusterInterface) Cluster(clusterPath lo
 }
 
 // List returns the entire collection of all ValidatingWebhookConfigurations across all clusters.
-func (c *validatingWebhookConfigurationsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*admissionregistrationv1beta1.ValidatingWebhookConfigurationList, error) {
+func (c *validatingWebhookConfigurationsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiadmissionregistrationv1beta1.ValidatingWebhookConfigurationList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingWebhookConfigurations().List(ctx, opts)
 }
 
 // Watch begins to watch all ValidatingWebhookConfigurations across all clusters.
-func (c *validatingWebhookConfigurationsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *validatingWebhookConfigurationsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ValidatingWebhookConfigurations().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/apiserverinternal/v1alpha1/apiserverinternal_client.go b/kubernetes/typed/apiserverinternal/v1alpha1/apiserverinternal_client.go
index bf855b6c2..576156e0d 100644
--- a/kubernetes/typed/apiserverinternal/v1alpha1/apiserverinternal_client.go
+++ b/kubernetes/typed/apiserverinternal/v1alpha1/apiserverinternal_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiapiserverinternalv1alpha1 "k8s.io/api/apiserverinternal/v1alpha1"
+	apiserverinternalv1alpha1 "k8s.io/client-go/kubernetes/typed/apiserverinternal/v1alpha1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	internalv1alpha1 "k8s.io/client-go/kubernetes/typed/apiserverinternal/v1alpha1"
-	"k8s.io/client-go/rest"
 )
 
 type InternalV1alpha1ClusterInterface interface {
@@ -37,14 +36,15 @@ type InternalV1alpha1ClusterInterface interface {
 }
 
 type InternalV1alpha1ClusterScoper interface {
-	Cluster(logicalcluster.Path) internalv1alpha1.InternalV1alpha1Interface
+	Cluster(logicalcluster.Path) apiserverinternalv1alpha1.InternalV1alpha1Interface
 }
 
+// InternalV1alpha1ClusterClient is used to interact with features provided by the internal.apiserver.k8s.io group.
 type InternalV1alpha1ClusterClient struct {
-	clientCache kcpclient.Cache[*internalv1alpha1.InternalV1alpha1Client]
+	clientCache kcpclient.Cache[*apiserverinternalv1alpha1.InternalV1alpha1Client]
 }
 
-func (c *InternalV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) internalv1alpha1.InternalV1alpha1Interface {
+func (c *InternalV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) apiserverinternalv1alpha1.InternalV1alpha1Interface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -59,22 +59,25 @@ func (c *InternalV1alpha1ClusterClient) StorageVersions() StorageVersionClusterI
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*InternalV1alpha1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new InternalV1alpha1ClusterClient for the given config and http client.
 // Note the http client provided takes precedence over the configured transport values.
 func NewForConfigAndClient(c *rest.Config, h *http.Client) (*InternalV1alpha1ClusterClient, error) {
-	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*internalv1alpha1.InternalV1alpha1Client]{
-		NewForConfigAndClient: internalv1alpha1.NewForConfigAndClient,
+	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*apiserverinternalv1alpha1.InternalV1alpha1Client]{
+		NewForConfigAndClient: apiserverinternalv1alpha1.NewForConfigAndClient,
 	})
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &InternalV1alpha1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *InternalV1alpha1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiapiserverinternalv1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/apiserverinternal/v1alpha1/doc.go b/kubernetes/typed/apiserverinternal/v1alpha1/doc.go
new file mode 100644
index 000000000..08b80237c
--- /dev/null
+++ b/kubernetes/typed/apiserverinternal/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/kubernetes/typed/apiserverinternal/v1alpha1/fake/apiserverinternal_client.go b/kubernetes/typed/apiserverinternal/v1alpha1/fake/apiserverinternal_client.go
index a5899f3fa..8af196e85 100644
--- a/kubernetes/typed/apiserverinternal/v1alpha1/fake/apiserverinternal_client.go
+++ b/kubernetes/typed/apiserverinternal/v1alpha1/fake/apiserverinternal_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,49 +14,48 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	internalv1alpha1 "k8s.io/client-go/kubernetes/typed/apiserverinternal/v1alpha1"
-	"k8s.io/client-go/rest"
+	apiserverinternalv1alpha1 "k8s.io/client-go/kubernetes/typed/apiserverinternal/v1alpha1"
+	rest "k8s.io/client-go/rest"
 
-	kcpinternalv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/apiserverinternal/v1alpha1"
+	kcpapiserverinternalv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/apiserverinternal/v1alpha1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var _ kcpinternalv1alpha1.InternalV1alpha1ClusterInterface = (*InternalV1alpha1ClusterClient)(nil)
+var _ kcpapiserverinternalv1alpha1.InternalV1alpha1ClusterInterface = (*InternalV1alpha1ClusterClient)(nil)
 
 type InternalV1alpha1ClusterClient struct {
 	*kcptesting.Fake
 }
 
-func (c *InternalV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) internalv1alpha1.InternalV1alpha1Interface {
+func (c *InternalV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) apiserverinternalv1alpha1.InternalV1alpha1Interface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
 	return &InternalV1alpha1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *InternalV1alpha1ClusterClient) StorageVersions() kcpinternalv1alpha1.StorageVersionClusterInterface {
-	return &storageVersionsClusterClient{Fake: c.Fake}
+func (c *InternalV1alpha1ClusterClient) StorageVersions() kcpapiserverinternalv1alpha1.StorageVersionClusterInterface {
+	return newFakeStorageVersionClusterClient(c)
 }
 
-var _ internalv1alpha1.InternalV1alpha1Interface = (*InternalV1alpha1Client)(nil)
-
 type InternalV1alpha1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *InternalV1alpha1Client) StorageVersions() apiserverinternalv1alpha1.StorageVersionInterface {
+	return newFakeStorageVersionClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *InternalV1alpha1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *InternalV1alpha1Client) StorageVersions() internalv1alpha1.StorageVersionInterface {
-	return &storageVersionsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
diff --git a/kubernetes/typed/apiserverinternal/v1alpha1/fake/doc.go b/kubernetes/typed/apiserverinternal/v1alpha1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/apiserverinternal/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/apiserverinternal/v1alpha1/fake/storageversion.go b/kubernetes/typed/apiserverinternal/v1alpha1/fake/storageversion.go
index 1904be9df..e9ff4cdd4 100644
--- a/kubernetes/typed/apiserverinternal/v1alpha1/fake/storageversion.go
+++ b/kubernetes/typed/apiserverinternal/v1alpha1/fake/storageversion.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,81 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	internalv1alpha1 "k8s.io/api/apiserverinternal/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsinternalv1alpha1 "k8s.io/client-go/applyconfigurations/apiserverinternal/v1alpha1"
-	internalv1alpha1client "k8s.io/client-go/kubernetes/typed/apiserverinternal/v1alpha1"
-	"k8s.io/client-go/testing"
+	apiserverinternalv1alpha1 "k8s.io/api/apiserverinternal/v1alpha1"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/apiserverinternal/v1alpha1"
+	typedapiserverinternalv1alpha1 "k8s.io/client-go/kubernetes/typed/apiserverinternal/v1alpha1"
 
+	typedkcpapiserverinternalv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/apiserverinternal/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var storageVersionsResource = schema.GroupVersionResource{Group: "internal.apiserver.k8s.io", Version: "v1alpha1", Resource: "storageversions"}
-var storageVersionsKind = schema.GroupVersionKind{Group: "internal.apiserver.k8s.io", Version: "v1alpha1", Kind: "StorageVersion"}
-
-type storageVersionsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *storageVersionsClusterClient) Cluster(clusterPath logicalcluster.Path) internalv1alpha1client.StorageVersionInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &storageVersionsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of StorageVersions that match those selectors across all clusters.
-func (c *storageVersionsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*internalv1alpha1.StorageVersionList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(storageVersionsResource, storageVersionsKind, logicalcluster.Wildcard, opts), &internalv1alpha1.StorageVersionList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &internalv1alpha1.StorageVersionList{ListMeta: obj.(*internalv1alpha1.StorageVersionList).ListMeta}
-	for _, item := range obj.(*internalv1alpha1.StorageVersionList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested StorageVersions across all clusters.
-func (c *storageVersionsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(storageVersionsResource, logicalcluster.Wildcard, opts))
-}
-
-type storageVersionsClient struct {
-	*kcptesting.Fake
+// storageVersionClusterClient implements StorageVersionClusterInterface
+type storageVersionClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*apiserverinternalv1alpha1.StorageVersion, *apiserverinternalv1alpha1.StorageVersionList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeStorageVersionClusterClient(fake *InternalV1alpha1ClusterClient) typedkcpapiserverinternalv1alpha1.StorageVersionClusterInterface {
+	return &storageVersionClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*apiserverinternalv1alpha1.StorageVersion, *apiserverinternalv1alpha1.StorageVersionList](
+			fake.Fake,
+			apiserverinternalv1alpha1.SchemeGroupVersion.WithResource("storageversions"),
+			apiserverinternalv1alpha1.SchemeGroupVersion.WithKind("StorageVersion"),
+			func() *apiserverinternalv1alpha1.StorageVersion { return &apiserverinternalv1alpha1.StorageVersion{} },
+			func() *apiserverinternalv1alpha1.StorageVersionList {
+				return &apiserverinternalv1alpha1.StorageVersionList{}
+			},
+			func(dst, src *apiserverinternalv1alpha1.StorageVersionList) { dst.ListMeta = src.ListMeta },
+			func(list *apiserverinternalv1alpha1.StorageVersionList) []*apiserverinternalv1alpha1.StorageVersion {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *apiserverinternalv1alpha1.StorageVersionList, items []*apiserverinternalv1alpha1.StorageVersion) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *storageVersionClusterClient) Cluster(cluster logicalcluster.Path) typedapiserverinternalv1alpha1.StorageVersionInterface {
+	return newFakeStorageVersionClient(c.Fake, cluster)
+}
+
+// storageVersionScopedClient implements StorageVersionInterface
+type storageVersionScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*apiserverinternalv1alpha1.StorageVersion, *apiserverinternalv1alpha1.StorageVersionList, *v1alpha1.StorageVersionApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *storageVersionsClient) Create(ctx context.Context, storageVersion *internalv1alpha1.StorageVersion, opts metav1.CreateOptions) (*internalv1alpha1.StorageVersion, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(storageVersionsResource, c.ClusterPath, storageVersion), &internalv1alpha1.StorageVersion{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*internalv1alpha1.StorageVersion), err
-}
-
-func (c *storageVersionsClient) Update(ctx context.Context, storageVersion *internalv1alpha1.StorageVersion, opts metav1.UpdateOptions) (*internalv1alpha1.StorageVersion, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(storageVersionsResource, c.ClusterPath, storageVersion), &internalv1alpha1.StorageVersion{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*internalv1alpha1.StorageVersion), err
-}
-
-func (c *storageVersionsClient) UpdateStatus(ctx context.Context, storageVersion *internalv1alpha1.StorageVersion, opts metav1.UpdateOptions) (*internalv1alpha1.StorageVersion, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(storageVersionsResource, c.ClusterPath, "status", storageVersion), &internalv1alpha1.StorageVersion{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*internalv1alpha1.StorageVersion), err
-}
-
-func (c *storageVersionsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(storageVersionsResource, c.ClusterPath, name, opts), &internalv1alpha1.StorageVersion{})
-	return err
-}
-
-func (c *storageVersionsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(storageVersionsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &internalv1alpha1.StorageVersionList{})
-	return err
-}
-
-func (c *storageVersionsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*internalv1alpha1.StorageVersion, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(storageVersionsResource, c.ClusterPath, name), &internalv1alpha1.StorageVersion{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*internalv1alpha1.StorageVersion), err
-}
-
-// List takes label and field selectors, and returns the list of StorageVersions that match those selectors.
-func (c *storageVersionsClient) List(ctx context.Context, opts metav1.ListOptions) (*internalv1alpha1.StorageVersionList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(storageVersionsResource, storageVersionsKind, c.ClusterPath, opts), &internalv1alpha1.StorageVersionList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &internalv1alpha1.StorageVersionList{ListMeta: obj.(*internalv1alpha1.StorageVersionList).ListMeta}
-	for _, item := range obj.(*internalv1alpha1.StorageVersionList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *storageVersionsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(storageVersionsResource, c.ClusterPath, opts))
-}
-
-func (c *storageVersionsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*internalv1alpha1.StorageVersion, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(storageVersionsResource, c.ClusterPath, name, pt, data, subresources...), &internalv1alpha1.StorageVersion{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*internalv1alpha1.StorageVersion), err
-}
-
-func (c *storageVersionsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsinternalv1alpha1.StorageVersionApplyConfiguration, opts metav1.ApplyOptions) (*internalv1alpha1.StorageVersion, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(storageVersionsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &internalv1alpha1.StorageVersion{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*internalv1alpha1.StorageVersion), err
-}
-
-func (c *storageVersionsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsinternalv1alpha1.StorageVersionApplyConfiguration, opts metav1.ApplyOptions) (*internalv1alpha1.StorageVersion, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(storageVersionsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &internalv1alpha1.StorageVersion{})
-	if obj == nil {
-		return nil, err
+func newFakeStorageVersionClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedapiserverinternalv1alpha1.StorageVersionInterface {
+	return &storageVersionScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*apiserverinternalv1alpha1.StorageVersion, *apiserverinternalv1alpha1.StorageVersionList, *v1alpha1.StorageVersionApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			apiserverinternalv1alpha1.SchemeGroupVersion.WithResource("storageversions"),
+			apiserverinternalv1alpha1.SchemeGroupVersion.WithKind("StorageVersion"),
+			func() *apiserverinternalv1alpha1.StorageVersion { return &apiserverinternalv1alpha1.StorageVersion{} },
+			func() *apiserverinternalv1alpha1.StorageVersionList {
+				return &apiserverinternalv1alpha1.StorageVersionList{}
+			},
+			func(dst, src *apiserverinternalv1alpha1.StorageVersionList) { dst.ListMeta = src.ListMeta },
+			func(list *apiserverinternalv1alpha1.StorageVersionList) []*apiserverinternalv1alpha1.StorageVersion {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *apiserverinternalv1alpha1.StorageVersionList, items []*apiserverinternalv1alpha1.StorageVersion) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*internalv1alpha1.StorageVersion), err
 }
diff --git a/kubernetes/typed/apiserverinternal/v1alpha1/generated_expansion.go b/kubernetes/typed/apiserverinternal/v1alpha1/generated_expansion.go
new file mode 100644
index 000000000..8537e859c
--- /dev/null
+++ b/kubernetes/typed/apiserverinternal/v1alpha1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type StorageVersionClusterExpansion interface{}
diff --git a/kubernetes/typed/apiserverinternal/v1alpha1/storageversion.go b/kubernetes/typed/apiserverinternal/v1alpha1/storageversion.go
index 305cdc618..483f6a44d 100644
--- a/kubernetes/typed/apiserverinternal/v1alpha1/storageversion.go
+++ b/kubernetes/typed/apiserverinternal/v1alpha1/storageversion.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
+	context "context"
+
+	apiapiserverinternalv1alpha1 "k8s.io/api/apiserverinternal/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	apiserverinternalv1alpha1 "k8s.io/client-go/kubernetes/typed/apiserverinternal/v1alpha1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	internalv1alpha1 "k8s.io/api/apiserverinternal/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	internalv1alpha1client "k8s.io/client-go/kubernetes/typed/apiserverinternal/v1alpha1"
 )
 
 // StorageVersionsClusterGetter has a method to return a StorageVersionClusterInterface.
@@ -40,19 +37,20 @@ type StorageVersionsClusterGetter interface {
 }
 
 // StorageVersionClusterInterface can operate on StorageVersions across all clusters,
-// or scope down to one cluster and return a internalv1alpha1client.StorageVersionInterface.
+// or scope down to one cluster and return a apiserverinternalv1alpha1.StorageVersionInterface.
 type StorageVersionClusterInterface interface {
-	Cluster(logicalcluster.Path) internalv1alpha1client.StorageVersionInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*internalv1alpha1.StorageVersionList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) apiserverinternalv1alpha1.StorageVersionInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiapiserverinternalv1alpha1.StorageVersionList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	StorageVersionClusterExpansion
 }
 
 type storageVersionsClusterInterface struct {
-	clientCache kcpclient.Cache[*internalv1alpha1client.InternalV1alpha1Client]
+	clientCache kcpclient.Cache[*apiserverinternalv1alpha1.InternalV1alpha1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *storageVersionsClusterInterface) Cluster(clusterPath logicalcluster.Path) internalv1alpha1client.StorageVersionInterface {
+func (c *storageVersionsClusterInterface) Cluster(clusterPath logicalcluster.Path) apiserverinternalv1alpha1.StorageVersionInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *storageVersionsClusterInterface) Cluster(clusterPath logicalcluster.Pat
 }
 
 // List returns the entire collection of all StorageVersions across all clusters.
-func (c *storageVersionsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*internalv1alpha1.StorageVersionList, error) {
+func (c *storageVersionsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiapiserverinternalv1alpha1.StorageVersionList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StorageVersions().List(ctx, opts)
 }
 
 // Watch begins to watch all StorageVersions across all clusters.
-func (c *storageVersionsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *storageVersionsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StorageVersions().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/apps/v1/apps_client.go b/kubernetes/typed/apps/v1/apps_client.go
index 1a68cba11..e7b74f083 100644
--- a/kubernetes/typed/apps/v1/apps_client.go
+++ b/kubernetes/typed/apps/v1/apps_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,33 +14,36 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiappsv1 "k8s.io/api/apps/v1"
+	appsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
-	"k8s.io/client-go/rest"
 )
 
 type AppsV1ClusterInterface interface {
 	AppsV1ClusterScoper
-	StatefulSetsClusterGetter
-	DeploymentsClusterGetter
+	ControllerRevisionsClusterGetter
 	DaemonSetsClusterGetter
+	DeploymentsClusterGetter
 	ReplicaSetsClusterGetter
-	ControllerRevisionsClusterGetter
+	StatefulSetsClusterGetter
 }
 
 type AppsV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) appsv1.AppsV1Interface
 }
 
+// AppsV1ClusterClient is used to interact with features provided by the apps group.
 type AppsV1ClusterClient struct {
 	clientCache kcpclient.Cache[*appsv1.AppsV1Client]
 }
@@ -55,35 +55,37 @@ func (c *AppsV1ClusterClient) Cluster(clusterPath logicalcluster.Path) appsv1.Ap
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *AppsV1ClusterClient) StatefulSets() StatefulSetClusterInterface {
-	return &statefulSetsClusterInterface{clientCache: c.clientCache}
-}
-
-func (c *AppsV1ClusterClient) Deployments() DeploymentClusterInterface {
-	return &deploymentsClusterInterface{clientCache: c.clientCache}
+func (c *AppsV1ClusterClient) ControllerRevisions() ControllerRevisionClusterInterface {
+	return &controllerRevisionsClusterInterface{clientCache: c.clientCache}
 }
 
 func (c *AppsV1ClusterClient) DaemonSets() DaemonSetClusterInterface {
 	return &daemonSetsClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *AppsV1ClusterClient) Deployments() DeploymentClusterInterface {
+	return &deploymentsClusterInterface{clientCache: c.clientCache}
+}
+
 func (c *AppsV1ClusterClient) ReplicaSets() ReplicaSetClusterInterface {
 	return &replicaSetsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *AppsV1ClusterClient) ControllerRevisions() ControllerRevisionClusterInterface {
-	return &controllerRevisionsClusterInterface{clientCache: c.clientCache}
+func (c *AppsV1ClusterClient) StatefulSets() StatefulSetClusterInterface {
+	return &statefulSetsClusterInterface{clientCache: c.clientCache}
 }
 
 // NewForConfig creates a new AppsV1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AppsV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AppsV1ClusterClient for the given config and http client.
@@ -95,6 +97,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AppsV1ClusterClient
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AppsV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -107,3 +110,14 @@ func NewForConfigOrDie(c *rest.Config) *AppsV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiappsv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/apps/v1/controllerrevision.go b/kubernetes/typed/apps/v1/controllerrevision.go
index 2283979bf..c1293f964 100644
--- a/kubernetes/typed/apps/v1/controllerrevision.go
+++ b/kubernetes/typed/apps/v1/controllerrevision.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	appsv1 "k8s.io/api/apps/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1client "k8s.io/client-go/kubernetes/typed/apps/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ControllerRevisionsClusterGetter has a method to return a ControllerRevisionClusterInterface.
@@ -45,10 +42,11 @@ type ControllerRevisionClusterInterface interface {
 	Cluster(logicalcluster.Path) ControllerRevisionsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*appsv1.ControllerRevisionList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ControllerRevisionClusterExpansion
 }
 
 type controllerRevisionsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1client.AppsV1Client]
+	clientCache kcpclient.Cache[*typedappsv1.AppsV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *controllerRevisionsClusterInterface) Watch(ctx context.Context, opts me
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ControllerRevisions(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ControllerRevisionsNamespacer can scope to objects within a namespace, returning a appsv1client.ControllerRevisionInterface.
+// ControllerRevisionsNamespacer can scope to objects within a namespace, returning a typedappsv1.ControllerRevisionInterface.
 type ControllerRevisionsNamespacer interface {
-	Namespace(string) appsv1client.ControllerRevisionInterface
+	Namespace(string) typedappsv1.ControllerRevisionInterface
 }
 
 type controllerRevisionsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1client.AppsV1Client]
+	clientCache kcpclient.Cache[*typedappsv1.AppsV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *controllerRevisionsNamespacer) Namespace(namespace string) appsv1client.ControllerRevisionInterface {
+func (n *controllerRevisionsNamespacer) Namespace(namespace string) typedappsv1.ControllerRevisionInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).ControllerRevisions(namespace)
 }
diff --git a/kubernetes/typed/apps/v1/daemonset.go b/kubernetes/typed/apps/v1/daemonset.go
index 2dd180ec1..d02370d97 100644
--- a/kubernetes/typed/apps/v1/daemonset.go
+++ b/kubernetes/typed/apps/v1/daemonset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	appsv1 "k8s.io/api/apps/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1client "k8s.io/client-go/kubernetes/typed/apps/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // DaemonSetsClusterGetter has a method to return a DaemonSetClusterInterface.
@@ -45,10 +42,11 @@ type DaemonSetClusterInterface interface {
 	Cluster(logicalcluster.Path) DaemonSetsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*appsv1.DaemonSetList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	DaemonSetClusterExpansion
 }
 
 type daemonSetsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1client.AppsV1Client]
+	clientCache kcpclient.Cache[*typedappsv1.AppsV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *daemonSetsClusterInterface) Watch(ctx context.Context, opts metav1.List
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DaemonSets(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// DaemonSetsNamespacer can scope to objects within a namespace, returning a appsv1client.DaemonSetInterface.
+// DaemonSetsNamespacer can scope to objects within a namespace, returning a typedappsv1.DaemonSetInterface.
 type DaemonSetsNamespacer interface {
-	Namespace(string) appsv1client.DaemonSetInterface
+	Namespace(string) typedappsv1.DaemonSetInterface
 }
 
 type daemonSetsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1client.AppsV1Client]
+	clientCache kcpclient.Cache[*typedappsv1.AppsV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *daemonSetsNamespacer) Namespace(namespace string) appsv1client.DaemonSetInterface {
+func (n *daemonSetsNamespacer) Namespace(namespace string) typedappsv1.DaemonSetInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).DaemonSets(namespace)
 }
diff --git a/kubernetes/typed/apps/v1/deployment.go b/kubernetes/typed/apps/v1/deployment.go
index e29546076..f7c944984 100644
--- a/kubernetes/typed/apps/v1/deployment.go
+++ b/kubernetes/typed/apps/v1/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	appsv1 "k8s.io/api/apps/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1client "k8s.io/client-go/kubernetes/typed/apps/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // DeploymentsClusterGetter has a method to return a DeploymentClusterInterface.
@@ -45,10 +42,11 @@ type DeploymentClusterInterface interface {
 	Cluster(logicalcluster.Path) DeploymentsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*appsv1.DeploymentList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	DeploymentClusterExpansion
 }
 
 type deploymentsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1client.AppsV1Client]
+	clientCache kcpclient.Cache[*typedappsv1.AppsV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *deploymentsClusterInterface) Watch(ctx context.Context, opts metav1.Lis
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// DeploymentsNamespacer can scope to objects within a namespace, returning a appsv1client.DeploymentInterface.
+// DeploymentsNamespacer can scope to objects within a namespace, returning a typedappsv1.DeploymentInterface.
 type DeploymentsNamespacer interface {
-	Namespace(string) appsv1client.DeploymentInterface
+	Namespace(string) typedappsv1.DeploymentInterface
 }
 
 type deploymentsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1client.AppsV1Client]
+	clientCache kcpclient.Cache[*typedappsv1.AppsV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *deploymentsNamespacer) Namespace(namespace string) appsv1client.DeploymentInterface {
+func (n *deploymentsNamespacer) Namespace(namespace string) typedappsv1.DeploymentInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Deployments(namespace)
 }
diff --git a/kubernetes/typed/apps/v1/doc.go b/kubernetes/typed/apps/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/apps/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/apps/v1/fake/apps_client.go b/kubernetes/typed/apps/v1/fake/apps_client.go
index caa78e7b0..2d42ef76a 100644
--- a/kubernetes/typed/apps/v1/fake/apps_client.go
+++ b/kubernetes/typed/apps/v1/fake/apps_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpappsv1.AppsV1ClusterInterface = (*AppsV1ClusterClient)(nil)
@@ -44,54 +40,54 @@ func (c *AppsV1ClusterClient) Cluster(clusterPath logicalcluster.Path) appsv1.Ap
 	return &AppsV1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *AppsV1ClusterClient) StatefulSets() kcpappsv1.StatefulSetClusterInterface {
-	return &statefulSetsClusterClient{Fake: c.Fake}
+func (c *AppsV1ClusterClient) ControllerRevisions() kcpappsv1.ControllerRevisionClusterInterface {
+	return newFakeControllerRevisionClusterClient(c)
 }
 
-func (c *AppsV1ClusterClient) Deployments() kcpappsv1.DeploymentClusterInterface {
-	return &deploymentsClusterClient{Fake: c.Fake}
+func (c *AppsV1ClusterClient) DaemonSets() kcpappsv1.DaemonSetClusterInterface {
+	return newFakeDaemonSetClusterClient(c)
 }
 
-func (c *AppsV1ClusterClient) DaemonSets() kcpappsv1.DaemonSetClusterInterface {
-	return &daemonSetsClusterClient{Fake: c.Fake}
+func (c *AppsV1ClusterClient) Deployments() kcpappsv1.DeploymentClusterInterface {
+	return newFakeDeploymentClusterClient(c)
 }
 
 func (c *AppsV1ClusterClient) ReplicaSets() kcpappsv1.ReplicaSetClusterInterface {
-	return &replicaSetsClusterClient{Fake: c.Fake}
+	return newFakeReplicaSetClusterClient(c)
 }
 
-func (c *AppsV1ClusterClient) ControllerRevisions() kcpappsv1.ControllerRevisionClusterInterface {
-	return &controllerRevisionsClusterClient{Fake: c.Fake}
+func (c *AppsV1ClusterClient) StatefulSets() kcpappsv1.StatefulSetClusterInterface {
+	return newFakeStatefulSetClusterClient(c)
 }
 
-var _ appsv1.AppsV1Interface = (*AppsV1Client)(nil)
-
 type AppsV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *AppsV1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *AppsV1Client) ControllerRevisions(namespace string) appsv1.ControllerRevisionInterface {
+	return newFakeControllerRevisionClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AppsV1Client) StatefulSets(namespace string) appsv1.StatefulSetInterface {
-	return &statefulSetsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *AppsV1Client) DaemonSets(namespace string) appsv1.DaemonSetInterface {
+	return newFakeDaemonSetClient(c.Fake, namespace, c.ClusterPath)
 }
 
 func (c *AppsV1Client) Deployments(namespace string) appsv1.DeploymentInterface {
-	return &deploymentsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+	return newFakeDeploymentClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AppsV1Client) DaemonSets(namespace string) appsv1.DaemonSetInterface {
-	return &daemonSetsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *AppsV1Client) ReplicaSets(namespace string) appsv1.ReplicaSetInterface {
+	return newFakeReplicaSetClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AppsV1Client) ReplicaSets(namespace string) appsv1.ReplicaSetInterface {
-	return &replicaSetsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *AppsV1Client) StatefulSets(namespace string) appsv1.StatefulSetInterface {
+	return newFakeStatefulSetClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AppsV1Client) ControllerRevisions(namespace string) appsv1.ControllerRevisionInterface {
-	return &controllerRevisionsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AppsV1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/apps/v1/fake/controllerrevision.go b/kubernetes/typed/apps/v1/fake/controllerrevision.go
index 5da2f2b61..90c25ed74 100644
--- a/kubernetes/typed/apps/v1/fake/controllerrevision.go
+++ b/kubernetes/typed/apps/v1/fake/controllerrevision.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1 "k8s.io/api/apps/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1 "k8s.io/client-go/applyconfigurations/apps/v1"
-	appsv1client "k8s.io/client-go/kubernetes/typed/apps/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/apps/v1"
+	typedappsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
 
-	kcpappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1"
+	typedkcpappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var controllerRevisionsResource = schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "controllerrevisions"}
-var controllerRevisionsKind = schema.GroupVersionKind{Group: "apps", Version: "v1", Kind: "ControllerRevision"}
-
-type controllerRevisionsClusterClient struct {
-	*kcptesting.Fake
+// controllerRevisionClusterClient implements ControllerRevisionClusterInterface
+type controllerRevisionClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1.ControllerRevision, *appsv1.ControllerRevisionList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *controllerRevisionsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1.ControllerRevisionsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &controllerRevisionsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ControllerRevisions that match those selectors across all clusters.
-func (c *controllerRevisionsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1.ControllerRevisionList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(controllerRevisionsResource, controllerRevisionsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1.ControllerRevisionList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeControllerRevisionClusterClient(fake *AppsV1ClusterClient) typedkcpappsv1.ControllerRevisionClusterInterface {
+	return &controllerRevisionClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1.ControllerRevision, *appsv1.ControllerRevisionList](
+			fake.Fake,
+			appsv1.SchemeGroupVersion.WithResource("controllerrevisions"),
+			appsv1.SchemeGroupVersion.WithKind("ControllerRevision"),
+			func() *appsv1.ControllerRevision { return &appsv1.ControllerRevision{} },
+			func() *appsv1.ControllerRevisionList { return &appsv1.ControllerRevisionList{} },
+			func(dst, src *appsv1.ControllerRevisionList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1.ControllerRevisionList) []*appsv1.ControllerRevision {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1.ControllerRevisionList, items []*appsv1.ControllerRevision) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &appsv1.ControllerRevisionList{ListMeta: obj.(*appsv1.ControllerRevisionList).ListMeta}
-	for _, item := range obj.(*appsv1.ControllerRevisionList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ControllerRevisions across all clusters.
-func (c *controllerRevisionsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(controllerRevisionsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *controllerRevisionClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1.ControllerRevisionsNamespacer {
+	return &controllerRevisionNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type controllerRevisionsNamespacer struct {
+type controllerRevisionNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *controllerRevisionsNamespacer) Namespace(namespace string) appsv1client.ControllerRevisionInterface {
-	return &controllerRevisionsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *controllerRevisionNamespacer) Namespace(namespace string) typedappsv1.ControllerRevisionInterface {
+	return newFakeControllerRevisionClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type controllerRevisionsClient struct {
-	*kcptesting.Fake
+// controllerRevisionScopedClient implements ControllerRevisionInterface
+type controllerRevisionScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1.ControllerRevision, *appsv1.ControllerRevisionList, *v1.ControllerRevisionApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *controllerRevisionsClient) Create(ctx context.Context, controllerRevision *appsv1.ControllerRevision, opts metav1.CreateOptions) (*appsv1.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, controllerRevision), &appsv1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) Update(ctx context.Context, controllerRevision *appsv1.ControllerRevision, opts metav1.UpdateOptions) (*appsv1.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, controllerRevision), &appsv1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) UpdateStatus(ctx context.Context, controllerRevision *appsv1.ControllerRevision, opts metav1.UpdateOptions) (*appsv1.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(controllerRevisionsResource, c.ClusterPath, "status", c.Namespace, controllerRevision), &appsv1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(controllerRevisionsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1.ControllerRevision{})
-	return err
 }
 
-func (c *controllerRevisionsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1.ControllerRevisionList{})
-	return err
-}
-
-func (c *controllerRevisionsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, name), &appsv1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ControllerRevision), err
-}
-
-// List takes label and field selectors, and returns the list of ControllerRevisions that match those selectors.
-func (c *controllerRevisionsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1.ControllerRevisionList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(controllerRevisionsResource, controllerRevisionsKind, c.ClusterPath, c.Namespace, opts), &appsv1.ControllerRevisionList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1.ControllerRevisionList{ListMeta: obj.(*appsv1.ControllerRevisionList).ListMeta}
-	for _, item := range obj.(*appsv1.ControllerRevisionList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *controllerRevisionsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *controllerRevisionsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1.ControllerRevisionApplyConfiguration, opts metav1.ApplyOptions) (*appsv1.ControllerRevision, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1.ControllerRevisionApplyConfiguration, opts metav1.ApplyOptions) (*appsv1.ControllerRevision, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
+func newFakeControllerRevisionClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1.ControllerRevisionInterface {
+	return &controllerRevisionScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1.ControllerRevision, *appsv1.ControllerRevisionList, *v1.ControllerRevisionApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1.SchemeGroupVersion.WithResource("controllerrevisions"),
+			appsv1.SchemeGroupVersion.WithKind("ControllerRevision"),
+			func() *appsv1.ControllerRevision { return &appsv1.ControllerRevision{} },
+			func() *appsv1.ControllerRevisionList { return &appsv1.ControllerRevisionList{} },
+			func(dst, src *appsv1.ControllerRevisionList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1.ControllerRevisionList) []*appsv1.ControllerRevision {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1.ControllerRevisionList, items []*appsv1.ControllerRevision) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*appsv1.ControllerRevision), err
 }
diff --git a/kubernetes/typed/apps/v1/fake/daemonset.go b/kubernetes/typed/apps/v1/fake/daemonset.go
index 343c0e5cd..0b423b244 100644
--- a/kubernetes/typed/apps/v1/fake/daemonset.go
+++ b/kubernetes/typed/apps/v1/fake/daemonset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,82 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1 "k8s.io/api/apps/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1 "k8s.io/client-go/applyconfigurations/apps/v1"
-	appsv1client "k8s.io/client-go/kubernetes/typed/apps/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/apps/v1"
+	typedappsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
 
-	kcpappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1"
+	typedkcpappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var daemonSetsResource = schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "daemonsets"}
-var daemonSetsKind = schema.GroupVersionKind{Group: "apps", Version: "v1", Kind: "DaemonSet"}
-
-type daemonSetsClusterClient struct {
-	*kcptesting.Fake
+// daemonSetClusterClient implements DaemonSetClusterInterface
+type daemonSetClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1.DaemonSet, *appsv1.DaemonSetList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *daemonSetsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1.DaemonSetsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &daemonSetsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of DaemonSets that match those selectors across all clusters.
-func (c *daemonSetsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1.DaemonSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(daemonSetsResource, daemonSetsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1.DaemonSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeDaemonSetClusterClient(fake *AppsV1ClusterClient) typedkcpappsv1.DaemonSetClusterInterface {
+	return &daemonSetClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1.DaemonSet, *appsv1.DaemonSetList](
+			fake.Fake,
+			appsv1.SchemeGroupVersion.WithResource("daemonsets"),
+			appsv1.SchemeGroupVersion.WithKind("DaemonSet"),
+			func() *appsv1.DaemonSet { return &appsv1.DaemonSet{} },
+			func() *appsv1.DaemonSetList { return &appsv1.DaemonSetList{} },
+			func(dst, src *appsv1.DaemonSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1.DaemonSetList) []*appsv1.DaemonSet { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *appsv1.DaemonSetList, items []*appsv1.DaemonSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &appsv1.DaemonSetList{ListMeta: obj.(*appsv1.DaemonSetList).ListMeta}
-	for _, item := range obj.(*appsv1.DaemonSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested DaemonSets across all clusters.
-func (c *daemonSetsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(daemonSetsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *daemonSetClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1.DaemonSetsNamespacer {
+	return &daemonSetNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type daemonSetsNamespacer struct {
+type daemonSetNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *daemonSetsNamespacer) Namespace(namespace string) appsv1client.DaemonSetInterface {
-	return &daemonSetsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *daemonSetNamespacer) Namespace(namespace string) typedappsv1.DaemonSetInterface {
+	return newFakeDaemonSetClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type daemonSetsClient struct {
-	*kcptesting.Fake
+// daemonSetScopedClient implements DaemonSetInterface
+type daemonSetScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1.DaemonSet, *appsv1.DaemonSetList, *v1.DaemonSetApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *daemonSetsClient) Create(ctx context.Context, daemonSet *appsv1.DaemonSet, opts metav1.CreateOptions) (*appsv1.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(daemonSetsResource, c.ClusterPath, c.Namespace, daemonSet), &appsv1.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.DaemonSet), err
-}
-
-func (c *daemonSetsClient) Update(ctx context.Context, daemonSet *appsv1.DaemonSet, opts metav1.UpdateOptions) (*appsv1.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(daemonSetsResource, c.ClusterPath, c.Namespace, daemonSet), &appsv1.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.DaemonSet), err
-}
-
-func (c *daemonSetsClient) UpdateStatus(ctx context.Context, daemonSet *appsv1.DaemonSet, opts metav1.UpdateOptions) (*appsv1.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(daemonSetsResource, c.ClusterPath, "status", c.Namespace, daemonSet), &appsv1.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.DaemonSet), err
-}
-
-func (c *daemonSetsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(daemonSetsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1.DaemonSet{})
-	return err
 }
 
-func (c *daemonSetsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(daemonSetsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1.DaemonSetList{})
-	return err
-}
-
-func (c *daemonSetsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(daemonSetsResource, c.ClusterPath, c.Namespace, name), &appsv1.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.DaemonSet), err
-}
-
-// List takes label and field selectors, and returns the list of DaemonSets that match those selectors.
-func (c *daemonSetsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1.DaemonSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(daemonSetsResource, daemonSetsKind, c.ClusterPath, c.Namespace, opts), &appsv1.DaemonSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1.DaemonSetList{ListMeta: obj.(*appsv1.DaemonSetList).ListMeta}
-	for _, item := range obj.(*appsv1.DaemonSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *daemonSetsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(daemonSetsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *daemonSetsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(daemonSetsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.DaemonSet), err
-}
-
-func (c *daemonSetsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1.DaemonSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1.DaemonSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(daemonSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.DaemonSet), err
-}
-
-func (c *daemonSetsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1.DaemonSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1.DaemonSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(daemonSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1.DaemonSet{})
-	if obj == nil {
-		return nil, err
+func newFakeDaemonSetClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1.DaemonSetInterface {
+	return &daemonSetScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1.DaemonSet, *appsv1.DaemonSetList, *v1.DaemonSetApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1.SchemeGroupVersion.WithResource("daemonsets"),
+			appsv1.SchemeGroupVersion.WithKind("DaemonSet"),
+			func() *appsv1.DaemonSet { return &appsv1.DaemonSet{} },
+			func() *appsv1.DaemonSetList { return &appsv1.DaemonSetList{} },
+			func(dst, src *appsv1.DaemonSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1.DaemonSetList) []*appsv1.DaemonSet { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *appsv1.DaemonSetList, items []*appsv1.DaemonSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*appsv1.DaemonSet), err
 }
diff --git a/kubernetes/typed/apps/v1/fake/deployment.go b/kubernetes/typed/apps/v1/fake/deployment.go
index 00bd6606d..42ef7b985 100644
--- a/kubernetes/typed/apps/v1/fake/deployment.go
+++ b/kubernetes/typed/apps/v1/fake/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,234 +14,128 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
+	json "encoding/json"
+	fmt "fmt"
 
 	appsv1 "k8s.io/api/apps/v1"
 	autoscalingv1 "k8s.io/api/autoscaling/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1 "k8s.io/client-go/applyconfigurations/apps/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/apps/v1"
 	applyconfigurationsautoscalingv1 "k8s.io/client-go/applyconfigurations/autoscaling/v1"
-	appsv1client "k8s.io/client-go/kubernetes/typed/apps/v1"
-	"k8s.io/client-go/testing"
+	typedappsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
 
-	kcpappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1"
+	typedkcpappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var deploymentsResource = schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"}
-var deploymentsKind = schema.GroupVersionKind{Group: "apps", Version: "v1", Kind: "Deployment"}
-
-type deploymentsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *deploymentsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1.DeploymentsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &deploymentsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
+// deploymentClusterClient implements DeploymentClusterInterface
+type deploymentClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1.Deployment, *appsv1.DeploymentList]
+	Fake *kcptesting.Fake
 }
 
-// List takes label and field selectors, and returns the list of Deployments that match those selectors across all clusters.
-func (c *deploymentsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1.DeploymentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(deploymentsResource, deploymentsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1.DeploymentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1.DeploymentList{ListMeta: obj.(*appsv1.DeploymentList).ListMeta}
-	for _, item := range obj.(*appsv1.DeploymentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeDeploymentClusterClient(fake *AppsV1ClusterClient) typedkcpappsv1.DeploymentClusterInterface {
+	return &deploymentClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1.Deployment, *appsv1.DeploymentList](
+			fake.Fake,
+			appsv1.SchemeGroupVersion.WithResource("deployments"),
+			appsv1.SchemeGroupVersion.WithKind("Deployment"),
+			func() *appsv1.Deployment { return &appsv1.Deployment{} },
+			func() *appsv1.DeploymentList { return &appsv1.DeploymentList{} },
+			func(dst, src *appsv1.DeploymentList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1.DeploymentList) []*appsv1.Deployment { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *appsv1.DeploymentList, items []*appsv1.Deployment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Deployments across all clusters.
-func (c *deploymentsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(deploymentsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *deploymentClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1.DeploymentsNamespacer {
+	return &deploymentNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type deploymentsNamespacer struct {
+type deploymentNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *deploymentsNamespacer) Namespace(namespace string) appsv1client.DeploymentInterface {
-	return &deploymentsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *deploymentNamespacer) Namespace(namespace string) typedappsv1.DeploymentInterface {
+	return newFakeDeploymentClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type deploymentsClient struct {
-	*kcptesting.Fake
+// deploymentScopedClient implements DeploymentInterface
+type deploymentScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1.Deployment, *appsv1.DeploymentList, *v1.DeploymentApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *deploymentsClient) Create(ctx context.Context, deployment *appsv1.Deployment, opts metav1.CreateOptions) (*appsv1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(deploymentsResource, c.ClusterPath, c.Namespace, deployment), &appsv1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.Deployment), err
-}
-
-func (c *deploymentsClient) Update(ctx context.Context, deployment *appsv1.Deployment, opts metav1.UpdateOptions) (*appsv1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(deploymentsResource, c.ClusterPath, c.Namespace, deployment), &appsv1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.Deployment), err
-}
-
-func (c *deploymentsClient) UpdateStatus(ctx context.Context, deployment *appsv1.Deployment, opts metav1.UpdateOptions) (*appsv1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(deploymentsResource, c.ClusterPath, "status", c.Namespace, deployment), &appsv1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.Deployment), err
-}
-
-func (c *deploymentsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(deploymentsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1.Deployment{})
-	return err
-}
-
-func (c *deploymentsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(deploymentsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1.DeploymentList{})
-	return err
-}
-
-func (c *deploymentsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(deploymentsResource, c.ClusterPath, c.Namespace, name), &appsv1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.Deployment), err
-}
-
-// List takes label and field selectors, and returns the list of Deployments that match those selectors.
-func (c *deploymentsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1.DeploymentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(deploymentsResource, deploymentsKind, c.ClusterPath, c.Namespace, opts), &appsv1.DeploymentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1.DeploymentList{ListMeta: obj.(*appsv1.DeploymentList).ListMeta}
-	for _, item := range obj.(*appsv1.DeploymentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *deploymentsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(deploymentsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *deploymentsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.Deployment), err
-}
-
-func (c *deploymentsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1.DeploymentApplyConfiguration, opts metav1.ApplyOptions) (*appsv1.Deployment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.Deployment), err
-}
-
-func (c *deploymentsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1.DeploymentApplyConfiguration, opts metav1.ApplyOptions) (*appsv1.Deployment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.Deployment), err
 }
 
-func (c *deploymentsClient) GetScale(ctx context.Context, deploymentName string, options metav1.GetOptions) (*autoscalingv1.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(deploymentsResource, c.ClusterPath, "scale", c.Namespace, deploymentName), &autoscalingv1.Scale{})
+func newFakeDeploymentClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1.DeploymentInterface {
+	return &deploymentScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1.Deployment, *appsv1.DeploymentList, *v1.DeploymentApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1.SchemeGroupVersion.WithResource("deployments"),
+			appsv1.SchemeGroupVersion.WithKind("Deployment"),
+			func() *appsv1.Deployment { return &appsv1.Deployment{} },
+			func() *appsv1.DeploymentList { return &appsv1.DeploymentList{} },
+			func(dst, src *appsv1.DeploymentList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1.DeploymentList) []*appsv1.Deployment { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *appsv1.DeploymentList, items []*appsv1.Deployment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
+
+// GetScale takes name of the deployment, and returns the corresponding scale object, and an error if there is any.
+func (c *deploymentScopedClient) GetScale(ctx context.Context, deploymentName string, _ metav1.GetOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), "scale", deploymentName), emptyResult)
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*autoscalingv1.Scale), err
 }
 
-func (c *deploymentsClient) UpdateScale(ctx context.Context, deploymentName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (*autoscalingv1.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(deploymentsResource, c.ClusterPath, "scale", c.Namespace, scale), &autoscalingv1.Scale{})
+// UpdateScale takes the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *deploymentScopedClient) UpdateScale(ctx context.Context, deploymentName string, scale *autoscalingv1.Scale, _ metav1.UpdateOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(c.Resource(), c.ClusterPath, "scale", c.Namespace(), scale), &autoscalingv1.Scale{})
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*autoscalingv1.Scale), err
 }
 
-func (c *deploymentsClient) ApplyScale(ctx context.Context, deploymentName string, applyConfiguration *applyconfigurationsautoscalingv1.ScaleApplyConfiguration, opts metav1.ApplyOptions) (*autoscalingv1.Scale, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
+// ApplyScale takes top resource name and the apply declarative configuration for scale,
+// applies it and returns the applied scale, and an error, if there is any.
+func (c *deploymentScopedClient) ApplyScale(ctx context.Context, deploymentName string, scale *applyconfigurationsautoscalingv1.ScaleApplyConfiguration, _ metav1.ApplyOptions) (result *autoscalingv1.Scale, err error) {
+	if scale == nil {
+		return nil, fmt.Errorf("scale provided to ApplyScale must not be nil")
 	}
-	data, err := json.Marshal(applyConfiguration)
+	data, err := json.Marshal(scale)
 	if err != nil {
 		return nil, err
 	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &autoscalingv1.Scale{})
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), deploymentName, types.ApplyPatchType, data, "scale"), emptyResult)
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*autoscalingv1.Scale), err
 }
diff --git a/kubernetes/typed/apps/v1/fake/doc.go b/kubernetes/typed/apps/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/apps/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/apps/v1/fake/replicaset.go b/kubernetes/typed/apps/v1/fake/replicaset.go
index 6fb7b0c9f..06f93be4b 100644
--- a/kubernetes/typed/apps/v1/fake/replicaset.go
+++ b/kubernetes/typed/apps/v1/fake/replicaset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,234 +14,128 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
+	json "encoding/json"
+	fmt "fmt"
 
 	appsv1 "k8s.io/api/apps/v1"
 	autoscalingv1 "k8s.io/api/autoscaling/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1 "k8s.io/client-go/applyconfigurations/apps/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/apps/v1"
 	applyconfigurationsautoscalingv1 "k8s.io/client-go/applyconfigurations/autoscaling/v1"
-	appsv1client "k8s.io/client-go/kubernetes/typed/apps/v1"
-	"k8s.io/client-go/testing"
+	typedappsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
 
-	kcpappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1"
+	typedkcpappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var replicaSetsResource = schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "replicasets"}
-var replicaSetsKind = schema.GroupVersionKind{Group: "apps", Version: "v1", Kind: "ReplicaSet"}
-
-type replicaSetsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *replicaSetsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1.ReplicaSetsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &replicaSetsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
+// replicaSetClusterClient implements ReplicaSetClusterInterface
+type replicaSetClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1.ReplicaSet, *appsv1.ReplicaSetList]
+	Fake *kcptesting.Fake
 }
 
-// List takes label and field selectors, and returns the list of ReplicaSets that match those selectors across all clusters.
-func (c *replicaSetsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1.ReplicaSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(replicaSetsResource, replicaSetsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1.ReplicaSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1.ReplicaSetList{ListMeta: obj.(*appsv1.ReplicaSetList).ListMeta}
-	for _, item := range obj.(*appsv1.ReplicaSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeReplicaSetClusterClient(fake *AppsV1ClusterClient) typedkcpappsv1.ReplicaSetClusterInterface {
+	return &replicaSetClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1.ReplicaSet, *appsv1.ReplicaSetList](
+			fake.Fake,
+			appsv1.SchemeGroupVersion.WithResource("replicasets"),
+			appsv1.SchemeGroupVersion.WithKind("ReplicaSet"),
+			func() *appsv1.ReplicaSet { return &appsv1.ReplicaSet{} },
+			func() *appsv1.ReplicaSetList { return &appsv1.ReplicaSetList{} },
+			func(dst, src *appsv1.ReplicaSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1.ReplicaSetList) []*appsv1.ReplicaSet { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *appsv1.ReplicaSetList, items []*appsv1.ReplicaSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ReplicaSets across all clusters.
-func (c *replicaSetsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(replicaSetsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *replicaSetClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1.ReplicaSetsNamespacer {
+	return &replicaSetNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type replicaSetsNamespacer struct {
+type replicaSetNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *replicaSetsNamespacer) Namespace(namespace string) appsv1client.ReplicaSetInterface {
-	return &replicaSetsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *replicaSetNamespacer) Namespace(namespace string) typedappsv1.ReplicaSetInterface {
+	return newFakeReplicaSetClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type replicaSetsClient struct {
-	*kcptesting.Fake
+// replicaSetScopedClient implements ReplicaSetInterface
+type replicaSetScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1.ReplicaSet, *appsv1.ReplicaSetList, *v1.ReplicaSetApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *replicaSetsClient) Create(ctx context.Context, replicaSet *appsv1.ReplicaSet, opts metav1.CreateOptions) (*appsv1.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(replicaSetsResource, c.ClusterPath, c.Namespace, replicaSet), &appsv1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) Update(ctx context.Context, replicaSet *appsv1.ReplicaSet, opts metav1.UpdateOptions) (*appsv1.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(replicaSetsResource, c.ClusterPath, c.Namespace, replicaSet), &appsv1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) UpdateStatus(ctx context.Context, replicaSet *appsv1.ReplicaSet, opts metav1.UpdateOptions) (*appsv1.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(replicaSetsResource, c.ClusterPath, "status", c.Namespace, replicaSet), &appsv1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(replicaSetsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1.ReplicaSet{})
-	return err
-}
-
-func (c *replicaSetsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(replicaSetsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1.ReplicaSetList{})
-	return err
-}
-
-func (c *replicaSetsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(replicaSetsResource, c.ClusterPath, c.Namespace, name), &appsv1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ReplicaSet), err
-}
-
-// List takes label and field selectors, and returns the list of ReplicaSets that match those selectors.
-func (c *replicaSetsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1.ReplicaSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(replicaSetsResource, replicaSetsKind, c.ClusterPath, c.Namespace, opts), &appsv1.ReplicaSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1.ReplicaSetList{ListMeta: obj.(*appsv1.ReplicaSetList).ListMeta}
-	for _, item := range obj.(*appsv1.ReplicaSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *replicaSetsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(replicaSetsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *replicaSetsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicaSetsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1.ReplicaSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1.ReplicaSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicaSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1.ReplicaSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1.ReplicaSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicaSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.ReplicaSet), err
 }
 
-func (c *replicaSetsClient) GetScale(ctx context.Context, replicaSetName string, options metav1.GetOptions) (*autoscalingv1.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(replicaSetsResource, c.ClusterPath, "scale", c.Namespace, replicaSetName), &autoscalingv1.Scale{})
+func newFakeReplicaSetClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1.ReplicaSetInterface {
+	return &replicaSetScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1.ReplicaSet, *appsv1.ReplicaSetList, *v1.ReplicaSetApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1.SchemeGroupVersion.WithResource("replicasets"),
+			appsv1.SchemeGroupVersion.WithKind("ReplicaSet"),
+			func() *appsv1.ReplicaSet { return &appsv1.ReplicaSet{} },
+			func() *appsv1.ReplicaSetList { return &appsv1.ReplicaSetList{} },
+			func(dst, src *appsv1.ReplicaSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1.ReplicaSetList) []*appsv1.ReplicaSet { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *appsv1.ReplicaSetList, items []*appsv1.ReplicaSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
+
+// GetScale takes name of the replicaSet, and returns the corresponding scale object, and an error if there is any.
+func (c *replicaSetScopedClient) GetScale(ctx context.Context, replicaSetName string, _ metav1.GetOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), "scale", replicaSetName), emptyResult)
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*autoscalingv1.Scale), err
 }
 
-func (c *replicaSetsClient) UpdateScale(ctx context.Context, replicaSetName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (*autoscalingv1.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(replicaSetsResource, c.ClusterPath, "scale", c.Namespace, scale), &autoscalingv1.Scale{})
+// UpdateScale takes the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *replicaSetScopedClient) UpdateScale(ctx context.Context, replicaSetName string, scale *autoscalingv1.Scale, _ metav1.UpdateOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(c.Resource(), c.ClusterPath, "scale", c.Namespace(), scale), &autoscalingv1.Scale{})
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*autoscalingv1.Scale), err
 }
 
-func (c *replicaSetsClient) ApplyScale(ctx context.Context, replicaSetName string, applyConfiguration *applyconfigurationsautoscalingv1.ScaleApplyConfiguration, opts metav1.ApplyOptions) (*autoscalingv1.Scale, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
+// ApplyScale takes top resource name and the apply declarative configuration for scale,
+// applies it and returns the applied scale, and an error, if there is any.
+func (c *replicaSetScopedClient) ApplyScale(ctx context.Context, replicaSetName string, scale *applyconfigurationsautoscalingv1.ScaleApplyConfiguration, _ metav1.ApplyOptions) (result *autoscalingv1.Scale, err error) {
+	if scale == nil {
+		return nil, fmt.Errorf("scale provided to ApplyScale must not be nil")
 	}
-	data, err := json.Marshal(applyConfiguration)
+	data, err := json.Marshal(scale)
 	if err != nil {
 		return nil, err
 	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicaSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &autoscalingv1.Scale{})
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), replicaSetName, types.ApplyPatchType, data, "scale"), emptyResult)
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*autoscalingv1.Scale), err
 }
diff --git a/kubernetes/typed/apps/v1/fake/statefulset.go b/kubernetes/typed/apps/v1/fake/statefulset.go
index bcbb4a2b4..86dbd9b1f 100644
--- a/kubernetes/typed/apps/v1/fake/statefulset.go
+++ b/kubernetes/typed/apps/v1/fake/statefulset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,234 +14,128 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
+	json "encoding/json"
+	fmt "fmt"
 
 	appsv1 "k8s.io/api/apps/v1"
 	autoscalingv1 "k8s.io/api/autoscaling/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1 "k8s.io/client-go/applyconfigurations/apps/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1 "k8s.io/client-go/applyconfigurations/apps/v1"
 	applyconfigurationsautoscalingv1 "k8s.io/client-go/applyconfigurations/autoscaling/v1"
-	appsv1client "k8s.io/client-go/kubernetes/typed/apps/v1"
-	"k8s.io/client-go/testing"
+	typedappsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
 
-	kcpappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1"
+	typedkcpappsv1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var statefulSetsResource = schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "statefulsets"}
-var statefulSetsKind = schema.GroupVersionKind{Group: "apps", Version: "v1", Kind: "StatefulSet"}
-
-type statefulSetsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *statefulSetsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1.StatefulSetsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &statefulSetsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
+// statefulSetClusterClient implements StatefulSetClusterInterface
+type statefulSetClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1.StatefulSet, *appsv1.StatefulSetList]
+	Fake *kcptesting.Fake
 }
 
-// List takes label and field selectors, and returns the list of StatefulSets that match those selectors across all clusters.
-func (c *statefulSetsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1.StatefulSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(statefulSetsResource, statefulSetsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1.StatefulSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1.StatefulSetList{ListMeta: obj.(*appsv1.StatefulSetList).ListMeta}
-	for _, item := range obj.(*appsv1.StatefulSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeStatefulSetClusterClient(fake *AppsV1ClusterClient) typedkcpappsv1.StatefulSetClusterInterface {
+	return &statefulSetClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1.StatefulSet, *appsv1.StatefulSetList](
+			fake.Fake,
+			appsv1.SchemeGroupVersion.WithResource("statefulsets"),
+			appsv1.SchemeGroupVersion.WithKind("StatefulSet"),
+			func() *appsv1.StatefulSet { return &appsv1.StatefulSet{} },
+			func() *appsv1.StatefulSetList { return &appsv1.StatefulSetList{} },
+			func(dst, src *appsv1.StatefulSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1.StatefulSetList) []*appsv1.StatefulSet { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *appsv1.StatefulSetList, items []*appsv1.StatefulSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested StatefulSets across all clusters.
-func (c *statefulSetsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(statefulSetsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *statefulSetClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1.StatefulSetsNamespacer {
+	return &statefulSetNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type statefulSetsNamespacer struct {
+type statefulSetNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *statefulSetsNamespacer) Namespace(namespace string) appsv1client.StatefulSetInterface {
-	return &statefulSetsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *statefulSetNamespacer) Namespace(namespace string) typedappsv1.StatefulSetInterface {
+	return newFakeStatefulSetClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type statefulSetsClient struct {
-	*kcptesting.Fake
+// statefulSetScopedClient implements StatefulSetInterface
+type statefulSetScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1.StatefulSet, *appsv1.StatefulSetList, *v1.StatefulSetApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *statefulSetsClient) Create(ctx context.Context, statefulSet *appsv1.StatefulSet, opts metav1.CreateOptions) (*appsv1.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(statefulSetsResource, c.ClusterPath, c.Namespace, statefulSet), &appsv1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.StatefulSet), err
-}
-
-func (c *statefulSetsClient) Update(ctx context.Context, statefulSet *appsv1.StatefulSet, opts metav1.UpdateOptions) (*appsv1.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(statefulSetsResource, c.ClusterPath, c.Namespace, statefulSet), &appsv1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.StatefulSet), err
-}
-
-func (c *statefulSetsClient) UpdateStatus(ctx context.Context, statefulSet *appsv1.StatefulSet, opts metav1.UpdateOptions) (*appsv1.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(statefulSetsResource, c.ClusterPath, "status", c.Namespace, statefulSet), &appsv1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.StatefulSet), err
-}
-
-func (c *statefulSetsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(statefulSetsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1.StatefulSet{})
-	return err
-}
-
-func (c *statefulSetsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(statefulSetsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1.StatefulSetList{})
-	return err
-}
-
-func (c *statefulSetsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(statefulSetsResource, c.ClusterPath, c.Namespace, name), &appsv1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.StatefulSet), err
-}
-
-// List takes label and field selectors, and returns the list of StatefulSets that match those selectors.
-func (c *statefulSetsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1.StatefulSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(statefulSetsResource, statefulSetsKind, c.ClusterPath, c.Namespace, opts), &appsv1.StatefulSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1.StatefulSetList{ListMeta: obj.(*appsv1.StatefulSetList).ListMeta}
-	for _, item := range obj.(*appsv1.StatefulSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *statefulSetsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(statefulSetsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *statefulSetsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(statefulSetsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.StatefulSet), err
-}
-
-func (c *statefulSetsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1.StatefulSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1.StatefulSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(statefulSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.StatefulSet), err
-}
-
-func (c *statefulSetsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1.StatefulSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1.StatefulSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(statefulSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1.StatefulSet), err
 }
 
-func (c *statefulSetsClient) GetScale(ctx context.Context, statefulSetName string, options metav1.GetOptions) (*autoscalingv1.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(statefulSetsResource, c.ClusterPath, "scale", c.Namespace, statefulSetName), &autoscalingv1.Scale{})
+func newFakeStatefulSetClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1.StatefulSetInterface {
+	return &statefulSetScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1.StatefulSet, *appsv1.StatefulSetList, *v1.StatefulSetApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1.SchemeGroupVersion.WithResource("statefulsets"),
+			appsv1.SchemeGroupVersion.WithKind("StatefulSet"),
+			func() *appsv1.StatefulSet { return &appsv1.StatefulSet{} },
+			func() *appsv1.StatefulSetList { return &appsv1.StatefulSetList{} },
+			func(dst, src *appsv1.StatefulSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1.StatefulSetList) []*appsv1.StatefulSet { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *appsv1.StatefulSetList, items []*appsv1.StatefulSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
+
+// GetScale takes name of the statefulSet, and returns the corresponding scale object, and an error if there is any.
+func (c *statefulSetScopedClient) GetScale(ctx context.Context, statefulSetName string, _ metav1.GetOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), "scale", statefulSetName), emptyResult)
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*autoscalingv1.Scale), err
 }
 
-func (c *statefulSetsClient) UpdateScale(ctx context.Context, statefulSetName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (*autoscalingv1.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(statefulSetsResource, c.ClusterPath, "scale", c.Namespace, scale), &autoscalingv1.Scale{})
+// UpdateScale takes the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *statefulSetScopedClient) UpdateScale(ctx context.Context, statefulSetName string, scale *autoscalingv1.Scale, _ metav1.UpdateOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(c.Resource(), c.ClusterPath, "scale", c.Namespace(), scale), &autoscalingv1.Scale{})
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*autoscalingv1.Scale), err
 }
 
-func (c *statefulSetsClient) ApplyScale(ctx context.Context, statefulSetName string, applyConfiguration *applyconfigurationsautoscalingv1.ScaleApplyConfiguration, opts metav1.ApplyOptions) (*autoscalingv1.Scale, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
+// ApplyScale takes top resource name and the apply declarative configuration for scale,
+// applies it and returns the applied scale, and an error, if there is any.
+func (c *statefulSetScopedClient) ApplyScale(ctx context.Context, statefulSetName string, scale *applyconfigurationsautoscalingv1.ScaleApplyConfiguration, _ metav1.ApplyOptions) (result *autoscalingv1.Scale, err error) {
+	if scale == nil {
+		return nil, fmt.Errorf("scale provided to ApplyScale must not be nil")
 	}
-	data, err := json.Marshal(applyConfiguration)
+	data, err := json.Marshal(scale)
 	if err != nil {
 		return nil, err
 	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(statefulSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &autoscalingv1.Scale{})
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), statefulSetName, types.ApplyPatchType, data, "scale"), emptyResult)
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*autoscalingv1.Scale), err
 }
diff --git a/kubernetes/typed/apps/v1/generated_expansion.go b/kubernetes/typed/apps/v1/generated_expansion.go
new file mode 100644
index 000000000..69ab8c915
--- /dev/null
+++ b/kubernetes/typed/apps/v1/generated_expansion.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type ControllerRevisionClusterExpansion interface{}
+
+type DaemonSetClusterExpansion interface{}
+
+type DeploymentClusterExpansion interface{}
+
+type ReplicaSetClusterExpansion interface{}
+
+type StatefulSetClusterExpansion interface{}
diff --git a/kubernetes/typed/apps/v1/replicaset.go b/kubernetes/typed/apps/v1/replicaset.go
index ee94a8e75..c5d7399f9 100644
--- a/kubernetes/typed/apps/v1/replicaset.go
+++ b/kubernetes/typed/apps/v1/replicaset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	appsv1 "k8s.io/api/apps/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1client "k8s.io/client-go/kubernetes/typed/apps/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ReplicaSetsClusterGetter has a method to return a ReplicaSetClusterInterface.
@@ -45,10 +42,11 @@ type ReplicaSetClusterInterface interface {
 	Cluster(logicalcluster.Path) ReplicaSetsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*appsv1.ReplicaSetList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ReplicaSetClusterExpansion
 }
 
 type replicaSetsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1client.AppsV1Client]
+	clientCache kcpclient.Cache[*typedappsv1.AppsV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *replicaSetsClusterInterface) Watch(ctx context.Context, opts metav1.Lis
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ReplicaSets(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ReplicaSetsNamespacer can scope to objects within a namespace, returning a appsv1client.ReplicaSetInterface.
+// ReplicaSetsNamespacer can scope to objects within a namespace, returning a typedappsv1.ReplicaSetInterface.
 type ReplicaSetsNamespacer interface {
-	Namespace(string) appsv1client.ReplicaSetInterface
+	Namespace(string) typedappsv1.ReplicaSetInterface
 }
 
 type replicaSetsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1client.AppsV1Client]
+	clientCache kcpclient.Cache[*typedappsv1.AppsV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *replicaSetsNamespacer) Namespace(namespace string) appsv1client.ReplicaSetInterface {
+func (n *replicaSetsNamespacer) Namespace(namespace string) typedappsv1.ReplicaSetInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).ReplicaSets(namespace)
 }
diff --git a/kubernetes/typed/apps/v1/statefulset.go b/kubernetes/typed/apps/v1/statefulset.go
index d6c2d6c61..d1dece850 100644
--- a/kubernetes/typed/apps/v1/statefulset.go
+++ b/kubernetes/typed/apps/v1/statefulset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	appsv1 "k8s.io/api/apps/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1client "k8s.io/client-go/kubernetes/typed/apps/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1 "k8s.io/client-go/kubernetes/typed/apps/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // StatefulSetsClusterGetter has a method to return a StatefulSetClusterInterface.
@@ -45,10 +42,11 @@ type StatefulSetClusterInterface interface {
 	Cluster(logicalcluster.Path) StatefulSetsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*appsv1.StatefulSetList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	StatefulSetClusterExpansion
 }
 
 type statefulSetsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1client.AppsV1Client]
+	clientCache kcpclient.Cache[*typedappsv1.AppsV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *statefulSetsClusterInterface) Watch(ctx context.Context, opts metav1.Li
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StatefulSets(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// StatefulSetsNamespacer can scope to objects within a namespace, returning a appsv1client.StatefulSetInterface.
+// StatefulSetsNamespacer can scope to objects within a namespace, returning a typedappsv1.StatefulSetInterface.
 type StatefulSetsNamespacer interface {
-	Namespace(string) appsv1client.StatefulSetInterface
+	Namespace(string) typedappsv1.StatefulSetInterface
 }
 
 type statefulSetsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1client.AppsV1Client]
+	clientCache kcpclient.Cache[*typedappsv1.AppsV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *statefulSetsNamespacer) Namespace(namespace string) appsv1client.StatefulSetInterface {
+func (n *statefulSetsNamespacer) Namespace(namespace string) typedappsv1.StatefulSetInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).StatefulSets(namespace)
 }
diff --git a/kubernetes/typed/apps/v1beta1/apps_client.go b/kubernetes/typed/apps/v1beta1/apps_client.go
index 27defa592..fe9385916 100644
--- a/kubernetes/typed/apps/v1beta1/apps_client.go
+++ b/kubernetes/typed/apps/v1beta1/apps_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,31 +14,34 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiappsv1beta1 "k8s.io/api/apps/v1beta1"
+	appsv1beta1 "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta1 "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type AppsV1beta1ClusterInterface interface {
 	AppsV1beta1ClusterScoper
-	StatefulSetsClusterGetter
-	DeploymentsClusterGetter
 	ControllerRevisionsClusterGetter
+	DeploymentsClusterGetter
+	StatefulSetsClusterGetter
 }
 
 type AppsV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) appsv1beta1.AppsV1beta1Interface
 }
 
+// AppsV1beta1ClusterClient is used to interact with features provided by the apps group.
 type AppsV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*appsv1beta1.AppsV1beta1Client]
 }
@@ -53,27 +53,29 @@ func (c *AppsV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) apps
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *AppsV1beta1ClusterClient) StatefulSets() StatefulSetClusterInterface {
-	return &statefulSetsClusterInterface{clientCache: c.clientCache}
+func (c *AppsV1beta1ClusterClient) ControllerRevisions() ControllerRevisionClusterInterface {
+	return &controllerRevisionsClusterInterface{clientCache: c.clientCache}
 }
 
 func (c *AppsV1beta1ClusterClient) Deployments() DeploymentClusterInterface {
 	return &deploymentsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *AppsV1beta1ClusterClient) ControllerRevisions() ControllerRevisionClusterInterface {
-	return &controllerRevisionsClusterInterface{clientCache: c.clientCache}
+func (c *AppsV1beta1ClusterClient) StatefulSets() StatefulSetClusterInterface {
+	return &statefulSetsClusterInterface{clientCache: c.clientCache}
 }
 
 // NewForConfig creates a new AppsV1beta1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AppsV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AppsV1beta1ClusterClient for the given config and http client.
@@ -85,6 +87,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AppsV1beta1ClusterC
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AppsV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -97,3 +100,14 @@ func NewForConfigOrDie(c *rest.Config) *AppsV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiappsv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/apps/v1beta1/controllerrevision.go b/kubernetes/typed/apps/v1beta1/controllerrevision.go
index 44700ca17..f38b95923 100644
--- a/kubernetes/typed/apps/v1beta1/controllerrevision.go
+++ b/kubernetes/typed/apps/v1beta1/controllerrevision.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	appsv1beta1 "k8s.io/api/apps/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1beta1 "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1beta1client "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
 )
 
 // ControllerRevisionsClusterGetter has a method to return a ControllerRevisionClusterInterface.
@@ -43,12 +40,13 @@ type ControllerRevisionsClusterGetter interface {
 // or scope down to one cluster and return a ControllerRevisionsNamespacer.
 type ControllerRevisionClusterInterface interface {
 	Cluster(logicalcluster.Path) ControllerRevisionsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta1.ControllerRevisionList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*appsv1beta1.ControllerRevisionList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ControllerRevisionClusterExpansion
 }
 
 type controllerRevisionsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1beta1client.AppsV1beta1Client]
+	clientCache kcpclient.Cache[*typedappsv1beta1.AppsV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *controllerRevisionsClusterInterface) Cluster(clusterPath logicalcluster
 }
 
 // List returns the entire collection of all ControllerRevisions across all clusters.
-func (c *controllerRevisionsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta1.ControllerRevisionList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ControllerRevisions(metav1.NamespaceAll).List(ctx, opts)
+func (c *controllerRevisionsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*appsv1beta1.ControllerRevisionList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ControllerRevisions(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all ControllerRevisions across all clusters.
-func (c *controllerRevisionsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ControllerRevisions(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *controllerRevisionsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ControllerRevisions(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ControllerRevisionsNamespacer can scope to objects within a namespace, returning a appsv1beta1client.ControllerRevisionInterface.
+// ControllerRevisionsNamespacer can scope to objects within a namespace, returning a typedappsv1beta1.ControllerRevisionInterface.
 type ControllerRevisionsNamespacer interface {
-	Namespace(string) appsv1beta1client.ControllerRevisionInterface
+	Namespace(string) typedappsv1beta1.ControllerRevisionInterface
 }
 
 type controllerRevisionsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1beta1client.AppsV1beta1Client]
+	clientCache kcpclient.Cache[*typedappsv1beta1.AppsV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *controllerRevisionsNamespacer) Namespace(namespace string) appsv1beta1client.ControllerRevisionInterface {
+func (n *controllerRevisionsNamespacer) Namespace(namespace string) typedappsv1beta1.ControllerRevisionInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).ControllerRevisions(namespace)
 }
diff --git a/kubernetes/typed/apps/v1beta1/deployment.go b/kubernetes/typed/apps/v1beta1/deployment.go
index eb1680408..9f9db6004 100644
--- a/kubernetes/typed/apps/v1beta1/deployment.go
+++ b/kubernetes/typed/apps/v1beta1/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	appsv1beta1 "k8s.io/api/apps/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1beta1 "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1beta1client "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
 )
 
 // DeploymentsClusterGetter has a method to return a DeploymentClusterInterface.
@@ -43,12 +40,13 @@ type DeploymentsClusterGetter interface {
 // or scope down to one cluster and return a DeploymentsNamespacer.
 type DeploymentClusterInterface interface {
 	Cluster(logicalcluster.Path) DeploymentsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta1.DeploymentList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*appsv1beta1.DeploymentList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	DeploymentClusterExpansion
 }
 
 type deploymentsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1beta1client.AppsV1beta1Client]
+	clientCache kcpclient.Cache[*typedappsv1beta1.AppsV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *deploymentsClusterInterface) Cluster(clusterPath logicalcluster.Path) D
 }
 
 // List returns the entire collection of all Deployments across all clusters.
-func (c *deploymentsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta1.DeploymentList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(metav1.NamespaceAll).List(ctx, opts)
+func (c *deploymentsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*appsv1beta1.DeploymentList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all Deployments across all clusters.
-func (c *deploymentsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *deploymentsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// DeploymentsNamespacer can scope to objects within a namespace, returning a appsv1beta1client.DeploymentInterface.
+// DeploymentsNamespacer can scope to objects within a namespace, returning a typedappsv1beta1.DeploymentInterface.
 type DeploymentsNamespacer interface {
-	Namespace(string) appsv1beta1client.DeploymentInterface
+	Namespace(string) typedappsv1beta1.DeploymentInterface
 }
 
 type deploymentsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1beta1client.AppsV1beta1Client]
+	clientCache kcpclient.Cache[*typedappsv1beta1.AppsV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *deploymentsNamespacer) Namespace(namespace string) appsv1beta1client.DeploymentInterface {
+func (n *deploymentsNamespacer) Namespace(namespace string) typedappsv1beta1.DeploymentInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Deployments(namespace)
 }
diff --git a/kubernetes/typed/apps/v1beta1/doc.go b/kubernetes/typed/apps/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/apps/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/apps/v1beta1/fake/apps_client.go b/kubernetes/typed/apps/v1beta1/fake/apps_client.go
index 3d4cf0ffe..0fd315f4c 100644
--- a/kubernetes/typed/apps/v1beta1/fake/apps_client.go
+++ b/kubernetes/typed/apps/v1beta1/fake/apps_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta1 "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpappsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpappsv1beta1.AppsV1beta1ClusterInterface = (*AppsV1beta1ClusterClient)(nil)
@@ -44,38 +40,38 @@ func (c *AppsV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) apps
 	return &AppsV1beta1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *AppsV1beta1ClusterClient) StatefulSets() kcpappsv1beta1.StatefulSetClusterInterface {
-	return &statefulSetsClusterClient{Fake: c.Fake}
+func (c *AppsV1beta1ClusterClient) ControllerRevisions() kcpappsv1beta1.ControllerRevisionClusterInterface {
+	return newFakeControllerRevisionClusterClient(c)
 }
 
 func (c *AppsV1beta1ClusterClient) Deployments() kcpappsv1beta1.DeploymentClusterInterface {
-	return &deploymentsClusterClient{Fake: c.Fake}
+	return newFakeDeploymentClusterClient(c)
 }
 
-func (c *AppsV1beta1ClusterClient) ControllerRevisions() kcpappsv1beta1.ControllerRevisionClusterInterface {
-	return &controllerRevisionsClusterClient{Fake: c.Fake}
+func (c *AppsV1beta1ClusterClient) StatefulSets() kcpappsv1beta1.StatefulSetClusterInterface {
+	return newFakeStatefulSetClusterClient(c)
 }
 
-var _ appsv1beta1.AppsV1beta1Interface = (*AppsV1beta1Client)(nil)
-
 type AppsV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *AppsV1beta1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *AppsV1beta1Client) ControllerRevisions(namespace string) appsv1beta1.ControllerRevisionInterface {
+	return newFakeControllerRevisionClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AppsV1beta1Client) StatefulSets(namespace string) appsv1beta1.StatefulSetInterface {
-	return &statefulSetsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *AppsV1beta1Client) Deployments(namespace string) appsv1beta1.DeploymentInterface {
+	return newFakeDeploymentClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AppsV1beta1Client) Deployments(namespace string) appsv1beta1.DeploymentInterface {
-	return &deploymentsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *AppsV1beta1Client) StatefulSets(namespace string) appsv1beta1.StatefulSetInterface {
+	return newFakeStatefulSetClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AppsV1beta1Client) ControllerRevisions(namespace string) appsv1beta1.ControllerRevisionInterface {
-	return &controllerRevisionsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AppsV1beta1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/apps/v1beta1/fake/controllerrevision.go b/kubernetes/typed/apps/v1beta1/fake/controllerrevision.go
index 8958880f7..35f6b62f7 100644
--- a/kubernetes/typed/apps/v1beta1/fake/controllerrevision.go
+++ b/kubernetes/typed/apps/v1beta1/fake/controllerrevision.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1beta1 "k8s.io/client-go/applyconfigurations/apps/v1beta1"
-	appsv1beta1client "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/apps/v1beta1"
+	typedappsv1beta1 "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
 
-	kcpappsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta1"
+	typedkcpappsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var controllerRevisionsResource = schema.GroupVersionResource{Group: "apps", Version: "v1beta1", Resource: "controllerrevisions"}
-var controllerRevisionsKind = schema.GroupVersionKind{Group: "apps", Version: "v1beta1", Kind: "ControllerRevision"}
-
-type controllerRevisionsClusterClient struct {
-	*kcptesting.Fake
+// controllerRevisionClusterClient implements ControllerRevisionClusterInterface
+type controllerRevisionClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1beta1.ControllerRevision, *appsv1beta1.ControllerRevisionList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *controllerRevisionsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1beta1.ControllerRevisionsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &controllerRevisionsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ControllerRevisions that match those selectors across all clusters.
-func (c *controllerRevisionsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta1.ControllerRevisionList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(controllerRevisionsResource, controllerRevisionsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1beta1.ControllerRevisionList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeControllerRevisionClusterClient(fake *AppsV1beta1ClusterClient) typedkcpappsv1beta1.ControllerRevisionClusterInterface {
+	return &controllerRevisionClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1beta1.ControllerRevision, *appsv1beta1.ControllerRevisionList](
+			fake.Fake,
+			appsv1beta1.SchemeGroupVersion.WithResource("controllerrevisions"),
+			appsv1beta1.SchemeGroupVersion.WithKind("ControllerRevision"),
+			func() *appsv1beta1.ControllerRevision { return &appsv1beta1.ControllerRevision{} },
+			func() *appsv1beta1.ControllerRevisionList { return &appsv1beta1.ControllerRevisionList{} },
+			func(dst, src *appsv1beta1.ControllerRevisionList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta1.ControllerRevisionList) []*appsv1beta1.ControllerRevision {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta1.ControllerRevisionList, items []*appsv1beta1.ControllerRevision) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &appsv1beta1.ControllerRevisionList{ListMeta: obj.(*appsv1beta1.ControllerRevisionList).ListMeta}
-	for _, item := range obj.(*appsv1beta1.ControllerRevisionList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ControllerRevisions across all clusters.
-func (c *controllerRevisionsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(controllerRevisionsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *controllerRevisionClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1beta1.ControllerRevisionsNamespacer {
+	return &controllerRevisionNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type controllerRevisionsNamespacer struct {
+type controllerRevisionNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *controllerRevisionsNamespacer) Namespace(namespace string) appsv1beta1client.ControllerRevisionInterface {
-	return &controllerRevisionsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *controllerRevisionNamespacer) Namespace(namespace string) typedappsv1beta1.ControllerRevisionInterface {
+	return newFakeControllerRevisionClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type controllerRevisionsClient struct {
-	*kcptesting.Fake
+// controllerRevisionScopedClient implements ControllerRevisionInterface
+type controllerRevisionScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1beta1.ControllerRevision, *appsv1beta1.ControllerRevisionList, *v1beta1.ControllerRevisionApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *controllerRevisionsClient) Create(ctx context.Context, controllerRevision *appsv1beta1.ControllerRevision, opts metav1.CreateOptions) (*appsv1beta1.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, controllerRevision), &appsv1beta1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) Update(ctx context.Context, controllerRevision *appsv1beta1.ControllerRevision, opts metav1.UpdateOptions) (*appsv1beta1.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, controllerRevision), &appsv1beta1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) UpdateStatus(ctx context.Context, controllerRevision *appsv1beta1.ControllerRevision, opts metav1.UpdateOptions) (*appsv1beta1.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(controllerRevisionsResource, c.ClusterPath, "status", c.Namespace, controllerRevision), &appsv1beta1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(controllerRevisionsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1beta1.ControllerRevision{})
-	return err
 }
 
-func (c *controllerRevisionsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1beta1.ControllerRevisionList{})
-	return err
-}
-
-func (c *controllerRevisionsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1beta1.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, name), &appsv1beta1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.ControllerRevision), err
-}
-
-// List takes label and field selectors, and returns the list of ControllerRevisions that match those selectors.
-func (c *controllerRevisionsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta1.ControllerRevisionList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(controllerRevisionsResource, controllerRevisionsKind, c.ClusterPath, c.Namespace, opts), &appsv1beta1.ControllerRevisionList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1beta1.ControllerRevisionList{ListMeta: obj.(*appsv1beta1.ControllerRevisionList).ListMeta}
-	for _, item := range obj.(*appsv1beta1.ControllerRevisionList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *controllerRevisionsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *controllerRevisionsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1beta1.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1beta1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta1.ControllerRevisionApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta1.ControllerRevision, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1beta1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta1.ControllerRevisionApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta1.ControllerRevision, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1beta1.ControllerRevision{})
-	if obj == nil {
-		return nil, err
+func newFakeControllerRevisionClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1beta1.ControllerRevisionInterface {
+	return &controllerRevisionScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1beta1.ControllerRevision, *appsv1beta1.ControllerRevisionList, *v1beta1.ControllerRevisionApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1beta1.SchemeGroupVersion.WithResource("controllerrevisions"),
+			appsv1beta1.SchemeGroupVersion.WithKind("ControllerRevision"),
+			func() *appsv1beta1.ControllerRevision { return &appsv1beta1.ControllerRevision{} },
+			func() *appsv1beta1.ControllerRevisionList { return &appsv1beta1.ControllerRevisionList{} },
+			func(dst, src *appsv1beta1.ControllerRevisionList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta1.ControllerRevisionList) []*appsv1beta1.ControllerRevision {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta1.ControllerRevisionList, items []*appsv1beta1.ControllerRevision) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*appsv1beta1.ControllerRevision), err
 }
diff --git a/kubernetes/typed/apps/v1beta1/fake/deployment.go b/kubernetes/typed/apps/v1beta1/fake/deployment.go
index 9f75137a1..499a20697 100644
--- a/kubernetes/typed/apps/v1beta1/fake/deployment.go
+++ b/kubernetes/typed/apps/v1beta1/fake/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1beta1 "k8s.io/client-go/applyconfigurations/apps/v1beta1"
-	appsv1beta1client "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/apps/v1beta1"
+	typedappsv1beta1 "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
 
-	kcpappsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta1"
+	typedkcpappsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var deploymentsResource = schema.GroupVersionResource{Group: "apps", Version: "v1beta1", Resource: "deployments"}
-var deploymentsKind = schema.GroupVersionKind{Group: "apps", Version: "v1beta1", Kind: "Deployment"}
-
-type deploymentsClusterClient struct {
-	*kcptesting.Fake
+// deploymentClusterClient implements DeploymentClusterInterface
+type deploymentClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1beta1.Deployment, *appsv1beta1.DeploymentList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *deploymentsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1beta1.DeploymentsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &deploymentsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Deployments that match those selectors across all clusters.
-func (c *deploymentsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta1.DeploymentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(deploymentsResource, deploymentsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1beta1.DeploymentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeDeploymentClusterClient(fake *AppsV1beta1ClusterClient) typedkcpappsv1beta1.DeploymentClusterInterface {
+	return &deploymentClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1beta1.Deployment, *appsv1beta1.DeploymentList](
+			fake.Fake,
+			appsv1beta1.SchemeGroupVersion.WithResource("deployments"),
+			appsv1beta1.SchemeGroupVersion.WithKind("Deployment"),
+			func() *appsv1beta1.Deployment { return &appsv1beta1.Deployment{} },
+			func() *appsv1beta1.DeploymentList { return &appsv1beta1.DeploymentList{} },
+			func(dst, src *appsv1beta1.DeploymentList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta1.DeploymentList) []*appsv1beta1.Deployment {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta1.DeploymentList, items []*appsv1beta1.Deployment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &appsv1beta1.DeploymentList{ListMeta: obj.(*appsv1beta1.DeploymentList).ListMeta}
-	for _, item := range obj.(*appsv1beta1.DeploymentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Deployments across all clusters.
-func (c *deploymentsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(deploymentsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *deploymentClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1beta1.DeploymentsNamespacer {
+	return &deploymentNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type deploymentsNamespacer struct {
+type deploymentNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *deploymentsNamespacer) Namespace(namespace string) appsv1beta1client.DeploymentInterface {
-	return &deploymentsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *deploymentNamespacer) Namespace(namespace string) typedappsv1beta1.DeploymentInterface {
+	return newFakeDeploymentClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type deploymentsClient struct {
-	*kcptesting.Fake
+// deploymentScopedClient implements DeploymentInterface
+type deploymentScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1beta1.Deployment, *appsv1beta1.DeploymentList, *v1beta1.DeploymentApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *deploymentsClient) Create(ctx context.Context, deployment *appsv1beta1.Deployment, opts metav1.CreateOptions) (*appsv1beta1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(deploymentsResource, c.ClusterPath, c.Namespace, deployment), &appsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.Deployment), err
-}
-
-func (c *deploymentsClient) Update(ctx context.Context, deployment *appsv1beta1.Deployment, opts metav1.UpdateOptions) (*appsv1beta1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(deploymentsResource, c.ClusterPath, c.Namespace, deployment), &appsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.Deployment), err
-}
-
-func (c *deploymentsClient) UpdateStatus(ctx context.Context, deployment *appsv1beta1.Deployment, opts metav1.UpdateOptions) (*appsv1beta1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(deploymentsResource, c.ClusterPath, "status", c.Namespace, deployment), &appsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.Deployment), err
-}
-
-func (c *deploymentsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(deploymentsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1beta1.Deployment{})
-	return err
 }
 
-func (c *deploymentsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(deploymentsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1beta1.DeploymentList{})
-	return err
-}
-
-func (c *deploymentsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1beta1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(deploymentsResource, c.ClusterPath, c.Namespace, name), &appsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.Deployment), err
-}
-
-// List takes label and field selectors, and returns the list of Deployments that match those selectors.
-func (c *deploymentsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta1.DeploymentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(deploymentsResource, deploymentsKind, c.ClusterPath, c.Namespace, opts), &appsv1beta1.DeploymentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1beta1.DeploymentList{ListMeta: obj.(*appsv1beta1.DeploymentList).ListMeta}
-	for _, item := range obj.(*appsv1beta1.DeploymentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *deploymentsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(deploymentsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *deploymentsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1beta1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.Deployment), err
-}
-
-func (c *deploymentsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta1.DeploymentApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta1.Deployment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.Deployment), err
-}
-
-func (c *deploymentsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta1.DeploymentApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta1.Deployment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
+func newFakeDeploymentClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1beta1.DeploymentInterface {
+	return &deploymentScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1beta1.Deployment, *appsv1beta1.DeploymentList, *v1beta1.DeploymentApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1beta1.SchemeGroupVersion.WithResource("deployments"),
+			appsv1beta1.SchemeGroupVersion.WithKind("Deployment"),
+			func() *appsv1beta1.Deployment { return &appsv1beta1.Deployment{} },
+			func() *appsv1beta1.DeploymentList { return &appsv1beta1.DeploymentList{} },
+			func(dst, src *appsv1beta1.DeploymentList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta1.DeploymentList) []*appsv1beta1.Deployment {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta1.DeploymentList, items []*appsv1beta1.Deployment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*appsv1beta1.Deployment), err
 }
diff --git a/kubernetes/typed/apps/v1beta1/fake/doc.go b/kubernetes/typed/apps/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/apps/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/apps/v1beta1/fake/statefulset.go b/kubernetes/typed/apps/v1beta1/fake/statefulset.go
index a6fc1ee6f..15a995e3b 100644
--- a/kubernetes/typed/apps/v1beta1/fake/statefulset.go
+++ b/kubernetes/typed/apps/v1beta1/fake/statefulset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1beta1 "k8s.io/client-go/applyconfigurations/apps/v1beta1"
-	appsv1beta1client "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/apps/v1beta1"
+	typedappsv1beta1 "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
 
-	kcpappsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta1"
+	typedkcpappsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var statefulSetsResource = schema.GroupVersionResource{Group: "apps", Version: "v1beta1", Resource: "statefulsets"}
-var statefulSetsKind = schema.GroupVersionKind{Group: "apps", Version: "v1beta1", Kind: "StatefulSet"}
-
-type statefulSetsClusterClient struct {
-	*kcptesting.Fake
+// statefulSetClusterClient implements StatefulSetClusterInterface
+type statefulSetClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1beta1.StatefulSet, *appsv1beta1.StatefulSetList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *statefulSetsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1beta1.StatefulSetsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &statefulSetsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of StatefulSets that match those selectors across all clusters.
-func (c *statefulSetsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta1.StatefulSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(statefulSetsResource, statefulSetsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1beta1.StatefulSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeStatefulSetClusterClient(fake *AppsV1beta1ClusterClient) typedkcpappsv1beta1.StatefulSetClusterInterface {
+	return &statefulSetClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1beta1.StatefulSet, *appsv1beta1.StatefulSetList](
+			fake.Fake,
+			appsv1beta1.SchemeGroupVersion.WithResource("statefulsets"),
+			appsv1beta1.SchemeGroupVersion.WithKind("StatefulSet"),
+			func() *appsv1beta1.StatefulSet { return &appsv1beta1.StatefulSet{} },
+			func() *appsv1beta1.StatefulSetList { return &appsv1beta1.StatefulSetList{} },
+			func(dst, src *appsv1beta1.StatefulSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta1.StatefulSetList) []*appsv1beta1.StatefulSet {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta1.StatefulSetList, items []*appsv1beta1.StatefulSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &appsv1beta1.StatefulSetList{ListMeta: obj.(*appsv1beta1.StatefulSetList).ListMeta}
-	for _, item := range obj.(*appsv1beta1.StatefulSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested StatefulSets across all clusters.
-func (c *statefulSetsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(statefulSetsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *statefulSetClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1beta1.StatefulSetsNamespacer {
+	return &statefulSetNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type statefulSetsNamespacer struct {
+type statefulSetNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *statefulSetsNamespacer) Namespace(namespace string) appsv1beta1client.StatefulSetInterface {
-	return &statefulSetsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *statefulSetNamespacer) Namespace(namespace string) typedappsv1beta1.StatefulSetInterface {
+	return newFakeStatefulSetClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type statefulSetsClient struct {
-	*kcptesting.Fake
+// statefulSetScopedClient implements StatefulSetInterface
+type statefulSetScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1beta1.StatefulSet, *appsv1beta1.StatefulSetList, *v1beta1.StatefulSetApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *statefulSetsClient) Create(ctx context.Context, statefulSet *appsv1beta1.StatefulSet, opts metav1.CreateOptions) (*appsv1beta1.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(statefulSetsResource, c.ClusterPath, c.Namespace, statefulSet), &appsv1beta1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.StatefulSet), err
-}
-
-func (c *statefulSetsClient) Update(ctx context.Context, statefulSet *appsv1beta1.StatefulSet, opts metav1.UpdateOptions) (*appsv1beta1.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(statefulSetsResource, c.ClusterPath, c.Namespace, statefulSet), &appsv1beta1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.StatefulSet), err
-}
-
-func (c *statefulSetsClient) UpdateStatus(ctx context.Context, statefulSet *appsv1beta1.StatefulSet, opts metav1.UpdateOptions) (*appsv1beta1.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(statefulSetsResource, c.ClusterPath, "status", c.Namespace, statefulSet), &appsv1beta1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.StatefulSet), err
-}
-
-func (c *statefulSetsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(statefulSetsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1beta1.StatefulSet{})
-	return err
 }
 
-func (c *statefulSetsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(statefulSetsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1beta1.StatefulSetList{})
-	return err
-}
-
-func (c *statefulSetsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1beta1.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(statefulSetsResource, c.ClusterPath, c.Namespace, name), &appsv1beta1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.StatefulSet), err
-}
-
-// List takes label and field selectors, and returns the list of StatefulSets that match those selectors.
-func (c *statefulSetsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta1.StatefulSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(statefulSetsResource, statefulSetsKind, c.ClusterPath, c.Namespace, opts), &appsv1beta1.StatefulSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1beta1.StatefulSetList{ListMeta: obj.(*appsv1beta1.StatefulSetList).ListMeta}
-	for _, item := range obj.(*appsv1beta1.StatefulSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *statefulSetsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(statefulSetsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *statefulSetsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1beta1.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(statefulSetsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1beta1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.StatefulSet), err
-}
-
-func (c *statefulSetsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta1.StatefulSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta1.StatefulSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(statefulSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1beta1.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta1.StatefulSet), err
-}
-
-func (c *statefulSetsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta1.StatefulSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta1.StatefulSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(statefulSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1beta1.StatefulSet{})
-	if obj == nil {
-		return nil, err
+func newFakeStatefulSetClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1beta1.StatefulSetInterface {
+	return &statefulSetScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1beta1.StatefulSet, *appsv1beta1.StatefulSetList, *v1beta1.StatefulSetApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1beta1.SchemeGroupVersion.WithResource("statefulsets"),
+			appsv1beta1.SchemeGroupVersion.WithKind("StatefulSet"),
+			func() *appsv1beta1.StatefulSet { return &appsv1beta1.StatefulSet{} },
+			func() *appsv1beta1.StatefulSetList { return &appsv1beta1.StatefulSetList{} },
+			func(dst, src *appsv1beta1.StatefulSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta1.StatefulSetList) []*appsv1beta1.StatefulSet {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta1.StatefulSetList, items []*appsv1beta1.StatefulSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*appsv1beta1.StatefulSet), err
 }
diff --git a/kubernetes/typed/apps/v1beta1/generated_expansion.go b/kubernetes/typed/apps/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..c43b985f7
--- /dev/null
+++ b/kubernetes/typed/apps/v1beta1/generated_expansion.go
@@ -0,0 +1,25 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type ControllerRevisionClusterExpansion interface{}
+
+type DeploymentClusterExpansion interface{}
+
+type StatefulSetClusterExpansion interface{}
diff --git a/kubernetes/typed/apps/v1beta1/statefulset.go b/kubernetes/typed/apps/v1beta1/statefulset.go
index 210d1ec47..55cd4915a 100644
--- a/kubernetes/typed/apps/v1beta1/statefulset.go
+++ b/kubernetes/typed/apps/v1beta1/statefulset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	appsv1beta1 "k8s.io/api/apps/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1beta1 "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1beta1client "k8s.io/client-go/kubernetes/typed/apps/v1beta1"
 )
 
 // StatefulSetsClusterGetter has a method to return a StatefulSetClusterInterface.
@@ -43,12 +40,13 @@ type StatefulSetsClusterGetter interface {
 // or scope down to one cluster and return a StatefulSetsNamespacer.
 type StatefulSetClusterInterface interface {
 	Cluster(logicalcluster.Path) StatefulSetsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta1.StatefulSetList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*appsv1beta1.StatefulSetList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	StatefulSetClusterExpansion
 }
 
 type statefulSetsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1beta1client.AppsV1beta1Client]
+	clientCache kcpclient.Cache[*typedappsv1beta1.AppsV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *statefulSetsClusterInterface) Cluster(clusterPath logicalcluster.Path)
 }
 
 // List returns the entire collection of all StatefulSets across all clusters.
-func (c *statefulSetsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta1.StatefulSetList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StatefulSets(metav1.NamespaceAll).List(ctx, opts)
+func (c *statefulSetsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*appsv1beta1.StatefulSetList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StatefulSets(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all StatefulSets across all clusters.
-func (c *statefulSetsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StatefulSets(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *statefulSetsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StatefulSets(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// StatefulSetsNamespacer can scope to objects within a namespace, returning a appsv1beta1client.StatefulSetInterface.
+// StatefulSetsNamespacer can scope to objects within a namespace, returning a typedappsv1beta1.StatefulSetInterface.
 type StatefulSetsNamespacer interface {
-	Namespace(string) appsv1beta1client.StatefulSetInterface
+	Namespace(string) typedappsv1beta1.StatefulSetInterface
 }
 
 type statefulSetsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1beta1client.AppsV1beta1Client]
+	clientCache kcpclient.Cache[*typedappsv1beta1.AppsV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *statefulSetsNamespacer) Namespace(namespace string) appsv1beta1client.StatefulSetInterface {
+func (n *statefulSetsNamespacer) Namespace(namespace string) typedappsv1beta1.StatefulSetInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).StatefulSets(namespace)
 }
diff --git a/kubernetes/typed/apps/v1beta2/apps_client.go b/kubernetes/typed/apps/v1beta2/apps_client.go
index a07f25278..fd1b3fb89 100644
--- a/kubernetes/typed/apps/v1beta2/apps_client.go
+++ b/kubernetes/typed/apps/v1beta2/apps_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,33 +14,36 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiappsv1beta2 "k8s.io/api/apps/v1beta2"
+	appsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
-	"k8s.io/client-go/rest"
 )
 
 type AppsV1beta2ClusterInterface interface {
 	AppsV1beta2ClusterScoper
-	StatefulSetsClusterGetter
-	DeploymentsClusterGetter
+	ControllerRevisionsClusterGetter
 	DaemonSetsClusterGetter
+	DeploymentsClusterGetter
 	ReplicaSetsClusterGetter
-	ControllerRevisionsClusterGetter
+	StatefulSetsClusterGetter
 }
 
 type AppsV1beta2ClusterScoper interface {
 	Cluster(logicalcluster.Path) appsv1beta2.AppsV1beta2Interface
 }
 
+// AppsV1beta2ClusterClient is used to interact with features provided by the apps group.
 type AppsV1beta2ClusterClient struct {
 	clientCache kcpclient.Cache[*appsv1beta2.AppsV1beta2Client]
 }
@@ -55,35 +55,37 @@ func (c *AppsV1beta2ClusterClient) Cluster(clusterPath logicalcluster.Path) apps
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *AppsV1beta2ClusterClient) StatefulSets() StatefulSetClusterInterface {
-	return &statefulSetsClusterInterface{clientCache: c.clientCache}
-}
-
-func (c *AppsV1beta2ClusterClient) Deployments() DeploymentClusterInterface {
-	return &deploymentsClusterInterface{clientCache: c.clientCache}
+func (c *AppsV1beta2ClusterClient) ControllerRevisions() ControllerRevisionClusterInterface {
+	return &controllerRevisionsClusterInterface{clientCache: c.clientCache}
 }
 
 func (c *AppsV1beta2ClusterClient) DaemonSets() DaemonSetClusterInterface {
 	return &daemonSetsClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *AppsV1beta2ClusterClient) Deployments() DeploymentClusterInterface {
+	return &deploymentsClusterInterface{clientCache: c.clientCache}
+}
+
 func (c *AppsV1beta2ClusterClient) ReplicaSets() ReplicaSetClusterInterface {
 	return &replicaSetsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *AppsV1beta2ClusterClient) ControllerRevisions() ControllerRevisionClusterInterface {
-	return &controllerRevisionsClusterInterface{clientCache: c.clientCache}
+func (c *AppsV1beta2ClusterClient) StatefulSets() StatefulSetClusterInterface {
+	return &statefulSetsClusterInterface{clientCache: c.clientCache}
 }
 
 // NewForConfig creates a new AppsV1beta2ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AppsV1beta2ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AppsV1beta2ClusterClient for the given config and http client.
@@ -95,6 +97,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AppsV1beta2ClusterC
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AppsV1beta2ClusterClient{clientCache: cache}, nil
 }
 
@@ -107,3 +110,14 @@ func NewForConfigOrDie(c *rest.Config) *AppsV1beta2ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiappsv1beta2.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/apps/v1beta2/controllerrevision.go b/kubernetes/typed/apps/v1beta2/controllerrevision.go
index 52ae0e062..30a77a720 100644
--- a/kubernetes/typed/apps/v1beta2/controllerrevision.go
+++ b/kubernetes/typed/apps/v1beta2/controllerrevision.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
+	context "context"
+
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1beta2client "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 )
 
 // ControllerRevisionsClusterGetter has a method to return a ControllerRevisionClusterInterface.
@@ -43,12 +40,13 @@ type ControllerRevisionsClusterGetter interface {
 // or scope down to one cluster and return a ControllerRevisionsNamespacer.
 type ControllerRevisionClusterInterface interface {
 	Cluster(logicalcluster.Path) ControllerRevisionsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.ControllerRevisionList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*appsv1beta2.ControllerRevisionList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ControllerRevisionClusterExpansion
 }
 
 type controllerRevisionsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1beta2client.AppsV1beta2Client]
+	clientCache kcpclient.Cache[*typedappsv1beta2.AppsV1beta2Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *controllerRevisionsClusterInterface) Cluster(clusterPath logicalcluster
 }
 
 // List returns the entire collection of all ControllerRevisions across all clusters.
-func (c *controllerRevisionsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.ControllerRevisionList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ControllerRevisions(metav1.NamespaceAll).List(ctx, opts)
+func (c *controllerRevisionsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*appsv1beta2.ControllerRevisionList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ControllerRevisions(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all ControllerRevisions across all clusters.
-func (c *controllerRevisionsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ControllerRevisions(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *controllerRevisionsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ControllerRevisions(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ControllerRevisionsNamespacer can scope to objects within a namespace, returning a appsv1beta2client.ControllerRevisionInterface.
+// ControllerRevisionsNamespacer can scope to objects within a namespace, returning a typedappsv1beta2.ControllerRevisionInterface.
 type ControllerRevisionsNamespacer interface {
-	Namespace(string) appsv1beta2client.ControllerRevisionInterface
+	Namespace(string) typedappsv1beta2.ControllerRevisionInterface
 }
 
 type controllerRevisionsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1beta2client.AppsV1beta2Client]
+	clientCache kcpclient.Cache[*typedappsv1beta2.AppsV1beta2Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *controllerRevisionsNamespacer) Namespace(namespace string) appsv1beta2client.ControllerRevisionInterface {
+func (n *controllerRevisionsNamespacer) Namespace(namespace string) typedappsv1beta2.ControllerRevisionInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).ControllerRevisions(namespace)
 }
diff --git a/kubernetes/typed/apps/v1beta2/daemonset.go b/kubernetes/typed/apps/v1beta2/daemonset.go
index 9dc28a8b9..5408911ac 100644
--- a/kubernetes/typed/apps/v1beta2/daemonset.go
+++ b/kubernetes/typed/apps/v1beta2/daemonset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
+	context "context"
+
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1beta2client "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 )
 
 // DaemonSetsClusterGetter has a method to return a DaemonSetClusterInterface.
@@ -43,12 +40,13 @@ type DaemonSetsClusterGetter interface {
 // or scope down to one cluster and return a DaemonSetsNamespacer.
 type DaemonSetClusterInterface interface {
 	Cluster(logicalcluster.Path) DaemonSetsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.DaemonSetList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*appsv1beta2.DaemonSetList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	DaemonSetClusterExpansion
 }
 
 type daemonSetsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1beta2client.AppsV1beta2Client]
+	clientCache kcpclient.Cache[*typedappsv1beta2.AppsV1beta2Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *daemonSetsClusterInterface) Cluster(clusterPath logicalcluster.Path) Da
 }
 
 // List returns the entire collection of all DaemonSets across all clusters.
-func (c *daemonSetsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.DaemonSetList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DaemonSets(metav1.NamespaceAll).List(ctx, opts)
+func (c *daemonSetsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*appsv1beta2.DaemonSetList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DaemonSets(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all DaemonSets across all clusters.
-func (c *daemonSetsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DaemonSets(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *daemonSetsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DaemonSets(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// DaemonSetsNamespacer can scope to objects within a namespace, returning a appsv1beta2client.DaemonSetInterface.
+// DaemonSetsNamespacer can scope to objects within a namespace, returning a typedappsv1beta2.DaemonSetInterface.
 type DaemonSetsNamespacer interface {
-	Namespace(string) appsv1beta2client.DaemonSetInterface
+	Namespace(string) typedappsv1beta2.DaemonSetInterface
 }
 
 type daemonSetsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1beta2client.AppsV1beta2Client]
+	clientCache kcpclient.Cache[*typedappsv1beta2.AppsV1beta2Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *daemonSetsNamespacer) Namespace(namespace string) appsv1beta2client.DaemonSetInterface {
+func (n *daemonSetsNamespacer) Namespace(namespace string) typedappsv1beta2.DaemonSetInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).DaemonSets(namespace)
 }
diff --git a/kubernetes/typed/apps/v1beta2/deployment.go b/kubernetes/typed/apps/v1beta2/deployment.go
index b9fc80584..d4b239d9f 100644
--- a/kubernetes/typed/apps/v1beta2/deployment.go
+++ b/kubernetes/typed/apps/v1beta2/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
+	context "context"
+
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1beta2client "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 )
 
 // DeploymentsClusterGetter has a method to return a DeploymentClusterInterface.
@@ -43,12 +40,13 @@ type DeploymentsClusterGetter interface {
 // or scope down to one cluster and return a DeploymentsNamespacer.
 type DeploymentClusterInterface interface {
 	Cluster(logicalcluster.Path) DeploymentsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.DeploymentList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*appsv1beta2.DeploymentList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	DeploymentClusterExpansion
 }
 
 type deploymentsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1beta2client.AppsV1beta2Client]
+	clientCache kcpclient.Cache[*typedappsv1beta2.AppsV1beta2Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *deploymentsClusterInterface) Cluster(clusterPath logicalcluster.Path) D
 }
 
 // List returns the entire collection of all Deployments across all clusters.
-func (c *deploymentsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.DeploymentList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(metav1.NamespaceAll).List(ctx, opts)
+func (c *deploymentsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*appsv1beta2.DeploymentList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all Deployments across all clusters.
-func (c *deploymentsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *deploymentsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// DeploymentsNamespacer can scope to objects within a namespace, returning a appsv1beta2client.DeploymentInterface.
+// DeploymentsNamespacer can scope to objects within a namespace, returning a typedappsv1beta2.DeploymentInterface.
 type DeploymentsNamespacer interface {
-	Namespace(string) appsv1beta2client.DeploymentInterface
+	Namespace(string) typedappsv1beta2.DeploymentInterface
 }
 
 type deploymentsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1beta2client.AppsV1beta2Client]
+	clientCache kcpclient.Cache[*typedappsv1beta2.AppsV1beta2Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *deploymentsNamespacer) Namespace(namespace string) appsv1beta2client.DeploymentInterface {
+func (n *deploymentsNamespacer) Namespace(namespace string) typedappsv1beta2.DeploymentInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Deployments(namespace)
 }
diff --git a/kubernetes/typed/apps/v1beta2/doc.go b/kubernetes/typed/apps/v1beta2/doc.go
new file mode 100644
index 000000000..3f0720c40
--- /dev/null
+++ b/kubernetes/typed/apps/v1beta2/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta2
diff --git a/kubernetes/typed/apps/v1beta2/fake/apps_client.go b/kubernetes/typed/apps/v1beta2/fake/apps_client.go
index 8e801a08a..a191b9974 100644
--- a/kubernetes/typed/apps/v1beta2/fake/apps_client.go
+++ b/kubernetes/typed/apps/v1beta2/fake/apps_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpappsv1beta2.AppsV1beta2ClusterInterface = (*AppsV1beta2ClusterClient)(nil)
@@ -44,54 +40,54 @@ func (c *AppsV1beta2ClusterClient) Cluster(clusterPath logicalcluster.Path) apps
 	return &AppsV1beta2Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *AppsV1beta2ClusterClient) StatefulSets() kcpappsv1beta2.StatefulSetClusterInterface {
-	return &statefulSetsClusterClient{Fake: c.Fake}
+func (c *AppsV1beta2ClusterClient) ControllerRevisions() kcpappsv1beta2.ControllerRevisionClusterInterface {
+	return newFakeControllerRevisionClusterClient(c)
 }
 
-func (c *AppsV1beta2ClusterClient) Deployments() kcpappsv1beta2.DeploymentClusterInterface {
-	return &deploymentsClusterClient{Fake: c.Fake}
+func (c *AppsV1beta2ClusterClient) DaemonSets() kcpappsv1beta2.DaemonSetClusterInterface {
+	return newFakeDaemonSetClusterClient(c)
 }
 
-func (c *AppsV1beta2ClusterClient) DaemonSets() kcpappsv1beta2.DaemonSetClusterInterface {
-	return &daemonSetsClusterClient{Fake: c.Fake}
+func (c *AppsV1beta2ClusterClient) Deployments() kcpappsv1beta2.DeploymentClusterInterface {
+	return newFakeDeploymentClusterClient(c)
 }
 
 func (c *AppsV1beta2ClusterClient) ReplicaSets() kcpappsv1beta2.ReplicaSetClusterInterface {
-	return &replicaSetsClusterClient{Fake: c.Fake}
+	return newFakeReplicaSetClusterClient(c)
 }
 
-func (c *AppsV1beta2ClusterClient) ControllerRevisions() kcpappsv1beta2.ControllerRevisionClusterInterface {
-	return &controllerRevisionsClusterClient{Fake: c.Fake}
+func (c *AppsV1beta2ClusterClient) StatefulSets() kcpappsv1beta2.StatefulSetClusterInterface {
+	return newFakeStatefulSetClusterClient(c)
 }
 
-var _ appsv1beta2.AppsV1beta2Interface = (*AppsV1beta2Client)(nil)
-
 type AppsV1beta2Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *AppsV1beta2Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *AppsV1beta2Client) ControllerRevisions(namespace string) appsv1beta2.ControllerRevisionInterface {
+	return newFakeControllerRevisionClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AppsV1beta2Client) StatefulSets(namespace string) appsv1beta2.StatefulSetInterface {
-	return &statefulSetsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *AppsV1beta2Client) DaemonSets(namespace string) appsv1beta2.DaemonSetInterface {
+	return newFakeDaemonSetClient(c.Fake, namespace, c.ClusterPath)
 }
 
 func (c *AppsV1beta2Client) Deployments(namespace string) appsv1beta2.DeploymentInterface {
-	return &deploymentsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+	return newFakeDeploymentClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AppsV1beta2Client) DaemonSets(namespace string) appsv1beta2.DaemonSetInterface {
-	return &daemonSetsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *AppsV1beta2Client) ReplicaSets(namespace string) appsv1beta2.ReplicaSetInterface {
+	return newFakeReplicaSetClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AppsV1beta2Client) ReplicaSets(namespace string) appsv1beta2.ReplicaSetInterface {
-	return &replicaSetsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *AppsV1beta2Client) StatefulSets(namespace string) appsv1beta2.StatefulSetInterface {
+	return newFakeStatefulSetClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AppsV1beta2Client) ControllerRevisions(namespace string) appsv1beta2.ControllerRevisionInterface {
-	return &controllerRevisionsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AppsV1beta2Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/apps/v1beta2/fake/controllerrevision.go b/kubernetes/typed/apps/v1beta2/fake/controllerrevision.go
index 59452671b..abb2751d8 100644
--- a/kubernetes/typed/apps/v1beta2/fake/controllerrevision.go
+++ b/kubernetes/typed/apps/v1beta2/fake/controllerrevision.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1beta2 "k8s.io/client-go/applyconfigurations/apps/v1beta2"
-	appsv1beta2client "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
-	"k8s.io/client-go/testing"
+	v1beta2 "k8s.io/client-go/applyconfigurations/apps/v1beta2"
+	typedappsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 
-	kcpappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2"
+	typedkcpappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var controllerRevisionsResource = schema.GroupVersionResource{Group: "apps", Version: "v1beta2", Resource: "controllerrevisions"}
-var controllerRevisionsKind = schema.GroupVersionKind{Group: "apps", Version: "v1beta2", Kind: "ControllerRevision"}
-
-type controllerRevisionsClusterClient struct {
-	*kcptesting.Fake
+// controllerRevisionClusterClient implements ControllerRevisionClusterInterface
+type controllerRevisionClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1beta2.ControllerRevision, *appsv1beta2.ControllerRevisionList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *controllerRevisionsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1beta2.ControllerRevisionsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &controllerRevisionsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ControllerRevisions that match those selectors across all clusters.
-func (c *controllerRevisionsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.ControllerRevisionList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(controllerRevisionsResource, controllerRevisionsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1beta2.ControllerRevisionList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeControllerRevisionClusterClient(fake *AppsV1beta2ClusterClient) typedkcpappsv1beta2.ControllerRevisionClusterInterface {
+	return &controllerRevisionClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1beta2.ControllerRevision, *appsv1beta2.ControllerRevisionList](
+			fake.Fake,
+			appsv1beta2.SchemeGroupVersion.WithResource("controllerrevisions"),
+			appsv1beta2.SchemeGroupVersion.WithKind("ControllerRevision"),
+			func() *appsv1beta2.ControllerRevision { return &appsv1beta2.ControllerRevision{} },
+			func() *appsv1beta2.ControllerRevisionList { return &appsv1beta2.ControllerRevisionList{} },
+			func(dst, src *appsv1beta2.ControllerRevisionList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta2.ControllerRevisionList) []*appsv1beta2.ControllerRevision {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta2.ControllerRevisionList, items []*appsv1beta2.ControllerRevision) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &appsv1beta2.ControllerRevisionList{ListMeta: obj.(*appsv1beta2.ControllerRevisionList).ListMeta}
-	for _, item := range obj.(*appsv1beta2.ControllerRevisionList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ControllerRevisions across all clusters.
-func (c *controllerRevisionsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(controllerRevisionsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *controllerRevisionClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1beta2.ControllerRevisionsNamespacer {
+	return &controllerRevisionNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type controllerRevisionsNamespacer struct {
+type controllerRevisionNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *controllerRevisionsNamespacer) Namespace(namespace string) appsv1beta2client.ControllerRevisionInterface {
-	return &controllerRevisionsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *controllerRevisionNamespacer) Namespace(namespace string) typedappsv1beta2.ControllerRevisionInterface {
+	return newFakeControllerRevisionClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type controllerRevisionsClient struct {
-	*kcptesting.Fake
+// controllerRevisionScopedClient implements ControllerRevisionInterface
+type controllerRevisionScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1beta2.ControllerRevision, *appsv1beta2.ControllerRevisionList, *v1beta2.ControllerRevisionApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *controllerRevisionsClient) Create(ctx context.Context, controllerRevision *appsv1beta2.ControllerRevision, opts metav1.CreateOptions) (*appsv1beta2.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, controllerRevision), &appsv1beta2.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) Update(ctx context.Context, controllerRevision *appsv1beta2.ControllerRevision, opts metav1.UpdateOptions) (*appsv1beta2.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, controllerRevision), &appsv1beta2.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) UpdateStatus(ctx context.Context, controllerRevision *appsv1beta2.ControllerRevision, opts metav1.UpdateOptions) (*appsv1beta2.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(controllerRevisionsResource, c.ClusterPath, "status", c.Namespace, controllerRevision), &appsv1beta2.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(controllerRevisionsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1beta2.ControllerRevision{})
-	return err
 }
 
-func (c *controllerRevisionsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1beta2.ControllerRevisionList{})
-	return err
-}
-
-func (c *controllerRevisionsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1beta2.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, name), &appsv1beta2.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.ControllerRevision), err
-}
-
-// List takes label and field selectors, and returns the list of ControllerRevisions that match those selectors.
-func (c *controllerRevisionsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.ControllerRevisionList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(controllerRevisionsResource, controllerRevisionsKind, c.ClusterPath, c.Namespace, opts), &appsv1beta2.ControllerRevisionList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1beta2.ControllerRevisionList{ListMeta: obj.(*appsv1beta2.ControllerRevisionList).ListMeta}
-	for _, item := range obj.(*appsv1beta2.ControllerRevisionList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *controllerRevisionsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *controllerRevisionsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1beta2.ControllerRevision, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1beta2.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta2.ControllerRevisionApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta2.ControllerRevision, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1beta2.ControllerRevision{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.ControllerRevision), err
-}
-
-func (c *controllerRevisionsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta2.ControllerRevisionApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta2.ControllerRevision, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(controllerRevisionsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1beta2.ControllerRevision{})
-	if obj == nil {
-		return nil, err
+func newFakeControllerRevisionClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1beta2.ControllerRevisionInterface {
+	return &controllerRevisionScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1beta2.ControllerRevision, *appsv1beta2.ControllerRevisionList, *v1beta2.ControllerRevisionApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1beta2.SchemeGroupVersion.WithResource("controllerrevisions"),
+			appsv1beta2.SchemeGroupVersion.WithKind("ControllerRevision"),
+			func() *appsv1beta2.ControllerRevision { return &appsv1beta2.ControllerRevision{} },
+			func() *appsv1beta2.ControllerRevisionList { return &appsv1beta2.ControllerRevisionList{} },
+			func(dst, src *appsv1beta2.ControllerRevisionList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta2.ControllerRevisionList) []*appsv1beta2.ControllerRevision {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta2.ControllerRevisionList, items []*appsv1beta2.ControllerRevision) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*appsv1beta2.ControllerRevision), err
 }
diff --git a/kubernetes/typed/apps/v1beta2/fake/daemonset.go b/kubernetes/typed/apps/v1beta2/fake/daemonset.go
index bd9ada603..13aa313e2 100644
--- a/kubernetes/typed/apps/v1beta2/fake/daemonset.go
+++ b/kubernetes/typed/apps/v1beta2/fake/daemonset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1beta2 "k8s.io/client-go/applyconfigurations/apps/v1beta2"
-	appsv1beta2client "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
-	"k8s.io/client-go/testing"
+	v1beta2 "k8s.io/client-go/applyconfigurations/apps/v1beta2"
+	typedappsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 
-	kcpappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2"
+	typedkcpappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var daemonSetsResource = schema.GroupVersionResource{Group: "apps", Version: "v1beta2", Resource: "daemonsets"}
-var daemonSetsKind = schema.GroupVersionKind{Group: "apps", Version: "v1beta2", Kind: "DaemonSet"}
-
-type daemonSetsClusterClient struct {
-	*kcptesting.Fake
+// daemonSetClusterClient implements DaemonSetClusterInterface
+type daemonSetClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1beta2.DaemonSet, *appsv1beta2.DaemonSetList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *daemonSetsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1beta2.DaemonSetsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &daemonSetsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of DaemonSets that match those selectors across all clusters.
-func (c *daemonSetsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.DaemonSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(daemonSetsResource, daemonSetsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1beta2.DaemonSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeDaemonSetClusterClient(fake *AppsV1beta2ClusterClient) typedkcpappsv1beta2.DaemonSetClusterInterface {
+	return &daemonSetClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1beta2.DaemonSet, *appsv1beta2.DaemonSetList](
+			fake.Fake,
+			appsv1beta2.SchemeGroupVersion.WithResource("daemonsets"),
+			appsv1beta2.SchemeGroupVersion.WithKind("DaemonSet"),
+			func() *appsv1beta2.DaemonSet { return &appsv1beta2.DaemonSet{} },
+			func() *appsv1beta2.DaemonSetList { return &appsv1beta2.DaemonSetList{} },
+			func(dst, src *appsv1beta2.DaemonSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta2.DaemonSetList) []*appsv1beta2.DaemonSet {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta2.DaemonSetList, items []*appsv1beta2.DaemonSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &appsv1beta2.DaemonSetList{ListMeta: obj.(*appsv1beta2.DaemonSetList).ListMeta}
-	for _, item := range obj.(*appsv1beta2.DaemonSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested DaemonSets across all clusters.
-func (c *daemonSetsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(daemonSetsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *daemonSetClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1beta2.DaemonSetsNamespacer {
+	return &daemonSetNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type daemonSetsNamespacer struct {
+type daemonSetNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *daemonSetsNamespacer) Namespace(namespace string) appsv1beta2client.DaemonSetInterface {
-	return &daemonSetsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *daemonSetNamespacer) Namespace(namespace string) typedappsv1beta2.DaemonSetInterface {
+	return newFakeDaemonSetClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type daemonSetsClient struct {
-	*kcptesting.Fake
+// daemonSetScopedClient implements DaemonSetInterface
+type daemonSetScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1beta2.DaemonSet, *appsv1beta2.DaemonSetList, *v1beta2.DaemonSetApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *daemonSetsClient) Create(ctx context.Context, daemonSet *appsv1beta2.DaemonSet, opts metav1.CreateOptions) (*appsv1beta2.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(daemonSetsResource, c.ClusterPath, c.Namespace, daemonSet), &appsv1beta2.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.DaemonSet), err
-}
-
-func (c *daemonSetsClient) Update(ctx context.Context, daemonSet *appsv1beta2.DaemonSet, opts metav1.UpdateOptions) (*appsv1beta2.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(daemonSetsResource, c.ClusterPath, c.Namespace, daemonSet), &appsv1beta2.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.DaemonSet), err
-}
-
-func (c *daemonSetsClient) UpdateStatus(ctx context.Context, daemonSet *appsv1beta2.DaemonSet, opts metav1.UpdateOptions) (*appsv1beta2.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(daemonSetsResource, c.ClusterPath, "status", c.Namespace, daemonSet), &appsv1beta2.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.DaemonSet), err
-}
-
-func (c *daemonSetsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(daemonSetsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1beta2.DaemonSet{})
-	return err
 }
 
-func (c *daemonSetsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(daemonSetsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1beta2.DaemonSetList{})
-	return err
-}
-
-func (c *daemonSetsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1beta2.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(daemonSetsResource, c.ClusterPath, c.Namespace, name), &appsv1beta2.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.DaemonSet), err
-}
-
-// List takes label and field selectors, and returns the list of DaemonSets that match those selectors.
-func (c *daemonSetsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.DaemonSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(daemonSetsResource, daemonSetsKind, c.ClusterPath, c.Namespace, opts), &appsv1beta2.DaemonSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1beta2.DaemonSetList{ListMeta: obj.(*appsv1beta2.DaemonSetList).ListMeta}
-	for _, item := range obj.(*appsv1beta2.DaemonSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *daemonSetsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(daemonSetsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *daemonSetsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1beta2.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(daemonSetsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1beta2.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.DaemonSet), err
-}
-
-func (c *daemonSetsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta2.DaemonSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta2.DaemonSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(daemonSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1beta2.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.DaemonSet), err
-}
-
-func (c *daemonSetsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta2.DaemonSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta2.DaemonSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(daemonSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1beta2.DaemonSet{})
-	if obj == nil {
-		return nil, err
+func newFakeDaemonSetClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1beta2.DaemonSetInterface {
+	return &daemonSetScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1beta2.DaemonSet, *appsv1beta2.DaemonSetList, *v1beta2.DaemonSetApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1beta2.SchemeGroupVersion.WithResource("daemonsets"),
+			appsv1beta2.SchemeGroupVersion.WithKind("DaemonSet"),
+			func() *appsv1beta2.DaemonSet { return &appsv1beta2.DaemonSet{} },
+			func() *appsv1beta2.DaemonSetList { return &appsv1beta2.DaemonSetList{} },
+			func(dst, src *appsv1beta2.DaemonSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta2.DaemonSetList) []*appsv1beta2.DaemonSet {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta2.DaemonSetList, items []*appsv1beta2.DaemonSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*appsv1beta2.DaemonSet), err
 }
diff --git a/kubernetes/typed/apps/v1beta2/fake/deployment.go b/kubernetes/typed/apps/v1beta2/fake/deployment.go
index 98180e573..5abde4d8f 100644
--- a/kubernetes/typed/apps/v1beta2/fake/deployment.go
+++ b/kubernetes/typed/apps/v1beta2/fake/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1beta2 "k8s.io/client-go/applyconfigurations/apps/v1beta2"
-	appsv1beta2client "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
-	"k8s.io/client-go/testing"
+	v1beta2 "k8s.io/client-go/applyconfigurations/apps/v1beta2"
+	typedappsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 
-	kcpappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2"
+	typedkcpappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var deploymentsResource = schema.GroupVersionResource{Group: "apps", Version: "v1beta2", Resource: "deployments"}
-var deploymentsKind = schema.GroupVersionKind{Group: "apps", Version: "v1beta2", Kind: "Deployment"}
-
-type deploymentsClusterClient struct {
-	*kcptesting.Fake
+// deploymentClusterClient implements DeploymentClusterInterface
+type deploymentClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1beta2.Deployment, *appsv1beta2.DeploymentList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *deploymentsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1beta2.DeploymentsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &deploymentsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Deployments that match those selectors across all clusters.
-func (c *deploymentsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.DeploymentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(deploymentsResource, deploymentsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1beta2.DeploymentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeDeploymentClusterClient(fake *AppsV1beta2ClusterClient) typedkcpappsv1beta2.DeploymentClusterInterface {
+	return &deploymentClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1beta2.Deployment, *appsv1beta2.DeploymentList](
+			fake.Fake,
+			appsv1beta2.SchemeGroupVersion.WithResource("deployments"),
+			appsv1beta2.SchemeGroupVersion.WithKind("Deployment"),
+			func() *appsv1beta2.Deployment { return &appsv1beta2.Deployment{} },
+			func() *appsv1beta2.DeploymentList { return &appsv1beta2.DeploymentList{} },
+			func(dst, src *appsv1beta2.DeploymentList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta2.DeploymentList) []*appsv1beta2.Deployment {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta2.DeploymentList, items []*appsv1beta2.Deployment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &appsv1beta2.DeploymentList{ListMeta: obj.(*appsv1beta2.DeploymentList).ListMeta}
-	for _, item := range obj.(*appsv1beta2.DeploymentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Deployments across all clusters.
-func (c *deploymentsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(deploymentsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *deploymentClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1beta2.DeploymentsNamespacer {
+	return &deploymentNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type deploymentsNamespacer struct {
+type deploymentNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *deploymentsNamespacer) Namespace(namespace string) appsv1beta2client.DeploymentInterface {
-	return &deploymentsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *deploymentNamespacer) Namespace(namespace string) typedappsv1beta2.DeploymentInterface {
+	return newFakeDeploymentClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type deploymentsClient struct {
-	*kcptesting.Fake
+// deploymentScopedClient implements DeploymentInterface
+type deploymentScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1beta2.Deployment, *appsv1beta2.DeploymentList, *v1beta2.DeploymentApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *deploymentsClient) Create(ctx context.Context, deployment *appsv1beta2.Deployment, opts metav1.CreateOptions) (*appsv1beta2.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(deploymentsResource, c.ClusterPath, c.Namespace, deployment), &appsv1beta2.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.Deployment), err
-}
-
-func (c *deploymentsClient) Update(ctx context.Context, deployment *appsv1beta2.Deployment, opts metav1.UpdateOptions) (*appsv1beta2.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(deploymentsResource, c.ClusterPath, c.Namespace, deployment), &appsv1beta2.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.Deployment), err
-}
-
-func (c *deploymentsClient) UpdateStatus(ctx context.Context, deployment *appsv1beta2.Deployment, opts metav1.UpdateOptions) (*appsv1beta2.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(deploymentsResource, c.ClusterPath, "status", c.Namespace, deployment), &appsv1beta2.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.Deployment), err
-}
-
-func (c *deploymentsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(deploymentsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1beta2.Deployment{})
-	return err
 }
 
-func (c *deploymentsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(deploymentsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1beta2.DeploymentList{})
-	return err
-}
-
-func (c *deploymentsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1beta2.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(deploymentsResource, c.ClusterPath, c.Namespace, name), &appsv1beta2.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.Deployment), err
-}
-
-// List takes label and field selectors, and returns the list of Deployments that match those selectors.
-func (c *deploymentsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.DeploymentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(deploymentsResource, deploymentsKind, c.ClusterPath, c.Namespace, opts), &appsv1beta2.DeploymentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1beta2.DeploymentList{ListMeta: obj.(*appsv1beta2.DeploymentList).ListMeta}
-	for _, item := range obj.(*appsv1beta2.DeploymentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *deploymentsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(deploymentsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *deploymentsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1beta2.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1beta2.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.Deployment), err
-}
-
-func (c *deploymentsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta2.DeploymentApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta2.Deployment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1beta2.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.Deployment), err
-}
-
-func (c *deploymentsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta2.DeploymentApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta2.Deployment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1beta2.Deployment{})
-	if obj == nil {
-		return nil, err
+func newFakeDeploymentClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1beta2.DeploymentInterface {
+	return &deploymentScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1beta2.Deployment, *appsv1beta2.DeploymentList, *v1beta2.DeploymentApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1beta2.SchemeGroupVersion.WithResource("deployments"),
+			appsv1beta2.SchemeGroupVersion.WithKind("Deployment"),
+			func() *appsv1beta2.Deployment { return &appsv1beta2.Deployment{} },
+			func() *appsv1beta2.DeploymentList { return &appsv1beta2.DeploymentList{} },
+			func(dst, src *appsv1beta2.DeploymentList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta2.DeploymentList) []*appsv1beta2.Deployment {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta2.DeploymentList, items []*appsv1beta2.Deployment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*appsv1beta2.Deployment), err
 }
diff --git a/kubernetes/typed/apps/v1beta2/fake/doc.go b/kubernetes/typed/apps/v1beta2/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/apps/v1beta2/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/apps/v1beta2/fake/replicaset.go b/kubernetes/typed/apps/v1beta2/fake/replicaset.go
index 6008bd5bc..2134d6392 100644
--- a/kubernetes/typed/apps/v1beta2/fake/replicaset.go
+++ b/kubernetes/typed/apps/v1beta2/fake/replicaset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1beta2 "k8s.io/client-go/applyconfigurations/apps/v1beta2"
-	appsv1beta2client "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
-	"k8s.io/client-go/testing"
+	v1beta2 "k8s.io/client-go/applyconfigurations/apps/v1beta2"
+	typedappsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 
-	kcpappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2"
+	typedkcpappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var replicaSetsResource = schema.GroupVersionResource{Group: "apps", Version: "v1beta2", Resource: "replicasets"}
-var replicaSetsKind = schema.GroupVersionKind{Group: "apps", Version: "v1beta2", Kind: "ReplicaSet"}
-
-type replicaSetsClusterClient struct {
-	*kcptesting.Fake
+// replicaSetClusterClient implements ReplicaSetClusterInterface
+type replicaSetClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1beta2.ReplicaSet, *appsv1beta2.ReplicaSetList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *replicaSetsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1beta2.ReplicaSetsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &replicaSetsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ReplicaSets that match those selectors across all clusters.
-func (c *replicaSetsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.ReplicaSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(replicaSetsResource, replicaSetsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1beta2.ReplicaSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeReplicaSetClusterClient(fake *AppsV1beta2ClusterClient) typedkcpappsv1beta2.ReplicaSetClusterInterface {
+	return &replicaSetClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1beta2.ReplicaSet, *appsv1beta2.ReplicaSetList](
+			fake.Fake,
+			appsv1beta2.SchemeGroupVersion.WithResource("replicasets"),
+			appsv1beta2.SchemeGroupVersion.WithKind("ReplicaSet"),
+			func() *appsv1beta2.ReplicaSet { return &appsv1beta2.ReplicaSet{} },
+			func() *appsv1beta2.ReplicaSetList { return &appsv1beta2.ReplicaSetList{} },
+			func(dst, src *appsv1beta2.ReplicaSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta2.ReplicaSetList) []*appsv1beta2.ReplicaSet {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta2.ReplicaSetList, items []*appsv1beta2.ReplicaSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &appsv1beta2.ReplicaSetList{ListMeta: obj.(*appsv1beta2.ReplicaSetList).ListMeta}
-	for _, item := range obj.(*appsv1beta2.ReplicaSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ReplicaSets across all clusters.
-func (c *replicaSetsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(replicaSetsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *replicaSetClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1beta2.ReplicaSetsNamespacer {
+	return &replicaSetNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type replicaSetsNamespacer struct {
+type replicaSetNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *replicaSetsNamespacer) Namespace(namespace string) appsv1beta2client.ReplicaSetInterface {
-	return &replicaSetsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *replicaSetNamespacer) Namespace(namespace string) typedappsv1beta2.ReplicaSetInterface {
+	return newFakeReplicaSetClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type replicaSetsClient struct {
-	*kcptesting.Fake
+// replicaSetScopedClient implements ReplicaSetInterface
+type replicaSetScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1beta2.ReplicaSet, *appsv1beta2.ReplicaSetList, *v1beta2.ReplicaSetApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *replicaSetsClient) Create(ctx context.Context, replicaSet *appsv1beta2.ReplicaSet, opts metav1.CreateOptions) (*appsv1beta2.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(replicaSetsResource, c.ClusterPath, c.Namespace, replicaSet), &appsv1beta2.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) Update(ctx context.Context, replicaSet *appsv1beta2.ReplicaSet, opts metav1.UpdateOptions) (*appsv1beta2.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(replicaSetsResource, c.ClusterPath, c.Namespace, replicaSet), &appsv1beta2.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) UpdateStatus(ctx context.Context, replicaSet *appsv1beta2.ReplicaSet, opts metav1.UpdateOptions) (*appsv1beta2.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(replicaSetsResource, c.ClusterPath, "status", c.Namespace, replicaSet), &appsv1beta2.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(replicaSetsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1beta2.ReplicaSet{})
-	return err
 }
 
-func (c *replicaSetsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(replicaSetsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1beta2.ReplicaSetList{})
-	return err
-}
-
-func (c *replicaSetsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1beta2.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(replicaSetsResource, c.ClusterPath, c.Namespace, name), &appsv1beta2.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.ReplicaSet), err
-}
-
-// List takes label and field selectors, and returns the list of ReplicaSets that match those selectors.
-func (c *replicaSetsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.ReplicaSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(replicaSetsResource, replicaSetsKind, c.ClusterPath, c.Namespace, opts), &appsv1beta2.ReplicaSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1beta2.ReplicaSetList{ListMeta: obj.(*appsv1beta2.ReplicaSetList).ListMeta}
-	for _, item := range obj.(*appsv1beta2.ReplicaSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *replicaSetsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(replicaSetsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *replicaSetsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1beta2.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicaSetsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1beta2.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta2.ReplicaSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta2.ReplicaSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicaSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1beta2.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta2.ReplicaSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta2.ReplicaSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicaSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1beta2.ReplicaSet{})
-	if obj == nil {
-		return nil, err
+func newFakeReplicaSetClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1beta2.ReplicaSetInterface {
+	return &replicaSetScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1beta2.ReplicaSet, *appsv1beta2.ReplicaSetList, *v1beta2.ReplicaSetApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1beta2.SchemeGroupVersion.WithResource("replicasets"),
+			appsv1beta2.SchemeGroupVersion.WithKind("ReplicaSet"),
+			func() *appsv1beta2.ReplicaSet { return &appsv1beta2.ReplicaSet{} },
+			func() *appsv1beta2.ReplicaSetList { return &appsv1beta2.ReplicaSetList{} },
+			func(dst, src *appsv1beta2.ReplicaSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta2.ReplicaSetList) []*appsv1beta2.ReplicaSet {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta2.ReplicaSetList, items []*appsv1beta2.ReplicaSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*appsv1beta2.ReplicaSet), err
 }
diff --git a/kubernetes/typed/apps/v1beta2/fake/statefulset.go b/kubernetes/typed/apps/v1beta2/fake/statefulset.go
index 7e2607772..06b421735 100644
--- a/kubernetes/typed/apps/v1beta2/fake/statefulset.go
+++ b/kubernetes/typed/apps/v1beta2/fake/statefulset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,232 +14,130 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
+	json "encoding/json"
+	fmt "fmt"
 
 	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsappsv1beta2 "k8s.io/client-go/applyconfigurations/apps/v1beta2"
-	appsv1beta2client "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
-	"k8s.io/client-go/testing"
-
-	kcpappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1beta2 "k8s.io/client-go/applyconfigurations/apps/v1beta2"
+	typedappsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
+
+	typedkcpappsv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/apps/v1beta2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var statefulSetsResource = schema.GroupVersionResource{Group: "apps", Version: "v1beta2", Resource: "statefulsets"}
-var statefulSetsKind = schema.GroupVersionKind{Group: "apps", Version: "v1beta2", Kind: "StatefulSet"}
-
-type statefulSetsClusterClient struct {
-	*kcptesting.Fake
+// statefulSetClusterClient implements StatefulSetClusterInterface
+type statefulSetClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*appsv1beta2.StatefulSet, *appsv1beta2.StatefulSetList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *statefulSetsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpappsv1beta2.StatefulSetsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeStatefulSetClusterClient(fake *AppsV1beta2ClusterClient) typedkcpappsv1beta2.StatefulSetClusterInterface {
+	return &statefulSetClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*appsv1beta2.StatefulSet, *appsv1beta2.StatefulSetList](
+			fake.Fake,
+			appsv1beta2.SchemeGroupVersion.WithResource("statefulsets"),
+			appsv1beta2.SchemeGroupVersion.WithKind("StatefulSet"),
+			func() *appsv1beta2.StatefulSet { return &appsv1beta2.StatefulSet{} },
+			func() *appsv1beta2.StatefulSetList { return &appsv1beta2.StatefulSetList{} },
+			func(dst, src *appsv1beta2.StatefulSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta2.StatefulSetList) []*appsv1beta2.StatefulSet {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta2.StatefulSetList, items []*appsv1beta2.StatefulSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-
-	return &statefulSetsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-// List takes label and field selectors, and returns the list of StatefulSets that match those selectors across all clusters.
-func (c *statefulSetsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.StatefulSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(statefulSetsResource, statefulSetsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &appsv1beta2.StatefulSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1beta2.StatefulSetList{ListMeta: obj.(*appsv1beta2.StatefulSetList).ListMeta}
-	for _, item := range obj.(*appsv1beta2.StatefulSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested StatefulSets across all clusters.
-func (c *statefulSetsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(statefulSetsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *statefulSetClusterClient) Cluster(cluster logicalcluster.Path) typedkcpappsv1beta2.StatefulSetsNamespacer {
+	return &statefulSetNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type statefulSetsNamespacer struct {
+type statefulSetNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *statefulSetsNamespacer) Namespace(namespace string) appsv1beta2client.StatefulSetInterface {
-	return &statefulSetsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *statefulSetNamespacer) Namespace(namespace string) typedappsv1beta2.StatefulSetInterface {
+	return newFakeStatefulSetClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type statefulSetsClient struct {
-	*kcptesting.Fake
+// statefulSetScopedClient implements StatefulSetInterface
+type statefulSetScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*appsv1beta2.StatefulSet, *appsv1beta2.StatefulSetList, *v1beta2.StatefulSetApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
 }
 
-func (c *statefulSetsClient) Create(ctx context.Context, statefulSet *appsv1beta2.StatefulSet, opts metav1.CreateOptions) (*appsv1beta2.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(statefulSetsResource, c.ClusterPath, c.Namespace, statefulSet), &appsv1beta2.StatefulSet{})
+func newFakeStatefulSetClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedappsv1beta2.StatefulSetInterface {
+	return &statefulSetScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*appsv1beta2.StatefulSet, *appsv1beta2.StatefulSetList, *v1beta2.StatefulSetApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			appsv1beta2.SchemeGroupVersion.WithResource("statefulsets"),
+			appsv1beta2.SchemeGroupVersion.WithKind("StatefulSet"),
+			func() *appsv1beta2.StatefulSet { return &appsv1beta2.StatefulSet{} },
+			func() *appsv1beta2.StatefulSetList { return &appsv1beta2.StatefulSetList{} },
+			func(dst, src *appsv1beta2.StatefulSetList) { dst.ListMeta = src.ListMeta },
+			func(list *appsv1beta2.StatefulSetList) []*appsv1beta2.StatefulSet {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *appsv1beta2.StatefulSetList, items []*appsv1beta2.StatefulSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
+
+// GetScale takes name of the statefulSet, and returns the corresponding scale object, and an error if there is any.
+func (c *statefulSetScopedClient) GetScale(ctx context.Context, statefulSetName string, _ v1.GetOptions) (result *appsv1beta2.Scale, err error) {
+	emptyResult := &appsv1beta2.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), "scale", statefulSetName), emptyResult)
 	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.StatefulSet), err
-}
-
-func (c *statefulSetsClient) Update(ctx context.Context, statefulSet *appsv1beta2.StatefulSet, opts metav1.UpdateOptions) (*appsv1beta2.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(statefulSetsResource, c.ClusterPath, c.Namespace, statefulSet), &appsv1beta2.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.StatefulSet), err
-}
-
-func (c *statefulSetsClient) UpdateStatus(ctx context.Context, statefulSet *appsv1beta2.StatefulSet, opts metav1.UpdateOptions) (*appsv1beta2.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(statefulSetsResource, c.ClusterPath, "status", c.Namespace, statefulSet), &appsv1beta2.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.StatefulSet), err
-}
-
-func (c *statefulSetsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(statefulSetsResource, c.ClusterPath, c.Namespace, name, opts), &appsv1beta2.StatefulSet{})
-	return err
-}
-
-func (c *statefulSetsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(statefulSetsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &appsv1beta2.StatefulSetList{})
-	return err
-}
-
-func (c *statefulSetsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*appsv1beta2.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(statefulSetsResource, c.ClusterPath, c.Namespace, name), &appsv1beta2.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.StatefulSet), err
-}
-
-// List takes label and field selectors, and returns the list of StatefulSets that match those selectors.
-func (c *statefulSetsClient) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.StatefulSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(statefulSetsResource, statefulSetsKind, c.ClusterPath, c.Namespace, opts), &appsv1beta2.StatefulSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &appsv1beta2.StatefulSetList{ListMeta: obj.(*appsv1beta2.StatefulSetList).ListMeta}
-	for _, item := range obj.(*appsv1beta2.StatefulSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *statefulSetsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(statefulSetsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *statefulSetsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*appsv1beta2.StatefulSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(statefulSetsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &appsv1beta2.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.StatefulSet), err
-}
-
-func (c *statefulSetsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta2.StatefulSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta2.StatefulSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(statefulSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1beta2.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.StatefulSet), err
-}
-
-func (c *statefulSetsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsappsv1beta2.StatefulSetApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta2.StatefulSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(statefulSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &appsv1beta2.StatefulSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*appsv1beta2.StatefulSet), err
-}
-
-func (c *statefulSetsClient) GetScale(ctx context.Context, statefulSetName string, options metav1.GetOptions) (*appsv1beta2.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(statefulSetsResource, c.ClusterPath, "scale", c.Namespace, statefulSetName), &appsv1beta2.Scale{})
-	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*appsv1beta2.Scale), err
 }
 
-func (c *statefulSetsClient) UpdateScale(ctx context.Context, statefulSetName string, scale *appsv1beta2.Scale, opts metav1.UpdateOptions) (*appsv1beta2.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(statefulSetsResource, c.ClusterPath, "scale", c.Namespace, scale), &appsv1beta2.Scale{})
+// UpdateScale takes the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *statefulSetScopedClient) UpdateScale(ctx context.Context, statefulSetName string, scale *appsv1beta2.Scale, _ v1.UpdateOptions) (result *appsv1beta2.Scale, err error) {
+	emptyResult := &appsv1beta2.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(c.Resource(), c.ClusterPath, "scale", c.Namespace(), scale), &appsv1beta2.Scale{})
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*appsv1beta2.Scale), err
 }
 
-func (c *statefulSetsClient) ApplyScale(ctx context.Context, statefulSetName string, applyConfiguration *applyconfigurationsappsv1beta2.ScaleApplyConfiguration, opts metav1.ApplyOptions) (*appsv1beta2.Scale, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
+// ApplyScale takes top resource name and the apply declarative configuration for scale,
+// applies it and returns the applied scale, and an error, if there is any.
+func (c *statefulSetScopedClient) ApplyScale(ctx context.Context, statefulSetName string, scale *v1beta2.ScaleApplyConfiguration, _ v1.ApplyOptions) (result *appsv1beta2.Scale, err error) {
+	if scale == nil {
+		return nil, fmt.Errorf("scale provided to ApplyScale must not be nil")
 	}
-	data, err := json.Marshal(applyConfiguration)
+	data, err := json.Marshal(scale)
 	if err != nil {
 		return nil, err
 	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(statefulSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &appsv1beta2.Scale{})
+	emptyResult := &appsv1beta2.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), statefulSetName, types.ApplyPatchType, data, "scale"), emptyResult)
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*appsv1beta2.Scale), err
 }
diff --git a/kubernetes/typed/apps/v1beta2/generated_expansion.go b/kubernetes/typed/apps/v1beta2/generated_expansion.go
new file mode 100644
index 000000000..86f5db2f6
--- /dev/null
+++ b/kubernetes/typed/apps/v1beta2/generated_expansion.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta2
+
+type ControllerRevisionClusterExpansion interface{}
+
+type DaemonSetClusterExpansion interface{}
+
+type DeploymentClusterExpansion interface{}
+
+type ReplicaSetClusterExpansion interface{}
+
+type StatefulSetClusterExpansion interface{}
diff --git a/kubernetes/typed/apps/v1beta2/replicaset.go b/kubernetes/typed/apps/v1beta2/replicaset.go
index 5562f7988..e32d5e105 100644
--- a/kubernetes/typed/apps/v1beta2/replicaset.go
+++ b/kubernetes/typed/apps/v1beta2/replicaset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
+	context "context"
+
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1beta2client "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 )
 
 // ReplicaSetsClusterGetter has a method to return a ReplicaSetClusterInterface.
@@ -43,12 +40,13 @@ type ReplicaSetsClusterGetter interface {
 // or scope down to one cluster and return a ReplicaSetsNamespacer.
 type ReplicaSetClusterInterface interface {
 	Cluster(logicalcluster.Path) ReplicaSetsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.ReplicaSetList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*appsv1beta2.ReplicaSetList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ReplicaSetClusterExpansion
 }
 
 type replicaSetsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1beta2client.AppsV1beta2Client]
+	clientCache kcpclient.Cache[*typedappsv1beta2.AppsV1beta2Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *replicaSetsClusterInterface) Cluster(clusterPath logicalcluster.Path) R
 }
 
 // List returns the entire collection of all ReplicaSets across all clusters.
-func (c *replicaSetsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.ReplicaSetList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ReplicaSets(metav1.NamespaceAll).List(ctx, opts)
+func (c *replicaSetsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*appsv1beta2.ReplicaSetList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ReplicaSets(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all ReplicaSets across all clusters.
-func (c *replicaSetsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ReplicaSets(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *replicaSetsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ReplicaSets(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ReplicaSetsNamespacer can scope to objects within a namespace, returning a appsv1beta2client.ReplicaSetInterface.
+// ReplicaSetsNamespacer can scope to objects within a namespace, returning a typedappsv1beta2.ReplicaSetInterface.
 type ReplicaSetsNamespacer interface {
-	Namespace(string) appsv1beta2client.ReplicaSetInterface
+	Namespace(string) typedappsv1beta2.ReplicaSetInterface
 }
 
 type replicaSetsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1beta2client.AppsV1beta2Client]
+	clientCache kcpclient.Cache[*typedappsv1beta2.AppsV1beta2Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *replicaSetsNamespacer) Namespace(namespace string) appsv1beta2client.ReplicaSetInterface {
+func (n *replicaSetsNamespacer) Namespace(namespace string) typedappsv1beta2.ReplicaSetInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).ReplicaSets(namespace)
 }
diff --git a/kubernetes/typed/apps/v1beta2/statefulset.go b/kubernetes/typed/apps/v1beta2/statefulset.go
index 6b60aaae5..3534397e0 100644
--- a/kubernetes/typed/apps/v1beta2/statefulset.go
+++ b/kubernetes/typed/apps/v1beta2/statefulset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
+	context "context"
+
+	appsv1beta2 "k8s.io/api/apps/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedappsv1beta2 "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	appsv1beta2client "k8s.io/client-go/kubernetes/typed/apps/v1beta2"
 )
 
 // StatefulSetsClusterGetter has a method to return a StatefulSetClusterInterface.
@@ -43,12 +40,13 @@ type StatefulSetsClusterGetter interface {
 // or scope down to one cluster and return a StatefulSetsNamespacer.
 type StatefulSetClusterInterface interface {
 	Cluster(logicalcluster.Path) StatefulSetsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.StatefulSetList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*appsv1beta2.StatefulSetList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	StatefulSetClusterExpansion
 }
 
 type statefulSetsClusterInterface struct {
-	clientCache kcpclient.Cache[*appsv1beta2client.AppsV1beta2Client]
+	clientCache kcpclient.Cache[*typedappsv1beta2.AppsV1beta2Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *statefulSetsClusterInterface) Cluster(clusterPath logicalcluster.Path)
 }
 
 // List returns the entire collection of all StatefulSets across all clusters.
-func (c *statefulSetsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*appsv1beta2.StatefulSetList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StatefulSets(metav1.NamespaceAll).List(ctx, opts)
+func (c *statefulSetsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*appsv1beta2.StatefulSetList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StatefulSets(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all StatefulSets across all clusters.
-func (c *statefulSetsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StatefulSets(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *statefulSetsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StatefulSets(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// StatefulSetsNamespacer can scope to objects within a namespace, returning a appsv1beta2client.StatefulSetInterface.
+// StatefulSetsNamespacer can scope to objects within a namespace, returning a typedappsv1beta2.StatefulSetInterface.
 type StatefulSetsNamespacer interface {
-	Namespace(string) appsv1beta2client.StatefulSetInterface
+	Namespace(string) typedappsv1beta2.StatefulSetInterface
 }
 
 type statefulSetsNamespacer struct {
-	clientCache kcpclient.Cache[*appsv1beta2client.AppsV1beta2Client]
+	clientCache kcpclient.Cache[*typedappsv1beta2.AppsV1beta2Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *statefulSetsNamespacer) Namespace(namespace string) appsv1beta2client.StatefulSetInterface {
+func (n *statefulSetsNamespacer) Namespace(namespace string) typedappsv1beta2.StatefulSetInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).StatefulSets(namespace)
 }
diff --git a/kubernetes/typed/authentication/v1/authentication_client.go b/kubernetes/typed/authentication/v1/authentication_client.go
index 784b5f6ec..5b134e9d3 100644
--- a/kubernetes/typed/authentication/v1/authentication_client.go
+++ b/kubernetes/typed/authentication/v1/authentication_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,22 +14,25 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiauthenticationv1 "k8s.io/api/authentication/v1"
+	authenticationv1 "k8s.io/client-go/kubernetes/typed/authentication/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authenticationv1 "k8s.io/client-go/kubernetes/typed/authentication/v1"
-	"k8s.io/client-go/rest"
 )
 
 type AuthenticationV1ClusterInterface interface {
 	AuthenticationV1ClusterScoper
+	SelfSubjectReviewsClusterGetter
 	TokenReviewsClusterGetter
 }
 
@@ -40,6 +40,7 @@ type AuthenticationV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) authenticationv1.AuthenticationV1Interface
 }
 
+// AuthenticationV1ClusterClient is used to interact with features provided by the authentication.k8s.io group.
 type AuthenticationV1ClusterClient struct {
 	clientCache kcpclient.Cache[*authenticationv1.AuthenticationV1Client]
 }
@@ -51,6 +52,10 @@ func (c *AuthenticationV1ClusterClient) Cluster(clusterPath logicalcluster.Path)
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
+func (c *AuthenticationV1ClusterClient) SelfSubjectReviews() SelfSubjectReviewClusterInterface {
+	return &selfSubjectReviewsClusterInterface{clientCache: c.clientCache}
+}
+
 func (c *AuthenticationV1ClusterClient) TokenReviews() TokenReviewClusterInterface {
 	return &tokenReviewsClusterInterface{clientCache: c.clientCache}
 }
@@ -59,11 +64,13 @@ func (c *AuthenticationV1ClusterClient) TokenReviews() TokenReviewClusterInterfa
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AuthenticationV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AuthenticationV1ClusterClient for the given config and http client.
@@ -75,6 +82,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AuthenticationV1Clu
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AuthenticationV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +95,14 @@ func NewForConfigOrDie(c *rest.Config) *AuthenticationV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiauthenticationv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/authentication/v1/doc.go b/kubernetes/typed/authentication/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/authentication/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/authentication/v1/fake/authentication_client.go b/kubernetes/typed/authentication/v1/fake/authentication_client.go
index cd15946f6..a312d1323 100644
--- a/kubernetes/typed/authentication/v1/fake/authentication_client.go
+++ b/kubernetes/typed/authentication/v1/fake/authentication_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authenticationv1 "k8s.io/client-go/kubernetes/typed/authentication/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpauthenticationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpauthenticationv1.AuthenticationV1ClusterInterface = (*AuthenticationV1ClusterClient)(nil)
@@ -44,22 +40,30 @@ func (c *AuthenticationV1ClusterClient) Cluster(clusterPath logicalcluster.Path)
 	return &AuthenticationV1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *AuthenticationV1ClusterClient) TokenReviews() kcpauthenticationv1.TokenReviewClusterInterface {
-	return &tokenReviewsClusterClient{Fake: c.Fake}
+func (c *AuthenticationV1ClusterClient) SelfSubjectReviews() kcpauthenticationv1.SelfSubjectReviewClusterInterface {
+	return newFakeSelfSubjectReviewClusterClient(c)
 }
 
-var _ authenticationv1.AuthenticationV1Interface = (*AuthenticationV1Client)(nil)
+func (c *AuthenticationV1ClusterClient) TokenReviews() kcpauthenticationv1.TokenReviewClusterInterface {
+	return newFakeTokenReviewClusterClient(c)
+}
 
 type AuthenticationV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *AuthenticationV1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *AuthenticationV1Client) SelfSubjectReviews() authenticationv1.SelfSubjectReviewInterface {
+	return newFakeSelfSubjectReviewClient(c.Fake, c.ClusterPath)
 }
 
 func (c *AuthenticationV1Client) TokenReviews() authenticationv1.TokenReviewInterface {
-	return &tokenReviewsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakeTokenReviewClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AuthenticationV1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/authentication/v1/fake/doc.go b/kubernetes/typed/authentication/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/authentication/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/authentication/v1/fake/selfsubjectreview.go b/kubernetes/typed/authentication/v1/fake/selfsubjectreview.go
new file mode 100644
index 000000000..9db98f7a1
--- /dev/null
+++ b/kubernetes/typed/authentication/v1/fake/selfsubjectreview.go
@@ -0,0 +1,73 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	authenticationv1 "k8s.io/api/authentication/v1"
+	typedauthenticationv1 "k8s.io/client-go/kubernetes/typed/authentication/v1"
+
+	typedkcpauthenticationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// selfSubjectReviewClusterClient implements SelfSubjectReviewClusterInterface
+type selfSubjectReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authenticationv1.SelfSubjectReview]
+	Fake *kcptesting.Fake
+}
+
+func newFakeSelfSubjectReviewClusterClient(fake *AuthenticationV1ClusterClient) typedkcpauthenticationv1.SelfSubjectReviewClusterInterface {
+	return &selfSubjectReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authenticationv1.SelfSubjectReview](
+			fake.Fake,
+			authenticationv1.SchemeGroupVersion.WithResource("selfsubjectreviews"),
+			authenticationv1.SchemeGroupVersion.WithKind("SelfSubjectReview"),
+			func() *authenticationv1.SelfSubjectReview { return &authenticationv1.SelfSubjectReview{} },
+		),
+		fake.Fake,
+	}
+}
+
+func (c *selfSubjectReviewClusterClient) Cluster(cluster logicalcluster.Path) typedauthenticationv1.SelfSubjectReviewInterface {
+	return newFakeSelfSubjectReviewClient(c.Fake, cluster)
+}
+
+// selfSubjectReviewScopedClient implements SelfSubjectReviewInterface
+type selfSubjectReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authenticationv1.SelfSubjectReview]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeSelfSubjectReviewClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedauthenticationv1.SelfSubjectReviewInterface {
+	return &selfSubjectReviewScopedClient{
+		kcpgentype.NewFakeClient[*authenticationv1.SelfSubjectReview](
+			fake,
+			clusterPath,
+			"",
+			authenticationv1.SchemeGroupVersion.WithResource("selfsubjectreviews"),
+			authenticationv1.SchemeGroupVersion.WithKind("SelfSubjectReview"),
+			func() *authenticationv1.SelfSubjectReview { return &authenticationv1.SelfSubjectReview{} },
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/authentication/v1/fake/tokenreview.go b/kubernetes/typed/authentication/v1/fake/tokenreview.go
index 7a206a02f..e8f8d41d8 100644
--- a/kubernetes/typed/authentication/v1/fake/tokenreview.go
+++ b/kubernetes/typed/authentication/v1/fake/tokenreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,48 +14,60 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authenticationv1 "k8s.io/api/authentication/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	authenticationv1client "k8s.io/client-go/kubernetes/typed/authentication/v1"
+	typedauthenticationv1 "k8s.io/client-go/kubernetes/typed/authentication/v1"
 
+	typedkcpauthenticationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var tokenReviewsResource = schema.GroupVersionResource{Group: "authentication.k8s.io", Version: "v1", Resource: "tokenreviews"}
-var tokenReviewsKind = schema.GroupVersionKind{Group: "authentication.k8s.io", Version: "v1", Kind: "TokenReview"}
-
-type tokenReviewsClusterClient struct {
-	*kcptesting.Fake
+// tokenReviewClusterClient implements TokenReviewClusterInterface
+type tokenReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authenticationv1.TokenReview]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *tokenReviewsClusterClient) Cluster(clusterPath logicalcluster.Path) authenticationv1client.TokenReviewInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeTokenReviewClusterClient(fake *AuthenticationV1ClusterClient) typedkcpauthenticationv1.TokenReviewClusterInterface {
+	return &tokenReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authenticationv1.TokenReview](
+			fake.Fake,
+			authenticationv1.SchemeGroupVersion.WithResource("tokenreviews"),
+			authenticationv1.SchemeGroupVersion.WithKind("TokenReview"),
+			func() *authenticationv1.TokenReview { return &authenticationv1.TokenReview{} },
+		),
+		fake.Fake,
 	}
+}
 
-	return &tokenReviewsClient{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *tokenReviewClusterClient) Cluster(cluster logicalcluster.Path) typedauthenticationv1.TokenReviewInterface {
+	return newFakeTokenReviewClient(c.Fake, cluster)
 }
 
-type tokenReviewsClient struct {
-	*kcptesting.Fake
+// tokenReviewScopedClient implements TokenReviewInterface
+type tokenReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authenticationv1.TokenReview]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *tokenReviewsClient) Create(ctx context.Context, tokenReview *authenticationv1.TokenReview, opts metav1.CreateOptions) (*authenticationv1.TokenReview, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(tokenReviewsResource, c.ClusterPath, tokenReview), &authenticationv1.TokenReview{})
-	if obj == nil {
-		return nil, err
+func newFakeTokenReviewClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedauthenticationv1.TokenReviewInterface {
+	return &tokenReviewScopedClient{
+		kcpgentype.NewFakeClient[*authenticationv1.TokenReview](
+			fake,
+			clusterPath,
+			"",
+			authenticationv1.SchemeGroupVersion.WithResource("tokenreviews"),
+			authenticationv1.SchemeGroupVersion.WithKind("TokenReview"),
+			func() *authenticationv1.TokenReview { return &authenticationv1.TokenReview{} },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*authenticationv1.TokenReview), err
 }
diff --git a/kubernetes/typed/authentication/v1/generated_expansion.go b/kubernetes/typed/authentication/v1/generated_expansion.go
new file mode 100644
index 000000000..5076e9f82
--- /dev/null
+++ b/kubernetes/typed/authentication/v1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type SelfSubjectReviewClusterExpansion interface{}
+
+type TokenReviewClusterExpansion interface{}
diff --git a/kubernetes/typed/authentication/v1/selfsubjectreview.go b/kubernetes/typed/authentication/v1/selfsubjectreview.go
new file mode 100644
index 000000000..0db2c0586
--- /dev/null
+++ b/kubernetes/typed/authentication/v1/selfsubjectreview.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	authenticationv1 "k8s.io/client-go/kubernetes/typed/authentication/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// SelfSubjectReviewsClusterGetter has a method to return a SelfSubjectReviewClusterInterface.
+// A group's cluster client should implement this interface.
+type SelfSubjectReviewsClusterGetter interface {
+	SelfSubjectReviews() SelfSubjectReviewClusterInterface
+}
+
+// SelfSubjectReviewClusterInterface can operate on SelfSubjectReviews across all clusters,
+// or scope down to one cluster and return a authenticationv1.SelfSubjectReviewInterface.
+type SelfSubjectReviewClusterInterface interface {
+	Cluster(logicalcluster.Path) authenticationv1.SelfSubjectReviewInterface
+
+	SelfSubjectReviewClusterExpansion
+}
+
+type selfSubjectReviewsClusterInterface struct {
+	clientCache kcpclient.Cache[*authenticationv1.AuthenticationV1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *selfSubjectReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authenticationv1.SelfSubjectReviewInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).SelfSubjectReviews()
+}
diff --git a/kubernetes/typed/authentication/v1/tokenreview.go b/kubernetes/typed/authentication/v1/tokenreview.go
index 25fa9ccaf..74796d2a6 100644
--- a/kubernetes/typed/authentication/v1/tokenreview.go
+++ b/kubernetes/typed/authentication/v1/tokenreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
+	authenticationv1 "k8s.io/client-go/kubernetes/typed/authentication/v1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authenticationv1client "k8s.io/client-go/kubernetes/typed/authentication/v1"
 )
 
 // TokenReviewsClusterGetter has a method to return a TokenReviewClusterInterface.
@@ -34,17 +31,20 @@ type TokenReviewsClusterGetter interface {
 	TokenReviews() TokenReviewClusterInterface
 }
 
-// TokenReviewClusterInterface can scope down to one cluster and return a authenticationv1client.TokenReviewInterface.
+// TokenReviewClusterInterface can operate on TokenReviews across all clusters,
+// or scope down to one cluster and return a authenticationv1.TokenReviewInterface.
 type TokenReviewClusterInterface interface {
-	Cluster(logicalcluster.Path) authenticationv1client.TokenReviewInterface
+	Cluster(logicalcluster.Path) authenticationv1.TokenReviewInterface
+
+	TokenReviewClusterExpansion
 }
 
 type tokenReviewsClusterInterface struct {
-	clientCache kcpclient.Cache[*authenticationv1client.AuthenticationV1Client]
+	clientCache kcpclient.Cache[*authenticationv1.AuthenticationV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *tokenReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authenticationv1client.TokenReviewInterface {
+func (c *tokenReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authenticationv1.TokenReviewInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
diff --git a/kubernetes/typed/authentication/v1alpha1/authentication_client.go b/kubernetes/typed/authentication/v1alpha1/authentication_client.go
index a791b4886..d21ed2712 100644
--- a/kubernetes/typed/authentication/v1alpha1/authentication_client.go
+++ b/kubernetes/typed/authentication/v1alpha1/authentication_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiauthenticationv1alpha1 "k8s.io/api/authentication/v1alpha1"
+	authenticationv1alpha1 "k8s.io/client-go/kubernetes/typed/authentication/v1alpha1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authenticationv1alpha1 "k8s.io/client-go/kubernetes/typed/authentication/v1alpha1"
-	"k8s.io/client-go/rest"
 )
 
 type AuthenticationV1alpha1ClusterInterface interface {
@@ -40,6 +39,7 @@ type AuthenticationV1alpha1ClusterScoper interface {
 	Cluster(logicalcluster.Path) authenticationv1alpha1.AuthenticationV1alpha1Interface
 }
 
+// AuthenticationV1alpha1ClusterClient is used to interact with features provided by the authentication.k8s.io group.
 type AuthenticationV1alpha1ClusterClient struct {
 	clientCache kcpclient.Cache[*authenticationv1alpha1.AuthenticationV1alpha1Client]
 }
@@ -59,11 +59,13 @@ func (c *AuthenticationV1alpha1ClusterClient) SelfSubjectReviews() SelfSubjectRe
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AuthenticationV1alpha1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AuthenticationV1alpha1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AuthenticationV1alp
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AuthenticationV1alpha1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *AuthenticationV1alpha1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiauthenticationv1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/authentication/v1alpha1/doc.go b/kubernetes/typed/authentication/v1alpha1/doc.go
new file mode 100644
index 000000000..08b80237c
--- /dev/null
+++ b/kubernetes/typed/authentication/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/kubernetes/typed/authentication/v1alpha1/fake/authentication_client.go b/kubernetes/typed/authentication/v1alpha1/fake/authentication_client.go
index 1d10f6caf..2550f68ca 100644
--- a/kubernetes/typed/authentication/v1alpha1/fake/authentication_client.go
+++ b/kubernetes/typed/authentication/v1alpha1/fake/authentication_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authenticationv1alpha1 "k8s.io/client-go/kubernetes/typed/authentication/v1alpha1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpauthenticationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1alpha1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpauthenticationv1alpha1.AuthenticationV1alpha1ClusterInterface = (*AuthenticationV1alpha1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *AuthenticationV1alpha1ClusterClient) Cluster(clusterPath logicalcluster
 }
 
 func (c *AuthenticationV1alpha1ClusterClient) SelfSubjectReviews() kcpauthenticationv1alpha1.SelfSubjectReviewClusterInterface {
-	return &selfSubjectReviewsClusterClient{Fake: c.Fake}
+	return newFakeSelfSubjectReviewClusterClient(c)
 }
 
-var _ authenticationv1alpha1.AuthenticationV1alpha1Interface = (*AuthenticationV1alpha1Client)(nil)
-
 type AuthenticationV1alpha1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *AuthenticationV1alpha1Client) SelfSubjectReviews() authenticationv1alpha1.SelfSubjectReviewInterface {
+	return newFakeSelfSubjectReviewClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *AuthenticationV1alpha1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *AuthenticationV1alpha1Client) SelfSubjectReviews() authenticationv1alpha1.SelfSubjectReviewInterface {
-	return &selfSubjectReviewsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
diff --git a/kubernetes/typed/authentication/v1alpha1/fake/doc.go b/kubernetes/typed/authentication/v1alpha1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/authentication/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/authentication/v1alpha1/fake/selfsubjectreview.go b/kubernetes/typed/authentication/v1alpha1/fake/selfsubjectreview.go
index b801b62df..fb3db4899 100644
--- a/kubernetes/typed/authentication/v1alpha1/fake/selfsubjectreview.go
+++ b/kubernetes/typed/authentication/v1alpha1/fake/selfsubjectreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,48 +14,60 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authenticationv1alpha1 "k8s.io/api/authentication/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	authenticationv1alpha1client "k8s.io/client-go/kubernetes/typed/authentication/v1alpha1"
+	typedauthenticationv1alpha1 "k8s.io/client-go/kubernetes/typed/authentication/v1alpha1"
 
+	typedkcpauthenticationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var selfSubjectReviewsResource = schema.GroupVersionResource{Group: "authentication.k8s.io", Version: "v1alpha1", Resource: "selfsubjectreviews"}
-var selfSubjectReviewsKind = schema.GroupVersionKind{Group: "authentication.k8s.io", Version: "v1alpha1", Kind: "SelfSubjectReview"}
-
-type selfSubjectReviewsClusterClient struct {
-	*kcptesting.Fake
+// selfSubjectReviewClusterClient implements SelfSubjectReviewClusterInterface
+type selfSubjectReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authenticationv1alpha1.SelfSubjectReview]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *selfSubjectReviewsClusterClient) Cluster(clusterPath logicalcluster.Path) authenticationv1alpha1client.SelfSubjectReviewInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeSelfSubjectReviewClusterClient(fake *AuthenticationV1alpha1ClusterClient) typedkcpauthenticationv1alpha1.SelfSubjectReviewClusterInterface {
+	return &selfSubjectReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authenticationv1alpha1.SelfSubjectReview](
+			fake.Fake,
+			authenticationv1alpha1.SchemeGroupVersion.WithResource("selfsubjectreviews"),
+			authenticationv1alpha1.SchemeGroupVersion.WithKind("SelfSubjectReview"),
+			func() *authenticationv1alpha1.SelfSubjectReview { return &authenticationv1alpha1.SelfSubjectReview{} },
+		),
+		fake.Fake,
 	}
+}
 
-	return &selfSubjectReviewsClient{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *selfSubjectReviewClusterClient) Cluster(cluster logicalcluster.Path) typedauthenticationv1alpha1.SelfSubjectReviewInterface {
+	return newFakeSelfSubjectReviewClient(c.Fake, cluster)
 }
 
-type selfSubjectReviewsClient struct {
-	*kcptesting.Fake
+// selfSubjectReviewScopedClient implements SelfSubjectReviewInterface
+type selfSubjectReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authenticationv1alpha1.SelfSubjectReview]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *selfSubjectReviewsClient) Create(ctx context.Context, selfSubjectReview *authenticationv1alpha1.SelfSubjectReview, opts metav1.CreateOptions) (*authenticationv1alpha1.SelfSubjectReview, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(selfSubjectReviewsResource, c.ClusterPath, selfSubjectReview), &authenticationv1alpha1.SelfSubjectReview{})
-	if obj == nil {
-		return nil, err
+func newFakeSelfSubjectReviewClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedauthenticationv1alpha1.SelfSubjectReviewInterface {
+	return &selfSubjectReviewScopedClient{
+		kcpgentype.NewFakeClient[*authenticationv1alpha1.SelfSubjectReview](
+			fake,
+			clusterPath,
+			"",
+			authenticationv1alpha1.SchemeGroupVersion.WithResource("selfsubjectreviews"),
+			authenticationv1alpha1.SchemeGroupVersion.WithKind("SelfSubjectReview"),
+			func() *authenticationv1alpha1.SelfSubjectReview { return &authenticationv1alpha1.SelfSubjectReview{} },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*authenticationv1alpha1.SelfSubjectReview), err
 }
diff --git a/kubernetes/typed/authentication/v1alpha1/generated_expansion.go b/kubernetes/typed/authentication/v1alpha1/generated_expansion.go
new file mode 100644
index 000000000..fcc072a13
--- /dev/null
+++ b/kubernetes/typed/authentication/v1alpha1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type SelfSubjectReviewClusterExpansion interface{}
diff --git a/kubernetes/typed/authentication/v1alpha1/selfsubjectreview.go b/kubernetes/typed/authentication/v1alpha1/selfsubjectreview.go
index f45323efb..ca8da0987 100644
--- a/kubernetes/typed/authentication/v1alpha1/selfsubjectreview.go
+++ b/kubernetes/typed/authentication/v1alpha1/selfsubjectreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
+	authenticationv1alpha1 "k8s.io/client-go/kubernetes/typed/authentication/v1alpha1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authenticationv1alpha1client "k8s.io/client-go/kubernetes/typed/authentication/v1alpha1"
 )
 
 // SelfSubjectReviewsClusterGetter has a method to return a SelfSubjectReviewClusterInterface.
@@ -34,17 +31,20 @@ type SelfSubjectReviewsClusterGetter interface {
 	SelfSubjectReviews() SelfSubjectReviewClusterInterface
 }
 
-// SelfSubjectReviewClusterInterface can scope down to one cluster and return a authenticationv1alpha1client.SelfSubjectReviewInterface.
+// SelfSubjectReviewClusterInterface can operate on SelfSubjectReviews across all clusters,
+// or scope down to one cluster and return a authenticationv1alpha1.SelfSubjectReviewInterface.
 type SelfSubjectReviewClusterInterface interface {
-	Cluster(logicalcluster.Path) authenticationv1alpha1client.SelfSubjectReviewInterface
+	Cluster(logicalcluster.Path) authenticationv1alpha1.SelfSubjectReviewInterface
+
+	SelfSubjectReviewClusterExpansion
 }
 
 type selfSubjectReviewsClusterInterface struct {
-	clientCache kcpclient.Cache[*authenticationv1alpha1client.AuthenticationV1alpha1Client]
+	clientCache kcpclient.Cache[*authenticationv1alpha1.AuthenticationV1alpha1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *selfSubjectReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authenticationv1alpha1client.SelfSubjectReviewInterface {
+func (c *selfSubjectReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authenticationv1alpha1.SelfSubjectReviewInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
diff --git a/kubernetes/typed/authentication/v1beta1/authentication_client.go b/kubernetes/typed/authentication/v1beta1/authentication_client.go
index fbd86de9c..41d5f6b98 100644
--- a/kubernetes/typed/authentication/v1beta1/authentication_client.go
+++ b/kubernetes/typed/authentication/v1beta1/authentication_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,22 +14,25 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiauthenticationv1beta1 "k8s.io/api/authentication/v1beta1"
+	authenticationv1beta1 "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authenticationv1beta1 "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type AuthenticationV1beta1ClusterInterface interface {
 	AuthenticationV1beta1ClusterScoper
+	SelfSubjectReviewsClusterGetter
 	TokenReviewsClusterGetter
 }
 
@@ -40,6 +40,7 @@ type AuthenticationV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) authenticationv1beta1.AuthenticationV1beta1Interface
 }
 
+// AuthenticationV1beta1ClusterClient is used to interact with features provided by the authentication.k8s.io group.
 type AuthenticationV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*authenticationv1beta1.AuthenticationV1beta1Client]
 }
@@ -51,6 +52,10 @@ func (c *AuthenticationV1beta1ClusterClient) Cluster(clusterPath logicalcluster.
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
+func (c *AuthenticationV1beta1ClusterClient) SelfSubjectReviews() SelfSubjectReviewClusterInterface {
+	return &selfSubjectReviewsClusterInterface{clientCache: c.clientCache}
+}
+
 func (c *AuthenticationV1beta1ClusterClient) TokenReviews() TokenReviewClusterInterface {
 	return &tokenReviewsClusterInterface{clientCache: c.clientCache}
 }
@@ -59,11 +64,13 @@ func (c *AuthenticationV1beta1ClusterClient) TokenReviews() TokenReviewClusterIn
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AuthenticationV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AuthenticationV1beta1ClusterClient for the given config and http client.
@@ -75,6 +82,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AuthenticationV1bet
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AuthenticationV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +95,14 @@ func NewForConfigOrDie(c *rest.Config) *AuthenticationV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiauthenticationv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/authentication/v1beta1/doc.go b/kubernetes/typed/authentication/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/authentication/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/authentication/v1beta1/fake/authentication_client.go b/kubernetes/typed/authentication/v1beta1/fake/authentication_client.go
index c7c0de0fd..2bdc25673 100644
--- a/kubernetes/typed/authentication/v1beta1/fake/authentication_client.go
+++ b/kubernetes/typed/authentication/v1beta1/fake/authentication_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authenticationv1beta1 "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpauthenticationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpauthenticationv1beta1.AuthenticationV1beta1ClusterInterface = (*AuthenticationV1beta1ClusterClient)(nil)
@@ -44,22 +40,30 @@ func (c *AuthenticationV1beta1ClusterClient) Cluster(clusterPath logicalcluster.
 	return &AuthenticationV1beta1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *AuthenticationV1beta1ClusterClient) TokenReviews() kcpauthenticationv1beta1.TokenReviewClusterInterface {
-	return &tokenReviewsClusterClient{Fake: c.Fake}
+func (c *AuthenticationV1beta1ClusterClient) SelfSubjectReviews() kcpauthenticationv1beta1.SelfSubjectReviewClusterInterface {
+	return newFakeSelfSubjectReviewClusterClient(c)
 }
 
-var _ authenticationv1beta1.AuthenticationV1beta1Interface = (*AuthenticationV1beta1Client)(nil)
+func (c *AuthenticationV1beta1ClusterClient) TokenReviews() kcpauthenticationv1beta1.TokenReviewClusterInterface {
+	return newFakeTokenReviewClusterClient(c)
+}
 
 type AuthenticationV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *AuthenticationV1beta1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *AuthenticationV1beta1Client) SelfSubjectReviews() authenticationv1beta1.SelfSubjectReviewInterface {
+	return newFakeSelfSubjectReviewClient(c.Fake, c.ClusterPath)
 }
 
 func (c *AuthenticationV1beta1Client) TokenReviews() authenticationv1beta1.TokenReviewInterface {
-	return &tokenReviewsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakeTokenReviewClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AuthenticationV1beta1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/authentication/v1beta1/fake/doc.go b/kubernetes/typed/authentication/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/authentication/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/authentication/v1beta1/fake/selfsubjectreview.go b/kubernetes/typed/authentication/v1beta1/fake/selfsubjectreview.go
new file mode 100644
index 000000000..5a5d61b22
--- /dev/null
+++ b/kubernetes/typed/authentication/v1beta1/fake/selfsubjectreview.go
@@ -0,0 +1,73 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	authenticationv1beta1 "k8s.io/api/authentication/v1beta1"
+	typedauthenticationv1beta1 "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
+
+	typedkcpauthenticationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// selfSubjectReviewClusterClient implements SelfSubjectReviewClusterInterface
+type selfSubjectReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authenticationv1beta1.SelfSubjectReview]
+	Fake *kcptesting.Fake
+}
+
+func newFakeSelfSubjectReviewClusterClient(fake *AuthenticationV1beta1ClusterClient) typedkcpauthenticationv1beta1.SelfSubjectReviewClusterInterface {
+	return &selfSubjectReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authenticationv1beta1.SelfSubjectReview](
+			fake.Fake,
+			authenticationv1beta1.SchemeGroupVersion.WithResource("selfsubjectreviews"),
+			authenticationv1beta1.SchemeGroupVersion.WithKind("SelfSubjectReview"),
+			func() *authenticationv1beta1.SelfSubjectReview { return &authenticationv1beta1.SelfSubjectReview{} },
+		),
+		fake.Fake,
+	}
+}
+
+func (c *selfSubjectReviewClusterClient) Cluster(cluster logicalcluster.Path) typedauthenticationv1beta1.SelfSubjectReviewInterface {
+	return newFakeSelfSubjectReviewClient(c.Fake, cluster)
+}
+
+// selfSubjectReviewScopedClient implements SelfSubjectReviewInterface
+type selfSubjectReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authenticationv1beta1.SelfSubjectReview]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeSelfSubjectReviewClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedauthenticationv1beta1.SelfSubjectReviewInterface {
+	return &selfSubjectReviewScopedClient{
+		kcpgentype.NewFakeClient[*authenticationv1beta1.SelfSubjectReview](
+			fake,
+			clusterPath,
+			"",
+			authenticationv1beta1.SchemeGroupVersion.WithResource("selfsubjectreviews"),
+			authenticationv1beta1.SchemeGroupVersion.WithKind("SelfSubjectReview"),
+			func() *authenticationv1beta1.SelfSubjectReview { return &authenticationv1beta1.SelfSubjectReview{} },
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/authentication/v1beta1/fake/tokenreview.go b/kubernetes/typed/authentication/v1beta1/fake/tokenreview.go
index 6ba647f8a..dcadf80b7 100644
--- a/kubernetes/typed/authentication/v1beta1/fake/tokenreview.go
+++ b/kubernetes/typed/authentication/v1beta1/fake/tokenreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,48 +14,60 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authenticationv1beta1 "k8s.io/api/authentication/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	authenticationv1beta1client "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
+	typedauthenticationv1beta1 "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
 
+	typedkcpauthenticationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authentication/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var tokenReviewsResource = schema.GroupVersionResource{Group: "authentication.k8s.io", Version: "v1beta1", Resource: "tokenreviews"}
-var tokenReviewsKind = schema.GroupVersionKind{Group: "authentication.k8s.io", Version: "v1beta1", Kind: "TokenReview"}
-
-type tokenReviewsClusterClient struct {
-	*kcptesting.Fake
+// tokenReviewClusterClient implements TokenReviewClusterInterface
+type tokenReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authenticationv1beta1.TokenReview]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *tokenReviewsClusterClient) Cluster(clusterPath logicalcluster.Path) authenticationv1beta1client.TokenReviewInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeTokenReviewClusterClient(fake *AuthenticationV1beta1ClusterClient) typedkcpauthenticationv1beta1.TokenReviewClusterInterface {
+	return &tokenReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authenticationv1beta1.TokenReview](
+			fake.Fake,
+			authenticationv1beta1.SchemeGroupVersion.WithResource("tokenreviews"),
+			authenticationv1beta1.SchemeGroupVersion.WithKind("TokenReview"),
+			func() *authenticationv1beta1.TokenReview { return &authenticationv1beta1.TokenReview{} },
+		),
+		fake.Fake,
 	}
+}
 
-	return &tokenReviewsClient{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *tokenReviewClusterClient) Cluster(cluster logicalcluster.Path) typedauthenticationv1beta1.TokenReviewInterface {
+	return newFakeTokenReviewClient(c.Fake, cluster)
 }
 
-type tokenReviewsClient struct {
-	*kcptesting.Fake
+// tokenReviewScopedClient implements TokenReviewInterface
+type tokenReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authenticationv1beta1.TokenReview]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *tokenReviewsClient) Create(ctx context.Context, tokenReview *authenticationv1beta1.TokenReview, opts metav1.CreateOptions) (*authenticationv1beta1.TokenReview, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(tokenReviewsResource, c.ClusterPath, tokenReview), &authenticationv1beta1.TokenReview{})
-	if obj == nil {
-		return nil, err
+func newFakeTokenReviewClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedauthenticationv1beta1.TokenReviewInterface {
+	return &tokenReviewScopedClient{
+		kcpgentype.NewFakeClient[*authenticationv1beta1.TokenReview](
+			fake,
+			clusterPath,
+			"",
+			authenticationv1beta1.SchemeGroupVersion.WithResource("tokenreviews"),
+			authenticationv1beta1.SchemeGroupVersion.WithKind("TokenReview"),
+			func() *authenticationv1beta1.TokenReview { return &authenticationv1beta1.TokenReview{} },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*authenticationv1beta1.TokenReview), err
 }
diff --git a/kubernetes/typed/authentication/v1beta1/generated_expansion.go b/kubernetes/typed/authentication/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..797d42095
--- /dev/null
+++ b/kubernetes/typed/authentication/v1beta1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type SelfSubjectReviewClusterExpansion interface{}
+
+type TokenReviewClusterExpansion interface{}
diff --git a/kubernetes/typed/authentication/v1beta1/selfsubjectreview.go b/kubernetes/typed/authentication/v1beta1/selfsubjectreview.go
new file mode 100644
index 000000000..ad9b261ac
--- /dev/null
+++ b/kubernetes/typed/authentication/v1beta1/selfsubjectreview.go
@@ -0,0 +1,53 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	authenticationv1beta1 "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// SelfSubjectReviewsClusterGetter has a method to return a SelfSubjectReviewClusterInterface.
+// A group's cluster client should implement this interface.
+type SelfSubjectReviewsClusterGetter interface {
+	SelfSubjectReviews() SelfSubjectReviewClusterInterface
+}
+
+// SelfSubjectReviewClusterInterface can operate on SelfSubjectReviews across all clusters,
+// or scope down to one cluster and return a authenticationv1beta1.SelfSubjectReviewInterface.
+type SelfSubjectReviewClusterInterface interface {
+	Cluster(logicalcluster.Path) authenticationv1beta1.SelfSubjectReviewInterface
+
+	SelfSubjectReviewClusterExpansion
+}
+
+type selfSubjectReviewsClusterInterface struct {
+	clientCache kcpclient.Cache[*authenticationv1beta1.AuthenticationV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *selfSubjectReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authenticationv1beta1.SelfSubjectReviewInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).SelfSubjectReviews()
+}
diff --git a/kubernetes/typed/authentication/v1beta1/tokenreview.go b/kubernetes/typed/authentication/v1beta1/tokenreview.go
index 99c5b8b09..94920cc20 100644
--- a/kubernetes/typed/authentication/v1beta1/tokenreview.go
+++ b/kubernetes/typed/authentication/v1beta1/tokenreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
+	authenticationv1beta1 "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authenticationv1beta1client "k8s.io/client-go/kubernetes/typed/authentication/v1beta1"
 )
 
 // TokenReviewsClusterGetter has a method to return a TokenReviewClusterInterface.
@@ -34,17 +31,20 @@ type TokenReviewsClusterGetter interface {
 	TokenReviews() TokenReviewClusterInterface
 }
 
-// TokenReviewClusterInterface can scope down to one cluster and return a authenticationv1beta1client.TokenReviewInterface.
+// TokenReviewClusterInterface can operate on TokenReviews across all clusters,
+// or scope down to one cluster and return a authenticationv1beta1.TokenReviewInterface.
 type TokenReviewClusterInterface interface {
-	Cluster(logicalcluster.Path) authenticationv1beta1client.TokenReviewInterface
+	Cluster(logicalcluster.Path) authenticationv1beta1.TokenReviewInterface
+
+	TokenReviewClusterExpansion
 }
 
 type tokenReviewsClusterInterface struct {
-	clientCache kcpclient.Cache[*authenticationv1beta1client.AuthenticationV1beta1Client]
+	clientCache kcpclient.Cache[*authenticationv1beta1.AuthenticationV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *tokenReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authenticationv1beta1client.TokenReviewInterface {
+func (c *tokenReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authenticationv1beta1.TokenReviewInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
diff --git a/kubernetes/typed/authorization/v1/authorization_client.go b/kubernetes/typed/authorization/v1/authorization_client.go
index 8f2d71a3f..db1bc60b9 100644
--- a/kubernetes/typed/authorization/v1/authorization_client.go
+++ b/kubernetes/typed/authorization/v1/authorization_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,32 +14,35 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiauthorizationv1 "k8s.io/api/authorization/v1"
+	authorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
-	"k8s.io/client-go/rest"
 )
 
 type AuthorizationV1ClusterInterface interface {
 	AuthorizationV1ClusterScoper
-	SubjectAccessReviewsClusterGetter
-	SelfSubjectAccessReviewsClusterGetter
 	LocalSubjectAccessReviewsClusterGetter
+	SelfSubjectAccessReviewsClusterGetter
 	SelfSubjectRulesReviewsClusterGetter
+	SubjectAccessReviewsClusterGetter
 }
 
 type AuthorizationV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) authorizationv1.AuthorizationV1Interface
 }
 
+// AuthorizationV1ClusterClient is used to interact with features provided by the authorization.k8s.io group.
 type AuthorizationV1ClusterClient struct {
 	clientCache kcpclient.Cache[*authorizationv1.AuthorizationV1Client]
 }
@@ -54,31 +54,33 @@ func (c *AuthorizationV1ClusterClient) Cluster(clusterPath logicalcluster.Path)
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *AuthorizationV1ClusterClient) SubjectAccessReviews() SubjectAccessReviewClusterInterface {
-	return &subjectAccessReviewsClusterInterface{clientCache: c.clientCache}
+func (c *AuthorizationV1ClusterClient) LocalSubjectAccessReviews() LocalSubjectAccessReviewClusterInterface {
+	return &localSubjectAccessReviewsClusterInterface{clientCache: c.clientCache}
 }
 
 func (c *AuthorizationV1ClusterClient) SelfSubjectAccessReviews() SelfSubjectAccessReviewClusterInterface {
 	return &selfSubjectAccessReviewsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *AuthorizationV1ClusterClient) LocalSubjectAccessReviews() LocalSubjectAccessReviewClusterInterface {
-	return &localSubjectAccessReviewsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *AuthorizationV1ClusterClient) SelfSubjectRulesReviews() SelfSubjectRulesReviewClusterInterface {
 	return &selfSubjectRulesReviewsClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *AuthorizationV1ClusterClient) SubjectAccessReviews() SubjectAccessReviewClusterInterface {
+	return &subjectAccessReviewsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new AuthorizationV1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AuthorizationV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AuthorizationV1ClusterClient for the given config and http client.
@@ -90,6 +92,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AuthorizationV1Clus
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AuthorizationV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -102,3 +105,14 @@ func NewForConfigOrDie(c *rest.Config) *AuthorizationV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiauthorizationv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/authorization/v1/doc.go b/kubernetes/typed/authorization/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/authorization/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/authorization/v1/fake/authorization_client.go b/kubernetes/typed/authorization/v1/fake/authorization_client.go
index 313d6f1f2..b8b0babff 100644
--- a/kubernetes/typed/authorization/v1/fake/authorization_client.go
+++ b/kubernetes/typed/authorization/v1/fake/authorization_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpauthorizationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpauthorizationv1.AuthorizationV1ClusterInterface = (*AuthorizationV1ClusterClient)(nil)
@@ -44,46 +40,46 @@ func (c *AuthorizationV1ClusterClient) Cluster(clusterPath logicalcluster.Path)
 	return &AuthorizationV1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *AuthorizationV1ClusterClient) SubjectAccessReviews() kcpauthorizationv1.SubjectAccessReviewClusterInterface {
-	return &subjectAccessReviewsClusterClient{Fake: c.Fake}
+func (c *AuthorizationV1ClusterClient) LocalSubjectAccessReviews() kcpauthorizationv1.LocalSubjectAccessReviewClusterInterface {
+	return newFakeLocalSubjectAccessReviewClusterClient(c)
 }
 
 func (c *AuthorizationV1ClusterClient) SelfSubjectAccessReviews() kcpauthorizationv1.SelfSubjectAccessReviewClusterInterface {
-	return &selfSubjectAccessReviewsClusterClient{Fake: c.Fake}
-}
-
-func (c *AuthorizationV1ClusterClient) LocalSubjectAccessReviews() kcpauthorizationv1.LocalSubjectAccessReviewClusterInterface {
-	return &localSubjectAccessReviewsClusterClient{Fake: c.Fake}
+	return newFakeSelfSubjectAccessReviewClusterClient(c)
 }
 
 func (c *AuthorizationV1ClusterClient) SelfSubjectRulesReviews() kcpauthorizationv1.SelfSubjectRulesReviewClusterInterface {
-	return &selfSubjectRulesReviewsClusterClient{Fake: c.Fake}
+	return newFakeSelfSubjectRulesReviewClusterClient(c)
 }
 
-var _ authorizationv1.AuthorizationV1Interface = (*AuthorizationV1Client)(nil)
+func (c *AuthorizationV1ClusterClient) SubjectAccessReviews() kcpauthorizationv1.SubjectAccessReviewClusterInterface {
+	return newFakeSubjectAccessReviewClusterClient(c)
+}
 
 type AuthorizationV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *AuthorizationV1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *AuthorizationV1Client) LocalSubjectAccessReviews(namespace string) authorizationv1.LocalSubjectAccessReviewInterface {
+	return newFakeLocalSubjectAccessReviewClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AuthorizationV1Client) SubjectAccessReviews() authorizationv1.SubjectAccessReviewInterface {
-	return &subjectAccessReviewsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *AuthorizationV1Client) SelfSubjectAccessReviews() authorizationv1.SelfSubjectAccessReviewInterface {
+	return newFakeSelfSubjectAccessReviewClient(c.Fake, c.ClusterPath)
 }
 
-func (c *AuthorizationV1Client) SelfSubjectAccessReviews() authorizationv1.SelfSubjectAccessReviewInterface {
-	return &selfSubjectAccessReviewsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *AuthorizationV1Client) SelfSubjectRulesReviews() authorizationv1.SelfSubjectRulesReviewInterface {
+	return newFakeSelfSubjectRulesReviewClient(c.Fake, c.ClusterPath)
 }
 
-func (c *AuthorizationV1Client) LocalSubjectAccessReviews(namespace string) authorizationv1.LocalSubjectAccessReviewInterface {
-	return &localSubjectAccessReviewsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *AuthorizationV1Client) SubjectAccessReviews() authorizationv1.SubjectAccessReviewInterface {
+	return newFakeSubjectAccessReviewClient(c.Fake, c.ClusterPath)
 }
 
-func (c *AuthorizationV1Client) SelfSubjectRulesReviews() authorizationv1.SelfSubjectRulesReviewInterface {
-	return &selfSubjectRulesReviewsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AuthorizationV1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/authorization/v1/fake/doc.go b/kubernetes/typed/authorization/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/authorization/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/authorization/v1/fake/localsubjectaccessreview.go b/kubernetes/typed/authorization/v1/fake/localsubjectaccessreview.go
index 8c7c6b6d1..4bf6aff68 100644
--- a/kubernetes/typed/authorization/v1/fake/localsubjectaccessreview.go
+++ b/kubernetes/typed/authorization/v1/fake/localsubjectaccessreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,59 +14,69 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authorizationv1 "k8s.io/api/authorization/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	authorizationv1client "k8s.io/client-go/kubernetes/typed/authorization/v1"
+	typedauthorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
 
-	kcpauthorizationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1"
+	typedkcpauthorizationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var localSubjectAccessReviewsResource = schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1", Resource: "localsubjectaccessreviews"}
-var localSubjectAccessReviewsKind = schema.GroupVersionKind{Group: "authorization.k8s.io", Version: "v1", Kind: "LocalSubjectAccessReview"}
-
-type localSubjectAccessReviewsClusterClient struct {
-	*kcptesting.Fake
+// localSubjectAccessReviewClusterClient implements LocalSubjectAccessReviewClusterInterface
+type localSubjectAccessReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authorizationv1.LocalSubjectAccessReview]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *localSubjectAccessReviewsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpauthorizationv1.LocalSubjectAccessReviewsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeLocalSubjectAccessReviewClusterClient(fake *AuthorizationV1ClusterClient) typedkcpauthorizationv1.LocalSubjectAccessReviewClusterInterface {
+	return &localSubjectAccessReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authorizationv1.LocalSubjectAccessReview](
+			fake.Fake,
+			authorizationv1.SchemeGroupVersion.WithResource("localsubjectaccessreviews"),
+			authorizationv1.SchemeGroupVersion.WithKind("LocalSubjectAccessReview"),
+			func() *authorizationv1.LocalSubjectAccessReview { return &authorizationv1.LocalSubjectAccessReview{} },
+		),
+		fake.Fake,
 	}
+}
 
-	return &localSubjectAccessReviewsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *localSubjectAccessReviewClusterClient) Cluster(cluster logicalcluster.Path) typedkcpauthorizationv1.LocalSubjectAccessReviewsNamespacer {
+	return &localSubjectAccessReviewNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type localSubjectAccessReviewsNamespacer struct {
+type localSubjectAccessReviewNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *localSubjectAccessReviewsNamespacer) Namespace(namespace string) authorizationv1client.LocalSubjectAccessReviewInterface {
-	return &localSubjectAccessReviewsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *localSubjectAccessReviewNamespacer) Namespace(namespace string) typedauthorizationv1.LocalSubjectAccessReviewInterface {
+	return newFakeLocalSubjectAccessReviewClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type localSubjectAccessReviewsClient struct {
-	*kcptesting.Fake
+// localSubjectAccessReviewScopedClient implements LocalSubjectAccessReviewInterface
+type localSubjectAccessReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authorizationv1.LocalSubjectAccessReview]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
 }
 
-func (c *localSubjectAccessReviewsClient) Create(ctx context.Context, localSubjectAccessReview *authorizationv1.LocalSubjectAccessReview, opts metav1.CreateOptions) (*authorizationv1.LocalSubjectAccessReview, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(localSubjectAccessReviewsResource, c.ClusterPath, c.Namespace, localSubjectAccessReview), &authorizationv1.LocalSubjectAccessReview{})
-	if obj == nil {
-		return nil, err
+func newFakeLocalSubjectAccessReviewClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedauthorizationv1.LocalSubjectAccessReviewInterface {
+	return &localSubjectAccessReviewScopedClient{
+		kcpgentype.NewFakeClient[*authorizationv1.LocalSubjectAccessReview](
+			fake,
+			clusterPath,
+			namespace,
+			authorizationv1.SchemeGroupVersion.WithResource("localsubjectaccessreviews"),
+			authorizationv1.SchemeGroupVersion.WithKind("LocalSubjectAccessReview"),
+			func() *authorizationv1.LocalSubjectAccessReview { return &authorizationv1.LocalSubjectAccessReview{} },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*authorizationv1.LocalSubjectAccessReview), err
 }
diff --git a/kubernetes/typed/authorization/v1/fake/selfsubjectaccessreview.go b/kubernetes/typed/authorization/v1/fake/selfsubjectaccessreview.go
index d48fa6eb4..25f72908f 100644
--- a/kubernetes/typed/authorization/v1/fake/selfsubjectaccessreview.go
+++ b/kubernetes/typed/authorization/v1/fake/selfsubjectaccessreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,48 +14,60 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authorizationv1 "k8s.io/api/authorization/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	authorizationv1client "k8s.io/client-go/kubernetes/typed/authorization/v1"
+	typedauthorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
 
+	typedkcpauthorizationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var selfSubjectAccessReviewsResource = schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1", Resource: "selfsubjectaccessreviews"}
-var selfSubjectAccessReviewsKind = schema.GroupVersionKind{Group: "authorization.k8s.io", Version: "v1", Kind: "SelfSubjectAccessReview"}
-
-type selfSubjectAccessReviewsClusterClient struct {
-	*kcptesting.Fake
+// selfSubjectAccessReviewClusterClient implements SelfSubjectAccessReviewClusterInterface
+type selfSubjectAccessReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authorizationv1.SelfSubjectAccessReview]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *selfSubjectAccessReviewsClusterClient) Cluster(clusterPath logicalcluster.Path) authorizationv1client.SelfSubjectAccessReviewInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeSelfSubjectAccessReviewClusterClient(fake *AuthorizationV1ClusterClient) typedkcpauthorizationv1.SelfSubjectAccessReviewClusterInterface {
+	return &selfSubjectAccessReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authorizationv1.SelfSubjectAccessReview](
+			fake.Fake,
+			authorizationv1.SchemeGroupVersion.WithResource("selfsubjectaccessreviews"),
+			authorizationv1.SchemeGroupVersion.WithKind("SelfSubjectAccessReview"),
+			func() *authorizationv1.SelfSubjectAccessReview { return &authorizationv1.SelfSubjectAccessReview{} },
+		),
+		fake.Fake,
 	}
+}
 
-	return &selfSubjectAccessReviewsClient{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *selfSubjectAccessReviewClusterClient) Cluster(cluster logicalcluster.Path) typedauthorizationv1.SelfSubjectAccessReviewInterface {
+	return newFakeSelfSubjectAccessReviewClient(c.Fake, cluster)
 }
 
-type selfSubjectAccessReviewsClient struct {
-	*kcptesting.Fake
+// selfSubjectAccessReviewScopedClient implements SelfSubjectAccessReviewInterface
+type selfSubjectAccessReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authorizationv1.SelfSubjectAccessReview]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *selfSubjectAccessReviewsClient) Create(ctx context.Context, selfSubjectAccessReview *authorizationv1.SelfSubjectAccessReview, opts metav1.CreateOptions) (*authorizationv1.SelfSubjectAccessReview, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(selfSubjectAccessReviewsResource, c.ClusterPath, selfSubjectAccessReview), &authorizationv1.SelfSubjectAccessReview{})
-	if obj == nil {
-		return nil, err
+func newFakeSelfSubjectAccessReviewClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedauthorizationv1.SelfSubjectAccessReviewInterface {
+	return &selfSubjectAccessReviewScopedClient{
+		kcpgentype.NewFakeClient[*authorizationv1.SelfSubjectAccessReview](
+			fake,
+			clusterPath,
+			"",
+			authorizationv1.SchemeGroupVersion.WithResource("selfsubjectaccessreviews"),
+			authorizationv1.SchemeGroupVersion.WithKind("SelfSubjectAccessReview"),
+			func() *authorizationv1.SelfSubjectAccessReview { return &authorizationv1.SelfSubjectAccessReview{} },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*authorizationv1.SelfSubjectAccessReview), err
 }
diff --git a/kubernetes/typed/authorization/v1/fake/selfsubjectrulesreview.go b/kubernetes/typed/authorization/v1/fake/selfsubjectrulesreview.go
index cd8d79574..156c291d2 100644
--- a/kubernetes/typed/authorization/v1/fake/selfsubjectrulesreview.go
+++ b/kubernetes/typed/authorization/v1/fake/selfsubjectrulesreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,48 +14,60 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authorizationv1 "k8s.io/api/authorization/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	authorizationv1client "k8s.io/client-go/kubernetes/typed/authorization/v1"
+	typedauthorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
 
+	typedkcpauthorizationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var selfSubjectRulesReviewsResource = schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1", Resource: "selfsubjectrulesreviews"}
-var selfSubjectRulesReviewsKind = schema.GroupVersionKind{Group: "authorization.k8s.io", Version: "v1", Kind: "SelfSubjectRulesReview"}
-
-type selfSubjectRulesReviewsClusterClient struct {
-	*kcptesting.Fake
+// selfSubjectRulesReviewClusterClient implements SelfSubjectRulesReviewClusterInterface
+type selfSubjectRulesReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authorizationv1.SelfSubjectRulesReview]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *selfSubjectRulesReviewsClusterClient) Cluster(clusterPath logicalcluster.Path) authorizationv1client.SelfSubjectRulesReviewInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeSelfSubjectRulesReviewClusterClient(fake *AuthorizationV1ClusterClient) typedkcpauthorizationv1.SelfSubjectRulesReviewClusterInterface {
+	return &selfSubjectRulesReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authorizationv1.SelfSubjectRulesReview](
+			fake.Fake,
+			authorizationv1.SchemeGroupVersion.WithResource("selfsubjectrulesreviews"),
+			authorizationv1.SchemeGroupVersion.WithKind("SelfSubjectRulesReview"),
+			func() *authorizationv1.SelfSubjectRulesReview { return &authorizationv1.SelfSubjectRulesReview{} },
+		),
+		fake.Fake,
 	}
+}
 
-	return &selfSubjectRulesReviewsClient{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *selfSubjectRulesReviewClusterClient) Cluster(cluster logicalcluster.Path) typedauthorizationv1.SelfSubjectRulesReviewInterface {
+	return newFakeSelfSubjectRulesReviewClient(c.Fake, cluster)
 }
 
-type selfSubjectRulesReviewsClient struct {
-	*kcptesting.Fake
+// selfSubjectRulesReviewScopedClient implements SelfSubjectRulesReviewInterface
+type selfSubjectRulesReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authorizationv1.SelfSubjectRulesReview]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *selfSubjectRulesReviewsClient) Create(ctx context.Context, selfSubjectRulesReview *authorizationv1.SelfSubjectRulesReview, opts metav1.CreateOptions) (*authorizationv1.SelfSubjectRulesReview, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(selfSubjectRulesReviewsResource, c.ClusterPath, selfSubjectRulesReview), &authorizationv1.SelfSubjectRulesReview{})
-	if obj == nil {
-		return nil, err
+func newFakeSelfSubjectRulesReviewClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedauthorizationv1.SelfSubjectRulesReviewInterface {
+	return &selfSubjectRulesReviewScopedClient{
+		kcpgentype.NewFakeClient[*authorizationv1.SelfSubjectRulesReview](
+			fake,
+			clusterPath,
+			"",
+			authorizationv1.SchemeGroupVersion.WithResource("selfsubjectrulesreviews"),
+			authorizationv1.SchemeGroupVersion.WithKind("SelfSubjectRulesReview"),
+			func() *authorizationv1.SelfSubjectRulesReview { return &authorizationv1.SelfSubjectRulesReview{} },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*authorizationv1.SelfSubjectRulesReview), err
 }
diff --git a/kubernetes/typed/authorization/v1/fake/subjectaccessreview.go b/kubernetes/typed/authorization/v1/fake/subjectaccessreview.go
index c60dc0527..cb81b7cfe 100644
--- a/kubernetes/typed/authorization/v1/fake/subjectaccessreview.go
+++ b/kubernetes/typed/authorization/v1/fake/subjectaccessreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,48 +14,60 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authorizationv1 "k8s.io/api/authorization/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	authorizationv1client "k8s.io/client-go/kubernetes/typed/authorization/v1"
+	typedauthorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
 
+	typedkcpauthorizationv1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var subjectAccessReviewsResource = schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1", Resource: "subjectaccessreviews"}
-var subjectAccessReviewsKind = schema.GroupVersionKind{Group: "authorization.k8s.io", Version: "v1", Kind: "SubjectAccessReview"}
-
-type subjectAccessReviewsClusterClient struct {
-	*kcptesting.Fake
+// subjectAccessReviewClusterClient implements SubjectAccessReviewClusterInterface
+type subjectAccessReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authorizationv1.SubjectAccessReview]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *subjectAccessReviewsClusterClient) Cluster(clusterPath logicalcluster.Path) authorizationv1client.SubjectAccessReviewInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeSubjectAccessReviewClusterClient(fake *AuthorizationV1ClusterClient) typedkcpauthorizationv1.SubjectAccessReviewClusterInterface {
+	return &subjectAccessReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authorizationv1.SubjectAccessReview](
+			fake.Fake,
+			authorizationv1.SchemeGroupVersion.WithResource("subjectaccessreviews"),
+			authorizationv1.SchemeGroupVersion.WithKind("SubjectAccessReview"),
+			func() *authorizationv1.SubjectAccessReview { return &authorizationv1.SubjectAccessReview{} },
+		),
+		fake.Fake,
 	}
+}
 
-	return &subjectAccessReviewsClient{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *subjectAccessReviewClusterClient) Cluster(cluster logicalcluster.Path) typedauthorizationv1.SubjectAccessReviewInterface {
+	return newFakeSubjectAccessReviewClient(c.Fake, cluster)
 }
 
-type subjectAccessReviewsClient struct {
-	*kcptesting.Fake
+// subjectAccessReviewScopedClient implements SubjectAccessReviewInterface
+type subjectAccessReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authorizationv1.SubjectAccessReview]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *subjectAccessReviewsClient) Create(ctx context.Context, subjectAccessReview *authorizationv1.SubjectAccessReview, opts metav1.CreateOptions) (*authorizationv1.SubjectAccessReview, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(subjectAccessReviewsResource, c.ClusterPath, subjectAccessReview), &authorizationv1.SubjectAccessReview{})
-	if obj == nil {
-		return nil, err
+func newFakeSubjectAccessReviewClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedauthorizationv1.SubjectAccessReviewInterface {
+	return &subjectAccessReviewScopedClient{
+		kcpgentype.NewFakeClient[*authorizationv1.SubjectAccessReview](
+			fake,
+			clusterPath,
+			"",
+			authorizationv1.SchemeGroupVersion.WithResource("subjectaccessreviews"),
+			authorizationv1.SchemeGroupVersion.WithKind("SubjectAccessReview"),
+			func() *authorizationv1.SubjectAccessReview { return &authorizationv1.SubjectAccessReview{} },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*authorizationv1.SubjectAccessReview), err
 }
diff --git a/kubernetes/typed/authorization/v1/generated_expansion.go b/kubernetes/typed/authorization/v1/generated_expansion.go
new file mode 100644
index 000000000..4e6b8110d
--- /dev/null
+++ b/kubernetes/typed/authorization/v1/generated_expansion.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type LocalSubjectAccessReviewClusterExpansion interface{}
+
+type SelfSubjectAccessReviewClusterExpansion interface{}
+
+type SelfSubjectRulesReviewClusterExpansion interface{}
+
+type SubjectAccessReviewClusterExpansion interface{}
diff --git a/kubernetes/typed/authorization/v1/localsubjectaccessreview.go b/kubernetes/typed/authorization/v1/localsubjectaccessreview.go
index d26a18714..0fc33a44d 100644
--- a/kubernetes/typed/authorization/v1/localsubjectaccessreview.go
+++ b/kubernetes/typed/authorization/v1/localsubjectaccessreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
+	authorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authorizationv1client "k8s.io/client-go/kubernetes/typed/authorization/v1"
 )
 
 // LocalSubjectAccessReviewsClusterGetter has a method to return a LocalSubjectAccessReviewClusterInterface.
@@ -34,13 +31,16 @@ type LocalSubjectAccessReviewsClusterGetter interface {
 	LocalSubjectAccessReviews() LocalSubjectAccessReviewClusterInterface
 }
 
-// LocalSubjectAccessReviewClusterInterface can scope down to one cluster and return a LocalSubjectAccessReviewsNamespacer.
+// LocalSubjectAccessReviewClusterInterface can operate on LocalSubjectAccessReviews across all clusters,
+// or scope down to one cluster and return a LocalSubjectAccessReviewsNamespacer.
 type LocalSubjectAccessReviewClusterInterface interface {
 	Cluster(logicalcluster.Path) LocalSubjectAccessReviewsNamespacer
+
+	LocalSubjectAccessReviewClusterExpansion
 }
 
 type localSubjectAccessReviewsClusterInterface struct {
-	clientCache kcpclient.Cache[*authorizationv1client.AuthorizationV1Client]
+	clientCache kcpclient.Cache[*authorizationv1.AuthorizationV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -52,16 +52,16 @@ func (c *localSubjectAccessReviewsClusterInterface) Cluster(clusterPath logicalc
 	return &localSubjectAccessReviewsNamespacer{clientCache: c.clientCache, clusterPath: clusterPath}
 }
 
-// LocalSubjectAccessReviewsNamespacer can scope to objects within a namespace, returning a authorizationv1client.LocalSubjectAccessReviewInterface.
+// LocalSubjectAccessReviewsNamespacer can scope to objects within a namespace, returning a authorizationv1.LocalSubjectAccessReviewInterface.
 type LocalSubjectAccessReviewsNamespacer interface {
-	Namespace(string) authorizationv1client.LocalSubjectAccessReviewInterface
+	Namespace(string) authorizationv1.LocalSubjectAccessReviewInterface
 }
 
 type localSubjectAccessReviewsNamespacer struct {
-	clientCache kcpclient.Cache[*authorizationv1client.AuthorizationV1Client]
+	clientCache kcpclient.Cache[*authorizationv1.AuthorizationV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *localSubjectAccessReviewsNamespacer) Namespace(namespace string) authorizationv1client.LocalSubjectAccessReviewInterface {
+func (n *localSubjectAccessReviewsNamespacer) Namespace(namespace string) authorizationv1.LocalSubjectAccessReviewInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).LocalSubjectAccessReviews(namespace)
 }
diff --git a/kubernetes/typed/authorization/v1/selfsubjectaccessreview.go b/kubernetes/typed/authorization/v1/selfsubjectaccessreview.go
index 3c822a2fb..8657316b7 100644
--- a/kubernetes/typed/authorization/v1/selfsubjectaccessreview.go
+++ b/kubernetes/typed/authorization/v1/selfsubjectaccessreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
+	authorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authorizationv1client "k8s.io/client-go/kubernetes/typed/authorization/v1"
 )
 
 // SelfSubjectAccessReviewsClusterGetter has a method to return a SelfSubjectAccessReviewClusterInterface.
@@ -34,17 +31,20 @@ type SelfSubjectAccessReviewsClusterGetter interface {
 	SelfSubjectAccessReviews() SelfSubjectAccessReviewClusterInterface
 }
 
-// SelfSubjectAccessReviewClusterInterface can scope down to one cluster and return a authorizationv1client.SelfSubjectAccessReviewInterface.
+// SelfSubjectAccessReviewClusterInterface can operate on SelfSubjectAccessReviews across all clusters,
+// or scope down to one cluster and return a authorizationv1.SelfSubjectAccessReviewInterface.
 type SelfSubjectAccessReviewClusterInterface interface {
-	Cluster(logicalcluster.Path) authorizationv1client.SelfSubjectAccessReviewInterface
+	Cluster(logicalcluster.Path) authorizationv1.SelfSubjectAccessReviewInterface
+
+	SelfSubjectAccessReviewClusterExpansion
 }
 
 type selfSubjectAccessReviewsClusterInterface struct {
-	clientCache kcpclient.Cache[*authorizationv1client.AuthorizationV1Client]
+	clientCache kcpclient.Cache[*authorizationv1.AuthorizationV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *selfSubjectAccessReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authorizationv1client.SelfSubjectAccessReviewInterface {
+func (c *selfSubjectAccessReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authorizationv1.SelfSubjectAccessReviewInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
diff --git a/kubernetes/typed/authorization/v1/selfsubjectrulesreview.go b/kubernetes/typed/authorization/v1/selfsubjectrulesreview.go
index 72fee4fec..7a0443150 100644
--- a/kubernetes/typed/authorization/v1/selfsubjectrulesreview.go
+++ b/kubernetes/typed/authorization/v1/selfsubjectrulesreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
+	authorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authorizationv1client "k8s.io/client-go/kubernetes/typed/authorization/v1"
 )
 
 // SelfSubjectRulesReviewsClusterGetter has a method to return a SelfSubjectRulesReviewClusterInterface.
@@ -34,17 +31,20 @@ type SelfSubjectRulesReviewsClusterGetter interface {
 	SelfSubjectRulesReviews() SelfSubjectRulesReviewClusterInterface
 }
 
-// SelfSubjectRulesReviewClusterInterface can scope down to one cluster and return a authorizationv1client.SelfSubjectRulesReviewInterface.
+// SelfSubjectRulesReviewClusterInterface can operate on SelfSubjectRulesReviews across all clusters,
+// or scope down to one cluster and return a authorizationv1.SelfSubjectRulesReviewInterface.
 type SelfSubjectRulesReviewClusterInterface interface {
-	Cluster(logicalcluster.Path) authorizationv1client.SelfSubjectRulesReviewInterface
+	Cluster(logicalcluster.Path) authorizationv1.SelfSubjectRulesReviewInterface
+
+	SelfSubjectRulesReviewClusterExpansion
 }
 
 type selfSubjectRulesReviewsClusterInterface struct {
-	clientCache kcpclient.Cache[*authorizationv1client.AuthorizationV1Client]
+	clientCache kcpclient.Cache[*authorizationv1.AuthorizationV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *selfSubjectRulesReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authorizationv1client.SelfSubjectRulesReviewInterface {
+func (c *selfSubjectRulesReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authorizationv1.SelfSubjectRulesReviewInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
diff --git a/kubernetes/typed/authorization/v1/subjectaccessreview.go b/kubernetes/typed/authorization/v1/subjectaccessreview.go
index 2b5b79a48..1e8b6d350 100644
--- a/kubernetes/typed/authorization/v1/subjectaccessreview.go
+++ b/kubernetes/typed/authorization/v1/subjectaccessreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
+	authorizationv1 "k8s.io/client-go/kubernetes/typed/authorization/v1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authorizationv1client "k8s.io/client-go/kubernetes/typed/authorization/v1"
 )
 
 // SubjectAccessReviewsClusterGetter has a method to return a SubjectAccessReviewClusterInterface.
@@ -34,17 +31,20 @@ type SubjectAccessReviewsClusterGetter interface {
 	SubjectAccessReviews() SubjectAccessReviewClusterInterface
 }
 
-// SubjectAccessReviewClusterInterface can scope down to one cluster and return a authorizationv1client.SubjectAccessReviewInterface.
+// SubjectAccessReviewClusterInterface can operate on SubjectAccessReviews across all clusters,
+// or scope down to one cluster and return a authorizationv1.SubjectAccessReviewInterface.
 type SubjectAccessReviewClusterInterface interface {
-	Cluster(logicalcluster.Path) authorizationv1client.SubjectAccessReviewInterface
+	Cluster(logicalcluster.Path) authorizationv1.SubjectAccessReviewInterface
+
+	SubjectAccessReviewClusterExpansion
 }
 
 type subjectAccessReviewsClusterInterface struct {
-	clientCache kcpclient.Cache[*authorizationv1client.AuthorizationV1Client]
+	clientCache kcpclient.Cache[*authorizationv1.AuthorizationV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *subjectAccessReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authorizationv1client.SubjectAccessReviewInterface {
+func (c *subjectAccessReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authorizationv1.SubjectAccessReviewInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
diff --git a/kubernetes/typed/authorization/v1beta1/authorization_client.go b/kubernetes/typed/authorization/v1beta1/authorization_client.go
index abe088e0b..8ad33fd76 100644
--- a/kubernetes/typed/authorization/v1beta1/authorization_client.go
+++ b/kubernetes/typed/authorization/v1beta1/authorization_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,32 +14,35 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiauthorizationv1beta1 "k8s.io/api/authorization/v1beta1"
+	authorizationv1beta1 "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authorizationv1beta1 "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type AuthorizationV1beta1ClusterInterface interface {
 	AuthorizationV1beta1ClusterScoper
-	SubjectAccessReviewsClusterGetter
-	SelfSubjectAccessReviewsClusterGetter
 	LocalSubjectAccessReviewsClusterGetter
+	SelfSubjectAccessReviewsClusterGetter
 	SelfSubjectRulesReviewsClusterGetter
+	SubjectAccessReviewsClusterGetter
 }
 
 type AuthorizationV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) authorizationv1beta1.AuthorizationV1beta1Interface
 }
 
+// AuthorizationV1beta1ClusterClient is used to interact with features provided by the authorization.k8s.io group.
 type AuthorizationV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*authorizationv1beta1.AuthorizationV1beta1Client]
 }
@@ -54,31 +54,33 @@ func (c *AuthorizationV1beta1ClusterClient) Cluster(clusterPath logicalcluster.P
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *AuthorizationV1beta1ClusterClient) SubjectAccessReviews() SubjectAccessReviewClusterInterface {
-	return &subjectAccessReviewsClusterInterface{clientCache: c.clientCache}
+func (c *AuthorizationV1beta1ClusterClient) LocalSubjectAccessReviews() LocalSubjectAccessReviewClusterInterface {
+	return &localSubjectAccessReviewsClusterInterface{clientCache: c.clientCache}
 }
 
 func (c *AuthorizationV1beta1ClusterClient) SelfSubjectAccessReviews() SelfSubjectAccessReviewClusterInterface {
 	return &selfSubjectAccessReviewsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *AuthorizationV1beta1ClusterClient) LocalSubjectAccessReviews() LocalSubjectAccessReviewClusterInterface {
-	return &localSubjectAccessReviewsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *AuthorizationV1beta1ClusterClient) SelfSubjectRulesReviews() SelfSubjectRulesReviewClusterInterface {
 	return &selfSubjectRulesReviewsClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *AuthorizationV1beta1ClusterClient) SubjectAccessReviews() SubjectAccessReviewClusterInterface {
+	return &subjectAccessReviewsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new AuthorizationV1beta1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AuthorizationV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AuthorizationV1beta1ClusterClient for the given config and http client.
@@ -90,6 +92,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AuthorizationV1beta
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AuthorizationV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -102,3 +105,14 @@ func NewForConfigOrDie(c *rest.Config) *AuthorizationV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiauthorizationv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/authorization/v1beta1/doc.go b/kubernetes/typed/authorization/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/authorization/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/authorization/v1beta1/fake/authorization_client.go b/kubernetes/typed/authorization/v1beta1/fake/authorization_client.go
index d5cb3a504..e59cfde1c 100644
--- a/kubernetes/typed/authorization/v1beta1/fake/authorization_client.go
+++ b/kubernetes/typed/authorization/v1beta1/fake/authorization_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authorizationv1beta1 "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpauthorizationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpauthorizationv1beta1.AuthorizationV1beta1ClusterInterface = (*AuthorizationV1beta1ClusterClient)(nil)
@@ -44,46 +40,46 @@ func (c *AuthorizationV1beta1ClusterClient) Cluster(clusterPath logicalcluster.P
 	return &AuthorizationV1beta1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *AuthorizationV1beta1ClusterClient) SubjectAccessReviews() kcpauthorizationv1beta1.SubjectAccessReviewClusterInterface {
-	return &subjectAccessReviewsClusterClient{Fake: c.Fake}
+func (c *AuthorizationV1beta1ClusterClient) LocalSubjectAccessReviews() kcpauthorizationv1beta1.LocalSubjectAccessReviewClusterInterface {
+	return newFakeLocalSubjectAccessReviewClusterClient(c)
 }
 
 func (c *AuthorizationV1beta1ClusterClient) SelfSubjectAccessReviews() kcpauthorizationv1beta1.SelfSubjectAccessReviewClusterInterface {
-	return &selfSubjectAccessReviewsClusterClient{Fake: c.Fake}
-}
-
-func (c *AuthorizationV1beta1ClusterClient) LocalSubjectAccessReviews() kcpauthorizationv1beta1.LocalSubjectAccessReviewClusterInterface {
-	return &localSubjectAccessReviewsClusterClient{Fake: c.Fake}
+	return newFakeSelfSubjectAccessReviewClusterClient(c)
 }
 
 func (c *AuthorizationV1beta1ClusterClient) SelfSubjectRulesReviews() kcpauthorizationv1beta1.SelfSubjectRulesReviewClusterInterface {
-	return &selfSubjectRulesReviewsClusterClient{Fake: c.Fake}
+	return newFakeSelfSubjectRulesReviewClusterClient(c)
 }
 
-var _ authorizationv1beta1.AuthorizationV1beta1Interface = (*AuthorizationV1beta1Client)(nil)
+func (c *AuthorizationV1beta1ClusterClient) SubjectAccessReviews() kcpauthorizationv1beta1.SubjectAccessReviewClusterInterface {
+	return newFakeSubjectAccessReviewClusterClient(c)
+}
 
 type AuthorizationV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *AuthorizationV1beta1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *AuthorizationV1beta1Client) LocalSubjectAccessReviews(namespace string) authorizationv1beta1.LocalSubjectAccessReviewInterface {
+	return newFakeLocalSubjectAccessReviewClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *AuthorizationV1beta1Client) SubjectAccessReviews() authorizationv1beta1.SubjectAccessReviewInterface {
-	return &subjectAccessReviewsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *AuthorizationV1beta1Client) SelfSubjectAccessReviews() authorizationv1beta1.SelfSubjectAccessReviewInterface {
+	return newFakeSelfSubjectAccessReviewClient(c.Fake, c.ClusterPath)
 }
 
-func (c *AuthorizationV1beta1Client) SelfSubjectAccessReviews() authorizationv1beta1.SelfSubjectAccessReviewInterface {
-	return &selfSubjectAccessReviewsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *AuthorizationV1beta1Client) SelfSubjectRulesReviews() authorizationv1beta1.SelfSubjectRulesReviewInterface {
+	return newFakeSelfSubjectRulesReviewClient(c.Fake, c.ClusterPath)
 }
 
-func (c *AuthorizationV1beta1Client) LocalSubjectAccessReviews(namespace string) authorizationv1beta1.LocalSubjectAccessReviewInterface {
-	return &localSubjectAccessReviewsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *AuthorizationV1beta1Client) SubjectAccessReviews() authorizationv1beta1.SubjectAccessReviewInterface {
+	return newFakeSubjectAccessReviewClient(c.Fake, c.ClusterPath)
 }
 
-func (c *AuthorizationV1beta1Client) SelfSubjectRulesReviews() authorizationv1beta1.SelfSubjectRulesReviewInterface {
-	return &selfSubjectRulesReviewsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *AuthorizationV1beta1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/authorization/v1beta1/fake/doc.go b/kubernetes/typed/authorization/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/authorization/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/authorization/v1beta1/fake/localsubjectaccessreview.go b/kubernetes/typed/authorization/v1beta1/fake/localsubjectaccessreview.go
index 56e81d0cf..a7dea3871 100644
--- a/kubernetes/typed/authorization/v1beta1/fake/localsubjectaccessreview.go
+++ b/kubernetes/typed/authorization/v1beta1/fake/localsubjectaccessreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,59 +14,73 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authorizationv1beta1 "k8s.io/api/authorization/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	authorizationv1beta1client "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+	typedauthorizationv1beta1 "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
 
-	kcpauthorizationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1beta1"
+	typedkcpauthorizationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var localSubjectAccessReviewsResource = schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1beta1", Resource: "localsubjectaccessreviews"}
-var localSubjectAccessReviewsKind = schema.GroupVersionKind{Group: "authorization.k8s.io", Version: "v1beta1", Kind: "LocalSubjectAccessReview"}
-
-type localSubjectAccessReviewsClusterClient struct {
-	*kcptesting.Fake
+// localSubjectAccessReviewClusterClient implements LocalSubjectAccessReviewClusterInterface
+type localSubjectAccessReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authorizationv1beta1.LocalSubjectAccessReview]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *localSubjectAccessReviewsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpauthorizationv1beta1.LocalSubjectAccessReviewsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeLocalSubjectAccessReviewClusterClient(fake *AuthorizationV1beta1ClusterClient) typedkcpauthorizationv1beta1.LocalSubjectAccessReviewClusterInterface {
+	return &localSubjectAccessReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authorizationv1beta1.LocalSubjectAccessReview](
+			fake.Fake,
+			authorizationv1beta1.SchemeGroupVersion.WithResource("localsubjectaccessreviews"),
+			authorizationv1beta1.SchemeGroupVersion.WithKind("LocalSubjectAccessReview"),
+			func() *authorizationv1beta1.LocalSubjectAccessReview {
+				return &authorizationv1beta1.LocalSubjectAccessReview{}
+			},
+		),
+		fake.Fake,
 	}
+}
 
-	return &localSubjectAccessReviewsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *localSubjectAccessReviewClusterClient) Cluster(cluster logicalcluster.Path) typedkcpauthorizationv1beta1.LocalSubjectAccessReviewsNamespacer {
+	return &localSubjectAccessReviewNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type localSubjectAccessReviewsNamespacer struct {
+type localSubjectAccessReviewNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *localSubjectAccessReviewsNamespacer) Namespace(namespace string) authorizationv1beta1client.LocalSubjectAccessReviewInterface {
-	return &localSubjectAccessReviewsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *localSubjectAccessReviewNamespacer) Namespace(namespace string) typedauthorizationv1beta1.LocalSubjectAccessReviewInterface {
+	return newFakeLocalSubjectAccessReviewClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type localSubjectAccessReviewsClient struct {
-	*kcptesting.Fake
+// localSubjectAccessReviewScopedClient implements LocalSubjectAccessReviewInterface
+type localSubjectAccessReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authorizationv1beta1.LocalSubjectAccessReview]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
 }
 
-func (c *localSubjectAccessReviewsClient) Create(ctx context.Context, localSubjectAccessReview *authorizationv1beta1.LocalSubjectAccessReview, opts metav1.CreateOptions) (*authorizationv1beta1.LocalSubjectAccessReview, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(localSubjectAccessReviewsResource, c.ClusterPath, c.Namespace, localSubjectAccessReview), &authorizationv1beta1.LocalSubjectAccessReview{})
-	if obj == nil {
-		return nil, err
+func newFakeLocalSubjectAccessReviewClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedauthorizationv1beta1.LocalSubjectAccessReviewInterface {
+	return &localSubjectAccessReviewScopedClient{
+		kcpgentype.NewFakeClient[*authorizationv1beta1.LocalSubjectAccessReview](
+			fake,
+			clusterPath,
+			namespace,
+			authorizationv1beta1.SchemeGroupVersion.WithResource("localsubjectaccessreviews"),
+			authorizationv1beta1.SchemeGroupVersion.WithKind("LocalSubjectAccessReview"),
+			func() *authorizationv1beta1.LocalSubjectAccessReview {
+				return &authorizationv1beta1.LocalSubjectAccessReview{}
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*authorizationv1beta1.LocalSubjectAccessReview), err
 }
diff --git a/kubernetes/typed/authorization/v1beta1/fake/selfsubjectaccessreview.go b/kubernetes/typed/authorization/v1beta1/fake/selfsubjectaccessreview.go
index 20532577c..4cb0da759 100644
--- a/kubernetes/typed/authorization/v1beta1/fake/selfsubjectaccessreview.go
+++ b/kubernetes/typed/authorization/v1beta1/fake/selfsubjectaccessreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,48 +14,64 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authorizationv1beta1 "k8s.io/api/authorization/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	authorizationv1beta1client "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+	typedauthorizationv1beta1 "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
 
+	typedkcpauthorizationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var selfSubjectAccessReviewsResource = schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1beta1", Resource: "selfsubjectaccessreviews"}
-var selfSubjectAccessReviewsKind = schema.GroupVersionKind{Group: "authorization.k8s.io", Version: "v1beta1", Kind: "SelfSubjectAccessReview"}
-
-type selfSubjectAccessReviewsClusterClient struct {
-	*kcptesting.Fake
+// selfSubjectAccessReviewClusterClient implements SelfSubjectAccessReviewClusterInterface
+type selfSubjectAccessReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authorizationv1beta1.SelfSubjectAccessReview]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *selfSubjectAccessReviewsClusterClient) Cluster(clusterPath logicalcluster.Path) authorizationv1beta1client.SelfSubjectAccessReviewInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeSelfSubjectAccessReviewClusterClient(fake *AuthorizationV1beta1ClusterClient) typedkcpauthorizationv1beta1.SelfSubjectAccessReviewClusterInterface {
+	return &selfSubjectAccessReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authorizationv1beta1.SelfSubjectAccessReview](
+			fake.Fake,
+			authorizationv1beta1.SchemeGroupVersion.WithResource("selfsubjectaccessreviews"),
+			authorizationv1beta1.SchemeGroupVersion.WithKind("SelfSubjectAccessReview"),
+			func() *authorizationv1beta1.SelfSubjectAccessReview {
+				return &authorizationv1beta1.SelfSubjectAccessReview{}
+			},
+		),
+		fake.Fake,
 	}
+}
 
-	return &selfSubjectAccessReviewsClient{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *selfSubjectAccessReviewClusterClient) Cluster(cluster logicalcluster.Path) typedauthorizationv1beta1.SelfSubjectAccessReviewInterface {
+	return newFakeSelfSubjectAccessReviewClient(c.Fake, cluster)
 }
 
-type selfSubjectAccessReviewsClient struct {
-	*kcptesting.Fake
+// selfSubjectAccessReviewScopedClient implements SelfSubjectAccessReviewInterface
+type selfSubjectAccessReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authorizationv1beta1.SelfSubjectAccessReview]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *selfSubjectAccessReviewsClient) Create(ctx context.Context, selfSubjectAccessReview *authorizationv1beta1.SelfSubjectAccessReview, opts metav1.CreateOptions) (*authorizationv1beta1.SelfSubjectAccessReview, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(selfSubjectAccessReviewsResource, c.ClusterPath, selfSubjectAccessReview), &authorizationv1beta1.SelfSubjectAccessReview{})
-	if obj == nil {
-		return nil, err
+func newFakeSelfSubjectAccessReviewClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedauthorizationv1beta1.SelfSubjectAccessReviewInterface {
+	return &selfSubjectAccessReviewScopedClient{
+		kcpgentype.NewFakeClient[*authorizationv1beta1.SelfSubjectAccessReview](
+			fake,
+			clusterPath,
+			"",
+			authorizationv1beta1.SchemeGroupVersion.WithResource("selfsubjectaccessreviews"),
+			authorizationv1beta1.SchemeGroupVersion.WithKind("SelfSubjectAccessReview"),
+			func() *authorizationv1beta1.SelfSubjectAccessReview {
+				return &authorizationv1beta1.SelfSubjectAccessReview{}
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*authorizationv1beta1.SelfSubjectAccessReview), err
 }
diff --git a/kubernetes/typed/authorization/v1beta1/fake/selfsubjectrulesreview.go b/kubernetes/typed/authorization/v1beta1/fake/selfsubjectrulesreview.go
index b6b30161e..88d809d01 100644
--- a/kubernetes/typed/authorization/v1beta1/fake/selfsubjectrulesreview.go
+++ b/kubernetes/typed/authorization/v1beta1/fake/selfsubjectrulesreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,48 +14,64 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authorizationv1beta1 "k8s.io/api/authorization/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	authorizationv1beta1client "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+	typedauthorizationv1beta1 "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
 
+	typedkcpauthorizationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var selfSubjectRulesReviewsResource = schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1beta1", Resource: "selfsubjectrulesreviews"}
-var selfSubjectRulesReviewsKind = schema.GroupVersionKind{Group: "authorization.k8s.io", Version: "v1beta1", Kind: "SelfSubjectRulesReview"}
-
-type selfSubjectRulesReviewsClusterClient struct {
-	*kcptesting.Fake
+// selfSubjectRulesReviewClusterClient implements SelfSubjectRulesReviewClusterInterface
+type selfSubjectRulesReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authorizationv1beta1.SelfSubjectRulesReview]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *selfSubjectRulesReviewsClusterClient) Cluster(clusterPath logicalcluster.Path) authorizationv1beta1client.SelfSubjectRulesReviewInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeSelfSubjectRulesReviewClusterClient(fake *AuthorizationV1beta1ClusterClient) typedkcpauthorizationv1beta1.SelfSubjectRulesReviewClusterInterface {
+	return &selfSubjectRulesReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authorizationv1beta1.SelfSubjectRulesReview](
+			fake.Fake,
+			authorizationv1beta1.SchemeGroupVersion.WithResource("selfsubjectrulesreviews"),
+			authorizationv1beta1.SchemeGroupVersion.WithKind("SelfSubjectRulesReview"),
+			func() *authorizationv1beta1.SelfSubjectRulesReview {
+				return &authorizationv1beta1.SelfSubjectRulesReview{}
+			},
+		),
+		fake.Fake,
 	}
+}
 
-	return &selfSubjectRulesReviewsClient{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *selfSubjectRulesReviewClusterClient) Cluster(cluster logicalcluster.Path) typedauthorizationv1beta1.SelfSubjectRulesReviewInterface {
+	return newFakeSelfSubjectRulesReviewClient(c.Fake, cluster)
 }
 
-type selfSubjectRulesReviewsClient struct {
-	*kcptesting.Fake
+// selfSubjectRulesReviewScopedClient implements SelfSubjectRulesReviewInterface
+type selfSubjectRulesReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authorizationv1beta1.SelfSubjectRulesReview]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *selfSubjectRulesReviewsClient) Create(ctx context.Context, selfSubjectRulesReview *authorizationv1beta1.SelfSubjectRulesReview, opts metav1.CreateOptions) (*authorizationv1beta1.SelfSubjectRulesReview, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(selfSubjectRulesReviewsResource, c.ClusterPath, selfSubjectRulesReview), &authorizationv1beta1.SelfSubjectRulesReview{})
-	if obj == nil {
-		return nil, err
+func newFakeSelfSubjectRulesReviewClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedauthorizationv1beta1.SelfSubjectRulesReviewInterface {
+	return &selfSubjectRulesReviewScopedClient{
+		kcpgentype.NewFakeClient[*authorizationv1beta1.SelfSubjectRulesReview](
+			fake,
+			clusterPath,
+			"",
+			authorizationv1beta1.SchemeGroupVersion.WithResource("selfsubjectrulesreviews"),
+			authorizationv1beta1.SchemeGroupVersion.WithKind("SelfSubjectRulesReview"),
+			func() *authorizationv1beta1.SelfSubjectRulesReview {
+				return &authorizationv1beta1.SelfSubjectRulesReview{}
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*authorizationv1beta1.SelfSubjectRulesReview), err
 }
diff --git a/kubernetes/typed/authorization/v1beta1/fake/subjectaccessreview.go b/kubernetes/typed/authorization/v1beta1/fake/subjectaccessreview.go
index 5ef0ccc70..b9c2b0818 100644
--- a/kubernetes/typed/authorization/v1beta1/fake/subjectaccessreview.go
+++ b/kubernetes/typed/authorization/v1beta1/fake/subjectaccessreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,48 +14,60 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	authorizationv1beta1 "k8s.io/api/authorization/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	authorizationv1beta1client "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+	typedauthorizationv1beta1 "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
 
+	typedkcpauthorizationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/authorization/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var subjectAccessReviewsResource = schema.GroupVersionResource{Group: "authorization.k8s.io", Version: "v1beta1", Resource: "subjectaccessreviews"}
-var subjectAccessReviewsKind = schema.GroupVersionKind{Group: "authorization.k8s.io", Version: "v1beta1", Kind: "SubjectAccessReview"}
-
-type subjectAccessReviewsClusterClient struct {
-	*kcptesting.Fake
+// subjectAccessReviewClusterClient implements SubjectAccessReviewClusterInterface
+type subjectAccessReviewClusterClient struct {
+	*kcpgentype.FakeClusterClient[*authorizationv1beta1.SubjectAccessReview]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *subjectAccessReviewsClusterClient) Cluster(clusterPath logicalcluster.Path) authorizationv1beta1client.SubjectAccessReviewInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeSubjectAccessReviewClusterClient(fake *AuthorizationV1beta1ClusterClient) typedkcpauthorizationv1beta1.SubjectAccessReviewClusterInterface {
+	return &subjectAccessReviewClusterClient{
+		kcpgentype.NewFakeClusterClient[*authorizationv1beta1.SubjectAccessReview](
+			fake.Fake,
+			authorizationv1beta1.SchemeGroupVersion.WithResource("subjectaccessreviews"),
+			authorizationv1beta1.SchemeGroupVersion.WithKind("SubjectAccessReview"),
+			func() *authorizationv1beta1.SubjectAccessReview { return &authorizationv1beta1.SubjectAccessReview{} },
+		),
+		fake.Fake,
 	}
+}
 
-	return &subjectAccessReviewsClient{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *subjectAccessReviewClusterClient) Cluster(cluster logicalcluster.Path) typedauthorizationv1beta1.SubjectAccessReviewInterface {
+	return newFakeSubjectAccessReviewClient(c.Fake, cluster)
 }
 
-type subjectAccessReviewsClient struct {
-	*kcptesting.Fake
+// subjectAccessReviewScopedClient implements SubjectAccessReviewInterface
+type subjectAccessReviewScopedClient struct {
+	*kcpgentype.FakeClient[*authorizationv1beta1.SubjectAccessReview]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *subjectAccessReviewsClient) Create(ctx context.Context, subjectAccessReview *authorizationv1beta1.SubjectAccessReview, opts metav1.CreateOptions) (*authorizationv1beta1.SubjectAccessReview, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(subjectAccessReviewsResource, c.ClusterPath, subjectAccessReview), &authorizationv1beta1.SubjectAccessReview{})
-	if obj == nil {
-		return nil, err
+func newFakeSubjectAccessReviewClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedauthorizationv1beta1.SubjectAccessReviewInterface {
+	return &subjectAccessReviewScopedClient{
+		kcpgentype.NewFakeClient[*authorizationv1beta1.SubjectAccessReview](
+			fake,
+			clusterPath,
+			"",
+			authorizationv1beta1.SchemeGroupVersion.WithResource("subjectaccessreviews"),
+			authorizationv1beta1.SchemeGroupVersion.WithKind("SubjectAccessReview"),
+			func() *authorizationv1beta1.SubjectAccessReview { return &authorizationv1beta1.SubjectAccessReview{} },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*authorizationv1beta1.SubjectAccessReview), err
 }
diff --git a/kubernetes/typed/authorization/v1beta1/generated_expansion.go b/kubernetes/typed/authorization/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..48f2247fe
--- /dev/null
+++ b/kubernetes/typed/authorization/v1beta1/generated_expansion.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type LocalSubjectAccessReviewClusterExpansion interface{}
+
+type SelfSubjectAccessReviewClusterExpansion interface{}
+
+type SelfSubjectRulesReviewClusterExpansion interface{}
+
+type SubjectAccessReviewClusterExpansion interface{}
diff --git a/kubernetes/typed/authorization/v1beta1/localsubjectaccessreview.go b/kubernetes/typed/authorization/v1beta1/localsubjectaccessreview.go
index 2685f60c8..4aaf1bd48 100644
--- a/kubernetes/typed/authorization/v1beta1/localsubjectaccessreview.go
+++ b/kubernetes/typed/authorization/v1beta1/localsubjectaccessreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
+	authorizationv1beta1 "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authorizationv1beta1client "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
 )
 
 // LocalSubjectAccessReviewsClusterGetter has a method to return a LocalSubjectAccessReviewClusterInterface.
@@ -34,13 +31,16 @@ type LocalSubjectAccessReviewsClusterGetter interface {
 	LocalSubjectAccessReviews() LocalSubjectAccessReviewClusterInterface
 }
 
-// LocalSubjectAccessReviewClusterInterface can scope down to one cluster and return a LocalSubjectAccessReviewsNamespacer.
+// LocalSubjectAccessReviewClusterInterface can operate on LocalSubjectAccessReviews across all clusters,
+// or scope down to one cluster and return a LocalSubjectAccessReviewsNamespacer.
 type LocalSubjectAccessReviewClusterInterface interface {
 	Cluster(logicalcluster.Path) LocalSubjectAccessReviewsNamespacer
+
+	LocalSubjectAccessReviewClusterExpansion
 }
 
 type localSubjectAccessReviewsClusterInterface struct {
-	clientCache kcpclient.Cache[*authorizationv1beta1client.AuthorizationV1beta1Client]
+	clientCache kcpclient.Cache[*authorizationv1beta1.AuthorizationV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -52,16 +52,16 @@ func (c *localSubjectAccessReviewsClusterInterface) Cluster(clusterPath logicalc
 	return &localSubjectAccessReviewsNamespacer{clientCache: c.clientCache, clusterPath: clusterPath}
 }
 
-// LocalSubjectAccessReviewsNamespacer can scope to objects within a namespace, returning a authorizationv1beta1client.LocalSubjectAccessReviewInterface.
+// LocalSubjectAccessReviewsNamespacer can scope to objects within a namespace, returning a authorizationv1beta1.LocalSubjectAccessReviewInterface.
 type LocalSubjectAccessReviewsNamespacer interface {
-	Namespace(string) authorizationv1beta1client.LocalSubjectAccessReviewInterface
+	Namespace(string) authorizationv1beta1.LocalSubjectAccessReviewInterface
 }
 
 type localSubjectAccessReviewsNamespacer struct {
-	clientCache kcpclient.Cache[*authorizationv1beta1client.AuthorizationV1beta1Client]
+	clientCache kcpclient.Cache[*authorizationv1beta1.AuthorizationV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *localSubjectAccessReviewsNamespacer) Namespace(namespace string) authorizationv1beta1client.LocalSubjectAccessReviewInterface {
+func (n *localSubjectAccessReviewsNamespacer) Namespace(namespace string) authorizationv1beta1.LocalSubjectAccessReviewInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).LocalSubjectAccessReviews(namespace)
 }
diff --git a/kubernetes/typed/authorization/v1beta1/selfsubjectaccessreview.go b/kubernetes/typed/authorization/v1beta1/selfsubjectaccessreview.go
index 8f9521009..374734181 100644
--- a/kubernetes/typed/authorization/v1beta1/selfsubjectaccessreview.go
+++ b/kubernetes/typed/authorization/v1beta1/selfsubjectaccessreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
+	authorizationv1beta1 "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authorizationv1beta1client "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
 )
 
 // SelfSubjectAccessReviewsClusterGetter has a method to return a SelfSubjectAccessReviewClusterInterface.
@@ -34,17 +31,20 @@ type SelfSubjectAccessReviewsClusterGetter interface {
 	SelfSubjectAccessReviews() SelfSubjectAccessReviewClusterInterface
 }
 
-// SelfSubjectAccessReviewClusterInterface can scope down to one cluster and return a authorizationv1beta1client.SelfSubjectAccessReviewInterface.
+// SelfSubjectAccessReviewClusterInterface can operate on SelfSubjectAccessReviews across all clusters,
+// or scope down to one cluster and return a authorizationv1beta1.SelfSubjectAccessReviewInterface.
 type SelfSubjectAccessReviewClusterInterface interface {
-	Cluster(logicalcluster.Path) authorizationv1beta1client.SelfSubjectAccessReviewInterface
+	Cluster(logicalcluster.Path) authorizationv1beta1.SelfSubjectAccessReviewInterface
+
+	SelfSubjectAccessReviewClusterExpansion
 }
 
 type selfSubjectAccessReviewsClusterInterface struct {
-	clientCache kcpclient.Cache[*authorizationv1beta1client.AuthorizationV1beta1Client]
+	clientCache kcpclient.Cache[*authorizationv1beta1.AuthorizationV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *selfSubjectAccessReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authorizationv1beta1client.SelfSubjectAccessReviewInterface {
+func (c *selfSubjectAccessReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authorizationv1beta1.SelfSubjectAccessReviewInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
diff --git a/kubernetes/typed/authorization/v1beta1/selfsubjectrulesreview.go b/kubernetes/typed/authorization/v1beta1/selfsubjectrulesreview.go
index 45435df32..b73ccff7d 100644
--- a/kubernetes/typed/authorization/v1beta1/selfsubjectrulesreview.go
+++ b/kubernetes/typed/authorization/v1beta1/selfsubjectrulesreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
+	authorizationv1beta1 "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authorizationv1beta1client "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
 )
 
 // SelfSubjectRulesReviewsClusterGetter has a method to return a SelfSubjectRulesReviewClusterInterface.
@@ -34,17 +31,20 @@ type SelfSubjectRulesReviewsClusterGetter interface {
 	SelfSubjectRulesReviews() SelfSubjectRulesReviewClusterInterface
 }
 
-// SelfSubjectRulesReviewClusterInterface can scope down to one cluster and return a authorizationv1beta1client.SelfSubjectRulesReviewInterface.
+// SelfSubjectRulesReviewClusterInterface can operate on SelfSubjectRulesReviews across all clusters,
+// or scope down to one cluster and return a authorizationv1beta1.SelfSubjectRulesReviewInterface.
 type SelfSubjectRulesReviewClusterInterface interface {
-	Cluster(logicalcluster.Path) authorizationv1beta1client.SelfSubjectRulesReviewInterface
+	Cluster(logicalcluster.Path) authorizationv1beta1.SelfSubjectRulesReviewInterface
+
+	SelfSubjectRulesReviewClusterExpansion
 }
 
 type selfSubjectRulesReviewsClusterInterface struct {
-	clientCache kcpclient.Cache[*authorizationv1beta1client.AuthorizationV1beta1Client]
+	clientCache kcpclient.Cache[*authorizationv1beta1.AuthorizationV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *selfSubjectRulesReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authorizationv1beta1client.SelfSubjectRulesReviewInterface {
+func (c *selfSubjectRulesReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authorizationv1beta1.SelfSubjectRulesReviewInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
diff --git a/kubernetes/typed/authorization/v1beta1/subjectaccessreview.go b/kubernetes/typed/authorization/v1beta1/subjectaccessreview.go
index 6b8c0db1e..d8773512d 100644
--- a/kubernetes/typed/authorization/v1beta1/subjectaccessreview.go
+++ b/kubernetes/typed/authorization/v1beta1/subjectaccessreview.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
+	authorizationv1beta1 "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	authorizationv1beta1client "k8s.io/client-go/kubernetes/typed/authorization/v1beta1"
 )
 
 // SubjectAccessReviewsClusterGetter has a method to return a SubjectAccessReviewClusterInterface.
@@ -34,17 +31,20 @@ type SubjectAccessReviewsClusterGetter interface {
 	SubjectAccessReviews() SubjectAccessReviewClusterInterface
 }
 
-// SubjectAccessReviewClusterInterface can scope down to one cluster and return a authorizationv1beta1client.SubjectAccessReviewInterface.
+// SubjectAccessReviewClusterInterface can operate on SubjectAccessReviews across all clusters,
+// or scope down to one cluster and return a authorizationv1beta1.SubjectAccessReviewInterface.
 type SubjectAccessReviewClusterInterface interface {
-	Cluster(logicalcluster.Path) authorizationv1beta1client.SubjectAccessReviewInterface
+	Cluster(logicalcluster.Path) authorizationv1beta1.SubjectAccessReviewInterface
+
+	SubjectAccessReviewClusterExpansion
 }
 
 type subjectAccessReviewsClusterInterface struct {
-	clientCache kcpclient.Cache[*authorizationv1beta1client.AuthorizationV1beta1Client]
+	clientCache kcpclient.Cache[*authorizationv1beta1.AuthorizationV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *subjectAccessReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authorizationv1beta1client.SubjectAccessReviewInterface {
+func (c *subjectAccessReviewsClusterInterface) Cluster(clusterPath logicalcluster.Path) authorizationv1beta1.SubjectAccessReviewInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
diff --git a/kubernetes/typed/autoscaling/v1/autoscaling_client.go b/kubernetes/typed/autoscaling/v1/autoscaling_client.go
index d4cbe659f..54cf2dbc5 100644
--- a/kubernetes/typed/autoscaling/v1/autoscaling_client.go
+++ b/kubernetes/typed/autoscaling/v1/autoscaling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiautoscalingv1 "k8s.io/api/autoscaling/v1"
+	autoscalingv1 "k8s.io/client-go/kubernetes/typed/autoscaling/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	autoscalingv1 "k8s.io/client-go/kubernetes/typed/autoscaling/v1"
-	"k8s.io/client-go/rest"
 )
 
 type AutoscalingV1ClusterInterface interface {
@@ -40,6 +39,7 @@ type AutoscalingV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) autoscalingv1.AutoscalingV1Interface
 }
 
+// AutoscalingV1ClusterClient is used to interact with features provided by the autoscaling group.
 type AutoscalingV1ClusterClient struct {
 	clientCache kcpclient.Cache[*autoscalingv1.AutoscalingV1Client]
 }
@@ -59,11 +59,13 @@ func (c *AutoscalingV1ClusterClient) HorizontalPodAutoscalers() HorizontalPodAut
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AutoscalingV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AutoscalingV1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AutoscalingV1Cluste
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AutoscalingV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *AutoscalingV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiautoscalingv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/autoscaling/v1/doc.go b/kubernetes/typed/autoscaling/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/autoscaling/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/autoscaling/v1/fake/autoscaling_client.go b/kubernetes/typed/autoscaling/v1/fake/autoscaling_client.go
index 7cacd1032..f6fa39570 100644
--- a/kubernetes/typed/autoscaling/v1/fake/autoscaling_client.go
+++ b/kubernetes/typed/autoscaling/v1/fake/autoscaling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	autoscalingv1 "k8s.io/client-go/kubernetes/typed/autoscaling/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpautoscalingv1 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpautoscalingv1.AutoscalingV1ClusterInterface = (*AutoscalingV1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *AutoscalingV1ClusterClient) Cluster(clusterPath logicalcluster.Path) au
 }
 
 func (c *AutoscalingV1ClusterClient) HorizontalPodAutoscalers() kcpautoscalingv1.HorizontalPodAutoscalerClusterInterface {
-	return &horizontalPodAutoscalersClusterClient{Fake: c.Fake}
+	return newFakeHorizontalPodAutoscalerClusterClient(c)
 }
 
-var _ autoscalingv1.AutoscalingV1Interface = (*AutoscalingV1Client)(nil)
-
 type AutoscalingV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *AutoscalingV1Client) HorizontalPodAutoscalers(namespace string) autoscalingv1.HorizontalPodAutoscalerInterface {
+	return newFakeHorizontalPodAutoscalerClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *AutoscalingV1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *AutoscalingV1Client) HorizontalPodAutoscalers(namespace string) autoscalingv1.HorizontalPodAutoscalerInterface {
-	return &horizontalPodAutoscalersClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
diff --git a/kubernetes/typed/autoscaling/v1/fake/doc.go b/kubernetes/typed/autoscaling/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/autoscaling/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/autoscaling/v1/fake/horizontalpodautoscaler.go b/kubernetes/typed/autoscaling/v1/fake/horizontalpodautoscaler.go
index 23e211cee..a4f94dcde 100644
--- a/kubernetes/typed/autoscaling/v1/fake/horizontalpodautoscaler.go
+++ b/kubernetes/typed/autoscaling/v1/fake/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	autoscalingv1 "k8s.io/api/autoscaling/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsautoscalingv1 "k8s.io/client-go/applyconfigurations/autoscaling/v1"
-	autoscalingv1client "k8s.io/client-go/kubernetes/typed/autoscaling/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/autoscaling/v1"
+	typedautoscalingv1 "k8s.io/client-go/kubernetes/typed/autoscaling/v1"
 
-	kcpautoscalingv1 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v1"
+	typedkcpautoscalingv1 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var horizontalPodAutoscalersResource = schema.GroupVersionResource{Group: "autoscaling", Version: "v1", Resource: "horizontalpodautoscalers"}
-var horizontalPodAutoscalersKind = schema.GroupVersionKind{Group: "autoscaling", Version: "v1", Kind: "HorizontalPodAutoscaler"}
-
-type horizontalPodAutoscalersClusterClient struct {
-	*kcptesting.Fake
+// horizontalPodAutoscalerClusterClient implements HorizontalPodAutoscalerClusterInterface
+type horizontalPodAutoscalerClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*autoscalingv1.HorizontalPodAutoscaler, *autoscalingv1.HorizontalPodAutoscalerList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *horizontalPodAutoscalersClusterClient) Cluster(clusterPath logicalcluster.Path) kcpautoscalingv1.HorizontalPodAutoscalersNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &horizontalPodAutoscalersNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of HorizontalPodAutoscalers that match those selectors across all clusters.
-func (c *horizontalPodAutoscalersClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv1.HorizontalPodAutoscalerList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(horizontalPodAutoscalersResource, horizontalPodAutoscalersKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &autoscalingv1.HorizontalPodAutoscalerList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeHorizontalPodAutoscalerClusterClient(fake *AutoscalingV1ClusterClient) typedkcpautoscalingv1.HorizontalPodAutoscalerClusterInterface {
+	return &horizontalPodAutoscalerClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*autoscalingv1.HorizontalPodAutoscaler, *autoscalingv1.HorizontalPodAutoscalerList](
+			fake.Fake,
+			autoscalingv1.SchemeGroupVersion.WithResource("horizontalpodautoscalers"),
+			autoscalingv1.SchemeGroupVersion.WithKind("HorizontalPodAutoscaler"),
+			func() *autoscalingv1.HorizontalPodAutoscaler { return &autoscalingv1.HorizontalPodAutoscaler{} },
+			func() *autoscalingv1.HorizontalPodAutoscalerList { return &autoscalingv1.HorizontalPodAutoscalerList{} },
+			func(dst, src *autoscalingv1.HorizontalPodAutoscalerList) { dst.ListMeta = src.ListMeta },
+			func(list *autoscalingv1.HorizontalPodAutoscalerList) []*autoscalingv1.HorizontalPodAutoscaler {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *autoscalingv1.HorizontalPodAutoscalerList, items []*autoscalingv1.HorizontalPodAutoscaler) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &autoscalingv1.HorizontalPodAutoscalerList{ListMeta: obj.(*autoscalingv1.HorizontalPodAutoscalerList).ListMeta}
-	for _, item := range obj.(*autoscalingv1.HorizontalPodAutoscalerList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested HorizontalPodAutoscalers across all clusters.
-func (c *horizontalPodAutoscalersClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(horizontalPodAutoscalersResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *horizontalPodAutoscalerClusterClient) Cluster(cluster logicalcluster.Path) typedkcpautoscalingv1.HorizontalPodAutoscalersNamespacer {
+	return &horizontalPodAutoscalerNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type horizontalPodAutoscalersNamespacer struct {
+type horizontalPodAutoscalerNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *horizontalPodAutoscalersNamespacer) Namespace(namespace string) autoscalingv1client.HorizontalPodAutoscalerInterface {
-	return &horizontalPodAutoscalersClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *horizontalPodAutoscalerNamespacer) Namespace(namespace string) typedautoscalingv1.HorizontalPodAutoscalerInterface {
+	return newFakeHorizontalPodAutoscalerClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type horizontalPodAutoscalersClient struct {
-	*kcptesting.Fake
+// horizontalPodAutoscalerScopedClient implements HorizontalPodAutoscalerInterface
+type horizontalPodAutoscalerScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*autoscalingv1.HorizontalPodAutoscaler, *autoscalingv1.HorizontalPodAutoscalerList, *v1.HorizontalPodAutoscalerApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *horizontalPodAutoscalersClient) Create(ctx context.Context, horizontalPodAutoscaler *autoscalingv1.HorizontalPodAutoscaler, opts metav1.CreateOptions) (*autoscalingv1.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, horizontalPodAutoscaler), &autoscalingv1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv1.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) Update(ctx context.Context, horizontalPodAutoscaler *autoscalingv1.HorizontalPodAutoscaler, opts metav1.UpdateOptions) (*autoscalingv1.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, horizontalPodAutoscaler), &autoscalingv1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv1.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) UpdateStatus(ctx context.Context, horizontalPodAutoscaler *autoscalingv1.HorizontalPodAutoscaler, opts metav1.UpdateOptions) (*autoscalingv1.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, "status", c.Namespace, horizontalPodAutoscaler), &autoscalingv1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv1.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, name, opts), &autoscalingv1.HorizontalPodAutoscaler{})
-	return err
 }
 
-func (c *horizontalPodAutoscalersClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &autoscalingv1.HorizontalPodAutoscalerList{})
-	return err
-}
-
-func (c *horizontalPodAutoscalersClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*autoscalingv1.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, name), &autoscalingv1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv1.HorizontalPodAutoscaler), err
-}
-
-// List takes label and field selectors, and returns the list of HorizontalPodAutoscalers that match those selectors.
-func (c *horizontalPodAutoscalersClient) List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv1.HorizontalPodAutoscalerList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(horizontalPodAutoscalersResource, horizontalPodAutoscalersKind, c.ClusterPath, c.Namespace, opts), &autoscalingv1.HorizontalPodAutoscalerList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &autoscalingv1.HorizontalPodAutoscalerList{ListMeta: obj.(*autoscalingv1.HorizontalPodAutoscalerList).ListMeta}
-	for _, item := range obj.(*autoscalingv1.HorizontalPodAutoscalerList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *horizontalPodAutoscalersClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *horizontalPodAutoscalersClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*autoscalingv1.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &autoscalingv1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv1.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsautoscalingv1.HorizontalPodAutoscalerApplyConfiguration, opts metav1.ApplyOptions) (*autoscalingv1.HorizontalPodAutoscaler, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &autoscalingv1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv1.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsautoscalingv1.HorizontalPodAutoscalerApplyConfiguration, opts metav1.ApplyOptions) (*autoscalingv1.HorizontalPodAutoscaler, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &autoscalingv1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
+func newFakeHorizontalPodAutoscalerClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedautoscalingv1.HorizontalPodAutoscalerInterface {
+	return &horizontalPodAutoscalerScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*autoscalingv1.HorizontalPodAutoscaler, *autoscalingv1.HorizontalPodAutoscalerList, *v1.HorizontalPodAutoscalerApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			autoscalingv1.SchemeGroupVersion.WithResource("horizontalpodautoscalers"),
+			autoscalingv1.SchemeGroupVersion.WithKind("HorizontalPodAutoscaler"),
+			func() *autoscalingv1.HorizontalPodAutoscaler { return &autoscalingv1.HorizontalPodAutoscaler{} },
+			func() *autoscalingv1.HorizontalPodAutoscalerList { return &autoscalingv1.HorizontalPodAutoscalerList{} },
+			func(dst, src *autoscalingv1.HorizontalPodAutoscalerList) { dst.ListMeta = src.ListMeta },
+			func(list *autoscalingv1.HorizontalPodAutoscalerList) []*autoscalingv1.HorizontalPodAutoscaler {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *autoscalingv1.HorizontalPodAutoscalerList, items []*autoscalingv1.HorizontalPodAutoscaler) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*autoscalingv1.HorizontalPodAutoscaler), err
 }
diff --git a/kubernetes/typed/autoscaling/v1/generated_expansion.go b/kubernetes/typed/autoscaling/v1/generated_expansion.go
new file mode 100644
index 000000000..48f6add05
--- /dev/null
+++ b/kubernetes/typed/autoscaling/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type HorizontalPodAutoscalerClusterExpansion interface{}
diff --git a/kubernetes/typed/autoscaling/v1/horizontalpodautoscaler.go b/kubernetes/typed/autoscaling/v1/horizontalpodautoscaler.go
index 28cb9a169..71d98613d 100644
--- a/kubernetes/typed/autoscaling/v1/horizontalpodautoscaler.go
+++ b/kubernetes/typed/autoscaling/v1/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	autoscalingv1 "k8s.io/api/autoscaling/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	autoscalingv1client "k8s.io/client-go/kubernetes/typed/autoscaling/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedautoscalingv1 "k8s.io/client-go/kubernetes/typed/autoscaling/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // HorizontalPodAutoscalersClusterGetter has a method to return a HorizontalPodAutoscalerClusterInterface.
@@ -45,10 +42,11 @@ type HorizontalPodAutoscalerClusterInterface interface {
 	Cluster(logicalcluster.Path) HorizontalPodAutoscalersNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv1.HorizontalPodAutoscalerList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	HorizontalPodAutoscalerClusterExpansion
 }
 
 type horizontalPodAutoscalersClusterInterface struct {
-	clientCache kcpclient.Cache[*autoscalingv1client.AutoscalingV1Client]
+	clientCache kcpclient.Cache[*typedautoscalingv1.AutoscalingV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *horizontalPodAutoscalersClusterInterface) Watch(ctx context.Context, op
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// HorizontalPodAutoscalersNamespacer can scope to objects within a namespace, returning a autoscalingv1client.HorizontalPodAutoscalerInterface.
+// HorizontalPodAutoscalersNamespacer can scope to objects within a namespace, returning a typedautoscalingv1.HorizontalPodAutoscalerInterface.
 type HorizontalPodAutoscalersNamespacer interface {
-	Namespace(string) autoscalingv1client.HorizontalPodAutoscalerInterface
+	Namespace(string) typedautoscalingv1.HorizontalPodAutoscalerInterface
 }
 
 type horizontalPodAutoscalersNamespacer struct {
-	clientCache kcpclient.Cache[*autoscalingv1client.AutoscalingV1Client]
+	clientCache kcpclient.Cache[*typedautoscalingv1.AutoscalingV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *horizontalPodAutoscalersNamespacer) Namespace(namespace string) autoscalingv1client.HorizontalPodAutoscalerInterface {
+func (n *horizontalPodAutoscalersNamespacer) Namespace(namespace string) typedautoscalingv1.HorizontalPodAutoscalerInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).HorizontalPodAutoscalers(namespace)
 }
diff --git a/kubernetes/typed/autoscaling/v2/autoscaling_client.go b/kubernetes/typed/autoscaling/v2/autoscaling_client.go
index 044dec339..e8fec7b97 100644
--- a/kubernetes/typed/autoscaling/v2/autoscaling_client.go
+++ b/kubernetes/typed/autoscaling/v2/autoscaling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v2
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiautoscalingv2 "k8s.io/api/autoscaling/v2"
+	autoscalingv2 "k8s.io/client-go/kubernetes/typed/autoscaling/v2"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	autoscalingv2 "k8s.io/client-go/kubernetes/typed/autoscaling/v2"
-	"k8s.io/client-go/rest"
 )
 
 type AutoscalingV2ClusterInterface interface {
@@ -40,6 +39,7 @@ type AutoscalingV2ClusterScoper interface {
 	Cluster(logicalcluster.Path) autoscalingv2.AutoscalingV2Interface
 }
 
+// AutoscalingV2ClusterClient is used to interact with features provided by the autoscaling group.
 type AutoscalingV2ClusterClient struct {
 	clientCache kcpclient.Cache[*autoscalingv2.AutoscalingV2Client]
 }
@@ -59,11 +59,13 @@ func (c *AutoscalingV2ClusterClient) HorizontalPodAutoscalers() HorizontalPodAut
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AutoscalingV2ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AutoscalingV2ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AutoscalingV2Cluste
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AutoscalingV2ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *AutoscalingV2ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiautoscalingv2.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/autoscaling/v2/doc.go b/kubernetes/typed/autoscaling/v2/doc.go
new file mode 100644
index 000000000..4d145b873
--- /dev/null
+++ b/kubernetes/typed/autoscaling/v2/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v2
diff --git a/kubernetes/typed/autoscaling/v2/fake/autoscaling_client.go b/kubernetes/typed/autoscaling/v2/fake/autoscaling_client.go
index 3ee9cafd0..7d5f24c60 100644
--- a/kubernetes/typed/autoscaling/v2/fake/autoscaling_client.go
+++ b/kubernetes/typed/autoscaling/v2/fake/autoscaling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	autoscalingv2 "k8s.io/client-go/kubernetes/typed/autoscaling/v2"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpautoscalingv2 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpautoscalingv2.AutoscalingV2ClusterInterface = (*AutoscalingV2ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *AutoscalingV2ClusterClient) Cluster(clusterPath logicalcluster.Path) au
 }
 
 func (c *AutoscalingV2ClusterClient) HorizontalPodAutoscalers() kcpautoscalingv2.HorizontalPodAutoscalerClusterInterface {
-	return &horizontalPodAutoscalersClusterClient{Fake: c.Fake}
+	return newFakeHorizontalPodAutoscalerClusterClient(c)
 }
 
-var _ autoscalingv2.AutoscalingV2Interface = (*AutoscalingV2Client)(nil)
-
 type AutoscalingV2Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *AutoscalingV2Client) HorizontalPodAutoscalers(namespace string) autoscalingv2.HorizontalPodAutoscalerInterface {
+	return newFakeHorizontalPodAutoscalerClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *AutoscalingV2Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *AutoscalingV2Client) HorizontalPodAutoscalers(namespace string) autoscalingv2.HorizontalPodAutoscalerInterface {
-	return &horizontalPodAutoscalersClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
diff --git a/kubernetes/typed/autoscaling/v2/fake/doc.go b/kubernetes/typed/autoscaling/v2/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/autoscaling/v2/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/autoscaling/v2/fake/horizontalpodautoscaler.go b/kubernetes/typed/autoscaling/v2/fake/horizontalpodautoscaler.go
index ce2f2aa69..4eea5b71d 100644
--- a/kubernetes/typed/autoscaling/v2/fake/horizontalpodautoscaler.go
+++ b/kubernetes/typed/autoscaling/v2/fake/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	autoscalingv2 "k8s.io/api/autoscaling/v2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsautoscalingv2 "k8s.io/client-go/applyconfigurations/autoscaling/v2"
-	autoscalingv2client "k8s.io/client-go/kubernetes/typed/autoscaling/v2"
-	"k8s.io/client-go/testing"
+	v2 "k8s.io/client-go/applyconfigurations/autoscaling/v2"
+	typedautoscalingv2 "k8s.io/client-go/kubernetes/typed/autoscaling/v2"
 
-	kcpautoscalingv2 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2"
+	typedkcpautoscalingv2 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var horizontalPodAutoscalersResource = schema.GroupVersionResource{Group: "autoscaling", Version: "v2", Resource: "horizontalpodautoscalers"}
-var horizontalPodAutoscalersKind = schema.GroupVersionKind{Group: "autoscaling", Version: "v2", Kind: "HorizontalPodAutoscaler"}
-
-type horizontalPodAutoscalersClusterClient struct {
-	*kcptesting.Fake
+// horizontalPodAutoscalerClusterClient implements HorizontalPodAutoscalerClusterInterface
+type horizontalPodAutoscalerClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*autoscalingv2.HorizontalPodAutoscaler, *autoscalingv2.HorizontalPodAutoscalerList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *horizontalPodAutoscalersClusterClient) Cluster(clusterPath logicalcluster.Path) kcpautoscalingv2.HorizontalPodAutoscalersNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &horizontalPodAutoscalersNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of HorizontalPodAutoscalers that match those selectors across all clusters.
-func (c *horizontalPodAutoscalersClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv2.HorizontalPodAutoscalerList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(horizontalPodAutoscalersResource, horizontalPodAutoscalersKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &autoscalingv2.HorizontalPodAutoscalerList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeHorizontalPodAutoscalerClusterClient(fake *AutoscalingV2ClusterClient) typedkcpautoscalingv2.HorizontalPodAutoscalerClusterInterface {
+	return &horizontalPodAutoscalerClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*autoscalingv2.HorizontalPodAutoscaler, *autoscalingv2.HorizontalPodAutoscalerList](
+			fake.Fake,
+			autoscalingv2.SchemeGroupVersion.WithResource("horizontalpodautoscalers"),
+			autoscalingv2.SchemeGroupVersion.WithKind("HorizontalPodAutoscaler"),
+			func() *autoscalingv2.HorizontalPodAutoscaler { return &autoscalingv2.HorizontalPodAutoscaler{} },
+			func() *autoscalingv2.HorizontalPodAutoscalerList { return &autoscalingv2.HorizontalPodAutoscalerList{} },
+			func(dst, src *autoscalingv2.HorizontalPodAutoscalerList) { dst.ListMeta = src.ListMeta },
+			func(list *autoscalingv2.HorizontalPodAutoscalerList) []*autoscalingv2.HorizontalPodAutoscaler {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *autoscalingv2.HorizontalPodAutoscalerList, items []*autoscalingv2.HorizontalPodAutoscaler) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &autoscalingv2.HorizontalPodAutoscalerList{ListMeta: obj.(*autoscalingv2.HorizontalPodAutoscalerList).ListMeta}
-	for _, item := range obj.(*autoscalingv2.HorizontalPodAutoscalerList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested HorizontalPodAutoscalers across all clusters.
-func (c *horizontalPodAutoscalersClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(horizontalPodAutoscalersResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *horizontalPodAutoscalerClusterClient) Cluster(cluster logicalcluster.Path) typedkcpautoscalingv2.HorizontalPodAutoscalersNamespacer {
+	return &horizontalPodAutoscalerNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type horizontalPodAutoscalersNamespacer struct {
+type horizontalPodAutoscalerNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *horizontalPodAutoscalersNamespacer) Namespace(namespace string) autoscalingv2client.HorizontalPodAutoscalerInterface {
-	return &horizontalPodAutoscalersClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *horizontalPodAutoscalerNamespacer) Namespace(namespace string) typedautoscalingv2.HorizontalPodAutoscalerInterface {
+	return newFakeHorizontalPodAutoscalerClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type horizontalPodAutoscalersClient struct {
-	*kcptesting.Fake
+// horizontalPodAutoscalerScopedClient implements HorizontalPodAutoscalerInterface
+type horizontalPodAutoscalerScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*autoscalingv2.HorizontalPodAutoscaler, *autoscalingv2.HorizontalPodAutoscalerList, *v2.HorizontalPodAutoscalerApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *horizontalPodAutoscalersClient) Create(ctx context.Context, horizontalPodAutoscaler *autoscalingv2.HorizontalPodAutoscaler, opts metav1.CreateOptions) (*autoscalingv2.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, horizontalPodAutoscaler), &autoscalingv2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) Update(ctx context.Context, horizontalPodAutoscaler *autoscalingv2.HorizontalPodAutoscaler, opts metav1.UpdateOptions) (*autoscalingv2.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, horizontalPodAutoscaler), &autoscalingv2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) UpdateStatus(ctx context.Context, horizontalPodAutoscaler *autoscalingv2.HorizontalPodAutoscaler, opts metav1.UpdateOptions) (*autoscalingv2.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, "status", c.Namespace, horizontalPodAutoscaler), &autoscalingv2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, name, opts), &autoscalingv2.HorizontalPodAutoscaler{})
-	return err
 }
 
-func (c *horizontalPodAutoscalersClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &autoscalingv2.HorizontalPodAutoscalerList{})
-	return err
-}
-
-func (c *horizontalPodAutoscalersClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*autoscalingv2.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, name), &autoscalingv2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2.HorizontalPodAutoscaler), err
-}
-
-// List takes label and field selectors, and returns the list of HorizontalPodAutoscalers that match those selectors.
-func (c *horizontalPodAutoscalersClient) List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv2.HorizontalPodAutoscalerList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(horizontalPodAutoscalersResource, horizontalPodAutoscalersKind, c.ClusterPath, c.Namespace, opts), &autoscalingv2.HorizontalPodAutoscalerList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &autoscalingv2.HorizontalPodAutoscalerList{ListMeta: obj.(*autoscalingv2.HorizontalPodAutoscalerList).ListMeta}
-	for _, item := range obj.(*autoscalingv2.HorizontalPodAutoscalerList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *horizontalPodAutoscalersClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *horizontalPodAutoscalersClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*autoscalingv2.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &autoscalingv2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsautoscalingv2.HorizontalPodAutoscalerApplyConfiguration, opts metav1.ApplyOptions) (*autoscalingv2.HorizontalPodAutoscaler, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &autoscalingv2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsautoscalingv2.HorizontalPodAutoscalerApplyConfiguration, opts metav1.ApplyOptions) (*autoscalingv2.HorizontalPodAutoscaler, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &autoscalingv2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
+func newFakeHorizontalPodAutoscalerClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedautoscalingv2.HorizontalPodAutoscalerInterface {
+	return &horizontalPodAutoscalerScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*autoscalingv2.HorizontalPodAutoscaler, *autoscalingv2.HorizontalPodAutoscalerList, *v2.HorizontalPodAutoscalerApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			autoscalingv2.SchemeGroupVersion.WithResource("horizontalpodautoscalers"),
+			autoscalingv2.SchemeGroupVersion.WithKind("HorizontalPodAutoscaler"),
+			func() *autoscalingv2.HorizontalPodAutoscaler { return &autoscalingv2.HorizontalPodAutoscaler{} },
+			func() *autoscalingv2.HorizontalPodAutoscalerList { return &autoscalingv2.HorizontalPodAutoscalerList{} },
+			func(dst, src *autoscalingv2.HorizontalPodAutoscalerList) { dst.ListMeta = src.ListMeta },
+			func(list *autoscalingv2.HorizontalPodAutoscalerList) []*autoscalingv2.HorizontalPodAutoscaler {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *autoscalingv2.HorizontalPodAutoscalerList, items []*autoscalingv2.HorizontalPodAutoscaler) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*autoscalingv2.HorizontalPodAutoscaler), err
 }
diff --git a/kubernetes/typed/autoscaling/v2/generated_expansion.go b/kubernetes/typed/autoscaling/v2/generated_expansion.go
new file mode 100644
index 000000000..359b4f4ac
--- /dev/null
+++ b/kubernetes/typed/autoscaling/v2/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v2
+
+type HorizontalPodAutoscalerClusterExpansion interface{}
diff --git a/kubernetes/typed/autoscaling/v2/horizontalpodautoscaler.go b/kubernetes/typed/autoscaling/v2/horizontalpodautoscaler.go
index 557936f8e..605771002 100644
--- a/kubernetes/typed/autoscaling/v2/horizontalpodautoscaler.go
+++ b/kubernetes/typed/autoscaling/v2/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v2
 
 import (
-	"context"
+	context "context"
+
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedautoscalingv2 "k8s.io/client-go/kubernetes/typed/autoscaling/v2"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	autoscalingv2 "k8s.io/api/autoscaling/v2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	autoscalingv2client "k8s.io/client-go/kubernetes/typed/autoscaling/v2"
 )
 
 // HorizontalPodAutoscalersClusterGetter has a method to return a HorizontalPodAutoscalerClusterInterface.
@@ -43,12 +40,13 @@ type HorizontalPodAutoscalersClusterGetter interface {
 // or scope down to one cluster and return a HorizontalPodAutoscalersNamespacer.
 type HorizontalPodAutoscalerClusterInterface interface {
 	Cluster(logicalcluster.Path) HorizontalPodAutoscalersNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv2.HorizontalPodAutoscalerList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*autoscalingv2.HorizontalPodAutoscalerList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	HorizontalPodAutoscalerClusterExpansion
 }
 
 type horizontalPodAutoscalersClusterInterface struct {
-	clientCache kcpclient.Cache[*autoscalingv2client.AutoscalingV2Client]
+	clientCache kcpclient.Cache[*typedautoscalingv2.AutoscalingV2Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *horizontalPodAutoscalersClusterInterface) Cluster(clusterPath logicalcl
 }
 
 // List returns the entire collection of all HorizontalPodAutoscalers across all clusters.
-func (c *horizontalPodAutoscalersClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv2.HorizontalPodAutoscalerList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(metav1.NamespaceAll).List(ctx, opts)
+func (c *horizontalPodAutoscalersClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*autoscalingv2.HorizontalPodAutoscalerList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all HorizontalPodAutoscalers across all clusters.
-func (c *horizontalPodAutoscalersClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *horizontalPodAutoscalersClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// HorizontalPodAutoscalersNamespacer can scope to objects within a namespace, returning a autoscalingv2client.HorizontalPodAutoscalerInterface.
+// HorizontalPodAutoscalersNamespacer can scope to objects within a namespace, returning a typedautoscalingv2.HorizontalPodAutoscalerInterface.
 type HorizontalPodAutoscalersNamespacer interface {
-	Namespace(string) autoscalingv2client.HorizontalPodAutoscalerInterface
+	Namespace(string) typedautoscalingv2.HorizontalPodAutoscalerInterface
 }
 
 type horizontalPodAutoscalersNamespacer struct {
-	clientCache kcpclient.Cache[*autoscalingv2client.AutoscalingV2Client]
+	clientCache kcpclient.Cache[*typedautoscalingv2.AutoscalingV2Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *horizontalPodAutoscalersNamespacer) Namespace(namespace string) autoscalingv2client.HorizontalPodAutoscalerInterface {
+func (n *horizontalPodAutoscalersNamespacer) Namespace(namespace string) typedautoscalingv2.HorizontalPodAutoscalerInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).HorizontalPodAutoscalers(namespace)
 }
diff --git a/kubernetes/typed/autoscaling/v2beta1/autoscaling_client.go b/kubernetes/typed/autoscaling/v2beta1/autoscaling_client.go
index 21e59efb1..f0598b1f9 100644
--- a/kubernetes/typed/autoscaling/v2beta1/autoscaling_client.go
+++ b/kubernetes/typed/autoscaling/v2beta1/autoscaling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v2beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiautoscalingv2beta1 "k8s.io/api/autoscaling/v2beta1"
+	autoscalingv2beta1 "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	autoscalingv2beta1 "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta1"
-	"k8s.io/client-go/rest"
 )
 
 type AutoscalingV2beta1ClusterInterface interface {
@@ -40,6 +39,7 @@ type AutoscalingV2beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) autoscalingv2beta1.AutoscalingV2beta1Interface
 }
 
+// AutoscalingV2beta1ClusterClient is used to interact with features provided by the autoscaling group.
 type AutoscalingV2beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*autoscalingv2beta1.AutoscalingV2beta1Client]
 }
@@ -59,11 +59,13 @@ func (c *AutoscalingV2beta1ClusterClient) HorizontalPodAutoscalers() HorizontalP
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AutoscalingV2beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AutoscalingV2beta1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AutoscalingV2beta1C
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AutoscalingV2beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *AutoscalingV2beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiautoscalingv2beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/autoscaling/v2beta1/doc.go b/kubernetes/typed/autoscaling/v2beta1/doc.go
new file mode 100644
index 000000000..bca1e22cc
--- /dev/null
+++ b/kubernetes/typed/autoscaling/v2beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v2beta1
diff --git a/kubernetes/typed/autoscaling/v2beta1/fake/autoscaling_client.go b/kubernetes/typed/autoscaling/v2beta1/fake/autoscaling_client.go
index 03e290ed1..482f886f2 100644
--- a/kubernetes/typed/autoscaling/v2beta1/fake/autoscaling_client.go
+++ b/kubernetes/typed/autoscaling/v2beta1/fake/autoscaling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	autoscalingv2beta1 "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpautoscalingv2beta1 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpautoscalingv2beta1.AutoscalingV2beta1ClusterInterface = (*AutoscalingV2beta1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *AutoscalingV2beta1ClusterClient) Cluster(clusterPath logicalcluster.Pat
 }
 
 func (c *AutoscalingV2beta1ClusterClient) HorizontalPodAutoscalers() kcpautoscalingv2beta1.HorizontalPodAutoscalerClusterInterface {
-	return &horizontalPodAutoscalersClusterClient{Fake: c.Fake}
+	return newFakeHorizontalPodAutoscalerClusterClient(c)
 }
 
-var _ autoscalingv2beta1.AutoscalingV2beta1Interface = (*AutoscalingV2beta1Client)(nil)
-
 type AutoscalingV2beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *AutoscalingV2beta1Client) HorizontalPodAutoscalers(namespace string) autoscalingv2beta1.HorizontalPodAutoscalerInterface {
+	return newFakeHorizontalPodAutoscalerClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *AutoscalingV2beta1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *AutoscalingV2beta1Client) HorizontalPodAutoscalers(namespace string) autoscalingv2beta1.HorizontalPodAutoscalerInterface {
-	return &horizontalPodAutoscalersClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
diff --git a/kubernetes/typed/autoscaling/v2beta1/fake/doc.go b/kubernetes/typed/autoscaling/v2beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/autoscaling/v2beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/autoscaling/v2beta1/fake/horizontalpodautoscaler.go b/kubernetes/typed/autoscaling/v2beta1/fake/horizontalpodautoscaler.go
index 2e584cb0b..6f02f4eac 100644
--- a/kubernetes/typed/autoscaling/v2beta1/fake/horizontalpodautoscaler.go
+++ b/kubernetes/typed/autoscaling/v2beta1/fake/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,94 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	autoscalingv2beta1 "k8s.io/api/autoscaling/v2beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsautoscalingv2beta1 "k8s.io/client-go/applyconfigurations/autoscaling/v2beta1"
-	autoscalingv2beta1client "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta1"
-	"k8s.io/client-go/testing"
+	v2beta1 "k8s.io/client-go/applyconfigurations/autoscaling/v2beta1"
+	typedautoscalingv2beta1 "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta1"
 
-	kcpautoscalingv2beta1 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2beta1"
+	typedkcpautoscalingv2beta1 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var horizontalPodAutoscalersResource = schema.GroupVersionResource{Group: "autoscaling", Version: "v2beta1", Resource: "horizontalpodautoscalers"}
-var horizontalPodAutoscalersKind = schema.GroupVersionKind{Group: "autoscaling", Version: "v2beta1", Kind: "HorizontalPodAutoscaler"}
-
-type horizontalPodAutoscalersClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *horizontalPodAutoscalersClusterClient) Cluster(clusterPath logicalcluster.Path) kcpautoscalingv2beta1.HorizontalPodAutoscalersNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &horizontalPodAutoscalersNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of HorizontalPodAutoscalers that match those selectors across all clusters.
-func (c *horizontalPodAutoscalersClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv2beta1.HorizontalPodAutoscalerList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(horizontalPodAutoscalersResource, horizontalPodAutoscalersKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &autoscalingv2beta1.HorizontalPodAutoscalerList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &autoscalingv2beta1.HorizontalPodAutoscalerList{ListMeta: obj.(*autoscalingv2beta1.HorizontalPodAutoscalerList).ListMeta}
-	for _, item := range obj.(*autoscalingv2beta1.HorizontalPodAutoscalerList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested HorizontalPodAutoscalers across all clusters.
-func (c *horizontalPodAutoscalersClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(horizontalPodAutoscalersResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
-}
-
-type horizontalPodAutoscalersNamespacer struct {
+// horizontalPodAutoscalerClusterClient implements HorizontalPodAutoscalerClusterInterface
+type horizontalPodAutoscalerClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*autoscalingv2beta1.HorizontalPodAutoscaler, *autoscalingv2beta1.HorizontalPodAutoscalerList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeHorizontalPodAutoscalerClusterClient(fake *AutoscalingV2beta1ClusterClient) typedkcpautoscalingv2beta1.HorizontalPodAutoscalerClusterInterface {
+	return &horizontalPodAutoscalerClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*autoscalingv2beta1.HorizontalPodAutoscaler, *autoscalingv2beta1.HorizontalPodAutoscalerList](
+			fake.Fake,
+			autoscalingv2beta1.SchemeGroupVersion.WithResource("horizontalpodautoscalers"),
+			autoscalingv2beta1.SchemeGroupVersion.WithKind("HorizontalPodAutoscaler"),
+			func() *autoscalingv2beta1.HorizontalPodAutoscaler {
+				return &autoscalingv2beta1.HorizontalPodAutoscaler{}
+			},
+			func() *autoscalingv2beta1.HorizontalPodAutoscalerList {
+				return &autoscalingv2beta1.HorizontalPodAutoscalerList{}
+			},
+			func(dst, src *autoscalingv2beta1.HorizontalPodAutoscalerList) { dst.ListMeta = src.ListMeta },
+			func(list *autoscalingv2beta1.HorizontalPodAutoscalerList) []*autoscalingv2beta1.HorizontalPodAutoscaler {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *autoscalingv2beta1.HorizontalPodAutoscalerList, items []*autoscalingv2beta1.HorizontalPodAutoscaler) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *horizontalPodAutoscalerClusterClient) Cluster(cluster logicalcluster.Path) typedkcpautoscalingv2beta1.HorizontalPodAutoscalersNamespacer {
+	return &horizontalPodAutoscalerNamespacer{Fake: c.Fake, ClusterPath: cluster}
+}
+
+type horizontalPodAutoscalerNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *horizontalPodAutoscalersNamespacer) Namespace(namespace string) autoscalingv2beta1client.HorizontalPodAutoscalerInterface {
-	return &horizontalPodAutoscalersClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *horizontalPodAutoscalerNamespacer) Namespace(namespace string) typedautoscalingv2beta1.HorizontalPodAutoscalerInterface {
+	return newFakeHorizontalPodAutoscalerClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type horizontalPodAutoscalersClient struct {
-	*kcptesting.Fake
+// horizontalPodAutoscalerScopedClient implements HorizontalPodAutoscalerInterface
+type horizontalPodAutoscalerScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*autoscalingv2beta1.HorizontalPodAutoscaler, *autoscalingv2beta1.HorizontalPodAutoscalerList, *v2beta1.HorizontalPodAutoscalerApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
 }
 
-func (c *horizontalPodAutoscalersClient) Create(ctx context.Context, horizontalPodAutoscaler *autoscalingv2beta1.HorizontalPodAutoscaler, opts metav1.CreateOptions) (*autoscalingv2beta1.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, horizontalPodAutoscaler), &autoscalingv2beta1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2beta1.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) Update(ctx context.Context, horizontalPodAutoscaler *autoscalingv2beta1.HorizontalPodAutoscaler, opts metav1.UpdateOptions) (*autoscalingv2beta1.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, horizontalPodAutoscaler), &autoscalingv2beta1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2beta1.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) UpdateStatus(ctx context.Context, horizontalPodAutoscaler *autoscalingv2beta1.HorizontalPodAutoscaler, opts metav1.UpdateOptions) (*autoscalingv2beta1.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, "status", c.Namespace, horizontalPodAutoscaler), &autoscalingv2beta1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2beta1.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, name, opts), &autoscalingv2beta1.HorizontalPodAutoscaler{})
-	return err
-}
-
-func (c *horizontalPodAutoscalersClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &autoscalingv2beta1.HorizontalPodAutoscalerList{})
-	return err
-}
-
-func (c *horizontalPodAutoscalersClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*autoscalingv2beta1.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, name), &autoscalingv2beta1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2beta1.HorizontalPodAutoscaler), err
-}
-
-// List takes label and field selectors, and returns the list of HorizontalPodAutoscalers that match those selectors.
-func (c *horizontalPodAutoscalersClient) List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv2beta1.HorizontalPodAutoscalerList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(horizontalPodAutoscalersResource, horizontalPodAutoscalersKind, c.ClusterPath, c.Namespace, opts), &autoscalingv2beta1.HorizontalPodAutoscalerList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &autoscalingv2beta1.HorizontalPodAutoscalerList{ListMeta: obj.(*autoscalingv2beta1.HorizontalPodAutoscalerList).ListMeta}
-	for _, item := range obj.(*autoscalingv2beta1.HorizontalPodAutoscalerList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *horizontalPodAutoscalersClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *horizontalPodAutoscalersClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*autoscalingv2beta1.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &autoscalingv2beta1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2beta1.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsautoscalingv2beta1.HorizontalPodAutoscalerApplyConfiguration, opts metav1.ApplyOptions) (*autoscalingv2beta1.HorizontalPodAutoscaler, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &autoscalingv2beta1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2beta1.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsautoscalingv2beta1.HorizontalPodAutoscalerApplyConfiguration, opts metav1.ApplyOptions) (*autoscalingv2beta1.HorizontalPodAutoscaler, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &autoscalingv2beta1.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
+func newFakeHorizontalPodAutoscalerClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedautoscalingv2beta1.HorizontalPodAutoscalerInterface {
+	return &horizontalPodAutoscalerScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*autoscalingv2beta1.HorizontalPodAutoscaler, *autoscalingv2beta1.HorizontalPodAutoscalerList, *v2beta1.HorizontalPodAutoscalerApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			autoscalingv2beta1.SchemeGroupVersion.WithResource("horizontalpodautoscalers"),
+			autoscalingv2beta1.SchemeGroupVersion.WithKind("HorizontalPodAutoscaler"),
+			func() *autoscalingv2beta1.HorizontalPodAutoscaler {
+				return &autoscalingv2beta1.HorizontalPodAutoscaler{}
+			},
+			func() *autoscalingv2beta1.HorizontalPodAutoscalerList {
+				return &autoscalingv2beta1.HorizontalPodAutoscalerList{}
+			},
+			func(dst, src *autoscalingv2beta1.HorizontalPodAutoscalerList) { dst.ListMeta = src.ListMeta },
+			func(list *autoscalingv2beta1.HorizontalPodAutoscalerList) []*autoscalingv2beta1.HorizontalPodAutoscaler {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *autoscalingv2beta1.HorizontalPodAutoscalerList, items []*autoscalingv2beta1.HorizontalPodAutoscaler) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*autoscalingv2beta1.HorizontalPodAutoscaler), err
 }
diff --git a/kubernetes/typed/autoscaling/v2beta1/generated_expansion.go b/kubernetes/typed/autoscaling/v2beta1/generated_expansion.go
new file mode 100644
index 000000000..ffdeb08c2
--- /dev/null
+++ b/kubernetes/typed/autoscaling/v2beta1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v2beta1
+
+type HorizontalPodAutoscalerClusterExpansion interface{}
diff --git a/kubernetes/typed/autoscaling/v2beta1/horizontalpodautoscaler.go b/kubernetes/typed/autoscaling/v2beta1/horizontalpodautoscaler.go
index d994200b3..bc7fa93a1 100644
--- a/kubernetes/typed/autoscaling/v2beta1/horizontalpodautoscaler.go
+++ b/kubernetes/typed/autoscaling/v2beta1/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v2beta1
 
 import (
-	"context"
+	context "context"
+
+	autoscalingv2beta1 "k8s.io/api/autoscaling/v2beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedautoscalingv2beta1 "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	autoscalingv2beta1 "k8s.io/api/autoscaling/v2beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	autoscalingv2beta1client "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta1"
 )
 
 // HorizontalPodAutoscalersClusterGetter has a method to return a HorizontalPodAutoscalerClusterInterface.
@@ -43,12 +40,13 @@ type HorizontalPodAutoscalersClusterGetter interface {
 // or scope down to one cluster and return a HorizontalPodAutoscalersNamespacer.
 type HorizontalPodAutoscalerClusterInterface interface {
 	Cluster(logicalcluster.Path) HorizontalPodAutoscalersNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv2beta1.HorizontalPodAutoscalerList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*autoscalingv2beta1.HorizontalPodAutoscalerList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	HorizontalPodAutoscalerClusterExpansion
 }
 
 type horizontalPodAutoscalersClusterInterface struct {
-	clientCache kcpclient.Cache[*autoscalingv2beta1client.AutoscalingV2beta1Client]
+	clientCache kcpclient.Cache[*typedautoscalingv2beta1.AutoscalingV2beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *horizontalPodAutoscalersClusterInterface) Cluster(clusterPath logicalcl
 }
 
 // List returns the entire collection of all HorizontalPodAutoscalers across all clusters.
-func (c *horizontalPodAutoscalersClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv2beta1.HorizontalPodAutoscalerList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(metav1.NamespaceAll).List(ctx, opts)
+func (c *horizontalPodAutoscalersClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*autoscalingv2beta1.HorizontalPodAutoscalerList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all HorizontalPodAutoscalers across all clusters.
-func (c *horizontalPodAutoscalersClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *horizontalPodAutoscalersClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// HorizontalPodAutoscalersNamespacer can scope to objects within a namespace, returning a autoscalingv2beta1client.HorizontalPodAutoscalerInterface.
+// HorizontalPodAutoscalersNamespacer can scope to objects within a namespace, returning a typedautoscalingv2beta1.HorizontalPodAutoscalerInterface.
 type HorizontalPodAutoscalersNamespacer interface {
-	Namespace(string) autoscalingv2beta1client.HorizontalPodAutoscalerInterface
+	Namespace(string) typedautoscalingv2beta1.HorizontalPodAutoscalerInterface
 }
 
 type horizontalPodAutoscalersNamespacer struct {
-	clientCache kcpclient.Cache[*autoscalingv2beta1client.AutoscalingV2beta1Client]
+	clientCache kcpclient.Cache[*typedautoscalingv2beta1.AutoscalingV2beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *horizontalPodAutoscalersNamespacer) Namespace(namespace string) autoscalingv2beta1client.HorizontalPodAutoscalerInterface {
+func (n *horizontalPodAutoscalersNamespacer) Namespace(namespace string) typedautoscalingv2beta1.HorizontalPodAutoscalerInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).HorizontalPodAutoscalers(namespace)
 }
diff --git a/kubernetes/typed/autoscaling/v2beta2/autoscaling_client.go b/kubernetes/typed/autoscaling/v2beta2/autoscaling_client.go
index 4eda9b768..17d7f8111 100644
--- a/kubernetes/typed/autoscaling/v2beta2/autoscaling_client.go
+++ b/kubernetes/typed/autoscaling/v2beta2/autoscaling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v2beta2
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiautoscalingv2beta2 "k8s.io/api/autoscaling/v2beta2"
+	autoscalingv2beta2 "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta2"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	autoscalingv2beta2 "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta2"
-	"k8s.io/client-go/rest"
 )
 
 type AutoscalingV2beta2ClusterInterface interface {
@@ -40,6 +39,7 @@ type AutoscalingV2beta2ClusterScoper interface {
 	Cluster(logicalcluster.Path) autoscalingv2beta2.AutoscalingV2beta2Interface
 }
 
+// AutoscalingV2beta2ClusterClient is used to interact with features provided by the autoscaling group.
 type AutoscalingV2beta2ClusterClient struct {
 	clientCache kcpclient.Cache[*autoscalingv2beta2.AutoscalingV2beta2Client]
 }
@@ -59,11 +59,13 @@ func (c *AutoscalingV2beta2ClusterClient) HorizontalPodAutoscalers() HorizontalP
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*AutoscalingV2beta2ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new AutoscalingV2beta2ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*AutoscalingV2beta2C
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &AutoscalingV2beta2ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *AutoscalingV2beta2ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiautoscalingv2beta2.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/autoscaling/v2beta2/doc.go b/kubernetes/typed/autoscaling/v2beta2/doc.go
new file mode 100644
index 000000000..773f95bc5
--- /dev/null
+++ b/kubernetes/typed/autoscaling/v2beta2/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v2beta2
diff --git a/kubernetes/typed/autoscaling/v2beta2/fake/autoscaling_client.go b/kubernetes/typed/autoscaling/v2beta2/fake/autoscaling_client.go
index f8907f3e8..b34dacb82 100644
--- a/kubernetes/typed/autoscaling/v2beta2/fake/autoscaling_client.go
+++ b/kubernetes/typed/autoscaling/v2beta2/fake/autoscaling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	autoscalingv2beta2 "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta2"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpautoscalingv2beta2 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2beta2"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpautoscalingv2beta2.AutoscalingV2beta2ClusterInterface = (*AutoscalingV2beta2ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *AutoscalingV2beta2ClusterClient) Cluster(clusterPath logicalcluster.Pat
 }
 
 func (c *AutoscalingV2beta2ClusterClient) HorizontalPodAutoscalers() kcpautoscalingv2beta2.HorizontalPodAutoscalerClusterInterface {
-	return &horizontalPodAutoscalersClusterClient{Fake: c.Fake}
+	return newFakeHorizontalPodAutoscalerClusterClient(c)
 }
 
-var _ autoscalingv2beta2.AutoscalingV2beta2Interface = (*AutoscalingV2beta2Client)(nil)
-
 type AutoscalingV2beta2Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *AutoscalingV2beta2Client) HorizontalPodAutoscalers(namespace string) autoscalingv2beta2.HorizontalPodAutoscalerInterface {
+	return newFakeHorizontalPodAutoscalerClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *AutoscalingV2beta2Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *AutoscalingV2beta2Client) HorizontalPodAutoscalers(namespace string) autoscalingv2beta2.HorizontalPodAutoscalerInterface {
-	return &horizontalPodAutoscalersClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
diff --git a/kubernetes/typed/autoscaling/v2beta2/fake/doc.go b/kubernetes/typed/autoscaling/v2beta2/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/autoscaling/v2beta2/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/autoscaling/v2beta2/fake/horizontalpodautoscaler.go b/kubernetes/typed/autoscaling/v2beta2/fake/horizontalpodautoscaler.go
index 6a7eb1efc..881badb29 100644
--- a/kubernetes/typed/autoscaling/v2beta2/fake/horizontalpodautoscaler.go
+++ b/kubernetes/typed/autoscaling/v2beta2/fake/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,94 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	autoscalingv2beta2 "k8s.io/api/autoscaling/v2beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsautoscalingv2beta2 "k8s.io/client-go/applyconfigurations/autoscaling/v2beta2"
-	autoscalingv2beta2client "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta2"
-	"k8s.io/client-go/testing"
+	v2beta2 "k8s.io/client-go/applyconfigurations/autoscaling/v2beta2"
+	typedautoscalingv2beta2 "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta2"
 
-	kcpautoscalingv2beta2 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2beta2"
+	typedkcpautoscalingv2beta2 "github.com/kcp-dev/client-go/kubernetes/typed/autoscaling/v2beta2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var horizontalPodAutoscalersResource = schema.GroupVersionResource{Group: "autoscaling", Version: "v2beta2", Resource: "horizontalpodautoscalers"}
-var horizontalPodAutoscalersKind = schema.GroupVersionKind{Group: "autoscaling", Version: "v2beta2", Kind: "HorizontalPodAutoscaler"}
-
-type horizontalPodAutoscalersClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *horizontalPodAutoscalersClusterClient) Cluster(clusterPath logicalcluster.Path) kcpautoscalingv2beta2.HorizontalPodAutoscalersNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &horizontalPodAutoscalersNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of HorizontalPodAutoscalers that match those selectors across all clusters.
-func (c *horizontalPodAutoscalersClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv2beta2.HorizontalPodAutoscalerList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(horizontalPodAutoscalersResource, horizontalPodAutoscalersKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &autoscalingv2beta2.HorizontalPodAutoscalerList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &autoscalingv2beta2.HorizontalPodAutoscalerList{ListMeta: obj.(*autoscalingv2beta2.HorizontalPodAutoscalerList).ListMeta}
-	for _, item := range obj.(*autoscalingv2beta2.HorizontalPodAutoscalerList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested HorizontalPodAutoscalers across all clusters.
-func (c *horizontalPodAutoscalersClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(horizontalPodAutoscalersResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
-}
-
-type horizontalPodAutoscalersNamespacer struct {
+// horizontalPodAutoscalerClusterClient implements HorizontalPodAutoscalerClusterInterface
+type horizontalPodAutoscalerClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*autoscalingv2beta2.HorizontalPodAutoscaler, *autoscalingv2beta2.HorizontalPodAutoscalerList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeHorizontalPodAutoscalerClusterClient(fake *AutoscalingV2beta2ClusterClient) typedkcpautoscalingv2beta2.HorizontalPodAutoscalerClusterInterface {
+	return &horizontalPodAutoscalerClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*autoscalingv2beta2.HorizontalPodAutoscaler, *autoscalingv2beta2.HorizontalPodAutoscalerList](
+			fake.Fake,
+			autoscalingv2beta2.SchemeGroupVersion.WithResource("horizontalpodautoscalers"),
+			autoscalingv2beta2.SchemeGroupVersion.WithKind("HorizontalPodAutoscaler"),
+			func() *autoscalingv2beta2.HorizontalPodAutoscaler {
+				return &autoscalingv2beta2.HorizontalPodAutoscaler{}
+			},
+			func() *autoscalingv2beta2.HorizontalPodAutoscalerList {
+				return &autoscalingv2beta2.HorizontalPodAutoscalerList{}
+			},
+			func(dst, src *autoscalingv2beta2.HorizontalPodAutoscalerList) { dst.ListMeta = src.ListMeta },
+			func(list *autoscalingv2beta2.HorizontalPodAutoscalerList) []*autoscalingv2beta2.HorizontalPodAutoscaler {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *autoscalingv2beta2.HorizontalPodAutoscalerList, items []*autoscalingv2beta2.HorizontalPodAutoscaler) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *horizontalPodAutoscalerClusterClient) Cluster(cluster logicalcluster.Path) typedkcpautoscalingv2beta2.HorizontalPodAutoscalersNamespacer {
+	return &horizontalPodAutoscalerNamespacer{Fake: c.Fake, ClusterPath: cluster}
+}
+
+type horizontalPodAutoscalerNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *horizontalPodAutoscalersNamespacer) Namespace(namespace string) autoscalingv2beta2client.HorizontalPodAutoscalerInterface {
-	return &horizontalPodAutoscalersClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *horizontalPodAutoscalerNamespacer) Namespace(namespace string) typedautoscalingv2beta2.HorizontalPodAutoscalerInterface {
+	return newFakeHorizontalPodAutoscalerClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type horizontalPodAutoscalersClient struct {
-	*kcptesting.Fake
+// horizontalPodAutoscalerScopedClient implements HorizontalPodAutoscalerInterface
+type horizontalPodAutoscalerScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*autoscalingv2beta2.HorizontalPodAutoscaler, *autoscalingv2beta2.HorizontalPodAutoscalerList, *v2beta2.HorizontalPodAutoscalerApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
 }
 
-func (c *horizontalPodAutoscalersClient) Create(ctx context.Context, horizontalPodAutoscaler *autoscalingv2beta2.HorizontalPodAutoscaler, opts metav1.CreateOptions) (*autoscalingv2beta2.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, horizontalPodAutoscaler), &autoscalingv2beta2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2beta2.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) Update(ctx context.Context, horizontalPodAutoscaler *autoscalingv2beta2.HorizontalPodAutoscaler, opts metav1.UpdateOptions) (*autoscalingv2beta2.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, horizontalPodAutoscaler), &autoscalingv2beta2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2beta2.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) UpdateStatus(ctx context.Context, horizontalPodAutoscaler *autoscalingv2beta2.HorizontalPodAutoscaler, opts metav1.UpdateOptions) (*autoscalingv2beta2.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, "status", c.Namespace, horizontalPodAutoscaler), &autoscalingv2beta2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2beta2.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, name, opts), &autoscalingv2beta2.HorizontalPodAutoscaler{})
-	return err
-}
-
-func (c *horizontalPodAutoscalersClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &autoscalingv2beta2.HorizontalPodAutoscalerList{})
-	return err
-}
-
-func (c *horizontalPodAutoscalersClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*autoscalingv2beta2.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, name), &autoscalingv2beta2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2beta2.HorizontalPodAutoscaler), err
-}
-
-// List takes label and field selectors, and returns the list of HorizontalPodAutoscalers that match those selectors.
-func (c *horizontalPodAutoscalersClient) List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv2beta2.HorizontalPodAutoscalerList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(horizontalPodAutoscalersResource, horizontalPodAutoscalersKind, c.ClusterPath, c.Namespace, opts), &autoscalingv2beta2.HorizontalPodAutoscalerList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &autoscalingv2beta2.HorizontalPodAutoscalerList{ListMeta: obj.(*autoscalingv2beta2.HorizontalPodAutoscalerList).ListMeta}
-	for _, item := range obj.(*autoscalingv2beta2.HorizontalPodAutoscalerList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *horizontalPodAutoscalersClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *horizontalPodAutoscalersClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*autoscalingv2beta2.HorizontalPodAutoscaler, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &autoscalingv2beta2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2beta2.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsautoscalingv2beta2.HorizontalPodAutoscalerApplyConfiguration, opts metav1.ApplyOptions) (*autoscalingv2beta2.HorizontalPodAutoscaler, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &autoscalingv2beta2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*autoscalingv2beta2.HorizontalPodAutoscaler), err
-}
-
-func (c *horizontalPodAutoscalersClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsautoscalingv2beta2.HorizontalPodAutoscalerApplyConfiguration, opts metav1.ApplyOptions) (*autoscalingv2beta2.HorizontalPodAutoscaler, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(horizontalPodAutoscalersResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &autoscalingv2beta2.HorizontalPodAutoscaler{})
-	if obj == nil {
-		return nil, err
+func newFakeHorizontalPodAutoscalerClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedautoscalingv2beta2.HorizontalPodAutoscalerInterface {
+	return &horizontalPodAutoscalerScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*autoscalingv2beta2.HorizontalPodAutoscaler, *autoscalingv2beta2.HorizontalPodAutoscalerList, *v2beta2.HorizontalPodAutoscalerApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			autoscalingv2beta2.SchemeGroupVersion.WithResource("horizontalpodautoscalers"),
+			autoscalingv2beta2.SchemeGroupVersion.WithKind("HorizontalPodAutoscaler"),
+			func() *autoscalingv2beta2.HorizontalPodAutoscaler {
+				return &autoscalingv2beta2.HorizontalPodAutoscaler{}
+			},
+			func() *autoscalingv2beta2.HorizontalPodAutoscalerList {
+				return &autoscalingv2beta2.HorizontalPodAutoscalerList{}
+			},
+			func(dst, src *autoscalingv2beta2.HorizontalPodAutoscalerList) { dst.ListMeta = src.ListMeta },
+			func(list *autoscalingv2beta2.HorizontalPodAutoscalerList) []*autoscalingv2beta2.HorizontalPodAutoscaler {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *autoscalingv2beta2.HorizontalPodAutoscalerList, items []*autoscalingv2beta2.HorizontalPodAutoscaler) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*autoscalingv2beta2.HorizontalPodAutoscaler), err
 }
diff --git a/kubernetes/typed/autoscaling/v2beta2/generated_expansion.go b/kubernetes/typed/autoscaling/v2beta2/generated_expansion.go
new file mode 100644
index 000000000..2535677d7
--- /dev/null
+++ b/kubernetes/typed/autoscaling/v2beta2/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v2beta2
+
+type HorizontalPodAutoscalerClusterExpansion interface{}
diff --git a/kubernetes/typed/autoscaling/v2beta2/horizontalpodautoscaler.go b/kubernetes/typed/autoscaling/v2beta2/horizontalpodautoscaler.go
index b0e144a57..07e9550f3 100644
--- a/kubernetes/typed/autoscaling/v2beta2/horizontalpodautoscaler.go
+++ b/kubernetes/typed/autoscaling/v2beta2/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v2beta2
 
 import (
-	"context"
+	context "context"
+
+	autoscalingv2beta2 "k8s.io/api/autoscaling/v2beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedautoscalingv2beta2 "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta2"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	autoscalingv2beta2 "k8s.io/api/autoscaling/v2beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	autoscalingv2beta2client "k8s.io/client-go/kubernetes/typed/autoscaling/v2beta2"
 )
 
 // HorizontalPodAutoscalersClusterGetter has a method to return a HorizontalPodAutoscalerClusterInterface.
@@ -43,12 +40,13 @@ type HorizontalPodAutoscalersClusterGetter interface {
 // or scope down to one cluster and return a HorizontalPodAutoscalersNamespacer.
 type HorizontalPodAutoscalerClusterInterface interface {
 	Cluster(logicalcluster.Path) HorizontalPodAutoscalersNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv2beta2.HorizontalPodAutoscalerList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*autoscalingv2beta2.HorizontalPodAutoscalerList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	HorizontalPodAutoscalerClusterExpansion
 }
 
 type horizontalPodAutoscalersClusterInterface struct {
-	clientCache kcpclient.Cache[*autoscalingv2beta2client.AutoscalingV2beta2Client]
+	clientCache kcpclient.Cache[*typedautoscalingv2beta2.AutoscalingV2beta2Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *horizontalPodAutoscalersClusterInterface) Cluster(clusterPath logicalcl
 }
 
 // List returns the entire collection of all HorizontalPodAutoscalers across all clusters.
-func (c *horizontalPodAutoscalersClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*autoscalingv2beta2.HorizontalPodAutoscalerList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(metav1.NamespaceAll).List(ctx, opts)
+func (c *horizontalPodAutoscalersClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*autoscalingv2beta2.HorizontalPodAutoscalerList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all HorizontalPodAutoscalers across all clusters.
-func (c *horizontalPodAutoscalersClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *horizontalPodAutoscalersClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).HorizontalPodAutoscalers(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// HorizontalPodAutoscalersNamespacer can scope to objects within a namespace, returning a autoscalingv2beta2client.HorizontalPodAutoscalerInterface.
+// HorizontalPodAutoscalersNamespacer can scope to objects within a namespace, returning a typedautoscalingv2beta2.HorizontalPodAutoscalerInterface.
 type HorizontalPodAutoscalersNamespacer interface {
-	Namespace(string) autoscalingv2beta2client.HorizontalPodAutoscalerInterface
+	Namespace(string) typedautoscalingv2beta2.HorizontalPodAutoscalerInterface
 }
 
 type horizontalPodAutoscalersNamespacer struct {
-	clientCache kcpclient.Cache[*autoscalingv2beta2client.AutoscalingV2beta2Client]
+	clientCache kcpclient.Cache[*typedautoscalingv2beta2.AutoscalingV2beta2Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *horizontalPodAutoscalersNamespacer) Namespace(namespace string) autoscalingv2beta2client.HorizontalPodAutoscalerInterface {
+func (n *horizontalPodAutoscalersNamespacer) Namespace(namespace string) typedautoscalingv2beta2.HorizontalPodAutoscalerInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).HorizontalPodAutoscalers(namespace)
 }
diff --git a/kubernetes/typed/batch/v1/batch_client.go b/kubernetes/typed/batch/v1/batch_client.go
index 585e091f0..684895e36 100644
--- a/kubernetes/typed/batch/v1/batch_client.go
+++ b/kubernetes/typed/batch/v1/batch_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,33 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apibatchv1 "k8s.io/api/batch/v1"
+	batchv1 "k8s.io/client-go/kubernetes/typed/batch/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	batchv1 "k8s.io/client-go/kubernetes/typed/batch/v1"
-	"k8s.io/client-go/rest"
 )
 
 type BatchV1ClusterInterface interface {
 	BatchV1ClusterScoper
-	JobsClusterGetter
 	CronJobsClusterGetter
+	JobsClusterGetter
 }
 
 type BatchV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) batchv1.BatchV1Interface
 }
 
+// BatchV1ClusterClient is used to interact with features provided by the batch group.
 type BatchV1ClusterClient struct {
 	clientCache kcpclient.Cache[*batchv1.BatchV1Client]
 }
@@ -52,23 +52,25 @@ func (c *BatchV1ClusterClient) Cluster(clusterPath logicalcluster.Path) batchv1.
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *BatchV1ClusterClient) Jobs() JobClusterInterface {
-	return &jobsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *BatchV1ClusterClient) CronJobs() CronJobClusterInterface {
 	return &cronJobsClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *BatchV1ClusterClient) Jobs() JobClusterInterface {
+	return &jobsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new BatchV1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*BatchV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new BatchV1ClusterClient for the given config and http client.
@@ -80,6 +82,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*BatchV1ClusterClien
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &BatchV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -92,3 +95,14 @@ func NewForConfigOrDie(c *rest.Config) *BatchV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apibatchv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/batch/v1/cronjob.go b/kubernetes/typed/batch/v1/cronjob.go
index 1f6089c95..5768defd4 100644
--- a/kubernetes/typed/batch/v1/cronjob.go
+++ b/kubernetes/typed/batch/v1/cronjob.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	batchv1 "k8s.io/api/batch/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	batchv1client "k8s.io/client-go/kubernetes/typed/batch/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedbatchv1 "k8s.io/client-go/kubernetes/typed/batch/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CronJobsClusterGetter has a method to return a CronJobClusterInterface.
@@ -45,10 +42,11 @@ type CronJobClusterInterface interface {
 	Cluster(logicalcluster.Path) CronJobsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*batchv1.CronJobList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	CronJobClusterExpansion
 }
 
 type cronJobsClusterInterface struct {
-	clientCache kcpclient.Cache[*batchv1client.BatchV1Client]
+	clientCache kcpclient.Cache[*typedbatchv1.BatchV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *cronJobsClusterInterface) Watch(ctx context.Context, opts metav1.ListOp
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CronJobs(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// CronJobsNamespacer can scope to objects within a namespace, returning a batchv1client.CronJobInterface.
+// CronJobsNamespacer can scope to objects within a namespace, returning a typedbatchv1.CronJobInterface.
 type CronJobsNamespacer interface {
-	Namespace(string) batchv1client.CronJobInterface
+	Namespace(string) typedbatchv1.CronJobInterface
 }
 
 type cronJobsNamespacer struct {
-	clientCache kcpclient.Cache[*batchv1client.BatchV1Client]
+	clientCache kcpclient.Cache[*typedbatchv1.BatchV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *cronJobsNamespacer) Namespace(namespace string) batchv1client.CronJobInterface {
+func (n *cronJobsNamespacer) Namespace(namespace string) typedbatchv1.CronJobInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).CronJobs(namespace)
 }
diff --git a/kubernetes/typed/batch/v1/doc.go b/kubernetes/typed/batch/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/batch/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/batch/v1/fake/batch_client.go b/kubernetes/typed/batch/v1/fake/batch_client.go
index fddf0916e..6ba1f0a96 100644
--- a/kubernetes/typed/batch/v1/fake/batch_client.go
+++ b/kubernetes/typed/batch/v1/fake/batch_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	batchv1 "k8s.io/client-go/kubernetes/typed/batch/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpbatchv1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpbatchv1.BatchV1ClusterInterface = (*BatchV1ClusterClient)(nil)
@@ -44,30 +40,30 @@ func (c *BatchV1ClusterClient) Cluster(clusterPath logicalcluster.Path) batchv1.
 	return &BatchV1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *BatchV1ClusterClient) Jobs() kcpbatchv1.JobClusterInterface {
-	return &jobsClusterClient{Fake: c.Fake}
-}
-
 func (c *BatchV1ClusterClient) CronJobs() kcpbatchv1.CronJobClusterInterface {
-	return &cronJobsClusterClient{Fake: c.Fake}
+	return newFakeCronJobClusterClient(c)
 }
 
-var _ batchv1.BatchV1Interface = (*BatchV1Client)(nil)
+func (c *BatchV1ClusterClient) Jobs() kcpbatchv1.JobClusterInterface {
+	return newFakeJobClusterClient(c)
+}
 
 type BatchV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *BatchV1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *BatchV1Client) CronJobs(namespace string) batchv1.CronJobInterface {
+	return newFakeCronJobClient(c.Fake, namespace, c.ClusterPath)
 }
 
 func (c *BatchV1Client) Jobs(namespace string) batchv1.JobInterface {
-	return &jobsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+	return newFakeJobClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *BatchV1Client) CronJobs(namespace string) batchv1.CronJobInterface {
-	return &cronJobsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *BatchV1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/batch/v1/fake/cronjob.go b/kubernetes/typed/batch/v1/fake/cronjob.go
index 57b11ad1d..dbf807087 100644
--- a/kubernetes/typed/batch/v1/fake/cronjob.go
+++ b/kubernetes/typed/batch/v1/fake/cronjob.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,82 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	batchv1 "k8s.io/api/batch/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsbatchv1 "k8s.io/client-go/applyconfigurations/batch/v1"
-	batchv1client "k8s.io/client-go/kubernetes/typed/batch/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/batch/v1"
+	typedbatchv1 "k8s.io/client-go/kubernetes/typed/batch/v1"
 
-	kcpbatchv1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1"
+	typedkcpbatchv1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var cronJobsResource = schema.GroupVersionResource{Group: "batch", Version: "v1", Resource: "cronjobs"}
-var cronJobsKind = schema.GroupVersionKind{Group: "batch", Version: "v1", Kind: "CronJob"}
-
-type cronJobsClusterClient struct {
-	*kcptesting.Fake
+// cronJobClusterClient implements CronJobClusterInterface
+type cronJobClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*batchv1.CronJob, *batchv1.CronJobList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *cronJobsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpbatchv1.CronJobsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &cronJobsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of CronJobs that match those selectors across all clusters.
-func (c *cronJobsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*batchv1.CronJobList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(cronJobsResource, cronJobsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &batchv1.CronJobList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeCronJobClusterClient(fake *BatchV1ClusterClient) typedkcpbatchv1.CronJobClusterInterface {
+	return &cronJobClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*batchv1.CronJob, *batchv1.CronJobList](
+			fake.Fake,
+			batchv1.SchemeGroupVersion.WithResource("cronjobs"),
+			batchv1.SchemeGroupVersion.WithKind("CronJob"),
+			func() *batchv1.CronJob { return &batchv1.CronJob{} },
+			func() *batchv1.CronJobList { return &batchv1.CronJobList{} },
+			func(dst, src *batchv1.CronJobList) { dst.ListMeta = src.ListMeta },
+			func(list *batchv1.CronJobList) []*batchv1.CronJob { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *batchv1.CronJobList, items []*batchv1.CronJob) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &batchv1.CronJobList{ListMeta: obj.(*batchv1.CronJobList).ListMeta}
-	for _, item := range obj.(*batchv1.CronJobList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested CronJobs across all clusters.
-func (c *cronJobsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(cronJobsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *cronJobClusterClient) Cluster(cluster logicalcluster.Path) typedkcpbatchv1.CronJobsNamespacer {
+	return &cronJobNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type cronJobsNamespacer struct {
+type cronJobNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *cronJobsNamespacer) Namespace(namespace string) batchv1client.CronJobInterface {
-	return &cronJobsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *cronJobNamespacer) Namespace(namespace string) typedbatchv1.CronJobInterface {
+	return newFakeCronJobClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type cronJobsClient struct {
-	*kcptesting.Fake
+// cronJobScopedClient implements CronJobInterface
+type cronJobScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*batchv1.CronJob, *batchv1.CronJobList, *v1.CronJobApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *cronJobsClient) Create(ctx context.Context, cronJob *batchv1.CronJob, opts metav1.CreateOptions) (*batchv1.CronJob, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(cronJobsResource, c.ClusterPath, c.Namespace, cronJob), &batchv1.CronJob{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1.CronJob), err
-}
-
-func (c *cronJobsClient) Update(ctx context.Context, cronJob *batchv1.CronJob, opts metav1.UpdateOptions) (*batchv1.CronJob, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(cronJobsResource, c.ClusterPath, c.Namespace, cronJob), &batchv1.CronJob{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1.CronJob), err
-}
-
-func (c *cronJobsClient) UpdateStatus(ctx context.Context, cronJob *batchv1.CronJob, opts metav1.UpdateOptions) (*batchv1.CronJob, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(cronJobsResource, c.ClusterPath, "status", c.Namespace, cronJob), &batchv1.CronJob{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1.CronJob), err
-}
-
-func (c *cronJobsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(cronJobsResource, c.ClusterPath, c.Namespace, name, opts), &batchv1.CronJob{})
-	return err
 }
 
-func (c *cronJobsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(cronJobsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &batchv1.CronJobList{})
-	return err
-}
-
-func (c *cronJobsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*batchv1.CronJob, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(cronJobsResource, c.ClusterPath, c.Namespace, name), &batchv1.CronJob{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1.CronJob), err
-}
-
-// List takes label and field selectors, and returns the list of CronJobs that match those selectors.
-func (c *cronJobsClient) List(ctx context.Context, opts metav1.ListOptions) (*batchv1.CronJobList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(cronJobsResource, cronJobsKind, c.ClusterPath, c.Namespace, opts), &batchv1.CronJobList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &batchv1.CronJobList{ListMeta: obj.(*batchv1.CronJobList).ListMeta}
-	for _, item := range obj.(*batchv1.CronJobList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *cronJobsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(cronJobsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *cronJobsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*batchv1.CronJob, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cronJobsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &batchv1.CronJob{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1.CronJob), err
-}
-
-func (c *cronJobsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsbatchv1.CronJobApplyConfiguration, opts metav1.ApplyOptions) (*batchv1.CronJob, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cronJobsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &batchv1.CronJob{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1.CronJob), err
-}
-
-func (c *cronJobsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsbatchv1.CronJobApplyConfiguration, opts metav1.ApplyOptions) (*batchv1.CronJob, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cronJobsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &batchv1.CronJob{})
-	if obj == nil {
-		return nil, err
+func newFakeCronJobClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedbatchv1.CronJobInterface {
+	return &cronJobScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*batchv1.CronJob, *batchv1.CronJobList, *v1.CronJobApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			batchv1.SchemeGroupVersion.WithResource("cronjobs"),
+			batchv1.SchemeGroupVersion.WithKind("CronJob"),
+			func() *batchv1.CronJob { return &batchv1.CronJob{} },
+			func() *batchv1.CronJobList { return &batchv1.CronJobList{} },
+			func(dst, src *batchv1.CronJobList) { dst.ListMeta = src.ListMeta },
+			func(list *batchv1.CronJobList) []*batchv1.CronJob { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *batchv1.CronJobList, items []*batchv1.CronJob) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*batchv1.CronJob), err
 }
diff --git a/kubernetes/typed/batch/v1/fake/doc.go b/kubernetes/typed/batch/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/batch/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/batch/v1/fake/job.go b/kubernetes/typed/batch/v1/fake/job.go
index 671d81b49..d3e18ab63 100644
--- a/kubernetes/typed/batch/v1/fake/job.go
+++ b/kubernetes/typed/batch/v1/fake/job.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	batchv1 "k8s.io/api/batch/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsbatchv1 "k8s.io/client-go/applyconfigurations/batch/v1"
-	batchv1client "k8s.io/client-go/kubernetes/typed/batch/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/batch/v1"
+	typedbatchv1 "k8s.io/client-go/kubernetes/typed/batch/v1"
 
-	kcpbatchv1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1"
+	typedkcpbatchv1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var jobsResource = schema.GroupVersionResource{Group: "batch", Version: "v1", Resource: "jobs"}
-var jobsKind = schema.GroupVersionKind{Group: "batch", Version: "v1", Kind: "Job"}
-
-type jobsClusterClient struct {
-	*kcptesting.Fake
+// jobClusterClient implements JobClusterInterface
+type jobClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*batchv1.Job, *batchv1.JobList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *jobsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpbatchv1.JobsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &jobsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Jobs that match those selectors across all clusters.
-func (c *jobsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*batchv1.JobList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(jobsResource, jobsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &batchv1.JobList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeJobClusterClient(fake *BatchV1ClusterClient) typedkcpbatchv1.JobClusterInterface {
+	return &jobClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*batchv1.Job, *batchv1.JobList](
+			fake.Fake,
+			batchv1.SchemeGroupVersion.WithResource("jobs"),
+			batchv1.SchemeGroupVersion.WithKind("Job"),
+			func() *batchv1.Job { return &batchv1.Job{} },
+			func() *batchv1.JobList { return &batchv1.JobList{} },
+			func(dst, src *batchv1.JobList) { dst.ListMeta = src.ListMeta },
+			func(list *batchv1.JobList) []*batchv1.Job { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *batchv1.JobList, items []*batchv1.Job) { list.Items = kcpgentype.FromPointerSlice(items) },
+		),
+		fake.Fake,
 	}
-	list := &batchv1.JobList{ListMeta: obj.(*batchv1.JobList).ListMeta}
-	for _, item := range obj.(*batchv1.JobList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Jobs across all clusters.
-func (c *jobsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(jobsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *jobClusterClient) Cluster(cluster logicalcluster.Path) typedkcpbatchv1.JobsNamespacer {
+	return &jobNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type jobsNamespacer struct {
+type jobNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *jobsNamespacer) Namespace(namespace string) batchv1client.JobInterface {
-	return &jobsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *jobNamespacer) Namespace(namespace string) typedbatchv1.JobInterface {
+	return newFakeJobClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type jobsClient struct {
-	*kcptesting.Fake
+// jobScopedClient implements JobInterface
+type jobScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*batchv1.Job, *batchv1.JobList, *v1.JobApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *jobsClient) Create(ctx context.Context, job *batchv1.Job, opts metav1.CreateOptions) (*batchv1.Job, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(jobsResource, c.ClusterPath, c.Namespace, job), &batchv1.Job{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1.Job), err
-}
-
-func (c *jobsClient) Update(ctx context.Context, job *batchv1.Job, opts metav1.UpdateOptions) (*batchv1.Job, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(jobsResource, c.ClusterPath, c.Namespace, job), &batchv1.Job{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1.Job), err
-}
-
-func (c *jobsClient) UpdateStatus(ctx context.Context, job *batchv1.Job, opts metav1.UpdateOptions) (*batchv1.Job, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(jobsResource, c.ClusterPath, "status", c.Namespace, job), &batchv1.Job{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1.Job), err
-}
-
-func (c *jobsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(jobsResource, c.ClusterPath, c.Namespace, name, opts), &batchv1.Job{})
-	return err
 }
 
-func (c *jobsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(jobsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &batchv1.JobList{})
-	return err
-}
-
-func (c *jobsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*batchv1.Job, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(jobsResource, c.ClusterPath, c.Namespace, name), &batchv1.Job{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1.Job), err
-}
-
-// List takes label and field selectors, and returns the list of Jobs that match those selectors.
-func (c *jobsClient) List(ctx context.Context, opts metav1.ListOptions) (*batchv1.JobList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(jobsResource, jobsKind, c.ClusterPath, c.Namespace, opts), &batchv1.JobList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &batchv1.JobList{ListMeta: obj.(*batchv1.JobList).ListMeta}
-	for _, item := range obj.(*batchv1.JobList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *jobsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(jobsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *jobsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*batchv1.Job, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(jobsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &batchv1.Job{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1.Job), err
-}
-
-func (c *jobsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsbatchv1.JobApplyConfiguration, opts metav1.ApplyOptions) (*batchv1.Job, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(jobsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &batchv1.Job{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1.Job), err
-}
-
-func (c *jobsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsbatchv1.JobApplyConfiguration, opts metav1.ApplyOptions) (*batchv1.Job, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(jobsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &batchv1.Job{})
-	if obj == nil {
-		return nil, err
+func newFakeJobClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedbatchv1.JobInterface {
+	return &jobScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*batchv1.Job, *batchv1.JobList, *v1.JobApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			batchv1.SchemeGroupVersion.WithResource("jobs"),
+			batchv1.SchemeGroupVersion.WithKind("Job"),
+			func() *batchv1.Job { return &batchv1.Job{} },
+			func() *batchv1.JobList { return &batchv1.JobList{} },
+			func(dst, src *batchv1.JobList) { dst.ListMeta = src.ListMeta },
+			func(list *batchv1.JobList) []*batchv1.Job { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *batchv1.JobList, items []*batchv1.Job) { list.Items = kcpgentype.FromPointerSlice(items) },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*batchv1.Job), err
 }
diff --git a/kubernetes/typed/batch/v1/generated_expansion.go b/kubernetes/typed/batch/v1/generated_expansion.go
new file mode 100644
index 000000000..68dfc618b
--- /dev/null
+++ b/kubernetes/typed/batch/v1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type CronJobClusterExpansion interface{}
+
+type JobClusterExpansion interface{}
diff --git a/kubernetes/typed/batch/v1/job.go b/kubernetes/typed/batch/v1/job.go
index 45e4ebd03..16af1d9a7 100644
--- a/kubernetes/typed/batch/v1/job.go
+++ b/kubernetes/typed/batch/v1/job.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	batchv1 "k8s.io/api/batch/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	batchv1client "k8s.io/client-go/kubernetes/typed/batch/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedbatchv1 "k8s.io/client-go/kubernetes/typed/batch/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // JobsClusterGetter has a method to return a JobClusterInterface.
@@ -45,10 +42,11 @@ type JobClusterInterface interface {
 	Cluster(logicalcluster.Path) JobsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*batchv1.JobList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	JobClusterExpansion
 }
 
 type jobsClusterInterface struct {
-	clientCache kcpclient.Cache[*batchv1client.BatchV1Client]
+	clientCache kcpclient.Cache[*typedbatchv1.BatchV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *jobsClusterInterface) Watch(ctx context.Context, opts metav1.ListOption
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Jobs(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// JobsNamespacer can scope to objects within a namespace, returning a batchv1client.JobInterface.
+// JobsNamespacer can scope to objects within a namespace, returning a typedbatchv1.JobInterface.
 type JobsNamespacer interface {
-	Namespace(string) batchv1client.JobInterface
+	Namespace(string) typedbatchv1.JobInterface
 }
 
 type jobsNamespacer struct {
-	clientCache kcpclient.Cache[*batchv1client.BatchV1Client]
+	clientCache kcpclient.Cache[*typedbatchv1.BatchV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *jobsNamespacer) Namespace(namespace string) batchv1client.JobInterface {
+func (n *jobsNamespacer) Namespace(namespace string) typedbatchv1.JobInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Jobs(namespace)
 }
diff --git a/kubernetes/typed/batch/v1beta1/batch_client.go b/kubernetes/typed/batch/v1beta1/batch_client.go
index e04ca3d66..926df8af2 100644
--- a/kubernetes/typed/batch/v1beta1/batch_client.go
+++ b/kubernetes/typed/batch/v1beta1/batch_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apibatchv1beta1 "k8s.io/api/batch/v1beta1"
+	batchv1beta1 "k8s.io/client-go/kubernetes/typed/batch/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	batchv1beta1 "k8s.io/client-go/kubernetes/typed/batch/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type BatchV1beta1ClusterInterface interface {
@@ -40,6 +39,7 @@ type BatchV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) batchv1beta1.BatchV1beta1Interface
 }
 
+// BatchV1beta1ClusterClient is used to interact with features provided by the batch group.
 type BatchV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*batchv1beta1.BatchV1beta1Client]
 }
@@ -59,11 +59,13 @@ func (c *BatchV1beta1ClusterClient) CronJobs() CronJobClusterInterface {
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*BatchV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new BatchV1beta1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*BatchV1beta1Cluster
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &BatchV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *BatchV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apibatchv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/batch/v1beta1/cronjob.go b/kubernetes/typed/batch/v1beta1/cronjob.go
index a5d840e36..f271ca9ee 100644
--- a/kubernetes/typed/batch/v1beta1/cronjob.go
+++ b/kubernetes/typed/batch/v1beta1/cronjob.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	batchv1beta1 "k8s.io/api/batch/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedbatchv1beta1 "k8s.io/client-go/kubernetes/typed/batch/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	batchv1beta1 "k8s.io/api/batch/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	batchv1beta1client "k8s.io/client-go/kubernetes/typed/batch/v1beta1"
 )
 
 // CronJobsClusterGetter has a method to return a CronJobClusterInterface.
@@ -43,12 +40,13 @@ type CronJobsClusterGetter interface {
 // or scope down to one cluster and return a CronJobsNamespacer.
 type CronJobClusterInterface interface {
 	Cluster(logicalcluster.Path) CronJobsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*batchv1beta1.CronJobList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*batchv1beta1.CronJobList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	CronJobClusterExpansion
 }
 
 type cronJobsClusterInterface struct {
-	clientCache kcpclient.Cache[*batchv1beta1client.BatchV1beta1Client]
+	clientCache kcpclient.Cache[*typedbatchv1beta1.BatchV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *cronJobsClusterInterface) Cluster(clusterPath logicalcluster.Path) Cron
 }
 
 // List returns the entire collection of all CronJobs across all clusters.
-func (c *cronJobsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*batchv1beta1.CronJobList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CronJobs(metav1.NamespaceAll).List(ctx, opts)
+func (c *cronJobsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*batchv1beta1.CronJobList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CronJobs(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all CronJobs across all clusters.
-func (c *cronJobsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CronJobs(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *cronJobsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CronJobs(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// CronJobsNamespacer can scope to objects within a namespace, returning a batchv1beta1client.CronJobInterface.
+// CronJobsNamespacer can scope to objects within a namespace, returning a typedbatchv1beta1.CronJobInterface.
 type CronJobsNamespacer interface {
-	Namespace(string) batchv1beta1client.CronJobInterface
+	Namespace(string) typedbatchv1beta1.CronJobInterface
 }
 
 type cronJobsNamespacer struct {
-	clientCache kcpclient.Cache[*batchv1beta1client.BatchV1beta1Client]
+	clientCache kcpclient.Cache[*typedbatchv1beta1.BatchV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *cronJobsNamespacer) Namespace(namespace string) batchv1beta1client.CronJobInterface {
+func (n *cronJobsNamespacer) Namespace(namespace string) typedbatchv1beta1.CronJobInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).CronJobs(namespace)
 }
diff --git a/kubernetes/typed/batch/v1beta1/doc.go b/kubernetes/typed/batch/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/batch/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/batch/v1beta1/fake/batch_client.go b/kubernetes/typed/batch/v1beta1/fake/batch_client.go
index 5fce75760..e668f53e0 100644
--- a/kubernetes/typed/batch/v1beta1/fake/batch_client.go
+++ b/kubernetes/typed/batch/v1beta1/fake/batch_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	batchv1beta1 "k8s.io/client-go/kubernetes/typed/batch/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpbatchv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpbatchv1beta1.BatchV1beta1ClusterInterface = (*BatchV1beta1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *BatchV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) bat
 }
 
 func (c *BatchV1beta1ClusterClient) CronJobs() kcpbatchv1beta1.CronJobClusterInterface {
-	return &cronJobsClusterClient{Fake: c.Fake}
+	return newFakeCronJobClusterClient(c)
 }
 
-var _ batchv1beta1.BatchV1beta1Interface = (*BatchV1beta1Client)(nil)
-
 type BatchV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *BatchV1beta1Client) CronJobs(namespace string) batchv1beta1.CronJobInterface {
+	return newFakeCronJobClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *BatchV1beta1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *BatchV1beta1Client) CronJobs(namespace string) batchv1beta1.CronJobInterface {
-	return &cronJobsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
diff --git a/kubernetes/typed/batch/v1beta1/fake/cronjob.go b/kubernetes/typed/batch/v1beta1/fake/cronjob.go
index dc5ea0bf9..68cb8fef0 100644
--- a/kubernetes/typed/batch/v1beta1/fake/cronjob.go
+++ b/kubernetes/typed/batch/v1beta1/fake/cronjob.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	batchv1beta1 "k8s.io/api/batch/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsbatchv1beta1 "k8s.io/client-go/applyconfigurations/batch/v1beta1"
-	batchv1beta1client "k8s.io/client-go/kubernetes/typed/batch/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/batch/v1beta1"
+	typedbatchv1beta1 "k8s.io/client-go/kubernetes/typed/batch/v1beta1"
 
-	kcpbatchv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1beta1"
+	typedkcpbatchv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/batch/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var cronJobsResource = schema.GroupVersionResource{Group: "batch", Version: "v1beta1", Resource: "cronjobs"}
-var cronJobsKind = schema.GroupVersionKind{Group: "batch", Version: "v1beta1", Kind: "CronJob"}
-
-type cronJobsClusterClient struct {
-	*kcptesting.Fake
+// cronJobClusterClient implements CronJobClusterInterface
+type cronJobClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*batchv1beta1.CronJob, *batchv1beta1.CronJobList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *cronJobsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpbatchv1beta1.CronJobsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &cronJobsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of CronJobs that match those selectors across all clusters.
-func (c *cronJobsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*batchv1beta1.CronJobList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(cronJobsResource, cronJobsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &batchv1beta1.CronJobList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeCronJobClusterClient(fake *BatchV1beta1ClusterClient) typedkcpbatchv1beta1.CronJobClusterInterface {
+	return &cronJobClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*batchv1beta1.CronJob, *batchv1beta1.CronJobList](
+			fake.Fake,
+			batchv1beta1.SchemeGroupVersion.WithResource("cronjobs"),
+			batchv1beta1.SchemeGroupVersion.WithKind("CronJob"),
+			func() *batchv1beta1.CronJob { return &batchv1beta1.CronJob{} },
+			func() *batchv1beta1.CronJobList { return &batchv1beta1.CronJobList{} },
+			func(dst, src *batchv1beta1.CronJobList) { dst.ListMeta = src.ListMeta },
+			func(list *batchv1beta1.CronJobList) []*batchv1beta1.CronJob {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *batchv1beta1.CronJobList, items []*batchv1beta1.CronJob) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &batchv1beta1.CronJobList{ListMeta: obj.(*batchv1beta1.CronJobList).ListMeta}
-	for _, item := range obj.(*batchv1beta1.CronJobList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested CronJobs across all clusters.
-func (c *cronJobsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(cronJobsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *cronJobClusterClient) Cluster(cluster logicalcluster.Path) typedkcpbatchv1beta1.CronJobsNamespacer {
+	return &cronJobNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type cronJobsNamespacer struct {
+type cronJobNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *cronJobsNamespacer) Namespace(namespace string) batchv1beta1client.CronJobInterface {
-	return &cronJobsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *cronJobNamespacer) Namespace(namespace string) typedbatchv1beta1.CronJobInterface {
+	return newFakeCronJobClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type cronJobsClient struct {
-	*kcptesting.Fake
+// cronJobScopedClient implements CronJobInterface
+type cronJobScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*batchv1beta1.CronJob, *batchv1beta1.CronJobList, *v1beta1.CronJobApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *cronJobsClient) Create(ctx context.Context, cronJob *batchv1beta1.CronJob, opts metav1.CreateOptions) (*batchv1beta1.CronJob, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(cronJobsResource, c.ClusterPath, c.Namespace, cronJob), &batchv1beta1.CronJob{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1beta1.CronJob), err
-}
-
-func (c *cronJobsClient) Update(ctx context.Context, cronJob *batchv1beta1.CronJob, opts metav1.UpdateOptions) (*batchv1beta1.CronJob, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(cronJobsResource, c.ClusterPath, c.Namespace, cronJob), &batchv1beta1.CronJob{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1beta1.CronJob), err
-}
-
-func (c *cronJobsClient) UpdateStatus(ctx context.Context, cronJob *batchv1beta1.CronJob, opts metav1.UpdateOptions) (*batchv1beta1.CronJob, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(cronJobsResource, c.ClusterPath, "status", c.Namespace, cronJob), &batchv1beta1.CronJob{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1beta1.CronJob), err
-}
-
-func (c *cronJobsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(cronJobsResource, c.ClusterPath, c.Namespace, name, opts), &batchv1beta1.CronJob{})
-	return err
 }
 
-func (c *cronJobsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(cronJobsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &batchv1beta1.CronJobList{})
-	return err
-}
-
-func (c *cronJobsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*batchv1beta1.CronJob, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(cronJobsResource, c.ClusterPath, c.Namespace, name), &batchv1beta1.CronJob{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1beta1.CronJob), err
-}
-
-// List takes label and field selectors, and returns the list of CronJobs that match those selectors.
-func (c *cronJobsClient) List(ctx context.Context, opts metav1.ListOptions) (*batchv1beta1.CronJobList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(cronJobsResource, cronJobsKind, c.ClusterPath, c.Namespace, opts), &batchv1beta1.CronJobList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &batchv1beta1.CronJobList{ListMeta: obj.(*batchv1beta1.CronJobList).ListMeta}
-	for _, item := range obj.(*batchv1beta1.CronJobList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *cronJobsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(cronJobsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *cronJobsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*batchv1beta1.CronJob, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cronJobsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &batchv1beta1.CronJob{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1beta1.CronJob), err
-}
-
-func (c *cronJobsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsbatchv1beta1.CronJobApplyConfiguration, opts metav1.ApplyOptions) (*batchv1beta1.CronJob, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cronJobsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &batchv1beta1.CronJob{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*batchv1beta1.CronJob), err
-}
-
-func (c *cronJobsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsbatchv1beta1.CronJobApplyConfiguration, opts metav1.ApplyOptions) (*batchv1beta1.CronJob, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cronJobsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &batchv1beta1.CronJob{})
-	if obj == nil {
-		return nil, err
+func newFakeCronJobClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedbatchv1beta1.CronJobInterface {
+	return &cronJobScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*batchv1beta1.CronJob, *batchv1beta1.CronJobList, *v1beta1.CronJobApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			batchv1beta1.SchemeGroupVersion.WithResource("cronjobs"),
+			batchv1beta1.SchemeGroupVersion.WithKind("CronJob"),
+			func() *batchv1beta1.CronJob { return &batchv1beta1.CronJob{} },
+			func() *batchv1beta1.CronJobList { return &batchv1beta1.CronJobList{} },
+			func(dst, src *batchv1beta1.CronJobList) { dst.ListMeta = src.ListMeta },
+			func(list *batchv1beta1.CronJobList) []*batchv1beta1.CronJob {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *batchv1beta1.CronJobList, items []*batchv1beta1.CronJob) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*batchv1beta1.CronJob), err
 }
diff --git a/kubernetes/typed/batch/v1beta1/fake/doc.go b/kubernetes/typed/batch/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/batch/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/batch/v1beta1/generated_expansion.go b/kubernetes/typed/batch/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..502fb1518
--- /dev/null
+++ b/kubernetes/typed/batch/v1beta1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type CronJobClusterExpansion interface{}
diff --git a/kubernetes/typed/certificates/v1/certificates_client.go b/kubernetes/typed/certificates/v1/certificates_client.go
index a4662d9f7..e79db5fd2 100644
--- a/kubernetes/typed/certificates/v1/certificates_client.go
+++ b/kubernetes/typed/certificates/v1/certificates_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apicertificatesv1 "k8s.io/api/certificates/v1"
+	certificatesv1 "k8s.io/client-go/kubernetes/typed/certificates/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	certificatesv1 "k8s.io/client-go/kubernetes/typed/certificates/v1"
-	"k8s.io/client-go/rest"
 )
 
 type CertificatesV1ClusterInterface interface {
@@ -40,6 +39,7 @@ type CertificatesV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) certificatesv1.CertificatesV1Interface
 }
 
+// CertificatesV1ClusterClient is used to interact with features provided by the certificates.k8s.io group.
 type CertificatesV1ClusterClient struct {
 	clientCache kcpclient.Cache[*certificatesv1.CertificatesV1Client]
 }
@@ -59,11 +59,13 @@ func (c *CertificatesV1ClusterClient) CertificateSigningRequests() CertificateSi
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*CertificatesV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new CertificatesV1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*CertificatesV1Clust
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &CertificatesV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *CertificatesV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apicertificatesv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/certificates/v1/certificatesigningrequest.go b/kubernetes/typed/certificates/v1/certificatesigningrequest.go
index 5aef01251..c3e8e6a3b 100644
--- a/kubernetes/typed/certificates/v1/certificatesigningrequest.go
+++ b/kubernetes/typed/certificates/v1/certificatesigningrequest.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apicertificatesv1 "k8s.io/api/certificates/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	certificatesv1 "k8s.io/client-go/kubernetes/typed/certificates/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	certificatesv1 "k8s.io/api/certificates/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	certificatesv1client "k8s.io/client-go/kubernetes/typed/certificates/v1"
 )
 
 // CertificateSigningRequestsClusterGetter has a method to return a CertificateSigningRequestClusterInterface.
@@ -40,19 +37,20 @@ type CertificateSigningRequestsClusterGetter interface {
 }
 
 // CertificateSigningRequestClusterInterface can operate on CertificateSigningRequests across all clusters,
-// or scope down to one cluster and return a certificatesv1client.CertificateSigningRequestInterface.
+// or scope down to one cluster and return a certificatesv1.CertificateSigningRequestInterface.
 type CertificateSigningRequestClusterInterface interface {
-	Cluster(logicalcluster.Path) certificatesv1client.CertificateSigningRequestInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*certificatesv1.CertificateSigningRequestList, error)
+	Cluster(logicalcluster.Path) certificatesv1.CertificateSigningRequestInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apicertificatesv1.CertificateSigningRequestList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	CertificateSigningRequestClusterExpansion
 }
 
 type certificateSigningRequestsClusterInterface struct {
-	clientCache kcpclient.Cache[*certificatesv1client.CertificatesV1Client]
+	clientCache kcpclient.Cache[*certificatesv1.CertificatesV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *certificateSigningRequestsClusterInterface) Cluster(clusterPath logicalcluster.Path) certificatesv1client.CertificateSigningRequestInterface {
+func (c *certificateSigningRequestsClusterInterface) Cluster(clusterPath logicalcluster.Path) certificatesv1.CertificateSigningRequestInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *certificateSigningRequestsClusterInterface) Cluster(clusterPath logical
 }
 
 // List returns the entire collection of all CertificateSigningRequests across all clusters.
-func (c *certificateSigningRequestsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*certificatesv1.CertificateSigningRequestList, error) {
+func (c *certificateSigningRequestsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apicertificatesv1.CertificateSigningRequestList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CertificateSigningRequests().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/certificates/v1/doc.go b/kubernetes/typed/certificates/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/certificates/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/certificates/v1/fake/certificates_client.go b/kubernetes/typed/certificates/v1/fake/certificates_client.go
index 8d627ff5a..f0d55adce 100644
--- a/kubernetes/typed/certificates/v1/fake/certificates_client.go
+++ b/kubernetes/typed/certificates/v1/fake/certificates_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	certificatesv1 "k8s.io/client-go/kubernetes/typed/certificates/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpcertificatesv1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpcertificatesv1.CertificatesV1ClusterInterface = (*CertificatesV1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *CertificatesV1ClusterClient) Cluster(clusterPath logicalcluster.Path) c
 }
 
 func (c *CertificatesV1ClusterClient) CertificateSigningRequests() kcpcertificatesv1.CertificateSigningRequestClusterInterface {
-	return &certificateSigningRequestsClusterClient{Fake: c.Fake}
+	return newFakeCertificateSigningRequestClusterClient(c)
 }
 
-var _ certificatesv1.CertificatesV1Interface = (*CertificatesV1Client)(nil)
-
 type CertificatesV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *CertificatesV1Client) CertificateSigningRequests() certificatesv1.CertificateSigningRequestInterface {
+	return newFakeCertificateSigningRequestClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *CertificatesV1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *CertificatesV1Client) CertificateSigningRequests() certificatesv1.CertificateSigningRequestInterface {
-	return &certificateSigningRequestsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
diff --git a/kubernetes/typed/certificates/v1/fake/certificatesigningrequest.go b/kubernetes/typed/certificates/v1/fake/certificatesigningrequest.go
index 07a4547c1..800270da2 100644
--- a/kubernetes/typed/certificates/v1/fake/certificatesigningrequest.go
+++ b/kubernetes/typed/certificates/v1/fake/certificatesigningrequest.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,194 +14,94 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	certificatesv1 "k8s.io/api/certificates/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscertificatesv1 "k8s.io/client-go/applyconfigurations/certificates/v1"
-	certificatesv1client "k8s.io/client-go/kubernetes/typed/certificates/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/certificates/v1"
+	typedcertificatesv1 "k8s.io/client-go/kubernetes/typed/certificates/v1"
 
+	typedkcpcertificatesv1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var certificateSigningRequestsResource = schema.GroupVersionResource{Group: "certificates.k8s.io", Version: "v1", Resource: "certificatesigningrequests"}
-var certificateSigningRequestsKind = schema.GroupVersionKind{Group: "certificates.k8s.io", Version: "v1", Kind: "CertificateSigningRequest"}
-
-type certificateSigningRequestsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *certificateSigningRequestsClusterClient) Cluster(clusterPath logicalcluster.Path) certificatesv1client.CertificateSigningRequestInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &certificateSigningRequestsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of CertificateSigningRequests that match those selectors across all clusters.
-func (c *certificateSigningRequestsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*certificatesv1.CertificateSigningRequestList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(certificateSigningRequestsResource, certificateSigningRequestsKind, logicalcluster.Wildcard, opts), &certificatesv1.CertificateSigningRequestList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &certificatesv1.CertificateSigningRequestList{ListMeta: obj.(*certificatesv1.CertificateSigningRequestList).ListMeta}
-	for _, item := range obj.(*certificatesv1.CertificateSigningRequestList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested CertificateSigningRequests across all clusters.
-func (c *certificateSigningRequestsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(certificateSigningRequestsResource, logicalcluster.Wildcard, opts))
-}
-
-type certificateSigningRequestsClient struct {
-	*kcptesting.Fake
+// certificateSigningRequestClusterClient implements CertificateSigningRequestClusterInterface
+type certificateSigningRequestClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*certificatesv1.CertificateSigningRequest, *certificatesv1.CertificateSigningRequestList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeCertificateSigningRequestClusterClient(fake *CertificatesV1ClusterClient) typedkcpcertificatesv1.CertificateSigningRequestClusterInterface {
+	return &certificateSigningRequestClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*certificatesv1.CertificateSigningRequest, *certificatesv1.CertificateSigningRequestList](
+			fake.Fake,
+			certificatesv1.SchemeGroupVersion.WithResource("certificatesigningrequests"),
+			certificatesv1.SchemeGroupVersion.WithKind("CertificateSigningRequest"),
+			func() *certificatesv1.CertificateSigningRequest { return &certificatesv1.CertificateSigningRequest{} },
+			func() *certificatesv1.CertificateSigningRequestList {
+				return &certificatesv1.CertificateSigningRequestList{}
+			},
+			func(dst, src *certificatesv1.CertificateSigningRequestList) { dst.ListMeta = src.ListMeta },
+			func(list *certificatesv1.CertificateSigningRequestList) []*certificatesv1.CertificateSigningRequest {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *certificatesv1.CertificateSigningRequestList, items []*certificatesv1.CertificateSigningRequest) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *certificateSigningRequestClusterClient) Cluster(cluster logicalcluster.Path) typedcertificatesv1.CertificateSigningRequestInterface {
+	return newFakeCertificateSigningRequestClient(c.Fake, cluster)
+}
+
+// certificateSigningRequestScopedClient implements CertificateSigningRequestInterface
+type certificateSigningRequestScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*certificatesv1.CertificateSigningRequest, *certificatesv1.CertificateSigningRequestList, *v1.CertificateSigningRequestApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *certificateSigningRequestsClient) Create(ctx context.Context, certificateSigningRequest *certificatesv1.CertificateSigningRequest, opts metav1.CreateOptions) (*certificatesv1.CertificateSigningRequest, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(certificateSigningRequestsResource, c.ClusterPath, certificateSigningRequest), &certificatesv1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1.CertificateSigningRequest), err
-}
-
-func (c *certificateSigningRequestsClient) Update(ctx context.Context, certificateSigningRequest *certificatesv1.CertificateSigningRequest, opts metav1.UpdateOptions) (*certificatesv1.CertificateSigningRequest, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(certificateSigningRequestsResource, c.ClusterPath, certificateSigningRequest), &certificatesv1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1.CertificateSigningRequest), err
-}
-
-func (c *certificateSigningRequestsClient) UpdateStatus(ctx context.Context, certificateSigningRequest *certificatesv1.CertificateSigningRequest, opts metav1.UpdateOptions) (*certificatesv1.CertificateSigningRequest, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(certificateSigningRequestsResource, c.ClusterPath, "status", certificateSigningRequest), &certificatesv1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1.CertificateSigningRequest), err
-}
-
-func (c *certificateSigningRequestsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(certificateSigningRequestsResource, c.ClusterPath, name, opts), &certificatesv1.CertificateSigningRequest{})
-	return err
-}
-
-func (c *certificateSigningRequestsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(certificateSigningRequestsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &certificatesv1.CertificateSigningRequestList{})
-	return err
-}
-
-func (c *certificateSigningRequestsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*certificatesv1.CertificateSigningRequest, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(certificateSigningRequestsResource, c.ClusterPath, name), &certificatesv1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1.CertificateSigningRequest), err
-}
-
-// List takes label and field selectors, and returns the list of CertificateSigningRequests that match those selectors.
-func (c *certificateSigningRequestsClient) List(ctx context.Context, opts metav1.ListOptions) (*certificatesv1.CertificateSigningRequestList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(certificateSigningRequestsResource, certificateSigningRequestsKind, c.ClusterPath, opts), &certificatesv1.CertificateSigningRequestList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &certificatesv1.CertificateSigningRequestList{ListMeta: obj.(*certificatesv1.CertificateSigningRequestList).ListMeta}
-	for _, item := range obj.(*certificatesv1.CertificateSigningRequestList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *certificateSigningRequestsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(certificateSigningRequestsResource, c.ClusterPath, opts))
-}
-
-func (c *certificateSigningRequestsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*certificatesv1.CertificateSigningRequest, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(certificateSigningRequestsResource, c.ClusterPath, name, pt, data, subresources...), &certificatesv1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1.CertificateSigningRequest), err
-}
-
-func (c *certificateSigningRequestsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscertificatesv1.CertificateSigningRequestApplyConfiguration, opts metav1.ApplyOptions) (*certificatesv1.CertificateSigningRequest, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(certificateSigningRequestsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &certificatesv1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1.CertificateSigningRequest), err
-}
-
-func (c *certificateSigningRequestsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscertificatesv1.CertificateSigningRequestApplyConfiguration, opts metav1.ApplyOptions) (*certificatesv1.CertificateSigningRequest, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(certificateSigningRequestsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &certificatesv1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1.CertificateSigningRequest), err
-}
-
-func (c *certificateSigningRequestsClient) UpdateApproval(ctx context.Context, certificateSigningRequestName string, certificateSigningRequest *certificatesv1.CertificateSigningRequest, opts metav1.UpdateOptions) (*certificatesv1.CertificateSigningRequest, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(certificateSigningRequestsResource, c.ClusterPath, "approval", certificateSigningRequest), &certificatesv1.CertificateSigningRequest{})
+func newFakeCertificateSigningRequestClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedcertificatesv1.CertificateSigningRequestInterface {
+	return &certificateSigningRequestScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*certificatesv1.CertificateSigningRequest, *certificatesv1.CertificateSigningRequestList, *v1.CertificateSigningRequestApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			certificatesv1.SchemeGroupVersion.WithResource("certificatesigningrequests"),
+			certificatesv1.SchemeGroupVersion.WithKind("CertificateSigningRequest"),
+			func() *certificatesv1.CertificateSigningRequest { return &certificatesv1.CertificateSigningRequest{} },
+			func() *certificatesv1.CertificateSigningRequestList {
+				return &certificatesv1.CertificateSigningRequestList{}
+			},
+			func(dst, src *certificatesv1.CertificateSigningRequestList) { dst.ListMeta = src.ListMeta },
+			func(list *certificatesv1.CertificateSigningRequestList) []*certificatesv1.CertificateSigningRequest {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *certificatesv1.CertificateSigningRequestList, items []*certificatesv1.CertificateSigningRequest) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
+
+// UpdateApproval takes the representation of a certificateSigningRequest and updates it. Returns the server's representation of the certificateSigningRequest, and an error, if there is any.
+func (c *certificateSigningRequestScopedClient) UpdateApproval(ctx context.Context, certificateSigningRequestName string, certificateSigningRequest *certificatesv1.CertificateSigningRequest, _ metav1.UpdateOptions) (result *certificatesv1.CertificateSigningRequest, err error) {
+	emptyResult := &certificatesv1.CertificateSigningRequest{}
+	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(c.Resource(), c.ClusterPath, "approval", certificateSigningRequest), emptyResult)
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*certificatesv1.CertificateSigningRequest), err
 }
diff --git a/kubernetes/typed/certificates/v1/fake/doc.go b/kubernetes/typed/certificates/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/certificates/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/certificates/v1/generated_expansion.go b/kubernetes/typed/certificates/v1/generated_expansion.go
new file mode 100644
index 000000000..49eb67ef4
--- /dev/null
+++ b/kubernetes/typed/certificates/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type CertificateSigningRequestClusterExpansion interface{}
diff --git a/kubernetes/typed/certificates/v1alpha1/certificates_client.go b/kubernetes/typed/certificates/v1alpha1/certificates_client.go
new file mode 100644
index 000000000..7aa4ad64e
--- /dev/null
+++ b/kubernetes/typed/certificates/v1alpha1/certificates_client.go
@@ -0,0 +1,103 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	http "net/http"
+
+	apicertificatesv1alpha1 "k8s.io/api/certificates/v1alpha1"
+	certificatesv1alpha1 "k8s.io/client-go/kubernetes/typed/certificates/v1alpha1"
+	rest "k8s.io/client-go/rest"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+type CertificatesV1alpha1ClusterInterface interface {
+	CertificatesV1alpha1ClusterScoper
+	ClusterTrustBundlesClusterGetter
+}
+
+type CertificatesV1alpha1ClusterScoper interface {
+	Cluster(logicalcluster.Path) certificatesv1alpha1.CertificatesV1alpha1Interface
+}
+
+// CertificatesV1alpha1ClusterClient is used to interact with features provided by the certificates.k8s.io group.
+type CertificatesV1alpha1ClusterClient struct {
+	clientCache kcpclient.Cache[*certificatesv1alpha1.CertificatesV1alpha1Client]
+}
+
+func (c *CertificatesV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) certificatesv1alpha1.CertificatesV1alpha1Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return c.clientCache.ClusterOrDie(clusterPath)
+}
+
+func (c *CertificatesV1alpha1ClusterClient) ClusterTrustBundles() ClusterTrustBundleClusterInterface {
+	return &clusterTrustBundlesClusterInterface{clientCache: c.clientCache}
+}
+
+// NewForConfig creates a new CertificatesV1alpha1ClusterClient for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*CertificatesV1alpha1ClusterClient, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new CertificatesV1alpha1ClusterClient for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*CertificatesV1alpha1ClusterClient, error) {
+	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*certificatesv1alpha1.CertificatesV1alpha1Client]{
+		NewForConfigAndClient: certificatesv1alpha1.NewForConfigAndClient,
+	})
+	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
+		return nil, err
+	}
+
+	return &CertificatesV1alpha1ClusterClient{clientCache: cache}, nil
+}
+
+// NewForConfigOrDie creates a new CertificatesV1alpha1ClusterClient for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *CertificatesV1alpha1ClusterClient {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apicertificatesv1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/certificates/v1alpha1/clustertrustbundle.go b/kubernetes/typed/certificates/v1alpha1/clustertrustbundle.go
new file mode 100644
index 000000000..c5ad8e175
--- /dev/null
+++ b/kubernetes/typed/certificates/v1alpha1/clustertrustbundle.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	apicertificatesv1alpha1 "k8s.io/api/certificates/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	certificatesv1alpha1 "k8s.io/client-go/kubernetes/typed/certificates/v1alpha1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ClusterTrustBundlesClusterGetter has a method to return a ClusterTrustBundleClusterInterface.
+// A group's cluster client should implement this interface.
+type ClusterTrustBundlesClusterGetter interface {
+	ClusterTrustBundles() ClusterTrustBundleClusterInterface
+}
+
+// ClusterTrustBundleClusterInterface can operate on ClusterTrustBundles across all clusters,
+// or scope down to one cluster and return a certificatesv1alpha1.ClusterTrustBundleInterface.
+type ClusterTrustBundleClusterInterface interface {
+	Cluster(logicalcluster.Path) certificatesv1alpha1.ClusterTrustBundleInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apicertificatesv1alpha1.ClusterTrustBundleList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ClusterTrustBundleClusterExpansion
+}
+
+type clusterTrustBundlesClusterInterface struct {
+	clientCache kcpclient.Cache[*certificatesv1alpha1.CertificatesV1alpha1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *clusterTrustBundlesClusterInterface) Cluster(clusterPath logicalcluster.Path) certificatesv1alpha1.ClusterTrustBundleInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).ClusterTrustBundles()
+}
+
+// List returns the entire collection of all ClusterTrustBundles across all clusters.
+func (c *clusterTrustBundlesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apicertificatesv1alpha1.ClusterTrustBundleList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterTrustBundles().List(ctx, opts)
+}
+
+// Watch begins to watch all ClusterTrustBundles across all clusters.
+func (c *clusterTrustBundlesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterTrustBundles().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/certificates/v1alpha1/doc.go b/kubernetes/typed/certificates/v1alpha1/doc.go
new file mode 100644
index 000000000..08b80237c
--- /dev/null
+++ b/kubernetes/typed/certificates/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/kubernetes/typed/certificates/v1alpha1/fake/certificates_client.go b/kubernetes/typed/certificates/v1alpha1/fake/certificates_client.go
new file mode 100644
index 000000000..d9c2e0561
--- /dev/null
+++ b/kubernetes/typed/certificates/v1alpha1/fake/certificates_client.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	certificatesv1alpha1 "k8s.io/client-go/kubernetes/typed/certificates/v1alpha1"
+	rest "k8s.io/client-go/rest"
+
+	kcpcertificatesv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1alpha1"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+var _ kcpcertificatesv1alpha1.CertificatesV1alpha1ClusterInterface = (*CertificatesV1alpha1ClusterClient)(nil)
+
+type CertificatesV1alpha1ClusterClient struct {
+	*kcptesting.Fake
+}
+
+func (c *CertificatesV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) certificatesv1alpha1.CertificatesV1alpha1Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return &CertificatesV1alpha1Client{Fake: c.Fake, ClusterPath: clusterPath}
+}
+
+func (c *CertificatesV1alpha1ClusterClient) ClusterTrustBundles() kcpcertificatesv1alpha1.ClusterTrustBundleClusterInterface {
+	return newFakeClusterTrustBundleClusterClient(c)
+}
+
+type CertificatesV1alpha1Client struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (c *CertificatesV1alpha1Client) ClusterTrustBundles() certificatesv1alpha1.ClusterTrustBundleInterface {
+	return newFakeClusterTrustBundleClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *CertificatesV1alpha1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/kubernetes/typed/certificates/v1alpha1/fake/clustertrustbundle.go b/kubernetes/typed/certificates/v1alpha1/fake/clustertrustbundle.go
new file mode 100644
index 000000000..5928f9447
--- /dev/null
+++ b/kubernetes/typed/certificates/v1alpha1/fake/clustertrustbundle.go
@@ -0,0 +1,94 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	certificatesv1alpha1 "k8s.io/api/certificates/v1alpha1"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/certificates/v1alpha1"
+	typedcertificatesv1alpha1 "k8s.io/client-go/kubernetes/typed/certificates/v1alpha1"
+
+	typedkcpcertificatesv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// clusterTrustBundleClusterClient implements ClusterTrustBundleClusterInterface
+type clusterTrustBundleClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*certificatesv1alpha1.ClusterTrustBundle, *certificatesv1alpha1.ClusterTrustBundleList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeClusterTrustBundleClusterClient(fake *CertificatesV1alpha1ClusterClient) typedkcpcertificatesv1alpha1.ClusterTrustBundleClusterInterface {
+	return &clusterTrustBundleClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*certificatesv1alpha1.ClusterTrustBundle, *certificatesv1alpha1.ClusterTrustBundleList](
+			fake.Fake,
+			certificatesv1alpha1.SchemeGroupVersion.WithResource("clustertrustbundles"),
+			certificatesv1alpha1.SchemeGroupVersion.WithKind("ClusterTrustBundle"),
+			func() *certificatesv1alpha1.ClusterTrustBundle { return &certificatesv1alpha1.ClusterTrustBundle{} },
+			func() *certificatesv1alpha1.ClusterTrustBundleList {
+				return &certificatesv1alpha1.ClusterTrustBundleList{}
+			},
+			func(dst, src *certificatesv1alpha1.ClusterTrustBundleList) { dst.ListMeta = src.ListMeta },
+			func(list *certificatesv1alpha1.ClusterTrustBundleList) []*certificatesv1alpha1.ClusterTrustBundle {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *certificatesv1alpha1.ClusterTrustBundleList, items []*certificatesv1alpha1.ClusterTrustBundle) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *clusterTrustBundleClusterClient) Cluster(cluster logicalcluster.Path) typedcertificatesv1alpha1.ClusterTrustBundleInterface {
+	return newFakeClusterTrustBundleClient(c.Fake, cluster)
+}
+
+// clusterTrustBundleScopedClient implements ClusterTrustBundleInterface
+type clusterTrustBundleScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*certificatesv1alpha1.ClusterTrustBundle, *certificatesv1alpha1.ClusterTrustBundleList, *v1alpha1.ClusterTrustBundleApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeClusterTrustBundleClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedcertificatesv1alpha1.ClusterTrustBundleInterface {
+	return &clusterTrustBundleScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*certificatesv1alpha1.ClusterTrustBundle, *certificatesv1alpha1.ClusterTrustBundleList, *v1alpha1.ClusterTrustBundleApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			certificatesv1alpha1.SchemeGroupVersion.WithResource("clustertrustbundles"),
+			certificatesv1alpha1.SchemeGroupVersion.WithKind("ClusterTrustBundle"),
+			func() *certificatesv1alpha1.ClusterTrustBundle { return &certificatesv1alpha1.ClusterTrustBundle{} },
+			func() *certificatesv1alpha1.ClusterTrustBundleList {
+				return &certificatesv1alpha1.ClusterTrustBundleList{}
+			},
+			func(dst, src *certificatesv1alpha1.ClusterTrustBundleList) { dst.ListMeta = src.ListMeta },
+			func(list *certificatesv1alpha1.ClusterTrustBundleList) []*certificatesv1alpha1.ClusterTrustBundle {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *certificatesv1alpha1.ClusterTrustBundleList, items []*certificatesv1alpha1.ClusterTrustBundle) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/certificates/v1alpha1/fake/doc.go b/kubernetes/typed/certificates/v1alpha1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/certificates/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/certificates/v1alpha1/generated_expansion.go b/kubernetes/typed/certificates/v1alpha1/generated_expansion.go
new file mode 100644
index 000000000..7e3e8577c
--- /dev/null
+++ b/kubernetes/typed/certificates/v1alpha1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type ClusterTrustBundleClusterExpansion interface{}
diff --git a/kubernetes/typed/certificates/v1beta1/certificates_client.go b/kubernetes/typed/certificates/v1beta1/certificates_client.go
index 34ac6bede..03f24d088 100644
--- a/kubernetes/typed/certificates/v1beta1/certificates_client.go
+++ b/kubernetes/typed/certificates/v1beta1/certificates_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,29 +14,33 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apicertificatesv1beta1 "k8s.io/api/certificates/v1beta1"
+	certificatesv1beta1 "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	certificatesv1beta1 "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type CertificatesV1beta1ClusterInterface interface {
 	CertificatesV1beta1ClusterScoper
 	CertificateSigningRequestsClusterGetter
+	ClusterTrustBundlesClusterGetter
 }
 
 type CertificatesV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) certificatesv1beta1.CertificatesV1beta1Interface
 }
 
+// CertificatesV1beta1ClusterClient is used to interact with features provided by the certificates.k8s.io group.
 type CertificatesV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*certificatesv1beta1.CertificatesV1beta1Client]
 }
@@ -55,15 +56,21 @@ func (c *CertificatesV1beta1ClusterClient) CertificateSigningRequests() Certific
 	return &certificateSigningRequestsClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *CertificatesV1beta1ClusterClient) ClusterTrustBundles() ClusterTrustBundleClusterInterface {
+	return &clusterTrustBundlesClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new CertificatesV1beta1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*CertificatesV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new CertificatesV1beta1ClusterClient for the given config and http client.
@@ -75,6 +82,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*CertificatesV1beta1
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &CertificatesV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +95,14 @@ func NewForConfigOrDie(c *rest.Config) *CertificatesV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apicertificatesv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/certificates/v1beta1/certificatesigningrequest.go b/kubernetes/typed/certificates/v1beta1/certificatesigningrequest.go
index 82549fe96..e57fc8b82 100644
--- a/kubernetes/typed/certificates/v1beta1/certificatesigningrequest.go
+++ b/kubernetes/typed/certificates/v1beta1/certificatesigningrequest.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apicertificatesv1beta1 "k8s.io/api/certificates/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	certificatesv1beta1 "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	certificatesv1beta1client "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
 )
 
 // CertificateSigningRequestsClusterGetter has a method to return a CertificateSigningRequestClusterInterface.
@@ -40,19 +37,20 @@ type CertificateSigningRequestsClusterGetter interface {
 }
 
 // CertificateSigningRequestClusterInterface can operate on CertificateSigningRequests across all clusters,
-// or scope down to one cluster and return a certificatesv1beta1client.CertificateSigningRequestInterface.
+// or scope down to one cluster and return a certificatesv1beta1.CertificateSigningRequestInterface.
 type CertificateSigningRequestClusterInterface interface {
-	Cluster(logicalcluster.Path) certificatesv1beta1client.CertificateSigningRequestInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*certificatesv1beta1.CertificateSigningRequestList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) certificatesv1beta1.CertificateSigningRequestInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apicertificatesv1beta1.CertificateSigningRequestList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	CertificateSigningRequestClusterExpansion
 }
 
 type certificateSigningRequestsClusterInterface struct {
-	clientCache kcpclient.Cache[*certificatesv1beta1client.CertificatesV1beta1Client]
+	clientCache kcpclient.Cache[*certificatesv1beta1.CertificatesV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *certificateSigningRequestsClusterInterface) Cluster(clusterPath logicalcluster.Path) certificatesv1beta1client.CertificateSigningRequestInterface {
+func (c *certificateSigningRequestsClusterInterface) Cluster(clusterPath logicalcluster.Path) certificatesv1beta1.CertificateSigningRequestInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *certificateSigningRequestsClusterInterface) Cluster(clusterPath logical
 }
 
 // List returns the entire collection of all CertificateSigningRequests across all clusters.
-func (c *certificateSigningRequestsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*certificatesv1beta1.CertificateSigningRequestList, error) {
+func (c *certificateSigningRequestsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apicertificatesv1beta1.CertificateSigningRequestList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CertificateSigningRequests().List(ctx, opts)
 }
 
 // Watch begins to watch all CertificateSigningRequests across all clusters.
-func (c *certificateSigningRequestsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *certificateSigningRequestsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CertificateSigningRequests().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/certificates/v1beta1/clustertrustbundle.go b/kubernetes/typed/certificates/v1beta1/clustertrustbundle.go
new file mode 100644
index 000000000..12d3fb4d7
--- /dev/null
+++ b/kubernetes/typed/certificates/v1beta1/clustertrustbundle.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	apicertificatesv1beta1 "k8s.io/api/certificates/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	certificatesv1beta1 "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ClusterTrustBundlesClusterGetter has a method to return a ClusterTrustBundleClusterInterface.
+// A group's cluster client should implement this interface.
+type ClusterTrustBundlesClusterGetter interface {
+	ClusterTrustBundles() ClusterTrustBundleClusterInterface
+}
+
+// ClusterTrustBundleClusterInterface can operate on ClusterTrustBundles across all clusters,
+// or scope down to one cluster and return a certificatesv1beta1.ClusterTrustBundleInterface.
+type ClusterTrustBundleClusterInterface interface {
+	Cluster(logicalcluster.Path) certificatesv1beta1.ClusterTrustBundleInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apicertificatesv1beta1.ClusterTrustBundleList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ClusterTrustBundleClusterExpansion
+}
+
+type clusterTrustBundlesClusterInterface struct {
+	clientCache kcpclient.Cache[*certificatesv1beta1.CertificatesV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *clusterTrustBundlesClusterInterface) Cluster(clusterPath logicalcluster.Path) certificatesv1beta1.ClusterTrustBundleInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).ClusterTrustBundles()
+}
+
+// List returns the entire collection of all ClusterTrustBundles across all clusters.
+func (c *clusterTrustBundlesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apicertificatesv1beta1.ClusterTrustBundleList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterTrustBundles().List(ctx, opts)
+}
+
+// Watch begins to watch all ClusterTrustBundles across all clusters.
+func (c *clusterTrustBundlesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterTrustBundles().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/certificates/v1beta1/doc.go b/kubernetes/typed/certificates/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/certificates/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/certificates/v1beta1/fake/certificates_client.go b/kubernetes/typed/certificates/v1beta1/fake/certificates_client.go
index c3c329296..1d604a818 100644
--- a/kubernetes/typed/certificates/v1beta1/fake/certificates_client.go
+++ b/kubernetes/typed/certificates/v1beta1/fake/certificates_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	certificatesv1beta1 "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpcertificatesv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpcertificatesv1beta1.CertificatesV1beta1ClusterInterface = (*CertificatesV1beta1ClusterClient)(nil)
@@ -45,21 +41,29 @@ func (c *CertificatesV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Pa
 }
 
 func (c *CertificatesV1beta1ClusterClient) CertificateSigningRequests() kcpcertificatesv1beta1.CertificateSigningRequestClusterInterface {
-	return &certificateSigningRequestsClusterClient{Fake: c.Fake}
+	return newFakeCertificateSigningRequestClusterClient(c)
 }
 
-var _ certificatesv1beta1.CertificatesV1beta1Interface = (*CertificatesV1beta1Client)(nil)
+func (c *CertificatesV1beta1ClusterClient) ClusterTrustBundles() kcpcertificatesv1beta1.ClusterTrustBundleClusterInterface {
+	return newFakeClusterTrustBundleClusterClient(c)
+}
 
 type CertificatesV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *CertificatesV1beta1Client) CertificateSigningRequests() certificatesv1beta1.CertificateSigningRequestInterface {
+	return newFakeCertificateSigningRequestClient(c.Fake, c.ClusterPath)
+}
+
+func (c *CertificatesV1beta1Client) ClusterTrustBundles() certificatesv1beta1.ClusterTrustBundleInterface {
+	return newFakeClusterTrustBundleClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *CertificatesV1beta1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *CertificatesV1beta1Client) CertificateSigningRequests() certificatesv1beta1.CertificateSigningRequestInterface {
-	return &certificateSigningRequestsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
diff --git a/kubernetes/typed/certificates/v1beta1/fake/certificatesigningrequest.go b/kubernetes/typed/certificates/v1beta1/fake/certificatesigningrequest.go
index 283e64c6d..1384067ce 100644
--- a/kubernetes/typed/certificates/v1beta1/fake/certificatesigningrequest.go
+++ b/kubernetes/typed/certificates/v1beta1/fake/certificatesigningrequest.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,85 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscertificatesv1beta1 "k8s.io/client-go/applyconfigurations/certificates/v1beta1"
-	certificatesv1beta1client "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/certificates/v1beta1"
+	typedcertificatesv1beta1 "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
 
+	typedkcpcertificatesv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var certificateSigningRequestsResource = schema.GroupVersionResource{Group: "certificates.k8s.io", Version: "v1beta1", Resource: "certificatesigningrequests"}
-var certificateSigningRequestsKind = schema.GroupVersionKind{Group: "certificates.k8s.io", Version: "v1beta1", Kind: "CertificateSigningRequest"}
-
-type certificateSigningRequestsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *certificateSigningRequestsClusterClient) Cluster(clusterPath logicalcluster.Path) certificatesv1beta1client.CertificateSigningRequestInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &certificateSigningRequestsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of CertificateSigningRequests that match those selectors across all clusters.
-func (c *certificateSigningRequestsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*certificatesv1beta1.CertificateSigningRequestList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(certificateSigningRequestsResource, certificateSigningRequestsKind, logicalcluster.Wildcard, opts), &certificatesv1beta1.CertificateSigningRequestList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &certificatesv1beta1.CertificateSigningRequestList{ListMeta: obj.(*certificatesv1beta1.CertificateSigningRequestList).ListMeta}
-	for _, item := range obj.(*certificatesv1beta1.CertificateSigningRequestList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested CertificateSigningRequests across all clusters.
-func (c *certificateSigningRequestsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(certificateSigningRequestsResource, logicalcluster.Wildcard, opts))
-}
-
-type certificateSigningRequestsClient struct {
-	*kcptesting.Fake
+// certificateSigningRequestClusterClient implements CertificateSigningRequestClusterInterface
+type certificateSigningRequestClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*certificatesv1beta1.CertificateSigningRequest, *certificatesv1beta1.CertificateSigningRequestList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeCertificateSigningRequestClusterClient(fake *CertificatesV1beta1ClusterClient) typedkcpcertificatesv1beta1.CertificateSigningRequestClusterInterface {
+	return &certificateSigningRequestClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*certificatesv1beta1.CertificateSigningRequest, *certificatesv1beta1.CertificateSigningRequestList](
+			fake.Fake,
+			certificatesv1beta1.SchemeGroupVersion.WithResource("certificatesigningrequests"),
+			certificatesv1beta1.SchemeGroupVersion.WithKind("CertificateSigningRequest"),
+			func() *certificatesv1beta1.CertificateSigningRequest {
+				return &certificatesv1beta1.CertificateSigningRequest{}
+			},
+			func() *certificatesv1beta1.CertificateSigningRequestList {
+				return &certificatesv1beta1.CertificateSigningRequestList{}
+			},
+			func(dst, src *certificatesv1beta1.CertificateSigningRequestList) { dst.ListMeta = src.ListMeta },
+			func(list *certificatesv1beta1.CertificateSigningRequestList) []*certificatesv1beta1.CertificateSigningRequest {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *certificatesv1beta1.CertificateSigningRequestList, items []*certificatesv1beta1.CertificateSigningRequest) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *certificateSigningRequestClusterClient) Cluster(cluster logicalcluster.Path) typedcertificatesv1beta1.CertificateSigningRequestInterface {
+	return newFakeCertificateSigningRequestClient(c.Fake, cluster)
+}
+
+// certificateSigningRequestScopedClient implements CertificateSigningRequestInterface
+type certificateSigningRequestScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*certificatesv1beta1.CertificateSigningRequest, *certificatesv1beta1.CertificateSigningRequestList, *v1beta1.CertificateSigningRequestApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *certificateSigningRequestsClient) Create(ctx context.Context, certificateSigningRequest *certificatesv1beta1.CertificateSigningRequest, opts metav1.CreateOptions) (*certificatesv1beta1.CertificateSigningRequest, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(certificateSigningRequestsResource, c.ClusterPath, certificateSigningRequest), &certificatesv1beta1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1beta1.CertificateSigningRequest), err
-}
-
-func (c *certificateSigningRequestsClient) Update(ctx context.Context, certificateSigningRequest *certificatesv1beta1.CertificateSigningRequest, opts metav1.UpdateOptions) (*certificatesv1beta1.CertificateSigningRequest, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(certificateSigningRequestsResource, c.ClusterPath, certificateSigningRequest), &certificatesv1beta1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1beta1.CertificateSigningRequest), err
-}
-
-func (c *certificateSigningRequestsClient) UpdateStatus(ctx context.Context, certificateSigningRequest *certificatesv1beta1.CertificateSigningRequest, opts metav1.UpdateOptions) (*certificatesv1beta1.CertificateSigningRequest, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(certificateSigningRequestsResource, c.ClusterPath, "status", certificateSigningRequest), &certificatesv1beta1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1beta1.CertificateSigningRequest), err
-}
-
-func (c *certificateSigningRequestsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(certificateSigningRequestsResource, c.ClusterPath, name, opts), &certificatesv1beta1.CertificateSigningRequest{})
-	return err
-}
-
-func (c *certificateSigningRequestsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(certificateSigningRequestsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &certificatesv1beta1.CertificateSigningRequestList{})
-	return err
-}
-
-func (c *certificateSigningRequestsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*certificatesv1beta1.CertificateSigningRequest, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(certificateSigningRequestsResource, c.ClusterPath, name), &certificatesv1beta1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1beta1.CertificateSigningRequest), err
-}
-
-// List takes label and field selectors, and returns the list of CertificateSigningRequests that match those selectors.
-func (c *certificateSigningRequestsClient) List(ctx context.Context, opts metav1.ListOptions) (*certificatesv1beta1.CertificateSigningRequestList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(certificateSigningRequestsResource, certificateSigningRequestsKind, c.ClusterPath, opts), &certificatesv1beta1.CertificateSigningRequestList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &certificatesv1beta1.CertificateSigningRequestList{ListMeta: obj.(*certificatesv1beta1.CertificateSigningRequestList).ListMeta}
-	for _, item := range obj.(*certificatesv1beta1.CertificateSigningRequestList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *certificateSigningRequestsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(certificateSigningRequestsResource, c.ClusterPath, opts))
-}
-
-func (c *certificateSigningRequestsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*certificatesv1beta1.CertificateSigningRequest, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(certificateSigningRequestsResource, c.ClusterPath, name, pt, data, subresources...), &certificatesv1beta1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1beta1.CertificateSigningRequest), err
-}
-
-func (c *certificateSigningRequestsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscertificatesv1beta1.CertificateSigningRequestApplyConfiguration, opts metav1.ApplyOptions) (*certificatesv1beta1.CertificateSigningRequest, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(certificateSigningRequestsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &certificatesv1beta1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*certificatesv1beta1.CertificateSigningRequest), err
-}
-
-func (c *certificateSigningRequestsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscertificatesv1beta1.CertificateSigningRequestApplyConfiguration, opts metav1.ApplyOptions) (*certificatesv1beta1.CertificateSigningRequest, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(certificateSigningRequestsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &certificatesv1beta1.CertificateSigningRequest{})
-	if obj == nil {
-		return nil, err
+func newFakeCertificateSigningRequestClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedcertificatesv1beta1.CertificateSigningRequestInterface {
+	return &certificateSigningRequestScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*certificatesv1beta1.CertificateSigningRequest, *certificatesv1beta1.CertificateSigningRequestList, *v1beta1.CertificateSigningRequestApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			certificatesv1beta1.SchemeGroupVersion.WithResource("certificatesigningrequests"),
+			certificatesv1beta1.SchemeGroupVersion.WithKind("CertificateSigningRequest"),
+			func() *certificatesv1beta1.CertificateSigningRequest {
+				return &certificatesv1beta1.CertificateSigningRequest{}
+			},
+			func() *certificatesv1beta1.CertificateSigningRequestList {
+				return &certificatesv1beta1.CertificateSigningRequestList{}
+			},
+			func(dst, src *certificatesv1beta1.CertificateSigningRequestList) { dst.ListMeta = src.ListMeta },
+			func(list *certificatesv1beta1.CertificateSigningRequestList) []*certificatesv1beta1.CertificateSigningRequest {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *certificatesv1beta1.CertificateSigningRequestList, items []*certificatesv1beta1.CertificateSigningRequest) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*certificatesv1beta1.CertificateSigningRequest), err
 }
diff --git a/kubernetes/typed/certificates/v1beta1/fake/clustertrustbundle.go b/kubernetes/typed/certificates/v1beta1/fake/clustertrustbundle.go
new file mode 100644
index 000000000..2882767a4
--- /dev/null
+++ b/kubernetes/typed/certificates/v1beta1/fake/clustertrustbundle.go
@@ -0,0 +1,94 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
+	v1beta1 "k8s.io/client-go/applyconfigurations/certificates/v1beta1"
+	typedcertificatesv1beta1 "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
+
+	typedkcpcertificatesv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/certificates/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// clusterTrustBundleClusterClient implements ClusterTrustBundleClusterInterface
+type clusterTrustBundleClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*certificatesv1beta1.ClusterTrustBundle, *certificatesv1beta1.ClusterTrustBundleList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeClusterTrustBundleClusterClient(fake *CertificatesV1beta1ClusterClient) typedkcpcertificatesv1beta1.ClusterTrustBundleClusterInterface {
+	return &clusterTrustBundleClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*certificatesv1beta1.ClusterTrustBundle, *certificatesv1beta1.ClusterTrustBundleList](
+			fake.Fake,
+			certificatesv1beta1.SchemeGroupVersion.WithResource("clustertrustbundles"),
+			certificatesv1beta1.SchemeGroupVersion.WithKind("ClusterTrustBundle"),
+			func() *certificatesv1beta1.ClusterTrustBundle { return &certificatesv1beta1.ClusterTrustBundle{} },
+			func() *certificatesv1beta1.ClusterTrustBundleList {
+				return &certificatesv1beta1.ClusterTrustBundleList{}
+			},
+			func(dst, src *certificatesv1beta1.ClusterTrustBundleList) { dst.ListMeta = src.ListMeta },
+			func(list *certificatesv1beta1.ClusterTrustBundleList) []*certificatesv1beta1.ClusterTrustBundle {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *certificatesv1beta1.ClusterTrustBundleList, items []*certificatesv1beta1.ClusterTrustBundle) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *clusterTrustBundleClusterClient) Cluster(cluster logicalcluster.Path) typedcertificatesv1beta1.ClusterTrustBundleInterface {
+	return newFakeClusterTrustBundleClient(c.Fake, cluster)
+}
+
+// clusterTrustBundleScopedClient implements ClusterTrustBundleInterface
+type clusterTrustBundleScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*certificatesv1beta1.ClusterTrustBundle, *certificatesv1beta1.ClusterTrustBundleList, *v1beta1.ClusterTrustBundleApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeClusterTrustBundleClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedcertificatesv1beta1.ClusterTrustBundleInterface {
+	return &clusterTrustBundleScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*certificatesv1beta1.ClusterTrustBundle, *certificatesv1beta1.ClusterTrustBundleList, *v1beta1.ClusterTrustBundleApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			certificatesv1beta1.SchemeGroupVersion.WithResource("clustertrustbundles"),
+			certificatesv1beta1.SchemeGroupVersion.WithKind("ClusterTrustBundle"),
+			func() *certificatesv1beta1.ClusterTrustBundle { return &certificatesv1beta1.ClusterTrustBundle{} },
+			func() *certificatesv1beta1.ClusterTrustBundleList {
+				return &certificatesv1beta1.ClusterTrustBundleList{}
+			},
+			func(dst, src *certificatesv1beta1.ClusterTrustBundleList) { dst.ListMeta = src.ListMeta },
+			func(list *certificatesv1beta1.ClusterTrustBundleList) []*certificatesv1beta1.ClusterTrustBundle {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *certificatesv1beta1.ClusterTrustBundleList, items []*certificatesv1beta1.ClusterTrustBundle) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/certificates/v1beta1/fake/doc.go b/kubernetes/typed/certificates/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/certificates/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/certificates/v1beta1/fake/fake_certificatesigningrequest_expansion.go b/kubernetes/typed/certificates/v1beta1/fake/fake_certificatesigningrequest_expansion.go
index 2cf232cf4..832c76f11 100644
--- a/kubernetes/typed/certificates/v1beta1/fake/fake_certificatesigningrequest_expansion.go
+++ b/kubernetes/typed/certificates/v1beta1/fake/fake_certificatesigningrequest_expansion.go
@@ -26,8 +26,9 @@ import (
 	core "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
 )
 
-func (c *certificateSigningRequestsClient) UpdateApproval(ctx context.Context, certificateSigningRequest *certificates.CertificateSigningRequest, opts metav1.UpdateOptions) (result *certificates.CertificateSigningRequest, err error) {
-	obj, err := c.Fake.Invokes(core.NewRootUpdateSubresourceAction(certificateSigningRequestsResource, c.ClusterPath, "approval", certificateSigningRequest), &certificates.CertificateSigningRequest{})
+func (c *certificateSigningRequestScopedClient) UpdateApproval(ctx context.Context, certificateSigningRequest *certificates.CertificateSigningRequest, opts metav1.UpdateOptions) (result *certificates.CertificateSigningRequest, err error) {
+	obj, err := c.Fake.
+		Invokes(core.NewRootUpdateSubresourceAction(c.Resource(), c.ClusterPath, "approval", certificateSigningRequest), &certificates.CertificateSigningRequest{})
 	if obj == nil {
 		return nil, err
 	}
diff --git a/kubernetes/typed/certificates/v1beta1/generated_expansion.go b/kubernetes/typed/certificates/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..bdd9c31e0
--- /dev/null
+++ b/kubernetes/typed/certificates/v1beta1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type CertificateSigningRequestClusterExpansion interface{}
+
+type ClusterTrustBundleClusterExpansion interface{}
diff --git a/kubernetes/typed/coordination/v1/coordination_client.go b/kubernetes/typed/coordination/v1/coordination_client.go
index 37b1e4ca1..309f3fc29 100644
--- a/kubernetes/typed/coordination/v1/coordination_client.go
+++ b/kubernetes/typed/coordination/v1/coordination_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apicoordinationv1 "k8s.io/api/coordination/v1"
+	coordinationv1 "k8s.io/client-go/kubernetes/typed/coordination/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	coordinationv1 "k8s.io/client-go/kubernetes/typed/coordination/v1"
-	"k8s.io/client-go/rest"
 )
 
 type CoordinationV1ClusterInterface interface {
@@ -40,6 +39,7 @@ type CoordinationV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) coordinationv1.CoordinationV1Interface
 }
 
+// CoordinationV1ClusterClient is used to interact with features provided by the coordination.k8s.io group.
 type CoordinationV1ClusterClient struct {
 	clientCache kcpclient.Cache[*coordinationv1.CoordinationV1Client]
 }
@@ -59,11 +59,13 @@ func (c *CoordinationV1ClusterClient) Leases() LeaseClusterInterface {
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*CoordinationV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new CoordinationV1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*CoordinationV1Clust
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &CoordinationV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *CoordinationV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apicoordinationv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/coordination/v1/doc.go b/kubernetes/typed/coordination/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/coordination/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/coordination/v1/fake/coordination_client.go b/kubernetes/typed/coordination/v1/fake/coordination_client.go
index a528b2190..aecd0aad1 100644
--- a/kubernetes/typed/coordination/v1/fake/coordination_client.go
+++ b/kubernetes/typed/coordination/v1/fake/coordination_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	coordinationv1 "k8s.io/client-go/kubernetes/typed/coordination/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpcoordinationv1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpcoordinationv1.CoordinationV1ClusterInterface = (*CoordinationV1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *CoordinationV1ClusterClient) Cluster(clusterPath logicalcluster.Path) c
 }
 
 func (c *CoordinationV1ClusterClient) Leases() kcpcoordinationv1.LeaseClusterInterface {
-	return &leasesClusterClient{Fake: c.Fake}
+	return newFakeLeaseClusterClient(c)
 }
 
-var _ coordinationv1.CoordinationV1Interface = (*CoordinationV1Client)(nil)
-
 type CoordinationV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *CoordinationV1Client) Leases(namespace string) coordinationv1.LeaseInterface {
+	return newFakeLeaseClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *CoordinationV1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *CoordinationV1Client) Leases(namespace string) coordinationv1.LeaseInterface {
-	return &leasesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
diff --git a/kubernetes/typed/coordination/v1/fake/doc.go b/kubernetes/typed/coordination/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/coordination/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/coordination/v1/fake/lease.go b/kubernetes/typed/coordination/v1/fake/lease.go
index 2e9985aa8..c3e1c7b0c 100644
--- a/kubernetes/typed/coordination/v1/fake/lease.go
+++ b/kubernetes/typed/coordination/v1/fake/lease.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	coordinationv1 "k8s.io/api/coordination/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscoordinationv1 "k8s.io/client-go/applyconfigurations/coordination/v1"
-	coordinationv1client "k8s.io/client-go/kubernetes/typed/coordination/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/coordination/v1"
+	typedcoordinationv1 "k8s.io/client-go/kubernetes/typed/coordination/v1"
 
-	kcpcoordinationv1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1"
+	typedkcpcoordinationv1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var leasesResource = schema.GroupVersionResource{Group: "coordination.k8s.io", Version: "v1", Resource: "leases"}
-var leasesKind = schema.GroupVersionKind{Group: "coordination.k8s.io", Version: "v1", Kind: "Lease"}
-
-type leasesClusterClient struct {
-	*kcptesting.Fake
+// leaseClusterClient implements LeaseClusterInterface
+type leaseClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*coordinationv1.Lease, *coordinationv1.LeaseList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *leasesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcoordinationv1.LeasesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &leasesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Leases that match those selectors across all clusters.
-func (c *leasesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*coordinationv1.LeaseList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(leasesResource, leasesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &coordinationv1.LeaseList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeLeaseClusterClient(fake *CoordinationV1ClusterClient) typedkcpcoordinationv1.LeaseClusterInterface {
+	return &leaseClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*coordinationv1.Lease, *coordinationv1.LeaseList](
+			fake.Fake,
+			coordinationv1.SchemeGroupVersion.WithResource("leases"),
+			coordinationv1.SchemeGroupVersion.WithKind("Lease"),
+			func() *coordinationv1.Lease { return &coordinationv1.Lease{} },
+			func() *coordinationv1.LeaseList { return &coordinationv1.LeaseList{} },
+			func(dst, src *coordinationv1.LeaseList) { dst.ListMeta = src.ListMeta },
+			func(list *coordinationv1.LeaseList) []*coordinationv1.Lease {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *coordinationv1.LeaseList, items []*coordinationv1.Lease) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &coordinationv1.LeaseList{ListMeta: obj.(*coordinationv1.LeaseList).ListMeta}
-	for _, item := range obj.(*coordinationv1.LeaseList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Leases across all clusters.
-func (c *leasesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(leasesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *leaseClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcoordinationv1.LeasesNamespacer {
+	return &leaseNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type leasesNamespacer struct {
+type leaseNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *leasesNamespacer) Namespace(namespace string) coordinationv1client.LeaseInterface {
-	return &leasesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *leaseNamespacer) Namespace(namespace string) typedcoordinationv1.LeaseInterface {
+	return newFakeLeaseClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type leasesClient struct {
-	*kcptesting.Fake
+// leaseScopedClient implements LeaseInterface
+type leaseScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*coordinationv1.Lease, *coordinationv1.LeaseList, *v1.LeaseApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *leasesClient) Create(ctx context.Context, lease *coordinationv1.Lease, opts metav1.CreateOptions) (*coordinationv1.Lease, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(leasesResource, c.ClusterPath, c.Namespace, lease), &coordinationv1.Lease{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*coordinationv1.Lease), err
-}
-
-func (c *leasesClient) Update(ctx context.Context, lease *coordinationv1.Lease, opts metav1.UpdateOptions) (*coordinationv1.Lease, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(leasesResource, c.ClusterPath, c.Namespace, lease), &coordinationv1.Lease{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*coordinationv1.Lease), err
-}
-
-func (c *leasesClient) UpdateStatus(ctx context.Context, lease *coordinationv1.Lease, opts metav1.UpdateOptions) (*coordinationv1.Lease, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(leasesResource, c.ClusterPath, "status", c.Namespace, lease), &coordinationv1.Lease{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*coordinationv1.Lease), err
-}
-
-func (c *leasesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(leasesResource, c.ClusterPath, c.Namespace, name, opts), &coordinationv1.Lease{})
-	return err
 }
 
-func (c *leasesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(leasesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &coordinationv1.LeaseList{})
-	return err
-}
-
-func (c *leasesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*coordinationv1.Lease, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(leasesResource, c.ClusterPath, c.Namespace, name), &coordinationv1.Lease{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*coordinationv1.Lease), err
-}
-
-// List takes label and field selectors, and returns the list of Leases that match those selectors.
-func (c *leasesClient) List(ctx context.Context, opts metav1.ListOptions) (*coordinationv1.LeaseList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(leasesResource, leasesKind, c.ClusterPath, c.Namespace, opts), &coordinationv1.LeaseList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &coordinationv1.LeaseList{ListMeta: obj.(*coordinationv1.LeaseList).ListMeta}
-	for _, item := range obj.(*coordinationv1.LeaseList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *leasesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(leasesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *leasesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*coordinationv1.Lease, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(leasesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &coordinationv1.Lease{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*coordinationv1.Lease), err
-}
-
-func (c *leasesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscoordinationv1.LeaseApplyConfiguration, opts metav1.ApplyOptions) (*coordinationv1.Lease, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(leasesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &coordinationv1.Lease{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*coordinationv1.Lease), err
-}
-
-func (c *leasesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscoordinationv1.LeaseApplyConfiguration, opts metav1.ApplyOptions) (*coordinationv1.Lease, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(leasesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &coordinationv1.Lease{})
-	if obj == nil {
-		return nil, err
+func newFakeLeaseClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcoordinationv1.LeaseInterface {
+	return &leaseScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*coordinationv1.Lease, *coordinationv1.LeaseList, *v1.LeaseApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			coordinationv1.SchemeGroupVersion.WithResource("leases"),
+			coordinationv1.SchemeGroupVersion.WithKind("Lease"),
+			func() *coordinationv1.Lease { return &coordinationv1.Lease{} },
+			func() *coordinationv1.LeaseList { return &coordinationv1.LeaseList{} },
+			func(dst, src *coordinationv1.LeaseList) { dst.ListMeta = src.ListMeta },
+			func(list *coordinationv1.LeaseList) []*coordinationv1.Lease {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *coordinationv1.LeaseList, items []*coordinationv1.Lease) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*coordinationv1.Lease), err
 }
diff --git a/kubernetes/typed/coordination/v1/generated_expansion.go b/kubernetes/typed/coordination/v1/generated_expansion.go
new file mode 100644
index 000000000..9e050f2c2
--- /dev/null
+++ b/kubernetes/typed/coordination/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type LeaseClusterExpansion interface{}
diff --git a/kubernetes/typed/coordination/v1/lease.go b/kubernetes/typed/coordination/v1/lease.go
index cb75baad7..7af55cdaf 100644
--- a/kubernetes/typed/coordination/v1/lease.go
+++ b/kubernetes/typed/coordination/v1/lease.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	coordinationv1 "k8s.io/api/coordination/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	coordinationv1client "k8s.io/client-go/kubernetes/typed/coordination/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcoordinationv1 "k8s.io/client-go/kubernetes/typed/coordination/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // LeasesClusterGetter has a method to return a LeaseClusterInterface.
@@ -45,10 +42,11 @@ type LeaseClusterInterface interface {
 	Cluster(logicalcluster.Path) LeasesNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*coordinationv1.LeaseList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	LeaseClusterExpansion
 }
 
 type leasesClusterInterface struct {
-	clientCache kcpclient.Cache[*coordinationv1client.CoordinationV1Client]
+	clientCache kcpclient.Cache[*typedcoordinationv1.CoordinationV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *leasesClusterInterface) Watch(ctx context.Context, opts metav1.ListOpti
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Leases(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// LeasesNamespacer can scope to objects within a namespace, returning a coordinationv1client.LeaseInterface.
+// LeasesNamespacer can scope to objects within a namespace, returning a typedcoordinationv1.LeaseInterface.
 type LeasesNamespacer interface {
-	Namespace(string) coordinationv1client.LeaseInterface
+	Namespace(string) typedcoordinationv1.LeaseInterface
 }
 
 type leasesNamespacer struct {
-	clientCache kcpclient.Cache[*coordinationv1client.CoordinationV1Client]
+	clientCache kcpclient.Cache[*typedcoordinationv1.CoordinationV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *leasesNamespacer) Namespace(namespace string) coordinationv1client.LeaseInterface {
+func (n *leasesNamespacer) Namespace(namespace string) typedcoordinationv1.LeaseInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Leases(namespace)
 }
diff --git a/kubernetes/typed/coordination/v1alpha2/coordination_client.go b/kubernetes/typed/coordination/v1alpha2/coordination_client.go
new file mode 100644
index 000000000..020962423
--- /dev/null
+++ b/kubernetes/typed/coordination/v1alpha2/coordination_client.go
@@ -0,0 +1,103 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	http "net/http"
+
+	apicoordinationv1alpha2 "k8s.io/api/coordination/v1alpha2"
+	coordinationv1alpha2 "k8s.io/client-go/kubernetes/typed/coordination/v1alpha2"
+	rest "k8s.io/client-go/rest"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+type CoordinationV1alpha2ClusterInterface interface {
+	CoordinationV1alpha2ClusterScoper
+	LeaseCandidatesClusterGetter
+}
+
+type CoordinationV1alpha2ClusterScoper interface {
+	Cluster(logicalcluster.Path) coordinationv1alpha2.CoordinationV1alpha2Interface
+}
+
+// CoordinationV1alpha2ClusterClient is used to interact with features provided by the coordination.k8s.io group.
+type CoordinationV1alpha2ClusterClient struct {
+	clientCache kcpclient.Cache[*coordinationv1alpha2.CoordinationV1alpha2Client]
+}
+
+func (c *CoordinationV1alpha2ClusterClient) Cluster(clusterPath logicalcluster.Path) coordinationv1alpha2.CoordinationV1alpha2Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return c.clientCache.ClusterOrDie(clusterPath)
+}
+
+func (c *CoordinationV1alpha2ClusterClient) LeaseCandidates() LeaseCandidateClusterInterface {
+	return &leaseCandidatesClusterInterface{clientCache: c.clientCache}
+}
+
+// NewForConfig creates a new CoordinationV1alpha2ClusterClient for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*CoordinationV1alpha2ClusterClient, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new CoordinationV1alpha2ClusterClient for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*CoordinationV1alpha2ClusterClient, error) {
+	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*coordinationv1alpha2.CoordinationV1alpha2Client]{
+		NewForConfigAndClient: coordinationv1alpha2.NewForConfigAndClient,
+	})
+	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
+		return nil, err
+	}
+
+	return &CoordinationV1alpha2ClusterClient{clientCache: cache}, nil
+}
+
+// NewForConfigOrDie creates a new CoordinationV1alpha2ClusterClient for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *CoordinationV1alpha2ClusterClient {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apicoordinationv1alpha2.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/coordination/v1alpha2/doc.go b/kubernetes/typed/coordination/v1alpha2/doc.go
new file mode 100644
index 000000000..d6c1a4590
--- /dev/null
+++ b/kubernetes/typed/coordination/v1alpha2/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha2
diff --git a/kubernetes/typed/coordination/v1alpha2/fake/coordination_client.go b/kubernetes/typed/coordination/v1alpha2/fake/coordination_client.go
new file mode 100644
index 000000000..e5a02712b
--- /dev/null
+++ b/kubernetes/typed/coordination/v1alpha2/fake/coordination_client.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	coordinationv1alpha2 "k8s.io/client-go/kubernetes/typed/coordination/v1alpha2"
+	rest "k8s.io/client-go/rest"
+
+	kcpcoordinationv1alpha2 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1alpha2"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+var _ kcpcoordinationv1alpha2.CoordinationV1alpha2ClusterInterface = (*CoordinationV1alpha2ClusterClient)(nil)
+
+type CoordinationV1alpha2ClusterClient struct {
+	*kcptesting.Fake
+}
+
+func (c *CoordinationV1alpha2ClusterClient) Cluster(clusterPath logicalcluster.Path) coordinationv1alpha2.CoordinationV1alpha2Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return &CoordinationV1alpha2Client{Fake: c.Fake, ClusterPath: clusterPath}
+}
+
+func (c *CoordinationV1alpha2ClusterClient) LeaseCandidates() kcpcoordinationv1alpha2.LeaseCandidateClusterInterface {
+	return newFakeLeaseCandidateClusterClient(c)
+}
+
+type CoordinationV1alpha2Client struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (c *CoordinationV1alpha2Client) LeaseCandidates(namespace string) coordinationv1alpha2.LeaseCandidateInterface {
+	return newFakeLeaseCandidateClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *CoordinationV1alpha2Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/kubernetes/typed/coordination/v1alpha2/fake/doc.go b/kubernetes/typed/coordination/v1alpha2/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/coordination/v1alpha2/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/coordination/v1alpha2/fake/leasecandidate.go b/kubernetes/typed/coordination/v1alpha2/fake/leasecandidate.go
new file mode 100644
index 000000000..5816a6876
--- /dev/null
+++ b/kubernetes/typed/coordination/v1alpha2/fake/leasecandidate.go
@@ -0,0 +1,99 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	coordinationv1alpha2 "k8s.io/api/coordination/v1alpha2"
+	v1alpha2 "k8s.io/client-go/applyconfigurations/coordination/v1alpha2"
+	typedcoordinationv1alpha2 "k8s.io/client-go/kubernetes/typed/coordination/v1alpha2"
+
+	typedkcpcoordinationv1alpha2 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1alpha2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// leaseCandidateClusterClient implements LeaseCandidateClusterInterface
+type leaseCandidateClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*coordinationv1alpha2.LeaseCandidate, *coordinationv1alpha2.LeaseCandidateList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeLeaseCandidateClusterClient(fake *CoordinationV1alpha2ClusterClient) typedkcpcoordinationv1alpha2.LeaseCandidateClusterInterface {
+	return &leaseCandidateClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*coordinationv1alpha2.LeaseCandidate, *coordinationv1alpha2.LeaseCandidateList](
+			fake.Fake,
+			coordinationv1alpha2.SchemeGroupVersion.WithResource("leasecandidates"),
+			coordinationv1alpha2.SchemeGroupVersion.WithKind("LeaseCandidate"),
+			func() *coordinationv1alpha2.LeaseCandidate { return &coordinationv1alpha2.LeaseCandidate{} },
+			func() *coordinationv1alpha2.LeaseCandidateList { return &coordinationv1alpha2.LeaseCandidateList{} },
+			func(dst, src *coordinationv1alpha2.LeaseCandidateList) { dst.ListMeta = src.ListMeta },
+			func(list *coordinationv1alpha2.LeaseCandidateList) []*coordinationv1alpha2.LeaseCandidate {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *coordinationv1alpha2.LeaseCandidateList, items []*coordinationv1alpha2.LeaseCandidate) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *leaseCandidateClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcoordinationv1alpha2.LeaseCandidatesNamespacer {
+	return &leaseCandidateNamespacer{Fake: c.Fake, ClusterPath: cluster}
+}
+
+type leaseCandidateNamespacer struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (n *leaseCandidateNamespacer) Namespace(namespace string) typedcoordinationv1alpha2.LeaseCandidateInterface {
+	return newFakeLeaseCandidateClient(n.Fake, namespace, n.ClusterPath)
+}
+
+// leaseCandidateScopedClient implements LeaseCandidateInterface
+type leaseCandidateScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*coordinationv1alpha2.LeaseCandidate, *coordinationv1alpha2.LeaseCandidateList, *v1alpha2.LeaseCandidateApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeLeaseCandidateClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcoordinationv1alpha2.LeaseCandidateInterface {
+	return &leaseCandidateScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*coordinationv1alpha2.LeaseCandidate, *coordinationv1alpha2.LeaseCandidateList, *v1alpha2.LeaseCandidateApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			coordinationv1alpha2.SchemeGroupVersion.WithResource("leasecandidates"),
+			coordinationv1alpha2.SchemeGroupVersion.WithKind("LeaseCandidate"),
+			func() *coordinationv1alpha2.LeaseCandidate { return &coordinationv1alpha2.LeaseCandidate{} },
+			func() *coordinationv1alpha2.LeaseCandidateList { return &coordinationv1alpha2.LeaseCandidateList{} },
+			func(dst, src *coordinationv1alpha2.LeaseCandidateList) { dst.ListMeta = src.ListMeta },
+			func(list *coordinationv1alpha2.LeaseCandidateList) []*coordinationv1alpha2.LeaseCandidate {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *coordinationv1alpha2.LeaseCandidateList, items []*coordinationv1alpha2.LeaseCandidate) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/coordination/v1alpha2/generated_expansion.go b/kubernetes/typed/coordination/v1alpha2/generated_expansion.go
new file mode 100644
index 000000000..e10ab4e8d
--- /dev/null
+++ b/kubernetes/typed/coordination/v1alpha2/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha2
+
+type LeaseCandidateClusterExpansion interface{}
diff --git a/kubernetes/typed/coordination/v1alpha2/leasecandidate.go b/kubernetes/typed/coordination/v1alpha2/leasecandidate.go
new file mode 100644
index 000000000..b095589e9
--- /dev/null
+++ b/kubernetes/typed/coordination/v1alpha2/leasecandidate.go
@@ -0,0 +1,83 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	context "context"
+
+	coordinationv1alpha2 "k8s.io/api/coordination/v1alpha2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcoordinationv1alpha2 "k8s.io/client-go/kubernetes/typed/coordination/v1alpha2"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// LeaseCandidatesClusterGetter has a method to return a LeaseCandidateClusterInterface.
+// A group's cluster client should implement this interface.
+type LeaseCandidatesClusterGetter interface {
+	LeaseCandidates() LeaseCandidateClusterInterface
+}
+
+// LeaseCandidateClusterInterface can operate on LeaseCandidates across all clusters,
+// or scope down to one cluster and return a LeaseCandidatesNamespacer.
+type LeaseCandidateClusterInterface interface {
+	Cluster(logicalcluster.Path) LeaseCandidatesNamespacer
+	List(ctx context.Context, opts v1.ListOptions) (*coordinationv1alpha2.LeaseCandidateList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	LeaseCandidateClusterExpansion
+}
+
+type leaseCandidatesClusterInterface struct {
+	clientCache kcpclient.Cache[*typedcoordinationv1alpha2.CoordinationV1alpha2Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *leaseCandidatesClusterInterface) Cluster(clusterPath logicalcluster.Path) LeaseCandidatesNamespacer {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return &leaseCandidatesNamespacer{clientCache: c.clientCache, clusterPath: clusterPath}
+}
+
+// List returns the entire collection of all LeaseCandidates across all clusters.
+func (c *leaseCandidatesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*coordinationv1alpha2.LeaseCandidateList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).LeaseCandidates(v1.NamespaceAll).List(ctx, opts)
+}
+
+// Watch begins to watch all LeaseCandidates across all clusters.
+func (c *leaseCandidatesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).LeaseCandidates(v1.NamespaceAll).Watch(ctx, opts)
+}
+
+// LeaseCandidatesNamespacer can scope to objects within a namespace, returning a typedcoordinationv1alpha2.LeaseCandidateInterface.
+type LeaseCandidatesNamespacer interface {
+	Namespace(string) typedcoordinationv1alpha2.LeaseCandidateInterface
+}
+
+type leaseCandidatesNamespacer struct {
+	clientCache kcpclient.Cache[*typedcoordinationv1alpha2.CoordinationV1alpha2Client]
+	clusterPath logicalcluster.Path
+}
+
+func (n *leaseCandidatesNamespacer) Namespace(namespace string) typedcoordinationv1alpha2.LeaseCandidateInterface {
+	return n.clientCache.ClusterOrDie(n.clusterPath).LeaseCandidates(namespace)
+}
diff --git a/kubernetes/typed/coordination/v1beta1/coordination_client.go b/kubernetes/typed/coordination/v1beta1/coordination_client.go
index fb3eb2660..83683fd9c 100644
--- a/kubernetes/typed/coordination/v1beta1/coordination_client.go
+++ b/kubernetes/typed/coordination/v1beta1/coordination_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,29 +14,33 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apicoordinationv1beta1 "k8s.io/api/coordination/v1beta1"
+	coordinationv1beta1 "k8s.io/client-go/kubernetes/typed/coordination/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	coordinationv1beta1 "k8s.io/client-go/kubernetes/typed/coordination/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type CoordinationV1beta1ClusterInterface interface {
 	CoordinationV1beta1ClusterScoper
 	LeasesClusterGetter
+	LeaseCandidatesClusterGetter
 }
 
 type CoordinationV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) coordinationv1beta1.CoordinationV1beta1Interface
 }
 
+// CoordinationV1beta1ClusterClient is used to interact with features provided by the coordination.k8s.io group.
 type CoordinationV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*coordinationv1beta1.CoordinationV1beta1Client]
 }
@@ -55,15 +56,21 @@ func (c *CoordinationV1beta1ClusterClient) Leases() LeaseClusterInterface {
 	return &leasesClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *CoordinationV1beta1ClusterClient) LeaseCandidates() LeaseCandidateClusterInterface {
+	return &leaseCandidatesClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new CoordinationV1beta1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*CoordinationV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new CoordinationV1beta1ClusterClient for the given config and http client.
@@ -75,6 +82,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*CoordinationV1beta1
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &CoordinationV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +95,14 @@ func NewForConfigOrDie(c *rest.Config) *CoordinationV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apicoordinationv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/coordination/v1beta1/doc.go b/kubernetes/typed/coordination/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/coordination/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/coordination/v1beta1/fake/coordination_client.go b/kubernetes/typed/coordination/v1beta1/fake/coordination_client.go
index d085f377d..6f3074b54 100644
--- a/kubernetes/typed/coordination/v1beta1/fake/coordination_client.go
+++ b/kubernetes/typed/coordination/v1beta1/fake/coordination_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	coordinationv1beta1 "k8s.io/client-go/kubernetes/typed/coordination/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpcoordinationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpcoordinationv1beta1.CoordinationV1beta1ClusterInterface = (*CoordinationV1beta1ClusterClient)(nil)
@@ -45,21 +41,29 @@ func (c *CoordinationV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Pa
 }
 
 func (c *CoordinationV1beta1ClusterClient) Leases() kcpcoordinationv1beta1.LeaseClusterInterface {
-	return &leasesClusterClient{Fake: c.Fake}
+	return newFakeLeaseClusterClient(c)
 }
 
-var _ coordinationv1beta1.CoordinationV1beta1Interface = (*CoordinationV1beta1Client)(nil)
+func (c *CoordinationV1beta1ClusterClient) LeaseCandidates() kcpcoordinationv1beta1.LeaseCandidateClusterInterface {
+	return newFakeLeaseCandidateClusterClient(c)
+}
 
 type CoordinationV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *CoordinationV1beta1Client) Leases(namespace string) coordinationv1beta1.LeaseInterface {
+	return newFakeLeaseClient(c.Fake, namespace, c.ClusterPath)
+}
+
+func (c *CoordinationV1beta1Client) LeaseCandidates(namespace string) coordinationv1beta1.LeaseCandidateInterface {
+	return newFakeLeaseCandidateClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *CoordinationV1beta1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *CoordinationV1beta1Client) Leases(namespace string) coordinationv1beta1.LeaseInterface {
-	return &leasesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
diff --git a/kubernetes/typed/coordination/v1beta1/fake/doc.go b/kubernetes/typed/coordination/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/coordination/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/coordination/v1beta1/fake/lease.go b/kubernetes/typed/coordination/v1beta1/fake/lease.go
index 4df65d85b..58bcc8397 100644
--- a/kubernetes/typed/coordination/v1beta1/fake/lease.go
+++ b/kubernetes/typed/coordination/v1beta1/fake/lease.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	coordinationv1beta1 "k8s.io/api/coordination/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscoordinationv1beta1 "k8s.io/client-go/applyconfigurations/coordination/v1beta1"
-	coordinationv1beta1client "k8s.io/client-go/kubernetes/typed/coordination/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/coordination/v1beta1"
+	typedcoordinationv1beta1 "k8s.io/client-go/kubernetes/typed/coordination/v1beta1"
 
-	kcpcoordinationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1beta1"
+	typedkcpcoordinationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var leasesResource = schema.GroupVersionResource{Group: "coordination.k8s.io", Version: "v1beta1", Resource: "leases"}
-var leasesKind = schema.GroupVersionKind{Group: "coordination.k8s.io", Version: "v1beta1", Kind: "Lease"}
-
-type leasesClusterClient struct {
-	*kcptesting.Fake
+// leaseClusterClient implements LeaseClusterInterface
+type leaseClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*coordinationv1beta1.Lease, *coordinationv1beta1.LeaseList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *leasesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcoordinationv1beta1.LeasesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &leasesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Leases that match those selectors across all clusters.
-func (c *leasesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*coordinationv1beta1.LeaseList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(leasesResource, leasesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &coordinationv1beta1.LeaseList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeLeaseClusterClient(fake *CoordinationV1beta1ClusterClient) typedkcpcoordinationv1beta1.LeaseClusterInterface {
+	return &leaseClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*coordinationv1beta1.Lease, *coordinationv1beta1.LeaseList](
+			fake.Fake,
+			coordinationv1beta1.SchemeGroupVersion.WithResource("leases"),
+			coordinationv1beta1.SchemeGroupVersion.WithKind("Lease"),
+			func() *coordinationv1beta1.Lease { return &coordinationv1beta1.Lease{} },
+			func() *coordinationv1beta1.LeaseList { return &coordinationv1beta1.LeaseList{} },
+			func(dst, src *coordinationv1beta1.LeaseList) { dst.ListMeta = src.ListMeta },
+			func(list *coordinationv1beta1.LeaseList) []*coordinationv1beta1.Lease {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *coordinationv1beta1.LeaseList, items []*coordinationv1beta1.Lease) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &coordinationv1beta1.LeaseList{ListMeta: obj.(*coordinationv1beta1.LeaseList).ListMeta}
-	for _, item := range obj.(*coordinationv1beta1.LeaseList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Leases across all clusters.
-func (c *leasesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(leasesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *leaseClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcoordinationv1beta1.LeasesNamespacer {
+	return &leaseNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type leasesNamespacer struct {
+type leaseNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *leasesNamespacer) Namespace(namespace string) coordinationv1beta1client.LeaseInterface {
-	return &leasesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *leaseNamespacer) Namespace(namespace string) typedcoordinationv1beta1.LeaseInterface {
+	return newFakeLeaseClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type leasesClient struct {
-	*kcptesting.Fake
+// leaseScopedClient implements LeaseInterface
+type leaseScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*coordinationv1beta1.Lease, *coordinationv1beta1.LeaseList, *v1beta1.LeaseApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *leasesClient) Create(ctx context.Context, lease *coordinationv1beta1.Lease, opts metav1.CreateOptions) (*coordinationv1beta1.Lease, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(leasesResource, c.ClusterPath, c.Namespace, lease), &coordinationv1beta1.Lease{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*coordinationv1beta1.Lease), err
-}
-
-func (c *leasesClient) Update(ctx context.Context, lease *coordinationv1beta1.Lease, opts metav1.UpdateOptions) (*coordinationv1beta1.Lease, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(leasesResource, c.ClusterPath, c.Namespace, lease), &coordinationv1beta1.Lease{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*coordinationv1beta1.Lease), err
-}
-
-func (c *leasesClient) UpdateStatus(ctx context.Context, lease *coordinationv1beta1.Lease, opts metav1.UpdateOptions) (*coordinationv1beta1.Lease, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(leasesResource, c.ClusterPath, "status", c.Namespace, lease), &coordinationv1beta1.Lease{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*coordinationv1beta1.Lease), err
-}
-
-func (c *leasesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(leasesResource, c.ClusterPath, c.Namespace, name, opts), &coordinationv1beta1.Lease{})
-	return err
 }
 
-func (c *leasesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(leasesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &coordinationv1beta1.LeaseList{})
-	return err
-}
-
-func (c *leasesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*coordinationv1beta1.Lease, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(leasesResource, c.ClusterPath, c.Namespace, name), &coordinationv1beta1.Lease{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*coordinationv1beta1.Lease), err
-}
-
-// List takes label and field selectors, and returns the list of Leases that match those selectors.
-func (c *leasesClient) List(ctx context.Context, opts metav1.ListOptions) (*coordinationv1beta1.LeaseList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(leasesResource, leasesKind, c.ClusterPath, c.Namespace, opts), &coordinationv1beta1.LeaseList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &coordinationv1beta1.LeaseList{ListMeta: obj.(*coordinationv1beta1.LeaseList).ListMeta}
-	for _, item := range obj.(*coordinationv1beta1.LeaseList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *leasesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(leasesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *leasesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*coordinationv1beta1.Lease, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(leasesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &coordinationv1beta1.Lease{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*coordinationv1beta1.Lease), err
-}
-
-func (c *leasesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscoordinationv1beta1.LeaseApplyConfiguration, opts metav1.ApplyOptions) (*coordinationv1beta1.Lease, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(leasesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &coordinationv1beta1.Lease{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*coordinationv1beta1.Lease), err
-}
-
-func (c *leasesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscoordinationv1beta1.LeaseApplyConfiguration, opts metav1.ApplyOptions) (*coordinationv1beta1.Lease, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(leasesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &coordinationv1beta1.Lease{})
-	if obj == nil {
-		return nil, err
+func newFakeLeaseClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcoordinationv1beta1.LeaseInterface {
+	return &leaseScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*coordinationv1beta1.Lease, *coordinationv1beta1.LeaseList, *v1beta1.LeaseApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			coordinationv1beta1.SchemeGroupVersion.WithResource("leases"),
+			coordinationv1beta1.SchemeGroupVersion.WithKind("Lease"),
+			func() *coordinationv1beta1.Lease { return &coordinationv1beta1.Lease{} },
+			func() *coordinationv1beta1.LeaseList { return &coordinationv1beta1.LeaseList{} },
+			func(dst, src *coordinationv1beta1.LeaseList) { dst.ListMeta = src.ListMeta },
+			func(list *coordinationv1beta1.LeaseList) []*coordinationv1beta1.Lease {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *coordinationv1beta1.LeaseList, items []*coordinationv1beta1.Lease) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*coordinationv1beta1.Lease), err
 }
diff --git a/kubernetes/typed/coordination/v1beta1/fake/leasecandidate.go b/kubernetes/typed/coordination/v1beta1/fake/leasecandidate.go
new file mode 100644
index 000000000..428d18a80
--- /dev/null
+++ b/kubernetes/typed/coordination/v1beta1/fake/leasecandidate.go
@@ -0,0 +1,99 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	coordinationv1beta1 "k8s.io/api/coordination/v1beta1"
+	v1beta1 "k8s.io/client-go/applyconfigurations/coordination/v1beta1"
+	typedcoordinationv1beta1 "k8s.io/client-go/kubernetes/typed/coordination/v1beta1"
+
+	typedkcpcoordinationv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/coordination/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// leaseCandidateClusterClient implements LeaseCandidateClusterInterface
+type leaseCandidateClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*coordinationv1beta1.LeaseCandidate, *coordinationv1beta1.LeaseCandidateList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeLeaseCandidateClusterClient(fake *CoordinationV1beta1ClusterClient) typedkcpcoordinationv1beta1.LeaseCandidateClusterInterface {
+	return &leaseCandidateClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*coordinationv1beta1.LeaseCandidate, *coordinationv1beta1.LeaseCandidateList](
+			fake.Fake,
+			coordinationv1beta1.SchemeGroupVersion.WithResource("leasecandidates"),
+			coordinationv1beta1.SchemeGroupVersion.WithKind("LeaseCandidate"),
+			func() *coordinationv1beta1.LeaseCandidate { return &coordinationv1beta1.LeaseCandidate{} },
+			func() *coordinationv1beta1.LeaseCandidateList { return &coordinationv1beta1.LeaseCandidateList{} },
+			func(dst, src *coordinationv1beta1.LeaseCandidateList) { dst.ListMeta = src.ListMeta },
+			func(list *coordinationv1beta1.LeaseCandidateList) []*coordinationv1beta1.LeaseCandidate {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *coordinationv1beta1.LeaseCandidateList, items []*coordinationv1beta1.LeaseCandidate) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *leaseCandidateClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcoordinationv1beta1.LeaseCandidatesNamespacer {
+	return &leaseCandidateNamespacer{Fake: c.Fake, ClusterPath: cluster}
+}
+
+type leaseCandidateNamespacer struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (n *leaseCandidateNamespacer) Namespace(namespace string) typedcoordinationv1beta1.LeaseCandidateInterface {
+	return newFakeLeaseCandidateClient(n.Fake, namespace, n.ClusterPath)
+}
+
+// leaseCandidateScopedClient implements LeaseCandidateInterface
+type leaseCandidateScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*coordinationv1beta1.LeaseCandidate, *coordinationv1beta1.LeaseCandidateList, *v1beta1.LeaseCandidateApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeLeaseCandidateClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcoordinationv1beta1.LeaseCandidateInterface {
+	return &leaseCandidateScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*coordinationv1beta1.LeaseCandidate, *coordinationv1beta1.LeaseCandidateList, *v1beta1.LeaseCandidateApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			coordinationv1beta1.SchemeGroupVersion.WithResource("leasecandidates"),
+			coordinationv1beta1.SchemeGroupVersion.WithKind("LeaseCandidate"),
+			func() *coordinationv1beta1.LeaseCandidate { return &coordinationv1beta1.LeaseCandidate{} },
+			func() *coordinationv1beta1.LeaseCandidateList { return &coordinationv1beta1.LeaseCandidateList{} },
+			func(dst, src *coordinationv1beta1.LeaseCandidateList) { dst.ListMeta = src.ListMeta },
+			func(list *coordinationv1beta1.LeaseCandidateList) []*coordinationv1beta1.LeaseCandidate {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *coordinationv1beta1.LeaseCandidateList, items []*coordinationv1beta1.LeaseCandidate) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/coordination/v1beta1/generated_expansion.go b/kubernetes/typed/coordination/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..ee5e0af6f
--- /dev/null
+++ b/kubernetes/typed/coordination/v1beta1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type LeaseClusterExpansion interface{}
+
+type LeaseCandidateClusterExpansion interface{}
diff --git a/kubernetes/typed/coordination/v1beta1/lease.go b/kubernetes/typed/coordination/v1beta1/lease.go
index 802289828..dc2346c4c 100644
--- a/kubernetes/typed/coordination/v1beta1/lease.go
+++ b/kubernetes/typed/coordination/v1beta1/lease.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	coordinationv1beta1 "k8s.io/api/coordination/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcoordinationv1beta1 "k8s.io/client-go/kubernetes/typed/coordination/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	coordinationv1beta1 "k8s.io/api/coordination/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	coordinationv1beta1client "k8s.io/client-go/kubernetes/typed/coordination/v1beta1"
 )
 
 // LeasesClusterGetter has a method to return a LeaseClusterInterface.
@@ -43,12 +40,13 @@ type LeasesClusterGetter interface {
 // or scope down to one cluster and return a LeasesNamespacer.
 type LeaseClusterInterface interface {
 	Cluster(logicalcluster.Path) LeasesNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*coordinationv1beta1.LeaseList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*coordinationv1beta1.LeaseList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	LeaseClusterExpansion
 }
 
 type leasesClusterInterface struct {
-	clientCache kcpclient.Cache[*coordinationv1beta1client.CoordinationV1beta1Client]
+	clientCache kcpclient.Cache[*typedcoordinationv1beta1.CoordinationV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *leasesClusterInterface) Cluster(clusterPath logicalcluster.Path) Leases
 }
 
 // List returns the entire collection of all Leases across all clusters.
-func (c *leasesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*coordinationv1beta1.LeaseList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Leases(metav1.NamespaceAll).List(ctx, opts)
+func (c *leasesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*coordinationv1beta1.LeaseList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Leases(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all Leases across all clusters.
-func (c *leasesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Leases(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *leasesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Leases(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// LeasesNamespacer can scope to objects within a namespace, returning a coordinationv1beta1client.LeaseInterface.
+// LeasesNamespacer can scope to objects within a namespace, returning a typedcoordinationv1beta1.LeaseInterface.
 type LeasesNamespacer interface {
-	Namespace(string) coordinationv1beta1client.LeaseInterface
+	Namespace(string) typedcoordinationv1beta1.LeaseInterface
 }
 
 type leasesNamespacer struct {
-	clientCache kcpclient.Cache[*coordinationv1beta1client.CoordinationV1beta1Client]
+	clientCache kcpclient.Cache[*typedcoordinationv1beta1.CoordinationV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *leasesNamespacer) Namespace(namespace string) coordinationv1beta1client.LeaseInterface {
+func (n *leasesNamespacer) Namespace(namespace string) typedcoordinationv1beta1.LeaseInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Leases(namespace)
 }
diff --git a/kubernetes/typed/coordination/v1beta1/leasecandidate.go b/kubernetes/typed/coordination/v1beta1/leasecandidate.go
new file mode 100644
index 000000000..57dba5b34
--- /dev/null
+++ b/kubernetes/typed/coordination/v1beta1/leasecandidate.go
@@ -0,0 +1,83 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	coordinationv1beta1 "k8s.io/api/coordination/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcoordinationv1beta1 "k8s.io/client-go/kubernetes/typed/coordination/v1beta1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// LeaseCandidatesClusterGetter has a method to return a LeaseCandidateClusterInterface.
+// A group's cluster client should implement this interface.
+type LeaseCandidatesClusterGetter interface {
+	LeaseCandidates() LeaseCandidateClusterInterface
+}
+
+// LeaseCandidateClusterInterface can operate on LeaseCandidates across all clusters,
+// or scope down to one cluster and return a LeaseCandidatesNamespacer.
+type LeaseCandidateClusterInterface interface {
+	Cluster(logicalcluster.Path) LeaseCandidatesNamespacer
+	List(ctx context.Context, opts v1.ListOptions) (*coordinationv1beta1.LeaseCandidateList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	LeaseCandidateClusterExpansion
+}
+
+type leaseCandidatesClusterInterface struct {
+	clientCache kcpclient.Cache[*typedcoordinationv1beta1.CoordinationV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *leaseCandidatesClusterInterface) Cluster(clusterPath logicalcluster.Path) LeaseCandidatesNamespacer {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return &leaseCandidatesNamespacer{clientCache: c.clientCache, clusterPath: clusterPath}
+}
+
+// List returns the entire collection of all LeaseCandidates across all clusters.
+func (c *leaseCandidatesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*coordinationv1beta1.LeaseCandidateList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).LeaseCandidates(v1.NamespaceAll).List(ctx, opts)
+}
+
+// Watch begins to watch all LeaseCandidates across all clusters.
+func (c *leaseCandidatesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).LeaseCandidates(v1.NamespaceAll).Watch(ctx, opts)
+}
+
+// LeaseCandidatesNamespacer can scope to objects within a namespace, returning a typedcoordinationv1beta1.LeaseCandidateInterface.
+type LeaseCandidatesNamespacer interface {
+	Namespace(string) typedcoordinationv1beta1.LeaseCandidateInterface
+}
+
+type leaseCandidatesNamespacer struct {
+	clientCache kcpclient.Cache[*typedcoordinationv1beta1.CoordinationV1beta1Client]
+	clusterPath logicalcluster.Path
+}
+
+func (n *leaseCandidatesNamespacer) Namespace(namespace string) typedcoordinationv1beta1.LeaseCandidateInterface {
+	return n.clientCache.ClusterOrDie(n.clusterPath).LeaseCandidates(namespace)
+}
diff --git a/kubernetes/typed/core/v1/componentstatus.go b/kubernetes/typed/core/v1/componentstatus.go
index 5fd25dc5b..833262137 100644
--- a/kubernetes/typed/core/v1/componentstatus.go
+++ b/kubernetes/typed/core/v1/componentstatus.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
 )
 
 // ComponentStatusesClusterGetter has a method to return a ComponentStatusClusterInterface.
@@ -40,19 +37,20 @@ type ComponentStatusesClusterGetter interface {
 }
 
 // ComponentStatusClusterInterface can operate on ComponentStatuses across all clusters,
-// or scope down to one cluster and return a corev1client.ComponentStatusInterface.
+// or scope down to one cluster and return a corev1.ComponentStatusInterface.
 type ComponentStatusClusterInterface interface {
-	Cluster(logicalcluster.Path) corev1client.ComponentStatusInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*corev1.ComponentStatusList, error)
+	Cluster(logicalcluster.Path) corev1.ComponentStatusInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apicorev1.ComponentStatusList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ComponentStatusClusterExpansion
 }
 
 type componentStatusesClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*corev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *componentStatusesClusterInterface) Cluster(clusterPath logicalcluster.Path) corev1client.ComponentStatusInterface {
+func (c *componentStatusesClusterInterface) Cluster(clusterPath logicalcluster.Path) corev1.ComponentStatusInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *componentStatusesClusterInterface) Cluster(clusterPath logicalcluster.P
 }
 
 // List returns the entire collection of all ComponentStatuses across all clusters.
-func (c *componentStatusesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ComponentStatusList, error) {
+func (c *componentStatusesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apicorev1.ComponentStatusList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ComponentStatuses().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/core/v1/configmap.go b/kubernetes/typed/core/v1/configmap.go
index 7c95a55d1..1a72a6403 100644
--- a/kubernetes/typed/core/v1/configmap.go
+++ b/kubernetes/typed/core/v1/configmap.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ConfigMapsClusterGetter has a method to return a ConfigMapClusterInterface.
@@ -45,10 +42,11 @@ type ConfigMapClusterInterface interface {
 	Cluster(logicalcluster.Path) ConfigMapsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*corev1.ConfigMapList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ConfigMapClusterExpansion
 }
 
 type configMapsClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *configMapsClusterInterface) Watch(ctx context.Context, opts metav1.List
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ConfigMaps(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ConfigMapsNamespacer can scope to objects within a namespace, returning a corev1client.ConfigMapInterface.
+// ConfigMapsNamespacer can scope to objects within a namespace, returning a typedcorev1.ConfigMapInterface.
 type ConfigMapsNamespacer interface {
-	Namespace(string) corev1client.ConfigMapInterface
+	Namespace(string) typedcorev1.ConfigMapInterface
 }
 
 type configMapsNamespacer struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *configMapsNamespacer) Namespace(namespace string) corev1client.ConfigMapInterface {
+func (n *configMapsNamespacer) Namespace(namespace string) typedcorev1.ConfigMapInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).ConfigMaps(namespace)
 }
diff --git a/kubernetes/typed/core/v1/core_client.go b/kubernetes/typed/core/v1/core_client.go
index 98a40d5ea..fbf8ab4d5 100644
--- a/kubernetes/typed/core/v1/core_client.go
+++ b/kubernetes/typed/core/v1/core_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,44 +14,47 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apicorev1 "k8s.io/api/core/v1"
+	corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/rest"
 )
 
 type CoreV1ClusterInterface interface {
 	CoreV1ClusterScoper
+	ComponentStatusesClusterGetter
+	ConfigMapsClusterGetter
+	EndpointsClusterGetter
+	EventsClusterGetter
+	LimitRangesClusterGetter
+	NamespacesClusterGetter
+	NodesClusterGetter
 	PersistentVolumesClusterGetter
 	PersistentVolumeClaimsClusterGetter
 	PodsClusterGetter
 	PodTemplatesClusterGetter
 	ReplicationControllersClusterGetter
-	ServicesClusterGetter
-	ServiceAccountsClusterGetter
-	EndpointsClusterGetter
-	NodesClusterGetter
-	NamespacesClusterGetter
-	EventsClusterGetter
-	LimitRangesClusterGetter
 	ResourceQuotasClusterGetter
 	SecretsClusterGetter
-	ConfigMapsClusterGetter
-	ComponentStatusesClusterGetter
+	ServicesClusterGetter
+	ServiceAccountsClusterGetter
 }
 
 type CoreV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) corev1.CoreV1Interface
 }
 
+// CoreV1ClusterClient is used to interact with features provided by the  group.
 type CoreV1ClusterClient struct {
 	clientCache kcpclient.Cache[*corev1.CoreV1Client]
 }
@@ -66,52 +66,52 @@ func (c *CoreV1ClusterClient) Cluster(clusterPath logicalcluster.Path) corev1.Co
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *CoreV1ClusterClient) PersistentVolumes() PersistentVolumeClusterInterface {
-	return &persistentVolumesClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) ComponentStatuses() ComponentStatusClusterInterface {
+	return &componentStatusesClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) PersistentVolumeClaims() PersistentVolumeClaimClusterInterface {
-	return &persistentVolumeClaimsClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) ConfigMaps() ConfigMapClusterInterface {
+	return &configMapsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) Pods() PodClusterInterface {
-	return &podsClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) Endpoints() EndpointsClusterInterface {
+	return &endpointsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) PodTemplates() PodTemplateClusterInterface {
-	return &podTemplatesClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) Events() EventClusterInterface {
+	return &eventsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) ReplicationControllers() ReplicationControllerClusterInterface {
-	return &replicationControllersClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) LimitRanges() LimitRangeClusterInterface {
+	return &limitRangesClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) Services() ServiceClusterInterface {
-	return &servicesClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) Namespaces() NamespaceClusterInterface {
+	return &namespacesClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) ServiceAccounts() ServiceAccountClusterInterface {
-	return &serviceAccountsClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) Nodes() NodeClusterInterface {
+	return &nodesClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) Endpoints() EndpointsClusterInterface {
-	return &endpointsClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) PersistentVolumes() PersistentVolumeClusterInterface {
+	return &persistentVolumesClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) Nodes() NodeClusterInterface {
-	return &nodesClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) PersistentVolumeClaims() PersistentVolumeClaimClusterInterface {
+	return &persistentVolumeClaimsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) Namespaces() NamespaceClusterInterface {
-	return &namespacesClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) Pods() PodClusterInterface {
+	return &podsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) Events() EventClusterInterface {
-	return &eventsClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) PodTemplates() PodTemplateClusterInterface {
+	return &podTemplatesClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) LimitRanges() LimitRangeClusterInterface {
-	return &limitRangesClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) ReplicationControllers() ReplicationControllerClusterInterface {
+	return &replicationControllersClusterInterface{clientCache: c.clientCache}
 }
 
 func (c *CoreV1ClusterClient) ResourceQuotas() ResourceQuotaClusterInterface {
@@ -122,23 +122,25 @@ func (c *CoreV1ClusterClient) Secrets() SecretClusterInterface {
 	return &secretsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) ConfigMaps() ConfigMapClusterInterface {
-	return &configMapsClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) Services() ServiceClusterInterface {
+	return &servicesClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *CoreV1ClusterClient) ComponentStatuses() ComponentStatusClusterInterface {
-	return &componentStatusesClusterInterface{clientCache: c.clientCache}
+func (c *CoreV1ClusterClient) ServiceAccounts() ServiceAccountClusterInterface {
+	return &serviceAccountsClusterInterface{clientCache: c.clientCache}
 }
 
 // NewForConfig creates a new CoreV1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*CoreV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new CoreV1ClusterClient for the given config and http client.
@@ -150,6 +152,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*CoreV1ClusterClient
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &CoreV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -162,3 +165,14 @@ func NewForConfigOrDie(c *rest.Config) *CoreV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apicorev1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/api"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/core/v1/doc.go b/kubernetes/typed/core/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/core/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/core/v1/endpoints.go b/kubernetes/typed/core/v1/endpoints.go
index 5a11658a1..96e8aa14e 100644
--- a/kubernetes/typed/core/v1/endpoints.go
+++ b/kubernetes/typed/core/v1/endpoints.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // EndpointsClusterGetter has a method to return a EndpointsClusterInterface.
@@ -45,10 +42,11 @@ type EndpointsClusterInterface interface {
 	Cluster(logicalcluster.Path) EndpointsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*corev1.EndpointsList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	EndpointsClusterExpansion
 }
 
 type endpointsClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *endpointsClusterInterface) Watch(ctx context.Context, opts metav1.ListO
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Endpoints(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// EndpointsNamespacer can scope to objects within a namespace, returning a corev1client.EndpointsInterface.
+// EndpointsNamespacer can scope to objects within a namespace, returning a typedcorev1.EndpointsInterface.
 type EndpointsNamespacer interface {
-	Namespace(string) corev1client.EndpointsInterface
+	Namespace(string) typedcorev1.EndpointsInterface
 }
 
 type endpointsNamespacer struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *endpointsNamespacer) Namespace(namespace string) corev1client.EndpointsInterface {
+func (n *endpointsNamespacer) Namespace(namespace string) typedcorev1.EndpointsInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Endpoints(namespace)
 }
diff --git a/kubernetes/typed/core/v1/event.go b/kubernetes/typed/core/v1/event.go
index 4b119640a..fed700c9e 100644
--- a/kubernetes/typed/core/v1/event.go
+++ b/kubernetes/typed/core/v1/event.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // EventsClusterGetter has a method to return a EventClusterInterface.
@@ -45,10 +42,11 @@ type EventClusterInterface interface {
 	Cluster(logicalcluster.Path) EventsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*corev1.EventList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	EventClusterExpansion
 }
 
 type eventsClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *eventsClusterInterface) Watch(ctx context.Context, opts metav1.ListOpti
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Events(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// EventsNamespacer can scope to objects within a namespace, returning a corev1client.EventInterface.
+// EventsNamespacer can scope to objects within a namespace, returning a typedcorev1.EventInterface.
 type EventsNamespacer interface {
-	Namespace(string) corev1client.EventInterface
+	Namespace(string) typedcorev1.EventInterface
 }
 
 type eventsNamespacer struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *eventsNamespacer) Namespace(namespace string) corev1client.EventInterface {
+func (n *eventsNamespacer) Namespace(namespace string) typedcorev1.EventInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Events(namespace)
 }
diff --git a/kubernetes/typed/core/v1/fake/componentstatus.go b/kubernetes/typed/core/v1/fake/componentstatus.go
index 6a1af6a55..1301316f1 100644
--- a/kubernetes/typed/core/v1/fake/componentstatus.go
+++ b/kubernetes/typed/core/v1/fake/componentstatus.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var componentStatusesResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "componentstatuses"}
-var componentStatusesKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "ComponentStatus"}
-
-type componentStatusesClusterClient struct {
-	*kcptesting.Fake
+// componentStatusClusterClient implements ComponentStatusClusterInterface
+type componentStatusClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.ComponentStatus, *corev1.ComponentStatusList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *componentStatusesClusterClient) Cluster(clusterPath logicalcluster.Path) corev1client.ComponentStatusInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &componentStatusesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ComponentStatuses that match those selectors across all clusters.
-func (c *componentStatusesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ComponentStatusList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(componentStatusesResource, componentStatusesKind, logicalcluster.Wildcard, opts), &corev1.ComponentStatusList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.ComponentStatusList{ListMeta: obj.(*corev1.ComponentStatusList).ListMeta}
-	for _, item := range obj.(*corev1.ComponentStatusList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeComponentStatusClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.ComponentStatusClusterInterface {
+	return &componentStatusClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.ComponentStatus, *corev1.ComponentStatusList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("componentstatuses"),
+			corev1.SchemeGroupVersion.WithKind("ComponentStatus"),
+			func() *corev1.ComponentStatus { return &corev1.ComponentStatus{} },
+			func() *corev1.ComponentStatusList { return &corev1.ComponentStatusList{} },
+			func(dst, src *corev1.ComponentStatusList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.ComponentStatusList) []*corev1.ComponentStatus {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *corev1.ComponentStatusList, items []*corev1.ComponentStatus) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ComponentStatuses across all clusters.
-func (c *componentStatusesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(componentStatusesResource, logicalcluster.Wildcard, opts))
+func (c *componentStatusClusterClient) Cluster(cluster logicalcluster.Path) typedcorev1.ComponentStatusInterface {
+	return newFakeComponentStatusClient(c.Fake, cluster)
 }
 
-type componentStatusesClient struct {
-	*kcptesting.Fake
+// componentStatusScopedClient implements ComponentStatusInterface
+type componentStatusScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.ComponentStatus, *corev1.ComponentStatusList, *v1.ComponentStatusApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *componentStatusesClient) Create(ctx context.Context, componentStatus *corev1.ComponentStatus, opts metav1.CreateOptions) (*corev1.ComponentStatus, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(componentStatusesResource, c.ClusterPath, componentStatus), &corev1.ComponentStatus{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ComponentStatus), err
-}
-
-func (c *componentStatusesClient) Update(ctx context.Context, componentStatus *corev1.ComponentStatus, opts metav1.UpdateOptions) (*corev1.ComponentStatus, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(componentStatusesResource, c.ClusterPath, componentStatus), &corev1.ComponentStatus{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ComponentStatus), err
-}
-
-func (c *componentStatusesClient) UpdateStatus(ctx context.Context, componentStatus *corev1.ComponentStatus, opts metav1.UpdateOptions) (*corev1.ComponentStatus, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(componentStatusesResource, c.ClusterPath, "status", componentStatus), &corev1.ComponentStatus{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ComponentStatus), err
-}
-
-func (c *componentStatusesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(componentStatusesResource, c.ClusterPath, name, opts), &corev1.ComponentStatus{})
-	return err
-}
-
-func (c *componentStatusesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(componentStatusesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.ComponentStatusList{})
-	return err
-}
-
-func (c *componentStatusesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.ComponentStatus, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(componentStatusesResource, c.ClusterPath, name), &corev1.ComponentStatus{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ComponentStatus), err
-}
-
-// List takes label and field selectors, and returns the list of ComponentStatuses that match those selectors.
-func (c *componentStatusesClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ComponentStatusList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(componentStatusesResource, componentStatusesKind, c.ClusterPath, opts), &corev1.ComponentStatusList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.ComponentStatusList{ListMeta: obj.(*corev1.ComponentStatusList).ListMeta}
-	for _, item := range obj.(*corev1.ComponentStatusList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *componentStatusesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(componentStatusesResource, c.ClusterPath, opts))
-}
-
-func (c *componentStatusesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.ComponentStatus, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(componentStatusesResource, c.ClusterPath, name, pt, data, subresources...), &corev1.ComponentStatus{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ComponentStatus), err
-}
-
-func (c *componentStatusesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.ComponentStatusApplyConfiguration, opts metav1.ApplyOptions) (*corev1.ComponentStatus, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(componentStatusesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &corev1.ComponentStatus{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ComponentStatus), err
-}
-
-func (c *componentStatusesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.ComponentStatusApplyConfiguration, opts metav1.ApplyOptions) (*corev1.ComponentStatus, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(componentStatusesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &corev1.ComponentStatus{})
-	if obj == nil {
-		return nil, err
+func newFakeComponentStatusClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedcorev1.ComponentStatusInterface {
+	return &componentStatusScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.ComponentStatus, *corev1.ComponentStatusList, *v1.ComponentStatusApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			corev1.SchemeGroupVersion.WithResource("componentstatuses"),
+			corev1.SchemeGroupVersion.WithKind("ComponentStatus"),
+			func() *corev1.ComponentStatus { return &corev1.ComponentStatus{} },
+			func() *corev1.ComponentStatusList { return &corev1.ComponentStatusList{} },
+			func(dst, src *corev1.ComponentStatusList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.ComponentStatusList) []*corev1.ComponentStatus {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *corev1.ComponentStatusList, items []*corev1.ComponentStatus) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.ComponentStatus), err
 }
diff --git a/kubernetes/typed/core/v1/fake/configmap.go b/kubernetes/typed/core/v1/fake/configmap.go
index 43fb66dbb..e0bdc80bb 100644
--- a/kubernetes/typed/core/v1/fake/configmap.go
+++ b/kubernetes/typed/core/v1/fake/configmap.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,82 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
-	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var configMapsResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "configmaps"}
-var configMapsKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "ConfigMap"}
-
-type configMapsClusterClient struct {
-	*kcptesting.Fake
+// configMapClusterClient implements ConfigMapClusterInterface
+type configMapClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.ConfigMap, *corev1.ConfigMapList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *configMapsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcorev1.ConfigMapsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &configMapsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ConfigMaps that match those selectors across all clusters.
-func (c *configMapsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ConfigMapList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(configMapsResource, configMapsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &corev1.ConfigMapList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeConfigMapClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.ConfigMapClusterInterface {
+	return &configMapClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.ConfigMap, *corev1.ConfigMapList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("configmaps"),
+			corev1.SchemeGroupVersion.WithKind("ConfigMap"),
+			func() *corev1.ConfigMap { return &corev1.ConfigMap{} },
+			func() *corev1.ConfigMapList { return &corev1.ConfigMapList{} },
+			func(dst, src *corev1.ConfigMapList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.ConfigMapList) []*corev1.ConfigMap { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.ConfigMapList, items []*corev1.ConfigMap) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &corev1.ConfigMapList{ListMeta: obj.(*corev1.ConfigMapList).ListMeta}
-	for _, item := range obj.(*corev1.ConfigMapList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ConfigMaps across all clusters.
-func (c *configMapsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(configMapsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *configMapClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcorev1.ConfigMapsNamespacer {
+	return &configMapNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type configMapsNamespacer struct {
+type configMapNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *configMapsNamespacer) Namespace(namespace string) corev1client.ConfigMapInterface {
-	return &configMapsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *configMapNamespacer) Namespace(namespace string) typedcorev1.ConfigMapInterface {
+	return newFakeConfigMapClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type configMapsClient struct {
-	*kcptesting.Fake
+// configMapScopedClient implements ConfigMapInterface
+type configMapScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.ConfigMap, *corev1.ConfigMapList, *v1.ConfigMapApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *configMapsClient) Create(ctx context.Context, configMap *corev1.ConfigMap, opts metav1.CreateOptions) (*corev1.ConfigMap, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(configMapsResource, c.ClusterPath, c.Namespace, configMap), &corev1.ConfigMap{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ConfigMap), err
-}
-
-func (c *configMapsClient) Update(ctx context.Context, configMap *corev1.ConfigMap, opts metav1.UpdateOptions) (*corev1.ConfigMap, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(configMapsResource, c.ClusterPath, c.Namespace, configMap), &corev1.ConfigMap{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ConfigMap), err
-}
-
-func (c *configMapsClient) UpdateStatus(ctx context.Context, configMap *corev1.ConfigMap, opts metav1.UpdateOptions) (*corev1.ConfigMap, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(configMapsResource, c.ClusterPath, "status", c.Namespace, configMap), &corev1.ConfigMap{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ConfigMap), err
-}
-
-func (c *configMapsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(configMapsResource, c.ClusterPath, c.Namespace, name, opts), &corev1.ConfigMap{})
-	return err
 }
 
-func (c *configMapsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(configMapsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.ConfigMapList{})
-	return err
-}
-
-func (c *configMapsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.ConfigMap, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(configMapsResource, c.ClusterPath, c.Namespace, name), &corev1.ConfigMap{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ConfigMap), err
-}
-
-// List takes label and field selectors, and returns the list of ConfigMaps that match those selectors.
-func (c *configMapsClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ConfigMapList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(configMapsResource, configMapsKind, c.ClusterPath, c.Namespace, opts), &corev1.ConfigMapList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.ConfigMapList{ListMeta: obj.(*corev1.ConfigMapList).ListMeta}
-	for _, item := range obj.(*corev1.ConfigMapList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *configMapsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(configMapsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *configMapsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.ConfigMap, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(configMapsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &corev1.ConfigMap{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ConfigMap), err
-}
-
-func (c *configMapsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.ConfigMapApplyConfiguration, opts metav1.ApplyOptions) (*corev1.ConfigMap, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(configMapsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &corev1.ConfigMap{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ConfigMap), err
-}
-
-func (c *configMapsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.ConfigMapApplyConfiguration, opts metav1.ApplyOptions) (*corev1.ConfigMap, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(configMapsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &corev1.ConfigMap{})
-	if obj == nil {
-		return nil, err
+func newFakeConfigMapClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcorev1.ConfigMapInterface {
+	return &configMapScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.ConfigMap, *corev1.ConfigMapList, *v1.ConfigMapApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			corev1.SchemeGroupVersion.WithResource("configmaps"),
+			corev1.SchemeGroupVersion.WithKind("ConfigMap"),
+			func() *corev1.ConfigMap { return &corev1.ConfigMap{} },
+			func() *corev1.ConfigMapList { return &corev1.ConfigMapList{} },
+			func(dst, src *corev1.ConfigMapList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.ConfigMapList) []*corev1.ConfigMap { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.ConfigMapList, items []*corev1.ConfigMap) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.ConfigMap), err
 }
diff --git a/kubernetes/typed/core/v1/fake/core_client.go b/kubernetes/typed/core/v1/fake/core_client.go
index 53a8d696c..a0026c747 100644
--- a/kubernetes/typed/core/v1/fake/core_client.go
+++ b/kubernetes/typed/core/v1/fake/core_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpcorev1.CoreV1ClusterInterface = (*CoreV1ClusterClient)(nil)
@@ -44,142 +40,142 @@ func (c *CoreV1ClusterClient) Cluster(clusterPath logicalcluster.Path) corev1.Co
 	return &CoreV1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *CoreV1ClusterClient) PersistentVolumes() kcpcorev1.PersistentVolumeClusterInterface {
-	return &persistentVolumesClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) ComponentStatuses() kcpcorev1.ComponentStatusClusterInterface {
+	return newFakeComponentStatusClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) PersistentVolumeClaims() kcpcorev1.PersistentVolumeClaimClusterInterface {
-	return &persistentVolumeClaimsClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) ConfigMaps() kcpcorev1.ConfigMapClusterInterface {
+	return newFakeConfigMapClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) Pods() kcpcorev1.PodClusterInterface {
-	return &podsClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) Endpoints() kcpcorev1.EndpointsClusterInterface {
+	return newFakeEndpointsClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) PodTemplates() kcpcorev1.PodTemplateClusterInterface {
-	return &podTemplatesClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) Events() kcpcorev1.EventClusterInterface {
+	return newFakeEventClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) ReplicationControllers() kcpcorev1.ReplicationControllerClusterInterface {
-	return &replicationControllersClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) LimitRanges() kcpcorev1.LimitRangeClusterInterface {
+	return newFakeLimitRangeClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) Services() kcpcorev1.ServiceClusterInterface {
-	return &servicesClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) Namespaces() kcpcorev1.NamespaceClusterInterface {
+	return newFakeNamespaceClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) ServiceAccounts() kcpcorev1.ServiceAccountClusterInterface {
-	return &serviceAccountsClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) Nodes() kcpcorev1.NodeClusterInterface {
+	return newFakeNodeClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) Endpoints() kcpcorev1.EndpointsClusterInterface {
-	return &endpointsClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) PersistentVolumes() kcpcorev1.PersistentVolumeClusterInterface {
+	return newFakePersistentVolumeClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) Nodes() kcpcorev1.NodeClusterInterface {
-	return &nodesClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) PersistentVolumeClaims() kcpcorev1.PersistentVolumeClaimClusterInterface {
+	return newFakePersistentVolumeClaimClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) Namespaces() kcpcorev1.NamespaceClusterInterface {
-	return &namespacesClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) Pods() kcpcorev1.PodClusterInterface {
+	return newFakePodClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) Events() kcpcorev1.EventClusterInterface {
-	return &eventsClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) PodTemplates() kcpcorev1.PodTemplateClusterInterface {
+	return newFakePodTemplateClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) LimitRanges() kcpcorev1.LimitRangeClusterInterface {
-	return &limitRangesClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) ReplicationControllers() kcpcorev1.ReplicationControllerClusterInterface {
+	return newFakeReplicationControllerClusterClient(c)
 }
 
 func (c *CoreV1ClusterClient) ResourceQuotas() kcpcorev1.ResourceQuotaClusterInterface {
-	return &resourceQuotasClusterClient{Fake: c.Fake}
+	return newFakeResourceQuotaClusterClient(c)
 }
 
 func (c *CoreV1ClusterClient) Secrets() kcpcorev1.SecretClusterInterface {
-	return &secretsClusterClient{Fake: c.Fake}
+	return newFakeSecretClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) ConfigMaps() kcpcorev1.ConfigMapClusterInterface {
-	return &configMapsClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) Services() kcpcorev1.ServiceClusterInterface {
+	return newFakeServiceClusterClient(c)
 }
 
-func (c *CoreV1ClusterClient) ComponentStatuses() kcpcorev1.ComponentStatusClusterInterface {
-	return &componentStatusesClusterClient{Fake: c.Fake}
+func (c *CoreV1ClusterClient) ServiceAccounts() kcpcorev1.ServiceAccountClusterInterface {
+	return newFakeServiceAccountClusterClient(c)
 }
 
-var _ corev1.CoreV1Interface = (*CoreV1Client)(nil)
-
 type CoreV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *CoreV1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
-}
-
-func (c *CoreV1Client) PersistentVolumes() corev1.PersistentVolumeInterface {
-	return &persistentVolumesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *CoreV1Client) ComponentStatuses() corev1.ComponentStatusInterface {
+	return newFakeComponentStatusClient(c.Fake, c.ClusterPath)
 }
 
-func (c *CoreV1Client) PersistentVolumeClaims(namespace string) corev1.PersistentVolumeClaimInterface {
-	return &persistentVolumeClaimsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *CoreV1Client) ConfigMaps(namespace string) corev1.ConfigMapInterface {
+	return newFakeConfigMapClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *CoreV1Client) Pods(namespace string) corev1.PodInterface {
-	return &podsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *CoreV1Client) Endpoints(namespace string) corev1.EndpointsInterface {
+	return newFakeEndpointsClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *CoreV1Client) PodTemplates(namespace string) corev1.PodTemplateInterface {
-	return &podTemplatesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *CoreV1Client) Events(namespace string) corev1.EventInterface {
+	return newFakeEventClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *CoreV1Client) ReplicationControllers(namespace string) corev1.ReplicationControllerInterface {
-	return &replicationControllersClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *CoreV1Client) LimitRanges(namespace string) corev1.LimitRangeInterface {
+	return newFakeLimitRangeClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *CoreV1Client) Services(namespace string) corev1.ServiceInterface {
-	return &servicesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *CoreV1Client) Namespaces() corev1.NamespaceInterface {
+	return newFakeNamespaceClient(c.Fake, c.ClusterPath)
 }
 
-func (c *CoreV1Client) ServiceAccounts(namespace string) corev1.ServiceAccountInterface {
-	return &serviceAccountsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *CoreV1Client) Nodes() corev1.NodeInterface {
+	return newFakeNodeClient(c.Fake, c.ClusterPath)
 }
 
-func (c *CoreV1Client) Endpoints(namespace string) corev1.EndpointsInterface {
-	return &endpointsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *CoreV1Client) PersistentVolumes() corev1.PersistentVolumeInterface {
+	return newFakePersistentVolumeClient(c.Fake, c.ClusterPath)
 }
 
-func (c *CoreV1Client) Nodes() corev1.NodeInterface {
-	return &nodesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *CoreV1Client) PersistentVolumeClaims(namespace string) corev1.PersistentVolumeClaimInterface {
+	return newFakePersistentVolumeClaimClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *CoreV1Client) Namespaces() corev1.NamespaceInterface {
-	return &namespacesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *CoreV1Client) Pods(namespace string) corev1.PodInterface {
+	return newFakePodClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *CoreV1Client) Events(namespace string) corev1.EventInterface {
-	return &eventsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *CoreV1Client) PodTemplates(namespace string) corev1.PodTemplateInterface {
+	return newFakePodTemplateClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *CoreV1Client) LimitRanges(namespace string) corev1.LimitRangeInterface {
-	return &limitRangesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *CoreV1Client) ReplicationControllers(namespace string) corev1.ReplicationControllerInterface {
+	return newFakeReplicationControllerClient(c.Fake, namespace, c.ClusterPath)
 }
 
 func (c *CoreV1Client) ResourceQuotas(namespace string) corev1.ResourceQuotaInterface {
-	return &resourceQuotasClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+	return newFakeResourceQuotaClient(c.Fake, namespace, c.ClusterPath)
 }
 
 func (c *CoreV1Client) Secrets(namespace string) corev1.SecretInterface {
-	return &secretsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+	return newFakeSecretClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *CoreV1Client) ConfigMaps(namespace string) corev1.ConfigMapInterface {
-	return &configMapsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *CoreV1Client) Services(namespace string) corev1.ServiceInterface {
+	return newFakeServiceClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *CoreV1Client) ComponentStatuses() corev1.ComponentStatusInterface {
-	return &componentStatusesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *CoreV1Client) ServiceAccounts(namespace string) corev1.ServiceAccountInterface {
+	return newFakeServiceAccountClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *CoreV1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/core/v1/fake/doc.go b/kubernetes/typed/core/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/core/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/core/v1/fake/endpoints.go b/kubernetes/typed/core/v1/fake/endpoints.go
index 186437d18..71f1fcbc9 100644
--- a/kubernetes/typed/core/v1/fake/endpoints.go
+++ b/kubernetes/typed/core/v1/fake/endpoints.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,70 +14,47 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
-	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var endpointsResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "endpoints"}
-var endpointsKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Endpoints"}
-
+// endpointsClusterClient implements EndpointsClusterInterface
 type endpointsClusterClient struct {
-	*kcptesting.Fake
+	*kcpgentype.FakeClusterClientWithList[*corev1.Endpoints, *corev1.EndpointsList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *endpointsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcorev1.EndpointsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &endpointsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Endpoints that match those selectors across all clusters.
-func (c *endpointsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.EndpointsList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(endpointsResource, endpointsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &corev1.EndpointsList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeEndpointsClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.EndpointsClusterInterface {
+	return &endpointsClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.Endpoints, *corev1.EndpointsList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("endpoints"),
+			corev1.SchemeGroupVersion.WithKind("Endpoints"),
+			func() *corev1.Endpoints { return &corev1.Endpoints{} },
+			func() *corev1.EndpointsList { return &corev1.EndpointsList{} },
+			func(dst, src *corev1.EndpointsList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.EndpointsList) []*corev1.Endpoints { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.EndpointsList, items []*corev1.Endpoints) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &corev1.EndpointsList{ListMeta: obj.(*corev1.EndpointsList).ListMeta}
-	for _, item := range obj.(*corev1.EndpointsList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Endpoints across all clusters.
-func (c *endpointsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(endpointsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *endpointsClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcorev1.EndpointsNamespacer {
+	return &endpointsNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
 type endpointsNamespacer struct {
@@ -88,126 +62,34 @@ type endpointsNamespacer struct {
 	ClusterPath logicalcluster.Path
 }
 
-func (n *endpointsNamespacer) Namespace(namespace string) corev1client.EndpointsInterface {
-	return &endpointsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *endpointsNamespacer) Namespace(namespace string) typedcorev1.EndpointsInterface {
+	return newFakeEndpointsClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type endpointsClient struct {
-	*kcptesting.Fake
+// endpointsScopedClient implements EndpointsInterface
+type endpointsScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.Endpoints, *corev1.EndpointsList, *v1.EndpointsApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *endpointsClient) Create(ctx context.Context, endpoints *corev1.Endpoints, opts metav1.CreateOptions) (*corev1.Endpoints, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(endpointsResource, c.ClusterPath, c.Namespace, endpoints), &corev1.Endpoints{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Endpoints), err
-}
-
-func (c *endpointsClient) Update(ctx context.Context, endpoints *corev1.Endpoints, opts metav1.UpdateOptions) (*corev1.Endpoints, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(endpointsResource, c.ClusterPath, c.Namespace, endpoints), &corev1.Endpoints{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Endpoints), err
-}
-
-func (c *endpointsClient) UpdateStatus(ctx context.Context, endpoints *corev1.Endpoints, opts metav1.UpdateOptions) (*corev1.Endpoints, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(endpointsResource, c.ClusterPath, "status", c.Namespace, endpoints), &corev1.Endpoints{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Endpoints), err
-}
-
-func (c *endpointsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(endpointsResource, c.ClusterPath, c.Namespace, name, opts), &corev1.Endpoints{})
-	return err
 }
 
-func (c *endpointsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(endpointsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.EndpointsList{})
-	return err
-}
-
-func (c *endpointsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.Endpoints, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(endpointsResource, c.ClusterPath, c.Namespace, name), &corev1.Endpoints{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Endpoints), err
-}
-
-// List takes label and field selectors, and returns the list of Endpoints that match those selectors.
-func (c *endpointsClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.EndpointsList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(endpointsResource, endpointsKind, c.ClusterPath, c.Namespace, opts), &corev1.EndpointsList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.EndpointsList{ListMeta: obj.(*corev1.EndpointsList).ListMeta}
-	for _, item := range obj.(*corev1.EndpointsList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *endpointsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(endpointsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *endpointsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.Endpoints, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(endpointsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &corev1.Endpoints{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Endpoints), err
-}
-
-func (c *endpointsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.EndpointsApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Endpoints, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(endpointsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &corev1.Endpoints{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Endpoints), err
-}
-
-func (c *endpointsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.EndpointsApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Endpoints, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(endpointsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &corev1.Endpoints{})
-	if obj == nil {
-		return nil, err
+func newFakeEndpointsClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcorev1.EndpointsInterface {
+	return &endpointsScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.Endpoints, *corev1.EndpointsList, *v1.EndpointsApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			corev1.SchemeGroupVersion.WithResource("endpoints"),
+			corev1.SchemeGroupVersion.WithKind("Endpoints"),
+			func() *corev1.Endpoints { return &corev1.Endpoints{} },
+			func() *corev1.EndpointsList { return &corev1.EndpointsList{} },
+			func(dst, src *corev1.EndpointsList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.EndpointsList) []*corev1.Endpoints { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.EndpointsList, items []*corev1.Endpoints) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.Endpoints), err
 }
diff --git a/kubernetes/typed/core/v1/fake/event.go b/kubernetes/typed/core/v1/fake/event.go
index 8fd2daa20..e61aea0c4 100644
--- a/kubernetes/typed/core/v1/fake/event.go
+++ b/kubernetes/typed/core/v1/fake/event.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
-	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var eventsResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "events"}
-var eventsKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Event"}
-
-type eventsClusterClient struct {
-	*kcptesting.Fake
+// eventClusterClient implements EventClusterInterface
+type eventClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.Event, *corev1.EventList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *eventsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcorev1.EventsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &eventsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Events that match those selectors across all clusters.
-func (c *eventsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.EventList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(eventsResource, eventsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &corev1.EventList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeEventClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.EventClusterInterface {
+	return &eventClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.Event, *corev1.EventList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("events"),
+			corev1.SchemeGroupVersion.WithKind("Event"),
+			func() *corev1.Event { return &corev1.Event{} },
+			func() *corev1.EventList { return &corev1.EventList{} },
+			func(dst, src *corev1.EventList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.EventList) []*corev1.Event { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.EventList, items []*corev1.Event) { list.Items = kcpgentype.FromPointerSlice(items) },
+		),
+		fake.Fake,
 	}
-	list := &corev1.EventList{ListMeta: obj.(*corev1.EventList).ListMeta}
-	for _, item := range obj.(*corev1.EventList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Events across all clusters.
-func (c *eventsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(eventsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *eventClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcorev1.EventsNamespacer {
+	return &eventNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type eventsNamespacer struct {
+type eventNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *eventsNamespacer) Namespace(namespace string) corev1client.EventInterface {
-	return &eventsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *eventNamespacer) Namespace(namespace string) typedcorev1.EventInterface {
+	return newFakeEventClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type eventsClient struct {
-	*kcptesting.Fake
+// eventScopedClient implements EventInterface
+type eventScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.Event, *corev1.EventList, *v1.EventApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *eventsClient) Create(ctx context.Context, event *corev1.Event, opts metav1.CreateOptions) (*corev1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(eventsResource, c.ClusterPath, c.Namespace, event), &corev1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Event), err
-}
-
-func (c *eventsClient) Update(ctx context.Context, event *corev1.Event, opts metav1.UpdateOptions) (*corev1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(eventsResource, c.ClusterPath, c.Namespace, event), &corev1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Event), err
-}
-
-func (c *eventsClient) UpdateStatus(ctx context.Context, event *corev1.Event, opts metav1.UpdateOptions) (*corev1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(eventsResource, c.ClusterPath, "status", c.Namespace, event), &corev1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Event), err
-}
-
-func (c *eventsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(eventsResource, c.ClusterPath, c.Namespace, name, opts), &corev1.Event{})
-	return err
 }
 
-func (c *eventsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(eventsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.EventList{})
-	return err
-}
-
-func (c *eventsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(eventsResource, c.ClusterPath, c.Namespace, name), &corev1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Event), err
-}
-
-// List takes label and field selectors, and returns the list of Events that match those selectors.
-func (c *eventsClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.EventList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(eventsResource, eventsKind, c.ClusterPath, c.Namespace, opts), &corev1.EventList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.EventList{ListMeta: obj.(*corev1.EventList).ListMeta}
-	for _, item := range obj.(*corev1.EventList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *eventsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(eventsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *eventsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(eventsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &corev1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Event), err
-}
-
-func (c *eventsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.EventApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Event, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(eventsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &corev1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Event), err
-}
-
-func (c *eventsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.EventApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Event, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(eventsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &corev1.Event{})
-	if obj == nil {
-		return nil, err
+func newFakeEventClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcorev1.EventInterface {
+	return &eventScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.Event, *corev1.EventList, *v1.EventApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			corev1.SchemeGroupVersion.WithResource("events"),
+			corev1.SchemeGroupVersion.WithKind("Event"),
+			func() *corev1.Event { return &corev1.Event{} },
+			func() *corev1.EventList { return &corev1.EventList{} },
+			func(dst, src *corev1.EventList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.EventList) []*corev1.Event { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.EventList, items []*corev1.Event) { list.Items = kcpgentype.FromPointerSlice(items) },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.Event), err
 }
diff --git a/kubernetes/typed/core/v1/fake/fake_event_expansion.go b/kubernetes/typed/core/v1/fake/fake_event_expansion.go
index 314a0aaf9..44ce0cf20 100644
--- a/kubernetes/typed/core/v1/fake/fake_event_expansion.go
+++ b/kubernetes/typed/core/v1/fake/fake_event_expansion.go
@@ -18,19 +18,28 @@ limitations under the License.
 package fake
 
 import (
-	"k8s.io/api/core/v1"
+	"context"
+
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
+	types "k8s.io/apimachinery/pkg/types"
 
 	core "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
 )
 
-func (c *eventsClient) CreateWithEventNamespace(event *v1.Event) (*v1.Event, error) {
-	action := core.NewRootCreateAction(eventsResource, c.ClusterPath, event)
-	if c.Namespace != "" {
-		action = core.NewCreateAction(eventsResource, c.ClusterPath, c.Namespace, event)
+// Deprecated: use CreateWithEventNamespaceWithContext instead.
+func (c *eventScopedClient) CreateWithEventNamespace(event *v1.Event) (*v1.Event, error) {
+	return c.CreateWithEventNamespaceWithContext(context.Background(), event)
+}
+
+func (c *eventScopedClient) CreateWithEventNamespaceWithContext(_ context.Context, event *v1.Event) (*v1.Event, error) {
+	var action core.CreateActionImpl
+	if c.Namespace() != "" {
+		action = core.NewCreateAction(c.Resource(), c.ClusterPath, c.Namespace(), event)
+	} else {
+		action = core.NewCreateAction(c.Resource(), c.ClusterPath, event.GetNamespace(), event)
 	}
 	obj, err := c.Fake.Invokes(action, event)
 	if obj == nil {
@@ -41,10 +50,19 @@ func (c *eventsClient) CreateWithEventNamespace(event *v1.Event) (*v1.Event, err
 }
 
 // Update replaces an existing event. Returns the copy of the event the server returns, or an error.
-func (c *eventsClient) UpdateWithEventNamespace(event *v1.Event) (*v1.Event, error) {
-	action := core.NewRootUpdateAction(eventsResource, c.ClusterPath, event)
-	if c.Namespace != "" {
-		action = core.NewUpdateAction(eventsResource, c.ClusterPath, c.Namespace, event)
+//
+// Deprecated: use UpdateWithEventNamespaceWithContext instead.
+func (c *eventScopedClient) UpdateWithEventNamespace(event *v1.Event) (*v1.Event, error) {
+	return c.UpdateWithEventNamespaceWithContext(context.Background(), event)
+}
+
+// Update replaces an existing event. Returns the copy of the event the server returns, or an error.
+func (c *eventScopedClient) UpdateWithEventNamespaceWithContext(_ context.Context, event *v1.Event) (*v1.Event, error) {
+	var action core.UpdateActionImpl
+	if c.Namespace() != "" {
+		action = core.NewUpdateAction(c.Resource(), c.ClusterPath, c.Namespace(), event)
+	} else {
+		action = core.NewUpdateAction(c.Resource(), c.ClusterPath, event.GetNamespace(), event)
 	}
 	obj, err := c.Fake.Invokes(action, event)
 	if obj == nil {
@@ -56,12 +74,22 @@ func (c *eventsClient) UpdateWithEventNamespace(event *v1.Event) (*v1.Event, err
 
 // PatchWithEventNamespace patches an existing event. Returns the copy of the event the server returns, or an error.
 // TODO: Should take a PatchType as an argument probably.
-func (c *eventsClient) PatchWithEventNamespace(event *v1.Event, data []byte) (*v1.Event, error) {
+//
+// Deprecated: use PatchWithEventNamespaceWithContext instead.
+func (c *eventScopedClient) PatchWithEventNamespace(event *v1.Event, data []byte) (*v1.Event, error) {
+	return c.PatchWithEventNamespaceWithContext(context.Background(), event, data)
+}
+
+// PatchWithEventNamespaceWithContext patches an existing event. Returns the copy of the event the server returns, or an error.
+// TODO: Should take a PatchType as an argument probably.
+func (c *eventScopedClient) PatchWithEventNamespaceWithContext(_ context.Context, event *v1.Event, data []byte) (*v1.Event, error) {
 	// TODO: Should be configurable to support additional patch strategies.
 	pt := types.StrategicMergePatchType
-	action := core.NewRootPatchAction(eventsResource, c.ClusterPath, event.Name, pt, data)
-	if c.Namespace != "" {
-		action = core.NewPatchAction(eventsResource, c.ClusterPath, c.Namespace, event.Name, pt, data)
+	var action core.PatchActionImpl
+	if c.Namespace() != "" {
+		action = core.NewPatchAction(c.Resource(), c.ClusterPath, c.Namespace(), event.Name, pt, data)
+	} else {
+		action = core.NewPatchAction(c.Resource(), c.ClusterPath, event.GetNamespace(), event.Name, pt, data)
 	}
 	obj, err := c.Fake.Invokes(action, event)
 	if obj == nil {
@@ -72,10 +100,19 @@ func (c *eventsClient) PatchWithEventNamespace(event *v1.Event, data []byte) (*v
 }
 
 // Search returns a list of events matching the specified object.
-func (c *eventsClient) Search(scheme *runtime.Scheme, objOrRef runtime.Object) (*v1.EventList, error) {
-	action := core.NewRootListAction(eventsResource, eventsKind, c.ClusterPath, metav1.ListOptions{})
-	if c.Namespace != "" {
-		action = core.NewListAction(eventsResource, eventsKind, c.ClusterPath, c.Namespace, metav1.ListOptions{})
+//
+// Deprecated: use SearchWithContext instead.
+func (c *eventScopedClient) Search(scheme *runtime.Scheme, objOrRef runtime.Object) (*v1.EventList, error) {
+	return c.SearchWithContext(context.Background(), scheme, objOrRef)
+}
+
+// SearchWithContext returns a list of events matching the specified object.
+func (c *eventScopedClient) SearchWithContext(_ context.Context, scheme *runtime.Scheme, objOrRef runtime.Object) (*v1.EventList, error) {
+	var action core.ListActionImpl
+	if c.Namespace() != "" {
+		action = core.NewListAction(c.Resource(), c.Kind(), c.ClusterPath, c.Namespace(), metav1.ListOptions{})
+	} else {
+		action = core.NewListAction(c.Resource(), c.Kind(), c.ClusterPath, v1.NamespaceDefault, metav1.ListOptions{})
 	}
 	obj, err := c.Fake.Invokes(action, &v1.EventList{})
 	if obj == nil {
@@ -85,12 +122,11 @@ func (c *eventsClient) Search(scheme *runtime.Scheme, objOrRef runtime.Object) (
 	return obj.(*v1.EventList), err
 }
 
-func (c *eventsClient) GetFieldSelector(involvedObjectName, involvedObjectNamespace, involvedObjectKind, involvedObjectUID *string) fields.Selector {
+func (c *eventScopedClient) GetFieldSelector(involvedObjectName, involvedObjectNamespace, involvedObjectKind, involvedObjectUID *string) fields.Selector {
 	action := core.GenericActionImpl{}
 	action.Verb = "get-field-selector"
-	action.Resource = eventsResource
-	action.ClusterPath = c.ClusterPath
+	action.Resource = c.Resource()
 
-	_, _ = c.Fake.Invokes(action, nil)
+	c.Fake.Invokes(action, nil) //nolint:errcheck
 	return fields.Everything()
 }
diff --git a/kubernetes/typed/core/v1/fake/fake_namespace_expansion.go b/kubernetes/typed/core/v1/fake/fake_namespace_expansion.go
index c785a2fc9..4ff14780e 100644
--- a/kubernetes/typed/core/v1/fake/fake_namespace_expansion.go
+++ b/kubernetes/typed/core/v1/fake/fake_namespace_expansion.go
@@ -20,16 +20,16 @@ package fake
 import (
 	"context"
 
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	core "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
 )
 
-func (c *namespacesClient) Finalize(ctx context.Context, namespace *v1.Namespace, opts metav1.UpdateOptions) (*v1.Namespace, error) {
+func (c *namespaceScopedClient) Finalize(ctx context.Context, namespace *v1.Namespace, opts metav1.UpdateOptions) (*v1.Namespace, error) {
 	action := core.CreateActionImpl{}
 	action.Verb = "create"
-	action.Resource = namespacesResource
+	action.Resource = c.Resource()
 	action.Subresource = "finalize"
 	action.Object = namespace
 	action.ClusterPath = c.ClusterPath
diff --git a/kubernetes/typed/core/v1/fake/fake_node_expansion.go b/kubernetes/typed/core/v1/fake/fake_node_expansion.go
index 2dca4d0d2..6af6a4b0a 100644
--- a/kubernetes/typed/core/v1/fake/fake_node_expansion.go
+++ b/kubernetes/typed/core/v1/fake/fake_node_expansion.go
@@ -21,16 +21,17 @@ import (
 	"context"
 
 	v1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/types"
+	types "k8s.io/apimachinery/pkg/types"
 
 	core "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
 )
 
 // TODO: Should take a PatchType as an argument probably.
-func (c *nodesClient) PatchStatus(_ context.Context, nodeName string, data []byte) (*v1.Node, error) {
+func (c *nodeScopedClient) PatchStatus(_ context.Context, nodeName string, data []byte) (*v1.Node, error) {
 	// TODO: Should be configurable to support additional patch strategies.
 	pt := types.StrategicMergePatchType
-	obj, err := c.Fake.Invokes(core.NewRootPatchSubresourceAction(nodesResource, c.ClusterPath, nodeName, pt, data, "status"), &v1.Node{})
+	obj, err := c.Fake.Invokes(
+		core.NewRootPatchSubresourceAction(c.Resource(), c.ClusterPath, nodeName, pt, data, "status"), &v1.Node{})
 	if obj == nil {
 		return nil, err
 	}
diff --git a/kubernetes/typed/core/v1/fake/fake_pod_expansion.go b/kubernetes/typed/core/v1/fake/fake_pod_expansion.go
index e171f1d91..c919d627f 100644
--- a/kubernetes/typed/core/v1/fake/fake_pod_expansion.go
+++ b/kubernetes/typed/core/v1/fake/fake_pod_expansion.go
@@ -35,11 +35,11 @@ import (
 	core "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
 )
 
-func (c *podsClient) Bind(ctx context.Context, binding *v1.Binding, opts metav1.CreateOptions) error {
+func (c *podScopedClient) Bind(ctx context.Context, binding *v1.Binding, opts metav1.CreateOptions) error {
 	action := core.CreateActionImpl{}
 	action.Verb = "create"
 	action.Namespace = binding.Namespace
-	action.Resource = podsResource
+	action.Resource = c.Resource()
 	action.Subresource = "binding"
 	action.Object = binding
 	action.ClusterPath = c.ClusterPath
@@ -48,9 +48,9 @@ func (c *podsClient) Bind(ctx context.Context, binding *v1.Binding, opts metav1.
 	return err
 }
 
-func (c *podsClient) GetBinding(name string) (result *v1.Binding, err error) {
+func (c *podScopedClient) GetBinding(name string) (result *v1.Binding, err error) {
 	obj, err := c.Fake.
-		Invokes(core.NewGetSubresourceAction(podsResource, c.ClusterPath, c.Namespace, "binding", name), &v1.Binding{})
+		Invokes(core.NewGetSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), "binding", name), &v1.Binding{})
 
 	if obj == nil {
 		return nil, err
@@ -58,11 +58,11 @@ func (c *podsClient) GetBinding(name string) (result *v1.Binding, err error) {
 	return obj.(*v1.Binding), err
 }
 
-func (c *podsClient) GetLogs(name string, opts *v1.PodLogOptions) *restclient.Request {
+func (c *podScopedClient) GetLogs(name string, opts *v1.PodLogOptions) *restclient.Request {
 	action := core.GenericActionImpl{}
 	action.Verb = "get"
-	action.Namespace = c.Namespace
-	action.Resource = podsResource
+	action.Namespace = c.Namespace()
+	action.Resource = c.Resource()
 	action.Subresource = "log"
 	action.Value = opts
 	action.ClusterPath = c.ClusterPath
@@ -77,21 +77,21 @@ func (c *podsClient) GetLogs(name string, opts *v1.PodLogOptions) *restclient.Re
 			return resp, nil
 		}),
 		NegotiatedSerializer: scheme.Codecs.WithoutConversion(),
-		GroupVersion:         podsKind.GroupVersion(),
-		VersionedAPIPath:     fmt.Sprintf("/api/v1/namespaces/%s/pods/%s/log", c.Namespace, name),
+		GroupVersion:         c.Kind().GroupVersion(),
+		VersionedAPIPath:     fmt.Sprintf("/api/v1/namespaces/%s/pods/%s/log", c.Namespace(), name),
 	}
 	return fakeClient.Request()
 }
 
-func (c *podsClient) Evict(ctx context.Context, eviction *policyv1beta1.Eviction) error {
+func (c *podScopedClient) Evict(ctx context.Context, eviction *policyv1beta1.Eviction) error {
 	return c.EvictV1beta1(ctx, eviction)
 }
 
-func (c *podsClient) EvictV1(ctx context.Context, eviction *policyv1.Eviction) error {
+func (c *podScopedClient) EvictV1(ctx context.Context, eviction *policyv1.Eviction) error {
 	action := core.CreateActionImpl{}
 	action.Verb = "create"
-	action.Namespace = c.Namespace
-	action.Resource = podsResource
+	action.Namespace = c.Namespace()
+	action.Resource = c.Resource()
 	action.Subresource = "eviction"
 	action.Object = eviction
 	action.ClusterPath = c.ClusterPath
@@ -100,11 +100,11 @@ func (c *podsClient) EvictV1(ctx context.Context, eviction *policyv1.Eviction) e
 	return err
 }
 
-func (c *podsClient) EvictV1beta1(ctx context.Context, eviction *policyv1beta1.Eviction) error {
+func (c *podScopedClient) EvictV1beta1(ctx context.Context, eviction *policyv1beta1.Eviction) error {
 	action := core.CreateActionImpl{}
 	action.Verb = "create"
-	action.Namespace = c.Namespace
-	action.Resource = podsResource
+	action.Namespace = c.Namespace()
+	action.Resource = c.Resource()
 	action.Subresource = "eviction"
 	action.Object = eviction
 	action.ClusterPath = c.ClusterPath
@@ -113,6 +113,6 @@ func (c *podsClient) EvictV1beta1(ctx context.Context, eviction *policyv1beta1.E
 	return err
 }
 
-func (c *podsClient) ProxyGet(scheme, name, port, path string, params map[string]string) restclient.ResponseWrapper {
-	return c.Fake.InvokesProxy(core.NewProxyGetAction(podsResource, c.ClusterPath, c.Namespace, scheme, name, port, path, params))
+func (c *podScopedClient) ProxyGet(scheme, name, port, path string, params map[string]string) restclient.ResponseWrapper {
+	return c.Fake.InvokesProxy(core.NewProxyGetAction(c.Resource(), c.ClusterPath, c.Namespace(), scheme, name, port, path, params))
 }
diff --git a/kubernetes/typed/core/v1/fake/fake_service_expansion.go b/kubernetes/typed/core/v1/fake/fake_service_expansion.go
index d59af2eba..856bf6059 100644
--- a/kubernetes/typed/core/v1/fake/fake_service_expansion.go
+++ b/kubernetes/typed/core/v1/fake/fake_service_expansion.go
@@ -23,6 +23,6 @@ import (
 	core "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
 )
 
-func (c *servicesClient) ProxyGet(scheme, name, port, path string, params map[string]string) restclient.ResponseWrapper {
-	return c.Fake.InvokesProxy(core.NewProxyGetAction(servicesResource, c.ClusterPath, c.Namespace, scheme, name, port, path, params))
+func (c *serviceScopedClient) ProxyGet(scheme, name, port, path string, params map[string]string) restclient.ResponseWrapper {
+	return c.Fake.InvokesProxy(core.NewProxyGetAction(c.Resource(), c.ClusterPath, c.Namespace(), scheme, name, port, path, params))
 }
diff --git a/kubernetes/typed/core/v1/fake/limitrange.go b/kubernetes/typed/core/v1/fake/limitrange.go
index b1b3feb0b..c6132e7b0 100644
--- a/kubernetes/typed/core/v1/fake/limitrange.go
+++ b/kubernetes/typed/core/v1/fake/limitrange.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,82 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
-	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var limitRangesResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "limitranges"}
-var limitRangesKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "LimitRange"}
-
-type limitRangesClusterClient struct {
-	*kcptesting.Fake
+// limitRangeClusterClient implements LimitRangeClusterInterface
+type limitRangeClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.LimitRange, *corev1.LimitRangeList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *limitRangesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcorev1.LimitRangesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &limitRangesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of LimitRanges that match those selectors across all clusters.
-func (c *limitRangesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.LimitRangeList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(limitRangesResource, limitRangesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &corev1.LimitRangeList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeLimitRangeClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.LimitRangeClusterInterface {
+	return &limitRangeClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.LimitRange, *corev1.LimitRangeList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("limitranges"),
+			corev1.SchemeGroupVersion.WithKind("LimitRange"),
+			func() *corev1.LimitRange { return &corev1.LimitRange{} },
+			func() *corev1.LimitRangeList { return &corev1.LimitRangeList{} },
+			func(dst, src *corev1.LimitRangeList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.LimitRangeList) []*corev1.LimitRange { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.LimitRangeList, items []*corev1.LimitRange) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &corev1.LimitRangeList{ListMeta: obj.(*corev1.LimitRangeList).ListMeta}
-	for _, item := range obj.(*corev1.LimitRangeList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested LimitRanges across all clusters.
-func (c *limitRangesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(limitRangesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *limitRangeClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcorev1.LimitRangesNamespacer {
+	return &limitRangeNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type limitRangesNamespacer struct {
+type limitRangeNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *limitRangesNamespacer) Namespace(namespace string) corev1client.LimitRangeInterface {
-	return &limitRangesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *limitRangeNamespacer) Namespace(namespace string) typedcorev1.LimitRangeInterface {
+	return newFakeLimitRangeClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type limitRangesClient struct {
-	*kcptesting.Fake
+// limitRangeScopedClient implements LimitRangeInterface
+type limitRangeScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.LimitRange, *corev1.LimitRangeList, *v1.LimitRangeApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *limitRangesClient) Create(ctx context.Context, limitRange *corev1.LimitRange, opts metav1.CreateOptions) (*corev1.LimitRange, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(limitRangesResource, c.ClusterPath, c.Namespace, limitRange), &corev1.LimitRange{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.LimitRange), err
-}
-
-func (c *limitRangesClient) Update(ctx context.Context, limitRange *corev1.LimitRange, opts metav1.UpdateOptions) (*corev1.LimitRange, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(limitRangesResource, c.ClusterPath, c.Namespace, limitRange), &corev1.LimitRange{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.LimitRange), err
-}
-
-func (c *limitRangesClient) UpdateStatus(ctx context.Context, limitRange *corev1.LimitRange, opts metav1.UpdateOptions) (*corev1.LimitRange, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(limitRangesResource, c.ClusterPath, "status", c.Namespace, limitRange), &corev1.LimitRange{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.LimitRange), err
-}
-
-func (c *limitRangesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(limitRangesResource, c.ClusterPath, c.Namespace, name, opts), &corev1.LimitRange{})
-	return err
 }
 
-func (c *limitRangesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(limitRangesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.LimitRangeList{})
-	return err
-}
-
-func (c *limitRangesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.LimitRange, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(limitRangesResource, c.ClusterPath, c.Namespace, name), &corev1.LimitRange{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.LimitRange), err
-}
-
-// List takes label and field selectors, and returns the list of LimitRanges that match those selectors.
-func (c *limitRangesClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.LimitRangeList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(limitRangesResource, limitRangesKind, c.ClusterPath, c.Namespace, opts), &corev1.LimitRangeList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.LimitRangeList{ListMeta: obj.(*corev1.LimitRangeList).ListMeta}
-	for _, item := range obj.(*corev1.LimitRangeList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *limitRangesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(limitRangesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *limitRangesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.LimitRange, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(limitRangesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &corev1.LimitRange{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.LimitRange), err
-}
-
-func (c *limitRangesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.LimitRangeApplyConfiguration, opts metav1.ApplyOptions) (*corev1.LimitRange, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(limitRangesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &corev1.LimitRange{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.LimitRange), err
-}
-
-func (c *limitRangesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.LimitRangeApplyConfiguration, opts metav1.ApplyOptions) (*corev1.LimitRange, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(limitRangesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &corev1.LimitRange{})
-	if obj == nil {
-		return nil, err
+func newFakeLimitRangeClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcorev1.LimitRangeInterface {
+	return &limitRangeScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.LimitRange, *corev1.LimitRangeList, *v1.LimitRangeApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			corev1.SchemeGroupVersion.WithResource("limitranges"),
+			corev1.SchemeGroupVersion.WithKind("LimitRange"),
+			func() *corev1.LimitRange { return &corev1.LimitRange{} },
+			func() *corev1.LimitRangeList { return &corev1.LimitRangeList{} },
+			func(dst, src *corev1.LimitRangeList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.LimitRangeList) []*corev1.LimitRange { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.LimitRangeList, items []*corev1.LimitRange) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.LimitRange), err
 }
diff --git a/kubernetes/typed/core/v1/fake/namespace.go b/kubernetes/typed/core/v1/fake/namespace.go
index 333083c2e..b8b327d6e 100644
--- a/kubernetes/typed/core/v1/fake/namespace.go
+++ b/kubernetes/typed/core/v1/fake/namespace.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,179 +14,73 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var namespacesResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "namespaces"}
-var namespacesKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Namespace"}
-
-type namespacesClusterClient struct {
-	*kcptesting.Fake
+// namespaceClusterClient implements NamespaceClusterInterface
+type namespaceClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.Namespace, *corev1.NamespaceList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *namespacesClusterClient) Cluster(clusterPath logicalcluster.Path) corev1client.NamespaceInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &namespacesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Namespaces that match those selectors across all clusters.
-func (c *namespacesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.NamespaceList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(namespacesResource, namespacesKind, logicalcluster.Wildcard, opts), &corev1.NamespaceList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeNamespaceClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.NamespaceClusterInterface {
+	return &namespaceClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.Namespace, *corev1.NamespaceList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("namespaces"),
+			corev1.SchemeGroupVersion.WithKind("Namespace"),
+			func() *corev1.Namespace { return &corev1.Namespace{} },
+			func() *corev1.NamespaceList { return &corev1.NamespaceList{} },
+			func(dst, src *corev1.NamespaceList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.NamespaceList) []*corev1.Namespace { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.NamespaceList, items []*corev1.Namespace) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &corev1.NamespaceList{ListMeta: obj.(*corev1.NamespaceList).ListMeta}
-	for _, item := range obj.(*corev1.NamespaceList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Namespaces across all clusters.
-func (c *namespacesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(namespacesResource, logicalcluster.Wildcard, opts))
+func (c *namespaceClusterClient) Cluster(cluster logicalcluster.Path) typedcorev1.NamespaceInterface {
+	return newFakeNamespaceClient(c.Fake, cluster)
 }
 
-type namespacesClient struct {
-	*kcptesting.Fake
+// namespaceScopedClient implements NamespaceInterface
+type namespaceScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.Namespace, *corev1.NamespaceList, *v1.NamespaceApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *namespacesClient) Create(ctx context.Context, namespace *corev1.Namespace, opts metav1.CreateOptions) (*corev1.Namespace, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(namespacesResource, c.ClusterPath, namespace), &corev1.Namespace{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Namespace), err
-}
-
-func (c *namespacesClient) Update(ctx context.Context, namespace *corev1.Namespace, opts metav1.UpdateOptions) (*corev1.Namespace, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(namespacesResource, c.ClusterPath, namespace), &corev1.Namespace{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Namespace), err
-}
-
-func (c *namespacesClient) UpdateStatus(ctx context.Context, namespace *corev1.Namespace, opts metav1.UpdateOptions) (*corev1.Namespace, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(namespacesResource, c.ClusterPath, "status", namespace), &corev1.Namespace{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Namespace), err
-}
-
-func (c *namespacesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(namespacesResource, c.ClusterPath, name, opts), &corev1.Namespace{})
-	return err
-}
-
-func (c *namespacesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.Namespace, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(namespacesResource, c.ClusterPath, name), &corev1.Namespace{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Namespace), err
-}
-
-// List takes label and field selectors, and returns the list of Namespaces that match those selectors.
-func (c *namespacesClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.NamespaceList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(namespacesResource, namespacesKind, c.ClusterPath, opts), &corev1.NamespaceList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.NamespaceList{ListMeta: obj.(*corev1.NamespaceList).ListMeta}
-	for _, item := range obj.(*corev1.NamespaceList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *namespacesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(namespacesResource, c.ClusterPath, opts))
-}
-
-func (c *namespacesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.Namespace, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(namespacesResource, c.ClusterPath, name, pt, data, subresources...), &corev1.Namespace{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Namespace), err
-}
-
-func (c *namespacesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.NamespaceApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Namespace, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(namespacesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &corev1.Namespace{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Namespace), err
-}
-
-func (c *namespacesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.NamespaceApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Namespace, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(namespacesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &corev1.Namespace{})
-	if obj == nil {
-		return nil, err
+func newFakeNamespaceClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedcorev1.NamespaceInterface {
+	return &namespaceScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.Namespace, *corev1.NamespaceList, *v1.NamespaceApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			corev1.SchemeGroupVersion.WithResource("namespaces"),
+			corev1.SchemeGroupVersion.WithKind("Namespace"),
+			func() *corev1.Namespace { return &corev1.Namespace{} },
+			func() *corev1.NamespaceList { return &corev1.NamespaceList{} },
+			func(dst, src *corev1.NamespaceList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.NamespaceList) []*corev1.Namespace { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.NamespaceList, items []*corev1.Namespace) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.Namespace), err
 }
diff --git a/kubernetes/typed/core/v1/fake/node.go b/kubernetes/typed/core/v1/fake/node.go
index 00372a06c..c221b51b4 100644
--- a/kubernetes/typed/core/v1/fake/node.go
+++ b/kubernetes/typed/core/v1/fake/node.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,69 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var nodesResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "nodes"}
-var nodesKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Node"}
-
-type nodesClusterClient struct {
-	*kcptesting.Fake
+// nodeClusterClient implements NodeClusterInterface
+type nodeClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.Node, *corev1.NodeList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *nodesClusterClient) Cluster(clusterPath logicalcluster.Path) corev1client.NodeInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &nodesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Nodes that match those selectors across all clusters.
-func (c *nodesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.NodeList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(nodesResource, nodesKind, logicalcluster.Wildcard, opts), &corev1.NodeList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.NodeList{ListMeta: obj.(*corev1.NodeList).ListMeta}
-	for _, item := range obj.(*corev1.NodeList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeNodeClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.NodeClusterInterface {
+	return &nodeClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.Node, *corev1.NodeList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("nodes"),
+			corev1.SchemeGroupVersion.WithKind("Node"),
+			func() *corev1.Node { return &corev1.Node{} },
+			func() *corev1.NodeList { return &corev1.NodeList{} },
+			func(dst, src *corev1.NodeList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.NodeList) []*corev1.Node { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.NodeList, items []*corev1.Node) { list.Items = kcpgentype.FromPointerSlice(items) },
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Nodes across all clusters.
-func (c *nodesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(nodesResource, logicalcluster.Wildcard, opts))
+func (c *nodeClusterClient) Cluster(cluster logicalcluster.Path) typedcorev1.NodeInterface {
+	return newFakeNodeClient(c.Fake, cluster)
 }
 
-type nodesClient struct {
-	*kcptesting.Fake
+// nodeScopedClient implements NodeInterface
+type nodeScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.Node, *corev1.NodeList, *v1.NodeApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *nodesClient) Create(ctx context.Context, node *corev1.Node, opts metav1.CreateOptions) (*corev1.Node, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(nodesResource, c.ClusterPath, node), &corev1.Node{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Node), err
-}
-
-func (c *nodesClient) Update(ctx context.Context, node *corev1.Node, opts metav1.UpdateOptions) (*corev1.Node, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(nodesResource, c.ClusterPath, node), &corev1.Node{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Node), err
-}
-
-func (c *nodesClient) UpdateStatus(ctx context.Context, node *corev1.Node, opts metav1.UpdateOptions) (*corev1.Node, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(nodesResource, c.ClusterPath, "status", node), &corev1.Node{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Node), err
-}
-
-func (c *nodesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(nodesResource, c.ClusterPath, name, opts), &corev1.Node{})
-	return err
-}
-
-func (c *nodesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(nodesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.NodeList{})
-	return err
-}
-
-func (c *nodesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.Node, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(nodesResource, c.ClusterPath, name), &corev1.Node{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Node), err
-}
-
-// List takes label and field selectors, and returns the list of Nodes that match those selectors.
-func (c *nodesClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.NodeList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(nodesResource, nodesKind, c.ClusterPath, opts), &corev1.NodeList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.NodeList{ListMeta: obj.(*corev1.NodeList).ListMeta}
-	for _, item := range obj.(*corev1.NodeList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *nodesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(nodesResource, c.ClusterPath, opts))
-}
-
-func (c *nodesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.Node, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(nodesResource, c.ClusterPath, name, pt, data, subresources...), &corev1.Node{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Node), err
-}
-
-func (c *nodesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.NodeApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Node, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(nodesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &corev1.Node{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Node), err
-}
-
-func (c *nodesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.NodeApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Node, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(nodesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &corev1.Node{})
-	if obj == nil {
-		return nil, err
+func newFakeNodeClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedcorev1.NodeInterface {
+	return &nodeScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.Node, *corev1.NodeList, *v1.NodeApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			corev1.SchemeGroupVersion.WithResource("nodes"),
+			corev1.SchemeGroupVersion.WithKind("Node"),
+			func() *corev1.Node { return &corev1.Node{} },
+			func() *corev1.NodeList { return &corev1.NodeList{} },
+			func(dst, src *corev1.NodeList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.NodeList) []*corev1.Node { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.NodeList, items []*corev1.Node) { list.Items = kcpgentype.FromPointerSlice(items) },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.Node), err
 }
diff --git a/kubernetes/typed/core/v1/fake/persistentvolume.go b/kubernetes/typed/core/v1/fake/persistentvolume.go
index 89a24ba5c..f0e7cf498 100644
--- a/kubernetes/typed/core/v1/fake/persistentvolume.go
+++ b/kubernetes/typed/core/v1/fake/persistentvolume.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var persistentVolumesResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "persistentvolumes"}
-var persistentVolumesKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "PersistentVolume"}
-
-type persistentVolumesClusterClient struct {
-	*kcptesting.Fake
+// persistentVolumeClusterClient implements PersistentVolumeClusterInterface
+type persistentVolumeClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.PersistentVolume, *corev1.PersistentVolumeList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *persistentVolumesClusterClient) Cluster(clusterPath logicalcluster.Path) corev1client.PersistentVolumeInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &persistentVolumesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PersistentVolumes that match those selectors across all clusters.
-func (c *persistentVolumesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.PersistentVolumeList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(persistentVolumesResource, persistentVolumesKind, logicalcluster.Wildcard, opts), &corev1.PersistentVolumeList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.PersistentVolumeList{ListMeta: obj.(*corev1.PersistentVolumeList).ListMeta}
-	for _, item := range obj.(*corev1.PersistentVolumeList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakePersistentVolumeClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.PersistentVolumeClusterInterface {
+	return &persistentVolumeClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.PersistentVolume, *corev1.PersistentVolumeList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("persistentvolumes"),
+			corev1.SchemeGroupVersion.WithKind("PersistentVolume"),
+			func() *corev1.PersistentVolume { return &corev1.PersistentVolume{} },
+			func() *corev1.PersistentVolumeList { return &corev1.PersistentVolumeList{} },
+			func(dst, src *corev1.PersistentVolumeList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.PersistentVolumeList) []*corev1.PersistentVolume {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *corev1.PersistentVolumeList, items []*corev1.PersistentVolume) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested PersistentVolumes across all clusters.
-func (c *persistentVolumesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(persistentVolumesResource, logicalcluster.Wildcard, opts))
+func (c *persistentVolumeClusterClient) Cluster(cluster logicalcluster.Path) typedcorev1.PersistentVolumeInterface {
+	return newFakePersistentVolumeClient(c.Fake, cluster)
 }
 
-type persistentVolumesClient struct {
-	*kcptesting.Fake
+// persistentVolumeScopedClient implements PersistentVolumeInterface
+type persistentVolumeScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.PersistentVolume, *corev1.PersistentVolumeList, *v1.PersistentVolumeApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *persistentVolumesClient) Create(ctx context.Context, persistentVolume *corev1.PersistentVolume, opts metav1.CreateOptions) (*corev1.PersistentVolume, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(persistentVolumesResource, c.ClusterPath, persistentVolume), &corev1.PersistentVolume{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PersistentVolume), err
-}
-
-func (c *persistentVolumesClient) Update(ctx context.Context, persistentVolume *corev1.PersistentVolume, opts metav1.UpdateOptions) (*corev1.PersistentVolume, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(persistentVolumesResource, c.ClusterPath, persistentVolume), &corev1.PersistentVolume{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PersistentVolume), err
-}
-
-func (c *persistentVolumesClient) UpdateStatus(ctx context.Context, persistentVolume *corev1.PersistentVolume, opts metav1.UpdateOptions) (*corev1.PersistentVolume, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(persistentVolumesResource, c.ClusterPath, "status", persistentVolume), &corev1.PersistentVolume{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PersistentVolume), err
-}
-
-func (c *persistentVolumesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(persistentVolumesResource, c.ClusterPath, name, opts), &corev1.PersistentVolume{})
-	return err
-}
-
-func (c *persistentVolumesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(persistentVolumesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.PersistentVolumeList{})
-	return err
-}
-
-func (c *persistentVolumesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.PersistentVolume, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(persistentVolumesResource, c.ClusterPath, name), &corev1.PersistentVolume{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PersistentVolume), err
-}
-
-// List takes label and field selectors, and returns the list of PersistentVolumes that match those selectors.
-func (c *persistentVolumesClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.PersistentVolumeList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(persistentVolumesResource, persistentVolumesKind, c.ClusterPath, opts), &corev1.PersistentVolumeList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.PersistentVolumeList{ListMeta: obj.(*corev1.PersistentVolumeList).ListMeta}
-	for _, item := range obj.(*corev1.PersistentVolumeList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *persistentVolumesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(persistentVolumesResource, c.ClusterPath, opts))
-}
-
-func (c *persistentVolumesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.PersistentVolume, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(persistentVolumesResource, c.ClusterPath, name, pt, data, subresources...), &corev1.PersistentVolume{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PersistentVolume), err
-}
-
-func (c *persistentVolumesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.PersistentVolumeApplyConfiguration, opts metav1.ApplyOptions) (*corev1.PersistentVolume, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(persistentVolumesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &corev1.PersistentVolume{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PersistentVolume), err
-}
-
-func (c *persistentVolumesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.PersistentVolumeApplyConfiguration, opts metav1.ApplyOptions) (*corev1.PersistentVolume, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(persistentVolumesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &corev1.PersistentVolume{})
-	if obj == nil {
-		return nil, err
+func newFakePersistentVolumeClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedcorev1.PersistentVolumeInterface {
+	return &persistentVolumeScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.PersistentVolume, *corev1.PersistentVolumeList, *v1.PersistentVolumeApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			corev1.SchemeGroupVersion.WithResource("persistentvolumes"),
+			corev1.SchemeGroupVersion.WithKind("PersistentVolume"),
+			func() *corev1.PersistentVolume { return &corev1.PersistentVolume{} },
+			func() *corev1.PersistentVolumeList { return &corev1.PersistentVolumeList{} },
+			func(dst, src *corev1.PersistentVolumeList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.PersistentVolumeList) []*corev1.PersistentVolume {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *corev1.PersistentVolumeList, items []*corev1.PersistentVolume) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.PersistentVolume), err
 }
diff --git a/kubernetes/typed/core/v1/fake/persistentvolumeclaim.go b/kubernetes/typed/core/v1/fake/persistentvolumeclaim.go
index 27bef8fda..4a3a957b7 100644
--- a/kubernetes/typed/core/v1/fake/persistentvolumeclaim.go
+++ b/kubernetes/typed/core/v1/fake/persistentvolumeclaim.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
-	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var persistentVolumeClaimsResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "persistentvolumeclaims"}
-var persistentVolumeClaimsKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "PersistentVolumeClaim"}
-
-type persistentVolumeClaimsClusterClient struct {
-	*kcptesting.Fake
+// persistentVolumeClaimClusterClient implements PersistentVolumeClaimClusterInterface
+type persistentVolumeClaimClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.PersistentVolumeClaim, *corev1.PersistentVolumeClaimList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *persistentVolumeClaimsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcorev1.PersistentVolumeClaimsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &persistentVolumeClaimsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PersistentVolumeClaims that match those selectors across all clusters.
-func (c *persistentVolumeClaimsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.PersistentVolumeClaimList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(persistentVolumeClaimsResource, persistentVolumeClaimsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &corev1.PersistentVolumeClaimList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakePersistentVolumeClaimClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.PersistentVolumeClaimClusterInterface {
+	return &persistentVolumeClaimClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.PersistentVolumeClaim, *corev1.PersistentVolumeClaimList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("persistentvolumeclaims"),
+			corev1.SchemeGroupVersion.WithKind("PersistentVolumeClaim"),
+			func() *corev1.PersistentVolumeClaim { return &corev1.PersistentVolumeClaim{} },
+			func() *corev1.PersistentVolumeClaimList { return &corev1.PersistentVolumeClaimList{} },
+			func(dst, src *corev1.PersistentVolumeClaimList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.PersistentVolumeClaimList) []*corev1.PersistentVolumeClaim {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *corev1.PersistentVolumeClaimList, items []*corev1.PersistentVolumeClaim) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &corev1.PersistentVolumeClaimList{ListMeta: obj.(*corev1.PersistentVolumeClaimList).ListMeta}
-	for _, item := range obj.(*corev1.PersistentVolumeClaimList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested PersistentVolumeClaims across all clusters.
-func (c *persistentVolumeClaimsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(persistentVolumeClaimsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *persistentVolumeClaimClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcorev1.PersistentVolumeClaimsNamespacer {
+	return &persistentVolumeClaimNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type persistentVolumeClaimsNamespacer struct {
+type persistentVolumeClaimNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *persistentVolumeClaimsNamespacer) Namespace(namespace string) corev1client.PersistentVolumeClaimInterface {
-	return &persistentVolumeClaimsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *persistentVolumeClaimNamespacer) Namespace(namespace string) typedcorev1.PersistentVolumeClaimInterface {
+	return newFakePersistentVolumeClaimClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type persistentVolumeClaimsClient struct {
-	*kcptesting.Fake
+// persistentVolumeClaimScopedClient implements PersistentVolumeClaimInterface
+type persistentVolumeClaimScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.PersistentVolumeClaim, *corev1.PersistentVolumeClaimList, *v1.PersistentVolumeClaimApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *persistentVolumeClaimsClient) Create(ctx context.Context, persistentVolumeClaim *corev1.PersistentVolumeClaim, opts metav1.CreateOptions) (*corev1.PersistentVolumeClaim, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(persistentVolumeClaimsResource, c.ClusterPath, c.Namespace, persistentVolumeClaim), &corev1.PersistentVolumeClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PersistentVolumeClaim), err
-}
-
-func (c *persistentVolumeClaimsClient) Update(ctx context.Context, persistentVolumeClaim *corev1.PersistentVolumeClaim, opts metav1.UpdateOptions) (*corev1.PersistentVolumeClaim, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(persistentVolumeClaimsResource, c.ClusterPath, c.Namespace, persistentVolumeClaim), &corev1.PersistentVolumeClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PersistentVolumeClaim), err
-}
-
-func (c *persistentVolumeClaimsClient) UpdateStatus(ctx context.Context, persistentVolumeClaim *corev1.PersistentVolumeClaim, opts metav1.UpdateOptions) (*corev1.PersistentVolumeClaim, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(persistentVolumeClaimsResource, c.ClusterPath, "status", c.Namespace, persistentVolumeClaim), &corev1.PersistentVolumeClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PersistentVolumeClaim), err
-}
-
-func (c *persistentVolumeClaimsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(persistentVolumeClaimsResource, c.ClusterPath, c.Namespace, name, opts), &corev1.PersistentVolumeClaim{})
-	return err
 }
 
-func (c *persistentVolumeClaimsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(persistentVolumeClaimsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.PersistentVolumeClaimList{})
-	return err
-}
-
-func (c *persistentVolumeClaimsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.PersistentVolumeClaim, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(persistentVolumeClaimsResource, c.ClusterPath, c.Namespace, name), &corev1.PersistentVolumeClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PersistentVolumeClaim), err
-}
-
-// List takes label and field selectors, and returns the list of PersistentVolumeClaims that match those selectors.
-func (c *persistentVolumeClaimsClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.PersistentVolumeClaimList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(persistentVolumeClaimsResource, persistentVolumeClaimsKind, c.ClusterPath, c.Namespace, opts), &corev1.PersistentVolumeClaimList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.PersistentVolumeClaimList{ListMeta: obj.(*corev1.PersistentVolumeClaimList).ListMeta}
-	for _, item := range obj.(*corev1.PersistentVolumeClaimList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *persistentVolumeClaimsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(persistentVolumeClaimsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *persistentVolumeClaimsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.PersistentVolumeClaim, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(persistentVolumeClaimsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &corev1.PersistentVolumeClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PersistentVolumeClaim), err
-}
-
-func (c *persistentVolumeClaimsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.PersistentVolumeClaimApplyConfiguration, opts metav1.ApplyOptions) (*corev1.PersistentVolumeClaim, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(persistentVolumeClaimsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &corev1.PersistentVolumeClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PersistentVolumeClaim), err
-}
-
-func (c *persistentVolumeClaimsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.PersistentVolumeClaimApplyConfiguration, opts metav1.ApplyOptions) (*corev1.PersistentVolumeClaim, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(persistentVolumeClaimsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &corev1.PersistentVolumeClaim{})
-	if obj == nil {
-		return nil, err
+func newFakePersistentVolumeClaimClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcorev1.PersistentVolumeClaimInterface {
+	return &persistentVolumeClaimScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.PersistentVolumeClaim, *corev1.PersistentVolumeClaimList, *v1.PersistentVolumeClaimApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			corev1.SchemeGroupVersion.WithResource("persistentvolumeclaims"),
+			corev1.SchemeGroupVersion.WithKind("PersistentVolumeClaim"),
+			func() *corev1.PersistentVolumeClaim { return &corev1.PersistentVolumeClaim{} },
+			func() *corev1.PersistentVolumeClaimList { return &corev1.PersistentVolumeClaimList{} },
+			func(dst, src *corev1.PersistentVolumeClaimList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.PersistentVolumeClaimList) []*corev1.PersistentVolumeClaim {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *corev1.PersistentVolumeClaimList, items []*corev1.PersistentVolumeClaim) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.PersistentVolumeClaim), err
 }
diff --git a/kubernetes/typed/core/v1/fake/pod.go b/kubernetes/typed/core/v1/fake/pod.go
index ca4ce4f9e..f3a3f7f65 100644
--- a/kubernetes/typed/core/v1/fake/pod.go
+++ b/kubernetes/typed/core/v1/fake/pod.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,205 +14,101 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
-
-	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var podsResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"}
-var podsKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"}
-
-type podsClusterClient struct {
-	*kcptesting.Fake
+// podClusterClient implements PodClusterInterface
+type podClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.Pod, *corev1.PodList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *podsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcorev1.PodsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakePodClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.PodClusterInterface {
+	return &podClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.Pod, *corev1.PodList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("pods"),
+			corev1.SchemeGroupVersion.WithKind("Pod"),
+			func() *corev1.Pod { return &corev1.Pod{} },
+			func() *corev1.PodList { return &corev1.PodList{} },
+			func(dst, src *corev1.PodList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.PodList) []*corev1.Pod { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.PodList, items []*corev1.Pod) { list.Items = kcpgentype.FromPointerSlice(items) },
+		),
+		fake.Fake,
 	}
-
-	return &podsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-// List takes label and field selectors, and returns the list of Pods that match those selectors across all clusters.
-func (c *podsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.PodList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(podsResource, podsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &corev1.PodList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.PodList{ListMeta: obj.(*corev1.PodList).ListMeta}
-	for _, item := range obj.(*corev1.PodList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
+func (c *podClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcorev1.PodsNamespacer {
+	return &podNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-// Watch returns a watch.Interface that watches the requested Pods across all clusters.
-func (c *podsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(podsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
-}
-
-type podsNamespacer struct {
+type podNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *podsNamespacer) Namespace(namespace string) corev1client.PodInterface {
-	return &podsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *podNamespacer) Namespace(namespace string) typedcorev1.PodInterface {
+	return newFakePodClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type podsClient struct {
-	*kcptesting.Fake
+// podScopedClient implements PodInterface
+type podScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.Pod, *corev1.PodList, *v1.PodApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *podsClient) Create(ctx context.Context, pod *corev1.Pod, opts metav1.CreateOptions) (*corev1.Pod, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(podsResource, c.ClusterPath, c.Namespace, pod), &corev1.Pod{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Pod), err
-}
-
-func (c *podsClient) Update(ctx context.Context, pod *corev1.Pod, opts metav1.UpdateOptions) (*corev1.Pod, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(podsResource, c.ClusterPath, c.Namespace, pod), &corev1.Pod{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Pod), err
-}
-
-func (c *podsClient) UpdateStatus(ctx context.Context, pod *corev1.Pod, opts metav1.UpdateOptions) (*corev1.Pod, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(podsResource, c.ClusterPath, "status", c.Namespace, pod), &corev1.Pod{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Pod), err
-}
-
-func (c *podsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(podsResource, c.ClusterPath, c.Namespace, name, opts), &corev1.Pod{})
-	return err
 }
 
-func (c *podsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(podsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.PodList{})
-	return err
-}
-
-func (c *podsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.Pod, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(podsResource, c.ClusterPath, c.Namespace, name), &corev1.Pod{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Pod), err
-}
-
-// List takes label and field selectors, and returns the list of Pods that match those selectors.
-func (c *podsClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.PodList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(podsResource, podsKind, c.ClusterPath, c.Namespace, opts), &corev1.PodList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.PodList{ListMeta: obj.(*corev1.PodList).ListMeta}
-	for _, item := range obj.(*corev1.PodList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *podsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(podsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *podsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.Pod, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &corev1.Pod{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Pod), err
-}
-
-func (c *podsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.PodApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Pod, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &corev1.Pod{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Pod), err
-}
-
-func (c *podsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.PodApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Pod, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &corev1.Pod{})
+func newFakePodClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcorev1.PodInterface {
+	return &podScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.Pod, *corev1.PodList, *v1.PodApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			corev1.SchemeGroupVersion.WithResource("pods"),
+			corev1.SchemeGroupVersion.WithKind("Pod"),
+			func() *corev1.Pod { return &corev1.Pod{} },
+			func() *corev1.PodList { return &corev1.PodList{} },
+			func(dst, src *corev1.PodList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.PodList) []*corev1.Pod { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.PodList, items []*corev1.Pod) { list.Items = kcpgentype.FromPointerSlice(items) },
+		),
+		fake,
+		clusterPath,
+	}
+}
+
+// UpdateEphemeralContainers takes the representation of a pod and updates it. Returns the server's representation of the pod, and an error, if there is any.
+func (c *podScopedClient) UpdateEphemeralContainers(ctx context.Context, podName string, pod *corev1.Pod, _ metav1.UpdateOptions) (result *corev1.Pod, err error) {
+	emptyResult := &corev1.Pod{}
+	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(c.Resource(), c.ClusterPath, "ephemeralcontainers", c.Namespace(), pod), &corev1.Pod{})
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*corev1.Pod), err
 }
 
-func (c *podsClient) UpdateEphemeralContainers(ctx context.Context, podName string, pod *corev1.Pod, opts metav1.UpdateOptions) (*corev1.Pod, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(podsResource, c.ClusterPath, "ephemeralcontainers", c.Namespace, pod), &corev1.Pod{})
+// UpdateResize takes the representation of a pod and updates it. Returns the server's representation of the pod, and an error, if there is any.
+func (c *podScopedClient) UpdateResize(ctx context.Context, podName string, pod *corev1.Pod, _ metav1.UpdateOptions) (result *corev1.Pod, err error) {
+	emptyResult := &corev1.Pod{}
+	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(c.Resource(), c.ClusterPath, "resize", c.Namespace(), pod), &corev1.Pod{})
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*corev1.Pod), err
 }
diff --git a/kubernetes/typed/core/v1/fake/podtemplate.go b/kubernetes/typed/core/v1/fake/podtemplate.go
index 54e75b526..720f1c30a 100644
--- a/kubernetes/typed/core/v1/fake/podtemplate.go
+++ b/kubernetes/typed/core/v1/fake/podtemplate.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,82 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
-	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var podTemplatesResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "podtemplates"}
-var podTemplatesKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "PodTemplate"}
-
-type podTemplatesClusterClient struct {
-	*kcptesting.Fake
+// podTemplateClusterClient implements PodTemplateClusterInterface
+type podTemplateClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.PodTemplate, *corev1.PodTemplateList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *podTemplatesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcorev1.PodTemplatesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &podTemplatesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PodTemplates that match those selectors across all clusters.
-func (c *podTemplatesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.PodTemplateList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(podTemplatesResource, podTemplatesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &corev1.PodTemplateList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakePodTemplateClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.PodTemplateClusterInterface {
+	return &podTemplateClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.PodTemplate, *corev1.PodTemplateList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("podtemplates"),
+			corev1.SchemeGroupVersion.WithKind("PodTemplate"),
+			func() *corev1.PodTemplate { return &corev1.PodTemplate{} },
+			func() *corev1.PodTemplateList { return &corev1.PodTemplateList{} },
+			func(dst, src *corev1.PodTemplateList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.PodTemplateList) []*corev1.PodTemplate { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.PodTemplateList, items []*corev1.PodTemplate) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &corev1.PodTemplateList{ListMeta: obj.(*corev1.PodTemplateList).ListMeta}
-	for _, item := range obj.(*corev1.PodTemplateList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested PodTemplates across all clusters.
-func (c *podTemplatesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(podTemplatesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *podTemplateClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcorev1.PodTemplatesNamespacer {
+	return &podTemplateNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type podTemplatesNamespacer struct {
+type podTemplateNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *podTemplatesNamespacer) Namespace(namespace string) corev1client.PodTemplateInterface {
-	return &podTemplatesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *podTemplateNamespacer) Namespace(namespace string) typedcorev1.PodTemplateInterface {
+	return newFakePodTemplateClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type podTemplatesClient struct {
-	*kcptesting.Fake
+// podTemplateScopedClient implements PodTemplateInterface
+type podTemplateScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.PodTemplate, *corev1.PodTemplateList, *v1.PodTemplateApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *podTemplatesClient) Create(ctx context.Context, podTemplate *corev1.PodTemplate, opts metav1.CreateOptions) (*corev1.PodTemplate, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(podTemplatesResource, c.ClusterPath, c.Namespace, podTemplate), &corev1.PodTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PodTemplate), err
-}
-
-func (c *podTemplatesClient) Update(ctx context.Context, podTemplate *corev1.PodTemplate, opts metav1.UpdateOptions) (*corev1.PodTemplate, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(podTemplatesResource, c.ClusterPath, c.Namespace, podTemplate), &corev1.PodTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PodTemplate), err
-}
-
-func (c *podTemplatesClient) UpdateStatus(ctx context.Context, podTemplate *corev1.PodTemplate, opts metav1.UpdateOptions) (*corev1.PodTemplate, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(podTemplatesResource, c.ClusterPath, "status", c.Namespace, podTemplate), &corev1.PodTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PodTemplate), err
-}
-
-func (c *podTemplatesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(podTemplatesResource, c.ClusterPath, c.Namespace, name, opts), &corev1.PodTemplate{})
-	return err
 }
 
-func (c *podTemplatesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(podTemplatesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.PodTemplateList{})
-	return err
-}
-
-func (c *podTemplatesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.PodTemplate, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(podTemplatesResource, c.ClusterPath, c.Namespace, name), &corev1.PodTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PodTemplate), err
-}
-
-// List takes label and field selectors, and returns the list of PodTemplates that match those selectors.
-func (c *podTemplatesClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.PodTemplateList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(podTemplatesResource, podTemplatesKind, c.ClusterPath, c.Namespace, opts), &corev1.PodTemplateList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.PodTemplateList{ListMeta: obj.(*corev1.PodTemplateList).ListMeta}
-	for _, item := range obj.(*corev1.PodTemplateList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *podTemplatesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(podTemplatesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *podTemplatesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.PodTemplate, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podTemplatesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &corev1.PodTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PodTemplate), err
-}
-
-func (c *podTemplatesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.PodTemplateApplyConfiguration, opts metav1.ApplyOptions) (*corev1.PodTemplate, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podTemplatesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &corev1.PodTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.PodTemplate), err
-}
-
-func (c *podTemplatesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.PodTemplateApplyConfiguration, opts metav1.ApplyOptions) (*corev1.PodTemplate, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podTemplatesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &corev1.PodTemplate{})
-	if obj == nil {
-		return nil, err
+func newFakePodTemplateClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcorev1.PodTemplateInterface {
+	return &podTemplateScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.PodTemplate, *corev1.PodTemplateList, *v1.PodTemplateApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			corev1.SchemeGroupVersion.WithResource("podtemplates"),
+			corev1.SchemeGroupVersion.WithKind("PodTemplate"),
+			func() *corev1.PodTemplate { return &corev1.PodTemplate{} },
+			func() *corev1.PodTemplateList { return &corev1.PodTemplateList{} },
+			func(dst, src *corev1.PodTemplateList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.PodTemplateList) []*corev1.PodTemplate { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.PodTemplateList, items []*corev1.PodTemplate) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.PodTemplate), err
 }
diff --git a/kubernetes/typed/core/v1/fake/replicationcontroller.go b/kubernetes/typed/core/v1/fake/replicationcontroller.go
index 847df760b..22caa97a7 100644
--- a/kubernetes/typed/core/v1/fake/replicationcontroller.go
+++ b/kubernetes/typed/core/v1/fake/replicationcontroller.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,214 +14,110 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	autoscalingv1 "k8s.io/api/autoscaling/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
-
-	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var replicationControllersResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "replicationcontrollers"}
-var replicationControllersKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "ReplicationController"}
-
-type replicationControllersClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *replicationControllersClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcorev1.ReplicationControllersNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &replicationControllersNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
+// replicationControllerClusterClient implements ReplicationControllerClusterInterface
+type replicationControllerClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.ReplicationController, *corev1.ReplicationControllerList]
+	Fake *kcptesting.Fake
 }
 
-// List takes label and field selectors, and returns the list of ReplicationControllers that match those selectors across all clusters.
-func (c *replicationControllersClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ReplicationControllerList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(replicationControllersResource, replicationControllersKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &corev1.ReplicationControllerList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeReplicationControllerClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.ReplicationControllerClusterInterface {
+	return &replicationControllerClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.ReplicationController, *corev1.ReplicationControllerList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("replicationcontrollers"),
+			corev1.SchemeGroupVersion.WithKind("ReplicationController"),
+			func() *corev1.ReplicationController { return &corev1.ReplicationController{} },
+			func() *corev1.ReplicationControllerList { return &corev1.ReplicationControllerList{} },
+			func(dst, src *corev1.ReplicationControllerList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.ReplicationControllerList) []*corev1.ReplicationController {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *corev1.ReplicationControllerList, items []*corev1.ReplicationController) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &corev1.ReplicationControllerList{ListMeta: obj.(*corev1.ReplicationControllerList).ListMeta}
-	for _, item := range obj.(*corev1.ReplicationControllerList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ReplicationControllers across all clusters.
-func (c *replicationControllersClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(replicationControllersResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *replicationControllerClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcorev1.ReplicationControllersNamespacer {
+	return &replicationControllerNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type replicationControllersNamespacer struct {
+type replicationControllerNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *replicationControllersNamespacer) Namespace(namespace string) corev1client.ReplicationControllerInterface {
-	return &replicationControllersClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *replicationControllerNamespacer) Namespace(namespace string) typedcorev1.ReplicationControllerInterface {
+	return newFakeReplicationControllerClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type replicationControllersClient struct {
-	*kcptesting.Fake
+// replicationControllerScopedClient implements ReplicationControllerInterface
+type replicationControllerScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.ReplicationController, *corev1.ReplicationControllerList, *v1.ReplicationControllerApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *replicationControllersClient) Create(ctx context.Context, replicationController *corev1.ReplicationController, opts metav1.CreateOptions) (*corev1.ReplicationController, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(replicationControllersResource, c.ClusterPath, c.Namespace, replicationController), &corev1.ReplicationController{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ReplicationController), err
-}
-
-func (c *replicationControllersClient) Update(ctx context.Context, replicationController *corev1.ReplicationController, opts metav1.UpdateOptions) (*corev1.ReplicationController, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(replicationControllersResource, c.ClusterPath, c.Namespace, replicationController), &corev1.ReplicationController{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ReplicationController), err
-}
-
-func (c *replicationControllersClient) UpdateStatus(ctx context.Context, replicationController *corev1.ReplicationController, opts metav1.UpdateOptions) (*corev1.ReplicationController, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(replicationControllersResource, c.ClusterPath, "status", c.Namespace, replicationController), &corev1.ReplicationController{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ReplicationController), err
-}
-
-func (c *replicationControllersClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(replicationControllersResource, c.ClusterPath, c.Namespace, name, opts), &corev1.ReplicationController{})
-	return err
-}
-
-func (c *replicationControllersClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(replicationControllersResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.ReplicationControllerList{})
-	return err
-}
-
-func (c *replicationControllersClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.ReplicationController, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(replicationControllersResource, c.ClusterPath, c.Namespace, name), &corev1.ReplicationController{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ReplicationController), err
-}
-
-// List takes label and field selectors, and returns the list of ReplicationControllers that match those selectors.
-func (c *replicationControllersClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ReplicationControllerList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(replicationControllersResource, replicationControllersKind, c.ClusterPath, c.Namespace, opts), &corev1.ReplicationControllerList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.ReplicationControllerList{ListMeta: obj.(*corev1.ReplicationControllerList).ListMeta}
-	for _, item := range obj.(*corev1.ReplicationControllerList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *replicationControllersClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(replicationControllersResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *replicationControllersClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.ReplicationController, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicationControllersResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &corev1.ReplicationController{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ReplicationController), err
-}
-
-func (c *replicationControllersClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.ReplicationControllerApplyConfiguration, opts metav1.ApplyOptions) (*corev1.ReplicationController, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicationControllersResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &corev1.ReplicationController{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ReplicationController), err
-}
-
-func (c *replicationControllersClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.ReplicationControllerApplyConfiguration, opts metav1.ApplyOptions) (*corev1.ReplicationController, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicationControllersResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &corev1.ReplicationController{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ReplicationController), err
 }
 
-func (c *replicationControllersClient) GetScale(ctx context.Context, replicationControllerName string, options metav1.GetOptions) (*autoscalingv1.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(replicationControllersResource, c.ClusterPath, "scale", c.Namespace, replicationControllerName), &autoscalingv1.Scale{})
+func newFakeReplicationControllerClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcorev1.ReplicationControllerInterface {
+	return &replicationControllerScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.ReplicationController, *corev1.ReplicationControllerList, *v1.ReplicationControllerApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			corev1.SchemeGroupVersion.WithResource("replicationcontrollers"),
+			corev1.SchemeGroupVersion.WithKind("ReplicationController"),
+			func() *corev1.ReplicationController { return &corev1.ReplicationController{} },
+			func() *corev1.ReplicationControllerList { return &corev1.ReplicationControllerList{} },
+			func(dst, src *corev1.ReplicationControllerList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.ReplicationControllerList) []*corev1.ReplicationController {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *corev1.ReplicationControllerList, items []*corev1.ReplicationController) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
+
+// GetScale takes name of the replicationController, and returns the corresponding scale object, and an error if there is any.
+func (c *replicationControllerScopedClient) GetScale(ctx context.Context, replicationControllerName string, _ metav1.GetOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), "scale", replicationControllerName), emptyResult)
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*autoscalingv1.Scale), err
 }
 
-func (c *replicationControllersClient) UpdateScale(ctx context.Context, replicationControllerName string, scale *autoscalingv1.Scale, opts metav1.UpdateOptions) (*autoscalingv1.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(replicationControllersResource, c.ClusterPath, "scale", c.Namespace, scale), &autoscalingv1.Scale{})
+// UpdateScale takes the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *replicationControllerScopedClient) UpdateScale(ctx context.Context, replicationControllerName string, scale *autoscalingv1.Scale, _ metav1.UpdateOptions) (result *autoscalingv1.Scale, err error) {
+	emptyResult := &autoscalingv1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(c.Resource(), c.ClusterPath, "scale", c.Namespace(), scale), &autoscalingv1.Scale{})
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*autoscalingv1.Scale), err
 }
diff --git a/kubernetes/typed/core/v1/fake/resourcequota.go b/kubernetes/typed/core/v1/fake/resourcequota.go
index 5d7ad6e29..889f89780 100644
--- a/kubernetes/typed/core/v1/fake/resourcequota.go
+++ b/kubernetes/typed/core/v1/fake/resourcequota.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
-	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var resourceQuotasResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "resourcequotas"}
-var resourceQuotasKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "ResourceQuota"}
-
-type resourceQuotasClusterClient struct {
-	*kcptesting.Fake
+// resourceQuotaClusterClient implements ResourceQuotaClusterInterface
+type resourceQuotaClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.ResourceQuota, *corev1.ResourceQuotaList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *resourceQuotasClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcorev1.ResourceQuotasNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &resourceQuotasNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ResourceQuotas that match those selectors across all clusters.
-func (c *resourceQuotasClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ResourceQuotaList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(resourceQuotasResource, resourceQuotasKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &corev1.ResourceQuotaList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeResourceQuotaClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.ResourceQuotaClusterInterface {
+	return &resourceQuotaClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.ResourceQuota, *corev1.ResourceQuotaList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("resourcequotas"),
+			corev1.SchemeGroupVersion.WithKind("ResourceQuota"),
+			func() *corev1.ResourceQuota { return &corev1.ResourceQuota{} },
+			func() *corev1.ResourceQuotaList { return &corev1.ResourceQuotaList{} },
+			func(dst, src *corev1.ResourceQuotaList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.ResourceQuotaList) []*corev1.ResourceQuota {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *corev1.ResourceQuotaList, items []*corev1.ResourceQuota) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &corev1.ResourceQuotaList{ListMeta: obj.(*corev1.ResourceQuotaList).ListMeta}
-	for _, item := range obj.(*corev1.ResourceQuotaList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ResourceQuotas across all clusters.
-func (c *resourceQuotasClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(resourceQuotasResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *resourceQuotaClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcorev1.ResourceQuotasNamespacer {
+	return &resourceQuotaNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type resourceQuotasNamespacer struct {
+type resourceQuotaNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *resourceQuotasNamespacer) Namespace(namespace string) corev1client.ResourceQuotaInterface {
-	return &resourceQuotasClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *resourceQuotaNamespacer) Namespace(namespace string) typedcorev1.ResourceQuotaInterface {
+	return newFakeResourceQuotaClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type resourceQuotasClient struct {
-	*kcptesting.Fake
+// resourceQuotaScopedClient implements ResourceQuotaInterface
+type resourceQuotaScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.ResourceQuota, *corev1.ResourceQuotaList, *v1.ResourceQuotaApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *resourceQuotasClient) Create(ctx context.Context, resourceQuota *corev1.ResourceQuota, opts metav1.CreateOptions) (*corev1.ResourceQuota, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(resourceQuotasResource, c.ClusterPath, c.Namespace, resourceQuota), &corev1.ResourceQuota{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ResourceQuota), err
-}
-
-func (c *resourceQuotasClient) Update(ctx context.Context, resourceQuota *corev1.ResourceQuota, opts metav1.UpdateOptions) (*corev1.ResourceQuota, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(resourceQuotasResource, c.ClusterPath, c.Namespace, resourceQuota), &corev1.ResourceQuota{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ResourceQuota), err
-}
-
-func (c *resourceQuotasClient) UpdateStatus(ctx context.Context, resourceQuota *corev1.ResourceQuota, opts metav1.UpdateOptions) (*corev1.ResourceQuota, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(resourceQuotasResource, c.ClusterPath, "status", c.Namespace, resourceQuota), &corev1.ResourceQuota{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ResourceQuota), err
-}
-
-func (c *resourceQuotasClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(resourceQuotasResource, c.ClusterPath, c.Namespace, name, opts), &corev1.ResourceQuota{})
-	return err
 }
 
-func (c *resourceQuotasClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(resourceQuotasResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.ResourceQuotaList{})
-	return err
-}
-
-func (c *resourceQuotasClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.ResourceQuota, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(resourceQuotasResource, c.ClusterPath, c.Namespace, name), &corev1.ResourceQuota{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ResourceQuota), err
-}
-
-// List takes label and field selectors, and returns the list of ResourceQuotas that match those selectors.
-func (c *resourceQuotasClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ResourceQuotaList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(resourceQuotasResource, resourceQuotasKind, c.ClusterPath, c.Namespace, opts), &corev1.ResourceQuotaList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.ResourceQuotaList{ListMeta: obj.(*corev1.ResourceQuotaList).ListMeta}
-	for _, item := range obj.(*corev1.ResourceQuotaList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *resourceQuotasClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(resourceQuotasResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *resourceQuotasClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.ResourceQuota, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(resourceQuotasResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &corev1.ResourceQuota{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ResourceQuota), err
-}
-
-func (c *resourceQuotasClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.ResourceQuotaApplyConfiguration, opts metav1.ApplyOptions) (*corev1.ResourceQuota, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(resourceQuotasResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &corev1.ResourceQuota{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ResourceQuota), err
-}
-
-func (c *resourceQuotasClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.ResourceQuotaApplyConfiguration, opts metav1.ApplyOptions) (*corev1.ResourceQuota, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(resourceQuotasResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &corev1.ResourceQuota{})
-	if obj == nil {
-		return nil, err
+func newFakeResourceQuotaClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcorev1.ResourceQuotaInterface {
+	return &resourceQuotaScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.ResourceQuota, *corev1.ResourceQuotaList, *v1.ResourceQuotaApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			corev1.SchemeGroupVersion.WithResource("resourcequotas"),
+			corev1.SchemeGroupVersion.WithKind("ResourceQuota"),
+			func() *corev1.ResourceQuota { return &corev1.ResourceQuota{} },
+			func() *corev1.ResourceQuotaList { return &corev1.ResourceQuotaList{} },
+			func(dst, src *corev1.ResourceQuotaList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.ResourceQuotaList) []*corev1.ResourceQuota {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *corev1.ResourceQuotaList, items []*corev1.ResourceQuota) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.ResourceQuota), err
 }
diff --git a/kubernetes/typed/core/v1/fake/secret.go b/kubernetes/typed/core/v1/fake/secret.go
index 951a7680b..6b772feb0 100644
--- a/kubernetes/typed/core/v1/fake/secret.go
+++ b/kubernetes/typed/core/v1/fake/secret.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
-	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var secretsResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "secrets"}
-var secretsKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Secret"}
-
-type secretsClusterClient struct {
-	*kcptesting.Fake
+// secretClusterClient implements SecretClusterInterface
+type secretClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.Secret, *corev1.SecretList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *secretsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcorev1.SecretsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &secretsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Secrets that match those selectors across all clusters.
-func (c *secretsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.SecretList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(secretsResource, secretsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &corev1.SecretList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeSecretClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.SecretClusterInterface {
+	return &secretClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.Secret, *corev1.SecretList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("secrets"),
+			corev1.SchemeGroupVersion.WithKind("Secret"),
+			func() *corev1.Secret { return &corev1.Secret{} },
+			func() *corev1.SecretList { return &corev1.SecretList{} },
+			func(dst, src *corev1.SecretList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.SecretList) []*corev1.Secret { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.SecretList, items []*corev1.Secret) { list.Items = kcpgentype.FromPointerSlice(items) },
+		),
+		fake.Fake,
 	}
-	list := &corev1.SecretList{ListMeta: obj.(*corev1.SecretList).ListMeta}
-	for _, item := range obj.(*corev1.SecretList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Secrets across all clusters.
-func (c *secretsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(secretsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *secretClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcorev1.SecretsNamespacer {
+	return &secretNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type secretsNamespacer struct {
+type secretNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *secretsNamespacer) Namespace(namespace string) corev1client.SecretInterface {
-	return &secretsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *secretNamespacer) Namespace(namespace string) typedcorev1.SecretInterface {
+	return newFakeSecretClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type secretsClient struct {
-	*kcptesting.Fake
+// secretScopedClient implements SecretInterface
+type secretScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.Secret, *corev1.SecretList, *v1.SecretApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *secretsClient) Create(ctx context.Context, secret *corev1.Secret, opts metav1.CreateOptions) (*corev1.Secret, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(secretsResource, c.ClusterPath, c.Namespace, secret), &corev1.Secret{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Secret), err
-}
-
-func (c *secretsClient) Update(ctx context.Context, secret *corev1.Secret, opts metav1.UpdateOptions) (*corev1.Secret, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(secretsResource, c.ClusterPath, c.Namespace, secret), &corev1.Secret{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Secret), err
-}
-
-func (c *secretsClient) UpdateStatus(ctx context.Context, secret *corev1.Secret, opts metav1.UpdateOptions) (*corev1.Secret, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(secretsResource, c.ClusterPath, "status", c.Namespace, secret), &corev1.Secret{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Secret), err
-}
-
-func (c *secretsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(secretsResource, c.ClusterPath, c.Namespace, name, opts), &corev1.Secret{})
-	return err
 }
 
-func (c *secretsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(secretsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.SecretList{})
-	return err
-}
-
-func (c *secretsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.Secret, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(secretsResource, c.ClusterPath, c.Namespace, name), &corev1.Secret{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Secret), err
-}
-
-// List takes label and field selectors, and returns the list of Secrets that match those selectors.
-func (c *secretsClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.SecretList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(secretsResource, secretsKind, c.ClusterPath, c.Namespace, opts), &corev1.SecretList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.SecretList{ListMeta: obj.(*corev1.SecretList).ListMeta}
-	for _, item := range obj.(*corev1.SecretList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *secretsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(secretsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *secretsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.Secret, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(secretsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &corev1.Secret{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Secret), err
-}
-
-func (c *secretsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.SecretApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Secret, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(secretsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &corev1.Secret{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Secret), err
-}
-
-func (c *secretsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.SecretApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Secret, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(secretsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &corev1.Secret{})
-	if obj == nil {
-		return nil, err
+func newFakeSecretClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcorev1.SecretInterface {
+	return &secretScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.Secret, *corev1.SecretList, *v1.SecretApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			corev1.SchemeGroupVersion.WithResource("secrets"),
+			corev1.SchemeGroupVersion.WithKind("Secret"),
+			func() *corev1.Secret { return &corev1.Secret{} },
+			func() *corev1.SecretList { return &corev1.SecretList{} },
+			func(dst, src *corev1.SecretList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.SecretList) []*corev1.Secret { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.SecretList, items []*corev1.Secret) { list.Items = kcpgentype.FromPointerSlice(items) },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.Secret), err
 }
diff --git a/kubernetes/typed/core/v1/fake/service.go b/kubernetes/typed/core/v1/fake/service.go
index 3a9b3b727..4b61b6380 100644
--- a/kubernetes/typed/core/v1/fake/service.go
+++ b/kubernetes/typed/core/v1/fake/service.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,190 +14,82 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
-	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var servicesResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "services"}
-var servicesKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Service"}
-
-type servicesClusterClient struct {
-	*kcptesting.Fake
+// serviceClusterClient implements ServiceClusterInterface
+type serviceClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.Service, *corev1.ServiceList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *servicesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcorev1.ServicesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeServiceClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.ServiceClusterInterface {
+	return &serviceClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.Service, *corev1.ServiceList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("services"),
+			corev1.SchemeGroupVersion.WithKind("Service"),
+			func() *corev1.Service { return &corev1.Service{} },
+			func() *corev1.ServiceList { return &corev1.ServiceList{} },
+			func(dst, src *corev1.ServiceList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.ServiceList) []*corev1.Service { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.ServiceList, items []*corev1.Service) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-
-	return &servicesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-// List takes label and field selectors, and returns the list of Services that match those selectors across all clusters.
-func (c *servicesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ServiceList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(servicesResource, servicesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &corev1.ServiceList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.ServiceList{ListMeta: obj.(*corev1.ServiceList).ListMeta}
-	for _, item := range obj.(*corev1.ServiceList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
+func (c *serviceClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcorev1.ServicesNamespacer {
+	return &serviceNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-// Watch returns a watch.Interface that watches the requested Services across all clusters.
-func (c *servicesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(servicesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
-}
-
-type servicesNamespacer struct {
+type serviceNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *servicesNamespacer) Namespace(namespace string) corev1client.ServiceInterface {
-	return &servicesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *serviceNamespacer) Namespace(namespace string) typedcorev1.ServiceInterface {
+	return newFakeServiceClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type servicesClient struct {
-	*kcptesting.Fake
+// serviceScopedClient implements ServiceInterface
+type serviceScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.Service, *corev1.ServiceList, *v1.ServiceApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *servicesClient) Create(ctx context.Context, service *corev1.Service, opts metav1.CreateOptions) (*corev1.Service, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(servicesResource, c.ClusterPath, c.Namespace, service), &corev1.Service{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Service), err
-}
-
-func (c *servicesClient) Update(ctx context.Context, service *corev1.Service, opts metav1.UpdateOptions) (*corev1.Service, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(servicesResource, c.ClusterPath, c.Namespace, service), &corev1.Service{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Service), err
-}
-
-func (c *servicesClient) UpdateStatus(ctx context.Context, service *corev1.Service, opts metav1.UpdateOptions) (*corev1.Service, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(servicesResource, c.ClusterPath, "status", c.Namespace, service), &corev1.Service{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Service), err
 }
 
-func (c *servicesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(servicesResource, c.ClusterPath, c.Namespace, name, opts), &corev1.Service{})
-	return err
-}
-
-func (c *servicesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.Service, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(servicesResource, c.ClusterPath, c.Namespace, name), &corev1.Service{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Service), err
-}
-
-// List takes label and field selectors, and returns the list of Services that match those selectors.
-func (c *servicesClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ServiceList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(servicesResource, servicesKind, c.ClusterPath, c.Namespace, opts), &corev1.ServiceList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.ServiceList{ListMeta: obj.(*corev1.ServiceList).ListMeta}
-	for _, item := range obj.(*corev1.ServiceList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *servicesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(servicesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *servicesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.Service, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(servicesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &corev1.Service{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Service), err
-}
-
-func (c *servicesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.ServiceApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Service, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(servicesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &corev1.Service{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.Service), err
-}
-
-func (c *servicesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.ServiceApplyConfiguration, opts metav1.ApplyOptions) (*corev1.Service, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(servicesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &corev1.Service{})
-	if obj == nil {
-		return nil, err
+func newFakeServiceClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcorev1.ServiceInterface {
+	return &serviceScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.Service, *corev1.ServiceList, *v1.ServiceApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			corev1.SchemeGroupVersion.WithResource("services"),
+			corev1.SchemeGroupVersion.WithKind("Service"),
+			func() *corev1.Service { return &corev1.Service{} },
+			func() *corev1.ServiceList { return &corev1.ServiceList{} },
+			func(dst, src *corev1.ServiceList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.ServiceList) []*corev1.Service { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *corev1.ServiceList, items []*corev1.Service) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*corev1.Service), err
 }
diff --git a/kubernetes/typed/core/v1/fake/serviceaccount.go b/kubernetes/typed/core/v1/fake/serviceaccount.go
index 71d091e96..92b4fb77e 100644
--- a/kubernetes/typed/core/v1/fake/serviceaccount.go
+++ b/kubernetes/typed/core/v1/fake/serviceaccount.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,206 +14,100 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	authenticationv1 "k8s.io/api/authentication/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationscorev1 "k8s.io/client-go/applyconfigurations/core/v1"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
-	"k8s.io/client-go/testing"
-
-	kcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	v1 "k8s.io/client-go/applyconfigurations/core/v1"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	typedkcpcorev1 "github.com/kcp-dev/client-go/kubernetes/typed/core/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var serviceAccountsResource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "serviceaccounts"}
-var serviceAccountsKind = schema.GroupVersionKind{Group: "", Version: "v1", Kind: "ServiceAccount"}
-
-type serviceAccountsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *serviceAccountsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpcorev1.ServiceAccountsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &serviceAccountsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
+// serviceAccountClusterClient implements ServiceAccountClusterInterface
+type serviceAccountClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*corev1.ServiceAccount, *corev1.ServiceAccountList]
+	Fake *kcptesting.Fake
 }
 
-// List takes label and field selectors, and returns the list of ServiceAccounts that match those selectors across all clusters.
-func (c *serviceAccountsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ServiceAccountList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(serviceAccountsResource, serviceAccountsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &corev1.ServiceAccountList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeServiceAccountClusterClient(fake *CoreV1ClusterClient) typedkcpcorev1.ServiceAccountClusterInterface {
+	return &serviceAccountClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*corev1.ServiceAccount, *corev1.ServiceAccountList](
+			fake.Fake,
+			corev1.SchemeGroupVersion.WithResource("serviceaccounts"),
+			corev1.SchemeGroupVersion.WithKind("ServiceAccount"),
+			func() *corev1.ServiceAccount { return &corev1.ServiceAccount{} },
+			func() *corev1.ServiceAccountList { return &corev1.ServiceAccountList{} },
+			func(dst, src *corev1.ServiceAccountList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.ServiceAccountList) []*corev1.ServiceAccount {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *corev1.ServiceAccountList, items []*corev1.ServiceAccount) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &corev1.ServiceAccountList{ListMeta: obj.(*corev1.ServiceAccountList).ListMeta}
-	for _, item := range obj.(*corev1.ServiceAccountList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ServiceAccounts across all clusters.
-func (c *serviceAccountsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(serviceAccountsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *serviceAccountClusterClient) Cluster(cluster logicalcluster.Path) typedkcpcorev1.ServiceAccountsNamespacer {
+	return &serviceAccountNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type serviceAccountsNamespacer struct {
+type serviceAccountNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *serviceAccountsNamespacer) Namespace(namespace string) corev1client.ServiceAccountInterface {
-	return &serviceAccountsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *serviceAccountNamespacer) Namespace(namespace string) typedcorev1.ServiceAccountInterface {
+	return newFakeServiceAccountClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type serviceAccountsClient struct {
-	*kcptesting.Fake
+// serviceAccountScopedClient implements ServiceAccountInterface
+type serviceAccountScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*corev1.ServiceAccount, *corev1.ServiceAccountList, *v1.ServiceAccountApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *serviceAccountsClient) Create(ctx context.Context, serviceAccount *corev1.ServiceAccount, opts metav1.CreateOptions) (*corev1.ServiceAccount, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(serviceAccountsResource, c.ClusterPath, c.Namespace, serviceAccount), &corev1.ServiceAccount{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ServiceAccount), err
-}
-
-func (c *serviceAccountsClient) Update(ctx context.Context, serviceAccount *corev1.ServiceAccount, opts metav1.UpdateOptions) (*corev1.ServiceAccount, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(serviceAccountsResource, c.ClusterPath, c.Namespace, serviceAccount), &corev1.ServiceAccount{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ServiceAccount), err
-}
-
-func (c *serviceAccountsClient) UpdateStatus(ctx context.Context, serviceAccount *corev1.ServiceAccount, opts metav1.UpdateOptions) (*corev1.ServiceAccount, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(serviceAccountsResource, c.ClusterPath, "status", c.Namespace, serviceAccount), &corev1.ServiceAccount{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ServiceAccount), err
-}
-
-func (c *serviceAccountsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(serviceAccountsResource, c.ClusterPath, c.Namespace, name, opts), &corev1.ServiceAccount{})
-	return err
-}
-
-func (c *serviceAccountsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(serviceAccountsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &corev1.ServiceAccountList{})
-	return err
-}
-
-func (c *serviceAccountsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*corev1.ServiceAccount, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(serviceAccountsResource, c.ClusterPath, c.Namespace, name), &corev1.ServiceAccount{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ServiceAccount), err
-}
-
-// List takes label and field selectors, and returns the list of ServiceAccounts that match those selectors.
-func (c *serviceAccountsClient) List(ctx context.Context, opts metav1.ListOptions) (*corev1.ServiceAccountList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(serviceAccountsResource, serviceAccountsKind, c.ClusterPath, c.Namespace, opts), &corev1.ServiceAccountList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &corev1.ServiceAccountList{ListMeta: obj.(*corev1.ServiceAccountList).ListMeta}
-	for _, item := range obj.(*corev1.ServiceAccountList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *serviceAccountsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(serviceAccountsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *serviceAccountsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*corev1.ServiceAccount, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(serviceAccountsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &corev1.ServiceAccount{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ServiceAccount), err
-}
-
-func (c *serviceAccountsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationscorev1.ServiceAccountApplyConfiguration, opts metav1.ApplyOptions) (*corev1.ServiceAccount, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(serviceAccountsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &corev1.ServiceAccount{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ServiceAccount), err
-}
-
-func (c *serviceAccountsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationscorev1.ServiceAccountApplyConfiguration, opts metav1.ApplyOptions) (*corev1.ServiceAccount, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(serviceAccountsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &corev1.ServiceAccount{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*corev1.ServiceAccount), err
 }
 
-func (c *serviceAccountsClient) CreateToken(ctx context.Context, serviceAccountName string, tokenRequest *authenticationv1.TokenRequest, opts metav1.CreateOptions) (*authenticationv1.TokenRequest, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateSubresourceAction(serviceAccountsResource, c.ClusterPath, serviceAccountName, "token", c.Namespace, tokenRequest), &authenticationv1.TokenRequest{})
+func newFakeServiceAccountClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedcorev1.ServiceAccountInterface {
+	return &serviceAccountScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*corev1.ServiceAccount, *corev1.ServiceAccountList, *v1.ServiceAccountApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			corev1.SchemeGroupVersion.WithResource("serviceaccounts"),
+			corev1.SchemeGroupVersion.WithKind("ServiceAccount"),
+			func() *corev1.ServiceAccount { return &corev1.ServiceAccount{} },
+			func() *corev1.ServiceAccountList { return &corev1.ServiceAccountList{} },
+			func(dst, src *corev1.ServiceAccountList) { dst.ListMeta = src.ListMeta },
+			func(list *corev1.ServiceAccountList) []*corev1.ServiceAccount {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *corev1.ServiceAccountList, items []*corev1.ServiceAccount) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
+
+// CreateToken takes the representation of a tokenRequest and creates it. Returns the server's representation of the tokenRequest, and an error, if there is any.
+func (c *serviceAccountScopedClient) CreateToken(ctx context.Context, serviceAccountName string, tokenRequest *authenticationv1.TokenRequest, _ metav1.CreateOptions) (result *authenticationv1.TokenRequest, err error) {
+	emptyResult := &authenticationv1.TokenRequest{}
+	obj, err := c.Fake.Invokes(kcptesting.NewCreateSubresourceAction(c.Resource(), c.ClusterPath, serviceAccountName, "token", c.Namespace(), tokenRequest), emptyResult)
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*authenticationv1.TokenRequest), err
 }
diff --git a/kubernetes/typed/core/v1/generated_expansion.go b/kubernetes/typed/core/v1/generated_expansion.go
new file mode 100644
index 000000000..a7e4f03d6
--- /dev/null
+++ b/kubernetes/typed/core/v1/generated_expansion.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type ComponentStatusClusterExpansion interface{}
+
+type ConfigMapClusterExpansion interface{}
+
+type EndpointsClusterExpansion interface{}
+
+type EventClusterExpansion interface{}
+
+type LimitRangeClusterExpansion interface{}
+
+type NamespaceClusterExpansion interface{}
+
+type NodeClusterExpansion interface{}
+
+type PersistentVolumeClusterExpansion interface{}
+
+type PersistentVolumeClaimClusterExpansion interface{}
+
+type PodClusterExpansion interface{}
+
+type PodTemplateClusterExpansion interface{}
+
+type ReplicationControllerClusterExpansion interface{}
+
+type ResourceQuotaClusterExpansion interface{}
+
+type SecretClusterExpansion interface{}
+
+type ServiceClusterExpansion interface{}
+
+type ServiceAccountClusterExpansion interface{}
diff --git a/kubernetes/typed/core/v1/limitrange.go b/kubernetes/typed/core/v1/limitrange.go
index af697b4ec..5a51f311d 100644
--- a/kubernetes/typed/core/v1/limitrange.go
+++ b/kubernetes/typed/core/v1/limitrange.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // LimitRangesClusterGetter has a method to return a LimitRangeClusterInterface.
@@ -45,10 +42,11 @@ type LimitRangeClusterInterface interface {
 	Cluster(logicalcluster.Path) LimitRangesNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*corev1.LimitRangeList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	LimitRangeClusterExpansion
 }
 
 type limitRangesClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *limitRangesClusterInterface) Watch(ctx context.Context, opts metav1.Lis
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).LimitRanges(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// LimitRangesNamespacer can scope to objects within a namespace, returning a corev1client.LimitRangeInterface.
+// LimitRangesNamespacer can scope to objects within a namespace, returning a typedcorev1.LimitRangeInterface.
 type LimitRangesNamespacer interface {
-	Namespace(string) corev1client.LimitRangeInterface
+	Namespace(string) typedcorev1.LimitRangeInterface
 }
 
 type limitRangesNamespacer struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *limitRangesNamespacer) Namespace(namespace string) corev1client.LimitRangeInterface {
+func (n *limitRangesNamespacer) Namespace(namespace string) typedcorev1.LimitRangeInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).LimitRanges(namespace)
 }
diff --git a/kubernetes/typed/core/v1/namespace.go b/kubernetes/typed/core/v1/namespace.go
index c56a72228..53bc82f46 100644
--- a/kubernetes/typed/core/v1/namespace.go
+++ b/kubernetes/typed/core/v1/namespace.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
 )
 
 // NamespacesClusterGetter has a method to return a NamespaceClusterInterface.
@@ -40,19 +37,20 @@ type NamespacesClusterGetter interface {
 }
 
 // NamespaceClusterInterface can operate on Namespaces across all clusters,
-// or scope down to one cluster and return a corev1client.NamespaceInterface.
+// or scope down to one cluster and return a corev1.NamespaceInterface.
 type NamespaceClusterInterface interface {
-	Cluster(logicalcluster.Path) corev1client.NamespaceInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*corev1.NamespaceList, error)
+	Cluster(logicalcluster.Path) corev1.NamespaceInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apicorev1.NamespaceList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	NamespaceClusterExpansion
 }
 
 type namespacesClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*corev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *namespacesClusterInterface) Cluster(clusterPath logicalcluster.Path) corev1client.NamespaceInterface {
+func (c *namespacesClusterInterface) Cluster(clusterPath logicalcluster.Path) corev1.NamespaceInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *namespacesClusterInterface) Cluster(clusterPath logicalcluster.Path) co
 }
 
 // List returns the entire collection of all Namespaces across all clusters.
-func (c *namespacesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*corev1.NamespaceList, error) {
+func (c *namespacesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apicorev1.NamespaceList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Namespaces().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/core/v1/node.go b/kubernetes/typed/core/v1/node.go
index 59d17f7d8..63e75ddaa 100644
--- a/kubernetes/typed/core/v1/node.go
+++ b/kubernetes/typed/core/v1/node.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
 )
 
 // NodesClusterGetter has a method to return a NodeClusterInterface.
@@ -40,19 +37,20 @@ type NodesClusterGetter interface {
 }
 
 // NodeClusterInterface can operate on Nodes across all clusters,
-// or scope down to one cluster and return a corev1client.NodeInterface.
+// or scope down to one cluster and return a corev1.NodeInterface.
 type NodeClusterInterface interface {
-	Cluster(logicalcluster.Path) corev1client.NodeInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*corev1.NodeList, error)
+	Cluster(logicalcluster.Path) corev1.NodeInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apicorev1.NodeList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	NodeClusterExpansion
 }
 
 type nodesClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*corev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *nodesClusterInterface) Cluster(clusterPath logicalcluster.Path) corev1client.NodeInterface {
+func (c *nodesClusterInterface) Cluster(clusterPath logicalcluster.Path) corev1.NodeInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *nodesClusterInterface) Cluster(clusterPath logicalcluster.Path) corev1c
 }
 
 // List returns the entire collection of all Nodes across all clusters.
-func (c *nodesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*corev1.NodeList, error) {
+func (c *nodesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apicorev1.NodeList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Nodes().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/core/v1/persistentvolume.go b/kubernetes/typed/core/v1/persistentvolume.go
index 6dc1505d5..afc1391b6 100644
--- a/kubernetes/typed/core/v1/persistentvolume.go
+++ b/kubernetes/typed/core/v1/persistentvolume.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apicorev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
 )
 
 // PersistentVolumesClusterGetter has a method to return a PersistentVolumeClusterInterface.
@@ -40,19 +37,20 @@ type PersistentVolumesClusterGetter interface {
 }
 
 // PersistentVolumeClusterInterface can operate on PersistentVolumes across all clusters,
-// or scope down to one cluster and return a corev1client.PersistentVolumeInterface.
+// or scope down to one cluster and return a corev1.PersistentVolumeInterface.
 type PersistentVolumeClusterInterface interface {
-	Cluster(logicalcluster.Path) corev1client.PersistentVolumeInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*corev1.PersistentVolumeList, error)
+	Cluster(logicalcluster.Path) corev1.PersistentVolumeInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apicorev1.PersistentVolumeList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	PersistentVolumeClusterExpansion
 }
 
 type persistentVolumesClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*corev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *persistentVolumesClusterInterface) Cluster(clusterPath logicalcluster.Path) corev1client.PersistentVolumeInterface {
+func (c *persistentVolumesClusterInterface) Cluster(clusterPath logicalcluster.Path) corev1.PersistentVolumeInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *persistentVolumesClusterInterface) Cluster(clusterPath logicalcluster.P
 }
 
 // List returns the entire collection of all PersistentVolumes across all clusters.
-func (c *persistentVolumesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*corev1.PersistentVolumeList, error) {
+func (c *persistentVolumesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apicorev1.PersistentVolumeList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PersistentVolumes().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/core/v1/persistentvolumeclaim.go b/kubernetes/typed/core/v1/persistentvolumeclaim.go
index 7a556bf07..000134745 100644
--- a/kubernetes/typed/core/v1/persistentvolumeclaim.go
+++ b/kubernetes/typed/core/v1/persistentvolumeclaim.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PersistentVolumeClaimsClusterGetter has a method to return a PersistentVolumeClaimClusterInterface.
@@ -45,10 +42,11 @@ type PersistentVolumeClaimClusterInterface interface {
 	Cluster(logicalcluster.Path) PersistentVolumeClaimsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*corev1.PersistentVolumeClaimList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	PersistentVolumeClaimClusterExpansion
 }
 
 type persistentVolumeClaimsClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *persistentVolumeClaimsClusterInterface) Watch(ctx context.Context, opts
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PersistentVolumeClaims(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// PersistentVolumeClaimsNamespacer can scope to objects within a namespace, returning a corev1client.PersistentVolumeClaimInterface.
+// PersistentVolumeClaimsNamespacer can scope to objects within a namespace, returning a typedcorev1.PersistentVolumeClaimInterface.
 type PersistentVolumeClaimsNamespacer interface {
-	Namespace(string) corev1client.PersistentVolumeClaimInterface
+	Namespace(string) typedcorev1.PersistentVolumeClaimInterface
 }
 
 type persistentVolumeClaimsNamespacer struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *persistentVolumeClaimsNamespacer) Namespace(namespace string) corev1client.PersistentVolumeClaimInterface {
+func (n *persistentVolumeClaimsNamespacer) Namespace(namespace string) typedcorev1.PersistentVolumeClaimInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).PersistentVolumeClaims(namespace)
 }
diff --git a/kubernetes/typed/core/v1/pod.go b/kubernetes/typed/core/v1/pod.go
index 029dda6e6..69ab14a86 100644
--- a/kubernetes/typed/core/v1/pod.go
+++ b/kubernetes/typed/core/v1/pod.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PodsClusterGetter has a method to return a PodClusterInterface.
@@ -45,10 +42,11 @@ type PodClusterInterface interface {
 	Cluster(logicalcluster.Path) PodsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*corev1.PodList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	PodClusterExpansion
 }
 
 type podsClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *podsClusterInterface) Watch(ctx context.Context, opts metav1.ListOption
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Pods(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// PodsNamespacer can scope to objects within a namespace, returning a corev1client.PodInterface.
+// PodsNamespacer can scope to objects within a namespace, returning a typedcorev1.PodInterface.
 type PodsNamespacer interface {
-	Namespace(string) corev1client.PodInterface
+	Namespace(string) typedcorev1.PodInterface
 }
 
 type podsNamespacer struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *podsNamespacer) Namespace(namespace string) corev1client.PodInterface {
+func (n *podsNamespacer) Namespace(namespace string) typedcorev1.PodInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Pods(namespace)
 }
diff --git a/kubernetes/typed/core/v1/podtemplate.go b/kubernetes/typed/core/v1/podtemplate.go
index 76d21470e..7f6e2791e 100644
--- a/kubernetes/typed/core/v1/podtemplate.go
+++ b/kubernetes/typed/core/v1/podtemplate.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PodTemplatesClusterGetter has a method to return a PodTemplateClusterInterface.
@@ -45,10 +42,11 @@ type PodTemplateClusterInterface interface {
 	Cluster(logicalcluster.Path) PodTemplatesNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*corev1.PodTemplateList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	PodTemplateClusterExpansion
 }
 
 type podTemplatesClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *podTemplatesClusterInterface) Watch(ctx context.Context, opts metav1.Li
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PodTemplates(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// PodTemplatesNamespacer can scope to objects within a namespace, returning a corev1client.PodTemplateInterface.
+// PodTemplatesNamespacer can scope to objects within a namespace, returning a typedcorev1.PodTemplateInterface.
 type PodTemplatesNamespacer interface {
-	Namespace(string) corev1client.PodTemplateInterface
+	Namespace(string) typedcorev1.PodTemplateInterface
 }
 
 type podTemplatesNamespacer struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *podTemplatesNamespacer) Namespace(namespace string) corev1client.PodTemplateInterface {
+func (n *podTemplatesNamespacer) Namespace(namespace string) typedcorev1.PodTemplateInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).PodTemplates(namespace)
 }
diff --git a/kubernetes/typed/core/v1/replicationcontroller.go b/kubernetes/typed/core/v1/replicationcontroller.go
index bdbee34be..4e70ac944 100644
--- a/kubernetes/typed/core/v1/replicationcontroller.go
+++ b/kubernetes/typed/core/v1/replicationcontroller.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ReplicationControllersClusterGetter has a method to return a ReplicationControllerClusterInterface.
@@ -45,10 +42,11 @@ type ReplicationControllerClusterInterface interface {
 	Cluster(logicalcluster.Path) ReplicationControllersNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*corev1.ReplicationControllerList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ReplicationControllerClusterExpansion
 }
 
 type replicationControllersClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *replicationControllersClusterInterface) Watch(ctx context.Context, opts
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ReplicationControllers(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ReplicationControllersNamespacer can scope to objects within a namespace, returning a corev1client.ReplicationControllerInterface.
+// ReplicationControllersNamespacer can scope to objects within a namespace, returning a typedcorev1.ReplicationControllerInterface.
 type ReplicationControllersNamespacer interface {
-	Namespace(string) corev1client.ReplicationControllerInterface
+	Namespace(string) typedcorev1.ReplicationControllerInterface
 }
 
 type replicationControllersNamespacer struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *replicationControllersNamespacer) Namespace(namespace string) corev1client.ReplicationControllerInterface {
+func (n *replicationControllersNamespacer) Namespace(namespace string) typedcorev1.ReplicationControllerInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).ReplicationControllers(namespace)
 }
diff --git a/kubernetes/typed/core/v1/resourcequota.go b/kubernetes/typed/core/v1/resourcequota.go
index 111e22e57..6d4685628 100644
--- a/kubernetes/typed/core/v1/resourcequota.go
+++ b/kubernetes/typed/core/v1/resourcequota.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ResourceQuotasClusterGetter has a method to return a ResourceQuotaClusterInterface.
@@ -45,10 +42,11 @@ type ResourceQuotaClusterInterface interface {
 	Cluster(logicalcluster.Path) ResourceQuotasNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*corev1.ResourceQuotaList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ResourceQuotaClusterExpansion
 }
 
 type resourceQuotasClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *resourceQuotasClusterInterface) Watch(ctx context.Context, opts metav1.
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceQuotas(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ResourceQuotasNamespacer can scope to objects within a namespace, returning a corev1client.ResourceQuotaInterface.
+// ResourceQuotasNamespacer can scope to objects within a namespace, returning a typedcorev1.ResourceQuotaInterface.
 type ResourceQuotasNamespacer interface {
-	Namespace(string) corev1client.ResourceQuotaInterface
+	Namespace(string) typedcorev1.ResourceQuotaInterface
 }
 
 type resourceQuotasNamespacer struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *resourceQuotasNamespacer) Namespace(namespace string) corev1client.ResourceQuotaInterface {
+func (n *resourceQuotasNamespacer) Namespace(namespace string) typedcorev1.ResourceQuotaInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).ResourceQuotas(namespace)
 }
diff --git a/kubernetes/typed/core/v1/secret.go b/kubernetes/typed/core/v1/secret.go
index f65d7c4d9..01300d33f 100644
--- a/kubernetes/typed/core/v1/secret.go
+++ b/kubernetes/typed/core/v1/secret.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // SecretsClusterGetter has a method to return a SecretClusterInterface.
@@ -45,10 +42,11 @@ type SecretClusterInterface interface {
 	Cluster(logicalcluster.Path) SecretsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*corev1.SecretList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	SecretClusterExpansion
 }
 
 type secretsClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *secretsClusterInterface) Watch(ctx context.Context, opts metav1.ListOpt
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Secrets(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// SecretsNamespacer can scope to objects within a namespace, returning a corev1client.SecretInterface.
+// SecretsNamespacer can scope to objects within a namespace, returning a typedcorev1.SecretInterface.
 type SecretsNamespacer interface {
-	Namespace(string) corev1client.SecretInterface
+	Namespace(string) typedcorev1.SecretInterface
 }
 
 type secretsNamespacer struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *secretsNamespacer) Namespace(namespace string) corev1client.SecretInterface {
+func (n *secretsNamespacer) Namespace(namespace string) typedcorev1.SecretInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Secrets(namespace)
 }
diff --git a/kubernetes/typed/core/v1/service.go b/kubernetes/typed/core/v1/service.go
index 780aabb35..a430fd9dc 100644
--- a/kubernetes/typed/core/v1/service.go
+++ b/kubernetes/typed/core/v1/service.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ServicesClusterGetter has a method to return a ServiceClusterInterface.
@@ -45,10 +42,11 @@ type ServiceClusterInterface interface {
 	Cluster(logicalcluster.Path) ServicesNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*corev1.ServiceList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ServiceClusterExpansion
 }
 
 type servicesClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *servicesClusterInterface) Watch(ctx context.Context, opts metav1.ListOp
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Services(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ServicesNamespacer can scope to objects within a namespace, returning a corev1client.ServiceInterface.
+// ServicesNamespacer can scope to objects within a namespace, returning a typedcorev1.ServiceInterface.
 type ServicesNamespacer interface {
-	Namespace(string) corev1client.ServiceInterface
+	Namespace(string) typedcorev1.ServiceInterface
 }
 
 type servicesNamespacer struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *servicesNamespacer) Namespace(namespace string) corev1client.ServiceInterface {
+func (n *servicesNamespacer) Namespace(namespace string) typedcorev1.ServiceInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Services(namespace)
 }
diff --git a/kubernetes/typed/core/v1/serviceaccount.go b/kubernetes/typed/core/v1/serviceaccount.go
index 6325a0338..ffdfef9dd 100644
--- a/kubernetes/typed/core/v1/serviceaccount.go
+++ b/kubernetes/typed/core/v1/serviceaccount.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ServiceAccountsClusterGetter has a method to return a ServiceAccountClusterInterface.
@@ -45,10 +42,11 @@ type ServiceAccountClusterInterface interface {
 	Cluster(logicalcluster.Path) ServiceAccountsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*corev1.ServiceAccountList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ServiceAccountClusterExpansion
 }
 
 type serviceAccountsClusterInterface struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *serviceAccountsClusterInterface) Watch(ctx context.Context, opts metav1
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ServiceAccounts(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ServiceAccountsNamespacer can scope to objects within a namespace, returning a corev1client.ServiceAccountInterface.
+// ServiceAccountsNamespacer can scope to objects within a namespace, returning a typedcorev1.ServiceAccountInterface.
 type ServiceAccountsNamespacer interface {
-	Namespace(string) corev1client.ServiceAccountInterface
+	Namespace(string) typedcorev1.ServiceAccountInterface
 }
 
 type serviceAccountsNamespacer struct {
-	clientCache kcpclient.Cache[*corev1client.CoreV1Client]
+	clientCache kcpclient.Cache[*typedcorev1.CoreV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *serviceAccountsNamespacer) Namespace(namespace string) corev1client.ServiceAccountInterface {
+func (n *serviceAccountsNamespacer) Namespace(namespace string) typedcorev1.ServiceAccountInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).ServiceAccounts(namespace)
 }
diff --git a/kubernetes/typed/discovery/v1/discovery_client.go b/kubernetes/typed/discovery/v1/discovery_client.go
index bdc5517b1..031536f37 100644
--- a/kubernetes/typed/discovery/v1/discovery_client.go
+++ b/kubernetes/typed/discovery/v1/discovery_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apidiscoveryv1 "k8s.io/api/discovery/v1"
+	discoveryv1 "k8s.io/client-go/kubernetes/typed/discovery/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	discoveryv1 "k8s.io/client-go/kubernetes/typed/discovery/v1"
-	"k8s.io/client-go/rest"
 )
 
 type DiscoveryV1ClusterInterface interface {
@@ -40,6 +39,7 @@ type DiscoveryV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) discoveryv1.DiscoveryV1Interface
 }
 
+// DiscoveryV1ClusterClient is used to interact with features provided by the discovery.k8s.io group.
 type DiscoveryV1ClusterClient struct {
 	clientCache kcpclient.Cache[*discoveryv1.DiscoveryV1Client]
 }
@@ -59,11 +59,13 @@ func (c *DiscoveryV1ClusterClient) EndpointSlices() EndpointSliceClusterInterfac
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*DiscoveryV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new DiscoveryV1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*DiscoveryV1ClusterC
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &DiscoveryV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *DiscoveryV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apidiscoveryv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/discovery/v1/doc.go b/kubernetes/typed/discovery/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/discovery/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/discovery/v1/endpointslice.go b/kubernetes/typed/discovery/v1/endpointslice.go
index bbccaf561..083ecb9bc 100644
--- a/kubernetes/typed/discovery/v1/endpointslice.go
+++ b/kubernetes/typed/discovery/v1/endpointslice.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	discoveryv1 "k8s.io/api/discovery/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	discoveryv1client "k8s.io/client-go/kubernetes/typed/discovery/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typeddiscoveryv1 "k8s.io/client-go/kubernetes/typed/discovery/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // EndpointSlicesClusterGetter has a method to return a EndpointSliceClusterInterface.
@@ -45,10 +42,11 @@ type EndpointSliceClusterInterface interface {
 	Cluster(logicalcluster.Path) EndpointSlicesNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*discoveryv1.EndpointSliceList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	EndpointSliceClusterExpansion
 }
 
 type endpointSlicesClusterInterface struct {
-	clientCache kcpclient.Cache[*discoveryv1client.DiscoveryV1Client]
+	clientCache kcpclient.Cache[*typeddiscoveryv1.DiscoveryV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *endpointSlicesClusterInterface) Watch(ctx context.Context, opts metav1.
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).EndpointSlices(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// EndpointSlicesNamespacer can scope to objects within a namespace, returning a discoveryv1client.EndpointSliceInterface.
+// EndpointSlicesNamespacer can scope to objects within a namespace, returning a typeddiscoveryv1.EndpointSliceInterface.
 type EndpointSlicesNamespacer interface {
-	Namespace(string) discoveryv1client.EndpointSliceInterface
+	Namespace(string) typeddiscoveryv1.EndpointSliceInterface
 }
 
 type endpointSlicesNamespacer struct {
-	clientCache kcpclient.Cache[*discoveryv1client.DiscoveryV1Client]
+	clientCache kcpclient.Cache[*typeddiscoveryv1.DiscoveryV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *endpointSlicesNamespacer) Namespace(namespace string) discoveryv1client.EndpointSliceInterface {
+func (n *endpointSlicesNamespacer) Namespace(namespace string) typeddiscoveryv1.EndpointSliceInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).EndpointSlices(namespace)
 }
diff --git a/kubernetes/typed/discovery/v1/fake/discovery_client.go b/kubernetes/typed/discovery/v1/fake/discovery_client.go
index dbd73426d..3ba87aefd 100644
--- a/kubernetes/typed/discovery/v1/fake/discovery_client.go
+++ b/kubernetes/typed/discovery/v1/fake/discovery_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	discoveryv1 "k8s.io/client-go/kubernetes/typed/discovery/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpdiscoveryv1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpdiscoveryv1.DiscoveryV1ClusterInterface = (*DiscoveryV1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *DiscoveryV1ClusterClient) Cluster(clusterPath logicalcluster.Path) disc
 }
 
 func (c *DiscoveryV1ClusterClient) EndpointSlices() kcpdiscoveryv1.EndpointSliceClusterInterface {
-	return &endpointSlicesClusterClient{Fake: c.Fake}
+	return newFakeEndpointSliceClusterClient(c)
 }
 
-var _ discoveryv1.DiscoveryV1Interface = (*DiscoveryV1Client)(nil)
-
 type DiscoveryV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *DiscoveryV1Client) EndpointSlices(namespace string) discoveryv1.EndpointSliceInterface {
+	return newFakeEndpointSliceClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *DiscoveryV1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *DiscoveryV1Client) EndpointSlices(namespace string) discoveryv1.EndpointSliceInterface {
-	return &endpointSlicesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
diff --git a/kubernetes/typed/discovery/v1/fake/doc.go b/kubernetes/typed/discovery/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/discovery/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/discovery/v1/fake/endpointslice.go b/kubernetes/typed/discovery/v1/fake/endpointslice.go
index 676b5185b..888c2dd08 100644
--- a/kubernetes/typed/discovery/v1/fake/endpointslice.go
+++ b/kubernetes/typed/discovery/v1/fake/endpointslice.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	discoveryv1 "k8s.io/api/discovery/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsdiscoveryv1 "k8s.io/client-go/applyconfigurations/discovery/v1"
-	discoveryv1client "k8s.io/client-go/kubernetes/typed/discovery/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/discovery/v1"
+	typeddiscoveryv1 "k8s.io/client-go/kubernetes/typed/discovery/v1"
 
-	kcpdiscoveryv1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1"
+	typedkcpdiscoveryv1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var endpointSlicesResource = schema.GroupVersionResource{Group: "discovery.k8s.io", Version: "v1", Resource: "endpointslices"}
-var endpointSlicesKind = schema.GroupVersionKind{Group: "discovery.k8s.io", Version: "v1", Kind: "EndpointSlice"}
-
-type endpointSlicesClusterClient struct {
-	*kcptesting.Fake
+// endpointSliceClusterClient implements EndpointSliceClusterInterface
+type endpointSliceClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*discoveryv1.EndpointSlice, *discoveryv1.EndpointSliceList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *endpointSlicesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpdiscoveryv1.EndpointSlicesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &endpointSlicesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of EndpointSlices that match those selectors across all clusters.
-func (c *endpointSlicesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*discoveryv1.EndpointSliceList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(endpointSlicesResource, endpointSlicesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &discoveryv1.EndpointSliceList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeEndpointSliceClusterClient(fake *DiscoveryV1ClusterClient) typedkcpdiscoveryv1.EndpointSliceClusterInterface {
+	return &endpointSliceClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*discoveryv1.EndpointSlice, *discoveryv1.EndpointSliceList](
+			fake.Fake,
+			discoveryv1.SchemeGroupVersion.WithResource("endpointslices"),
+			discoveryv1.SchemeGroupVersion.WithKind("EndpointSlice"),
+			func() *discoveryv1.EndpointSlice { return &discoveryv1.EndpointSlice{} },
+			func() *discoveryv1.EndpointSliceList { return &discoveryv1.EndpointSliceList{} },
+			func(dst, src *discoveryv1.EndpointSliceList) { dst.ListMeta = src.ListMeta },
+			func(list *discoveryv1.EndpointSliceList) []*discoveryv1.EndpointSlice {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *discoveryv1.EndpointSliceList, items []*discoveryv1.EndpointSlice) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &discoveryv1.EndpointSliceList{ListMeta: obj.(*discoveryv1.EndpointSliceList).ListMeta}
-	for _, item := range obj.(*discoveryv1.EndpointSliceList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested EndpointSlices across all clusters.
-func (c *endpointSlicesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(endpointSlicesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *endpointSliceClusterClient) Cluster(cluster logicalcluster.Path) typedkcpdiscoveryv1.EndpointSlicesNamespacer {
+	return &endpointSliceNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type endpointSlicesNamespacer struct {
+type endpointSliceNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *endpointSlicesNamespacer) Namespace(namespace string) discoveryv1client.EndpointSliceInterface {
-	return &endpointSlicesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *endpointSliceNamespacer) Namespace(namespace string) typeddiscoveryv1.EndpointSliceInterface {
+	return newFakeEndpointSliceClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type endpointSlicesClient struct {
-	*kcptesting.Fake
+// endpointSliceScopedClient implements EndpointSliceInterface
+type endpointSliceScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*discoveryv1.EndpointSlice, *discoveryv1.EndpointSliceList, *v1.EndpointSliceApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *endpointSlicesClient) Create(ctx context.Context, endpointSlice *discoveryv1.EndpointSlice, opts metav1.CreateOptions) (*discoveryv1.EndpointSlice, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(endpointSlicesResource, c.ClusterPath, c.Namespace, endpointSlice), &discoveryv1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*discoveryv1.EndpointSlice), err
-}
-
-func (c *endpointSlicesClient) Update(ctx context.Context, endpointSlice *discoveryv1.EndpointSlice, opts metav1.UpdateOptions) (*discoveryv1.EndpointSlice, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(endpointSlicesResource, c.ClusterPath, c.Namespace, endpointSlice), &discoveryv1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*discoveryv1.EndpointSlice), err
-}
-
-func (c *endpointSlicesClient) UpdateStatus(ctx context.Context, endpointSlice *discoveryv1.EndpointSlice, opts metav1.UpdateOptions) (*discoveryv1.EndpointSlice, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(endpointSlicesResource, c.ClusterPath, "status", c.Namespace, endpointSlice), &discoveryv1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*discoveryv1.EndpointSlice), err
-}
-
-func (c *endpointSlicesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(endpointSlicesResource, c.ClusterPath, c.Namespace, name, opts), &discoveryv1.EndpointSlice{})
-	return err
 }
 
-func (c *endpointSlicesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(endpointSlicesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &discoveryv1.EndpointSliceList{})
-	return err
-}
-
-func (c *endpointSlicesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*discoveryv1.EndpointSlice, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(endpointSlicesResource, c.ClusterPath, c.Namespace, name), &discoveryv1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*discoveryv1.EndpointSlice), err
-}
-
-// List takes label and field selectors, and returns the list of EndpointSlices that match those selectors.
-func (c *endpointSlicesClient) List(ctx context.Context, opts metav1.ListOptions) (*discoveryv1.EndpointSliceList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(endpointSlicesResource, endpointSlicesKind, c.ClusterPath, c.Namespace, opts), &discoveryv1.EndpointSliceList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &discoveryv1.EndpointSliceList{ListMeta: obj.(*discoveryv1.EndpointSliceList).ListMeta}
-	for _, item := range obj.(*discoveryv1.EndpointSliceList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *endpointSlicesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(endpointSlicesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *endpointSlicesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*discoveryv1.EndpointSlice, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(endpointSlicesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &discoveryv1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*discoveryv1.EndpointSlice), err
-}
-
-func (c *endpointSlicesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsdiscoveryv1.EndpointSliceApplyConfiguration, opts metav1.ApplyOptions) (*discoveryv1.EndpointSlice, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(endpointSlicesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &discoveryv1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*discoveryv1.EndpointSlice), err
-}
-
-func (c *endpointSlicesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsdiscoveryv1.EndpointSliceApplyConfiguration, opts metav1.ApplyOptions) (*discoveryv1.EndpointSlice, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(endpointSlicesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &discoveryv1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
+func newFakeEndpointSliceClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typeddiscoveryv1.EndpointSliceInterface {
+	return &endpointSliceScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*discoveryv1.EndpointSlice, *discoveryv1.EndpointSliceList, *v1.EndpointSliceApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			discoveryv1.SchemeGroupVersion.WithResource("endpointslices"),
+			discoveryv1.SchemeGroupVersion.WithKind("EndpointSlice"),
+			func() *discoveryv1.EndpointSlice { return &discoveryv1.EndpointSlice{} },
+			func() *discoveryv1.EndpointSliceList { return &discoveryv1.EndpointSliceList{} },
+			func(dst, src *discoveryv1.EndpointSliceList) { dst.ListMeta = src.ListMeta },
+			func(list *discoveryv1.EndpointSliceList) []*discoveryv1.EndpointSlice {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *discoveryv1.EndpointSliceList, items []*discoveryv1.EndpointSlice) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*discoveryv1.EndpointSlice), err
 }
diff --git a/kubernetes/typed/discovery/v1/generated_expansion.go b/kubernetes/typed/discovery/v1/generated_expansion.go
new file mode 100644
index 000000000..24479f340
--- /dev/null
+++ b/kubernetes/typed/discovery/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type EndpointSliceClusterExpansion interface{}
diff --git a/kubernetes/typed/discovery/v1beta1/discovery_client.go b/kubernetes/typed/discovery/v1beta1/discovery_client.go
index bd3948fd1..8da03d6aa 100644
--- a/kubernetes/typed/discovery/v1beta1/discovery_client.go
+++ b/kubernetes/typed/discovery/v1beta1/discovery_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apidiscoveryv1beta1 "k8s.io/api/discovery/v1beta1"
+	discoveryv1beta1 "k8s.io/client-go/kubernetes/typed/discovery/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	discoveryv1beta1 "k8s.io/client-go/kubernetes/typed/discovery/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type DiscoveryV1beta1ClusterInterface interface {
@@ -40,6 +39,7 @@ type DiscoveryV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) discoveryv1beta1.DiscoveryV1beta1Interface
 }
 
+// DiscoveryV1beta1ClusterClient is used to interact with features provided by the discovery.k8s.io group.
 type DiscoveryV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*discoveryv1beta1.DiscoveryV1beta1Client]
 }
@@ -59,11 +59,13 @@ func (c *DiscoveryV1beta1ClusterClient) EndpointSlices() EndpointSliceClusterInt
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*DiscoveryV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new DiscoveryV1beta1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*DiscoveryV1beta1Clu
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &DiscoveryV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *DiscoveryV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apidiscoveryv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/discovery/v1beta1/doc.go b/kubernetes/typed/discovery/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/discovery/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/discovery/v1beta1/endpointslice.go b/kubernetes/typed/discovery/v1beta1/endpointslice.go
index 6143ef269..1b97a1d03 100644
--- a/kubernetes/typed/discovery/v1beta1/endpointslice.go
+++ b/kubernetes/typed/discovery/v1beta1/endpointslice.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	discoveryv1beta1 "k8s.io/api/discovery/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typeddiscoveryv1beta1 "k8s.io/client-go/kubernetes/typed/discovery/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	discoveryv1beta1 "k8s.io/api/discovery/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	discoveryv1beta1client "k8s.io/client-go/kubernetes/typed/discovery/v1beta1"
 )
 
 // EndpointSlicesClusterGetter has a method to return a EndpointSliceClusterInterface.
@@ -43,12 +40,13 @@ type EndpointSlicesClusterGetter interface {
 // or scope down to one cluster and return a EndpointSlicesNamespacer.
 type EndpointSliceClusterInterface interface {
 	Cluster(logicalcluster.Path) EndpointSlicesNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*discoveryv1beta1.EndpointSliceList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*discoveryv1beta1.EndpointSliceList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	EndpointSliceClusterExpansion
 }
 
 type endpointSlicesClusterInterface struct {
-	clientCache kcpclient.Cache[*discoveryv1beta1client.DiscoveryV1beta1Client]
+	clientCache kcpclient.Cache[*typeddiscoveryv1beta1.DiscoveryV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *endpointSlicesClusterInterface) Cluster(clusterPath logicalcluster.Path
 }
 
 // List returns the entire collection of all EndpointSlices across all clusters.
-func (c *endpointSlicesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*discoveryv1beta1.EndpointSliceList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).EndpointSlices(metav1.NamespaceAll).List(ctx, opts)
+func (c *endpointSlicesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*discoveryv1beta1.EndpointSliceList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).EndpointSlices(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all EndpointSlices across all clusters.
-func (c *endpointSlicesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).EndpointSlices(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *endpointSlicesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).EndpointSlices(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// EndpointSlicesNamespacer can scope to objects within a namespace, returning a discoveryv1beta1client.EndpointSliceInterface.
+// EndpointSlicesNamespacer can scope to objects within a namespace, returning a typeddiscoveryv1beta1.EndpointSliceInterface.
 type EndpointSlicesNamespacer interface {
-	Namespace(string) discoveryv1beta1client.EndpointSliceInterface
+	Namespace(string) typeddiscoveryv1beta1.EndpointSliceInterface
 }
 
 type endpointSlicesNamespacer struct {
-	clientCache kcpclient.Cache[*discoveryv1beta1client.DiscoveryV1beta1Client]
+	clientCache kcpclient.Cache[*typeddiscoveryv1beta1.DiscoveryV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *endpointSlicesNamespacer) Namespace(namespace string) discoveryv1beta1client.EndpointSliceInterface {
+func (n *endpointSlicesNamespacer) Namespace(namespace string) typeddiscoveryv1beta1.EndpointSliceInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).EndpointSlices(namespace)
 }
diff --git a/kubernetes/typed/discovery/v1beta1/fake/discovery_client.go b/kubernetes/typed/discovery/v1beta1/fake/discovery_client.go
index 3cf40b586..39458cd62 100644
--- a/kubernetes/typed/discovery/v1beta1/fake/discovery_client.go
+++ b/kubernetes/typed/discovery/v1beta1/fake/discovery_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	discoveryv1beta1 "k8s.io/client-go/kubernetes/typed/discovery/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpdiscoveryv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpdiscoveryv1beta1.DiscoveryV1beta1ClusterInterface = (*DiscoveryV1beta1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *DiscoveryV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path)
 }
 
 func (c *DiscoveryV1beta1ClusterClient) EndpointSlices() kcpdiscoveryv1beta1.EndpointSliceClusterInterface {
-	return &endpointSlicesClusterClient{Fake: c.Fake}
+	return newFakeEndpointSliceClusterClient(c)
 }
 
-var _ discoveryv1beta1.DiscoveryV1beta1Interface = (*DiscoveryV1beta1Client)(nil)
-
 type DiscoveryV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *DiscoveryV1beta1Client) EndpointSlices(namespace string) discoveryv1beta1.EndpointSliceInterface {
+	return newFakeEndpointSliceClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *DiscoveryV1beta1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *DiscoveryV1beta1Client) EndpointSlices(namespace string) discoveryv1beta1.EndpointSliceInterface {
-	return &endpointSlicesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
diff --git a/kubernetes/typed/discovery/v1beta1/fake/doc.go b/kubernetes/typed/discovery/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/discovery/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/discovery/v1beta1/fake/endpointslice.go b/kubernetes/typed/discovery/v1beta1/fake/endpointslice.go
index fc8a28e32..a0babfe1f 100644
--- a/kubernetes/typed/discovery/v1beta1/fake/endpointslice.go
+++ b/kubernetes/typed/discovery/v1beta1/fake/endpointslice.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	discoveryv1beta1 "k8s.io/api/discovery/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsdiscoveryv1beta1 "k8s.io/client-go/applyconfigurations/discovery/v1beta1"
-	discoveryv1beta1client "k8s.io/client-go/kubernetes/typed/discovery/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/discovery/v1beta1"
+	typeddiscoveryv1beta1 "k8s.io/client-go/kubernetes/typed/discovery/v1beta1"
 
-	kcpdiscoveryv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1beta1"
+	typedkcpdiscoveryv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/discovery/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var endpointSlicesResource = schema.GroupVersionResource{Group: "discovery.k8s.io", Version: "v1beta1", Resource: "endpointslices"}
-var endpointSlicesKind = schema.GroupVersionKind{Group: "discovery.k8s.io", Version: "v1beta1", Kind: "EndpointSlice"}
-
-type endpointSlicesClusterClient struct {
-	*kcptesting.Fake
+// endpointSliceClusterClient implements EndpointSliceClusterInterface
+type endpointSliceClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*discoveryv1beta1.EndpointSlice, *discoveryv1beta1.EndpointSliceList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *endpointSlicesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpdiscoveryv1beta1.EndpointSlicesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &endpointSlicesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of EndpointSlices that match those selectors across all clusters.
-func (c *endpointSlicesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*discoveryv1beta1.EndpointSliceList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(endpointSlicesResource, endpointSlicesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &discoveryv1beta1.EndpointSliceList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeEndpointSliceClusterClient(fake *DiscoveryV1beta1ClusterClient) typedkcpdiscoveryv1beta1.EndpointSliceClusterInterface {
+	return &endpointSliceClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*discoveryv1beta1.EndpointSlice, *discoveryv1beta1.EndpointSliceList](
+			fake.Fake,
+			discoveryv1beta1.SchemeGroupVersion.WithResource("endpointslices"),
+			discoveryv1beta1.SchemeGroupVersion.WithKind("EndpointSlice"),
+			func() *discoveryv1beta1.EndpointSlice { return &discoveryv1beta1.EndpointSlice{} },
+			func() *discoveryv1beta1.EndpointSliceList { return &discoveryv1beta1.EndpointSliceList{} },
+			func(dst, src *discoveryv1beta1.EndpointSliceList) { dst.ListMeta = src.ListMeta },
+			func(list *discoveryv1beta1.EndpointSliceList) []*discoveryv1beta1.EndpointSlice {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *discoveryv1beta1.EndpointSliceList, items []*discoveryv1beta1.EndpointSlice) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &discoveryv1beta1.EndpointSliceList{ListMeta: obj.(*discoveryv1beta1.EndpointSliceList).ListMeta}
-	for _, item := range obj.(*discoveryv1beta1.EndpointSliceList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested EndpointSlices across all clusters.
-func (c *endpointSlicesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(endpointSlicesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *endpointSliceClusterClient) Cluster(cluster logicalcluster.Path) typedkcpdiscoveryv1beta1.EndpointSlicesNamespacer {
+	return &endpointSliceNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type endpointSlicesNamespacer struct {
+type endpointSliceNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *endpointSlicesNamespacer) Namespace(namespace string) discoveryv1beta1client.EndpointSliceInterface {
-	return &endpointSlicesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *endpointSliceNamespacer) Namespace(namespace string) typeddiscoveryv1beta1.EndpointSliceInterface {
+	return newFakeEndpointSliceClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type endpointSlicesClient struct {
-	*kcptesting.Fake
+// endpointSliceScopedClient implements EndpointSliceInterface
+type endpointSliceScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*discoveryv1beta1.EndpointSlice, *discoveryv1beta1.EndpointSliceList, *v1beta1.EndpointSliceApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *endpointSlicesClient) Create(ctx context.Context, endpointSlice *discoveryv1beta1.EndpointSlice, opts metav1.CreateOptions) (*discoveryv1beta1.EndpointSlice, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(endpointSlicesResource, c.ClusterPath, c.Namespace, endpointSlice), &discoveryv1beta1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*discoveryv1beta1.EndpointSlice), err
-}
-
-func (c *endpointSlicesClient) Update(ctx context.Context, endpointSlice *discoveryv1beta1.EndpointSlice, opts metav1.UpdateOptions) (*discoveryv1beta1.EndpointSlice, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(endpointSlicesResource, c.ClusterPath, c.Namespace, endpointSlice), &discoveryv1beta1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*discoveryv1beta1.EndpointSlice), err
-}
-
-func (c *endpointSlicesClient) UpdateStatus(ctx context.Context, endpointSlice *discoveryv1beta1.EndpointSlice, opts metav1.UpdateOptions) (*discoveryv1beta1.EndpointSlice, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(endpointSlicesResource, c.ClusterPath, "status", c.Namespace, endpointSlice), &discoveryv1beta1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*discoveryv1beta1.EndpointSlice), err
-}
-
-func (c *endpointSlicesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(endpointSlicesResource, c.ClusterPath, c.Namespace, name, opts), &discoveryv1beta1.EndpointSlice{})
-	return err
 }
 
-func (c *endpointSlicesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(endpointSlicesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &discoveryv1beta1.EndpointSliceList{})
-	return err
-}
-
-func (c *endpointSlicesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*discoveryv1beta1.EndpointSlice, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(endpointSlicesResource, c.ClusterPath, c.Namespace, name), &discoveryv1beta1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*discoveryv1beta1.EndpointSlice), err
-}
-
-// List takes label and field selectors, and returns the list of EndpointSlices that match those selectors.
-func (c *endpointSlicesClient) List(ctx context.Context, opts metav1.ListOptions) (*discoveryv1beta1.EndpointSliceList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(endpointSlicesResource, endpointSlicesKind, c.ClusterPath, c.Namespace, opts), &discoveryv1beta1.EndpointSliceList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &discoveryv1beta1.EndpointSliceList{ListMeta: obj.(*discoveryv1beta1.EndpointSliceList).ListMeta}
-	for _, item := range obj.(*discoveryv1beta1.EndpointSliceList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *endpointSlicesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(endpointSlicesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *endpointSlicesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*discoveryv1beta1.EndpointSlice, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(endpointSlicesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &discoveryv1beta1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*discoveryv1beta1.EndpointSlice), err
-}
-
-func (c *endpointSlicesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsdiscoveryv1beta1.EndpointSliceApplyConfiguration, opts metav1.ApplyOptions) (*discoveryv1beta1.EndpointSlice, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(endpointSlicesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &discoveryv1beta1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*discoveryv1beta1.EndpointSlice), err
-}
-
-func (c *endpointSlicesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsdiscoveryv1beta1.EndpointSliceApplyConfiguration, opts metav1.ApplyOptions) (*discoveryv1beta1.EndpointSlice, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(endpointSlicesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &discoveryv1beta1.EndpointSlice{})
-	if obj == nil {
-		return nil, err
+func newFakeEndpointSliceClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typeddiscoveryv1beta1.EndpointSliceInterface {
+	return &endpointSliceScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*discoveryv1beta1.EndpointSlice, *discoveryv1beta1.EndpointSliceList, *v1beta1.EndpointSliceApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			discoveryv1beta1.SchemeGroupVersion.WithResource("endpointslices"),
+			discoveryv1beta1.SchemeGroupVersion.WithKind("EndpointSlice"),
+			func() *discoveryv1beta1.EndpointSlice { return &discoveryv1beta1.EndpointSlice{} },
+			func() *discoveryv1beta1.EndpointSliceList { return &discoveryv1beta1.EndpointSliceList{} },
+			func(dst, src *discoveryv1beta1.EndpointSliceList) { dst.ListMeta = src.ListMeta },
+			func(list *discoveryv1beta1.EndpointSliceList) []*discoveryv1beta1.EndpointSlice {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *discoveryv1beta1.EndpointSliceList, items []*discoveryv1beta1.EndpointSlice) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*discoveryv1beta1.EndpointSlice), err
 }
diff --git a/kubernetes/typed/discovery/v1beta1/generated_expansion.go b/kubernetes/typed/discovery/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..f3043d806
--- /dev/null
+++ b/kubernetes/typed/discovery/v1beta1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type EndpointSliceClusterExpansion interface{}
diff --git a/kubernetes/typed/events/v1/doc.go b/kubernetes/typed/events/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/events/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/events/v1/event.go b/kubernetes/typed/events/v1/event.go
index b71dbd717..dbb678a1d 100644
--- a/kubernetes/typed/events/v1/event.go
+++ b/kubernetes/typed/events/v1/event.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	eventsv1 "k8s.io/api/events/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	eventsv1client "k8s.io/client-go/kubernetes/typed/events/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedeventsv1 "k8s.io/client-go/kubernetes/typed/events/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // EventsClusterGetter has a method to return a EventClusterInterface.
@@ -45,10 +42,11 @@ type EventClusterInterface interface {
 	Cluster(logicalcluster.Path) EventsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*eventsv1.EventList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	EventClusterExpansion
 }
 
 type eventsClusterInterface struct {
-	clientCache kcpclient.Cache[*eventsv1client.EventsV1Client]
+	clientCache kcpclient.Cache[*typedeventsv1.EventsV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *eventsClusterInterface) Watch(ctx context.Context, opts metav1.ListOpti
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Events(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// EventsNamespacer can scope to objects within a namespace, returning a eventsv1client.EventInterface.
+// EventsNamespacer can scope to objects within a namespace, returning a typedeventsv1.EventInterface.
 type EventsNamespacer interface {
-	Namespace(string) eventsv1client.EventInterface
+	Namespace(string) typedeventsv1.EventInterface
 }
 
 type eventsNamespacer struct {
-	clientCache kcpclient.Cache[*eventsv1client.EventsV1Client]
+	clientCache kcpclient.Cache[*typedeventsv1.EventsV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *eventsNamespacer) Namespace(namespace string) eventsv1client.EventInterface {
+func (n *eventsNamespacer) Namespace(namespace string) typedeventsv1.EventInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Events(namespace)
 }
diff --git a/kubernetes/typed/events/v1/events_client.go b/kubernetes/typed/events/v1/events_client.go
index 1e0d75f81..b16abbf86 100644
--- a/kubernetes/typed/events/v1/events_client.go
+++ b/kubernetes/typed/events/v1/events_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apieventsv1 "k8s.io/api/events/v1"
+	eventsv1 "k8s.io/client-go/kubernetes/typed/events/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	eventsv1 "k8s.io/client-go/kubernetes/typed/events/v1"
-	"k8s.io/client-go/rest"
 )
 
 type EventsV1ClusterInterface interface {
@@ -40,6 +39,7 @@ type EventsV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) eventsv1.EventsV1Interface
 }
 
+// EventsV1ClusterClient is used to interact with features provided by the events.k8s.io group.
 type EventsV1ClusterClient struct {
 	clientCache kcpclient.Cache[*eventsv1.EventsV1Client]
 }
@@ -59,11 +59,13 @@ func (c *EventsV1ClusterClient) Events() EventClusterInterface {
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*EventsV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new EventsV1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*EventsV1ClusterClie
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &EventsV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *EventsV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apieventsv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/events/v1/fake/doc.go b/kubernetes/typed/events/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/events/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/events/v1/fake/event.go b/kubernetes/typed/events/v1/fake/event.go
index bc0891b6e..3ce4c11d0 100644
--- a/kubernetes/typed/events/v1/fake/event.go
+++ b/kubernetes/typed/events/v1/fake/event.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,82 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	eventsv1 "k8s.io/api/events/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationseventsv1 "k8s.io/client-go/applyconfigurations/events/v1"
-	eventsv1client "k8s.io/client-go/kubernetes/typed/events/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/events/v1"
+	typedeventsv1 "k8s.io/client-go/kubernetes/typed/events/v1"
 
-	kcpeventsv1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1"
+	typedkcpeventsv1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var eventsResource = schema.GroupVersionResource{Group: "events.k8s.io", Version: "v1", Resource: "events"}
-var eventsKind = schema.GroupVersionKind{Group: "events.k8s.io", Version: "v1", Kind: "Event"}
-
-type eventsClusterClient struct {
-	*kcptesting.Fake
+// eventClusterClient implements EventClusterInterface
+type eventClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*eventsv1.Event, *eventsv1.EventList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *eventsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpeventsv1.EventsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &eventsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Events that match those selectors across all clusters.
-func (c *eventsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*eventsv1.EventList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(eventsResource, eventsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &eventsv1.EventList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeEventClusterClient(fake *EventsV1ClusterClient) typedkcpeventsv1.EventClusterInterface {
+	return &eventClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*eventsv1.Event, *eventsv1.EventList](
+			fake.Fake,
+			eventsv1.SchemeGroupVersion.WithResource("events"),
+			eventsv1.SchemeGroupVersion.WithKind("Event"),
+			func() *eventsv1.Event { return &eventsv1.Event{} },
+			func() *eventsv1.EventList { return &eventsv1.EventList{} },
+			func(dst, src *eventsv1.EventList) { dst.ListMeta = src.ListMeta },
+			func(list *eventsv1.EventList) []*eventsv1.Event { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *eventsv1.EventList, items []*eventsv1.Event) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &eventsv1.EventList{ListMeta: obj.(*eventsv1.EventList).ListMeta}
-	for _, item := range obj.(*eventsv1.EventList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Events across all clusters.
-func (c *eventsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(eventsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *eventClusterClient) Cluster(cluster logicalcluster.Path) typedkcpeventsv1.EventsNamespacer {
+	return &eventNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type eventsNamespacer struct {
+type eventNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *eventsNamespacer) Namespace(namespace string) eventsv1client.EventInterface {
-	return &eventsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *eventNamespacer) Namespace(namespace string) typedeventsv1.EventInterface {
+	return newFakeEventClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type eventsClient struct {
-	*kcptesting.Fake
+// eventScopedClient implements EventInterface
+type eventScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*eventsv1.Event, *eventsv1.EventList, *v1.EventApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *eventsClient) Create(ctx context.Context, event *eventsv1.Event, opts metav1.CreateOptions) (*eventsv1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(eventsResource, c.ClusterPath, c.Namespace, event), &eventsv1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*eventsv1.Event), err
-}
-
-func (c *eventsClient) Update(ctx context.Context, event *eventsv1.Event, opts metav1.UpdateOptions) (*eventsv1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(eventsResource, c.ClusterPath, c.Namespace, event), &eventsv1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*eventsv1.Event), err
-}
-
-func (c *eventsClient) UpdateStatus(ctx context.Context, event *eventsv1.Event, opts metav1.UpdateOptions) (*eventsv1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(eventsResource, c.ClusterPath, "status", c.Namespace, event), &eventsv1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*eventsv1.Event), err
-}
-
-func (c *eventsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(eventsResource, c.ClusterPath, c.Namespace, name, opts), &eventsv1.Event{})
-	return err
 }
 
-func (c *eventsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(eventsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &eventsv1.EventList{})
-	return err
-}
-
-func (c *eventsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*eventsv1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(eventsResource, c.ClusterPath, c.Namespace, name), &eventsv1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*eventsv1.Event), err
-}
-
-// List takes label and field selectors, and returns the list of Events that match those selectors.
-func (c *eventsClient) List(ctx context.Context, opts metav1.ListOptions) (*eventsv1.EventList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(eventsResource, eventsKind, c.ClusterPath, c.Namespace, opts), &eventsv1.EventList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &eventsv1.EventList{ListMeta: obj.(*eventsv1.EventList).ListMeta}
-	for _, item := range obj.(*eventsv1.EventList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *eventsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(eventsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *eventsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*eventsv1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(eventsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &eventsv1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*eventsv1.Event), err
-}
-
-func (c *eventsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationseventsv1.EventApplyConfiguration, opts metav1.ApplyOptions) (*eventsv1.Event, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(eventsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &eventsv1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*eventsv1.Event), err
-}
-
-func (c *eventsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationseventsv1.EventApplyConfiguration, opts metav1.ApplyOptions) (*eventsv1.Event, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(eventsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &eventsv1.Event{})
-	if obj == nil {
-		return nil, err
+func newFakeEventClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedeventsv1.EventInterface {
+	return &eventScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*eventsv1.Event, *eventsv1.EventList, *v1.EventApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			eventsv1.SchemeGroupVersion.WithResource("events"),
+			eventsv1.SchemeGroupVersion.WithKind("Event"),
+			func() *eventsv1.Event { return &eventsv1.Event{} },
+			func() *eventsv1.EventList { return &eventsv1.EventList{} },
+			func(dst, src *eventsv1.EventList) { dst.ListMeta = src.ListMeta },
+			func(list *eventsv1.EventList) []*eventsv1.Event { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *eventsv1.EventList, items []*eventsv1.Event) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*eventsv1.Event), err
 }
diff --git a/kubernetes/typed/events/v1/fake/events_client.go b/kubernetes/typed/events/v1/fake/events_client.go
index 4519ebb48..287a2dc5f 100644
--- a/kubernetes/typed/events/v1/fake/events_client.go
+++ b/kubernetes/typed/events/v1/fake/events_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	eventsv1 "k8s.io/client-go/kubernetes/typed/events/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpeventsv1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpeventsv1.EventsV1ClusterInterface = (*EventsV1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *EventsV1ClusterClient) Cluster(clusterPath logicalcluster.Path) eventsv
 }
 
 func (c *EventsV1ClusterClient) Events() kcpeventsv1.EventClusterInterface {
-	return &eventsClusterClient{Fake: c.Fake}
+	return newFakeEventClusterClient(c)
 }
 
-var _ eventsv1.EventsV1Interface = (*EventsV1Client)(nil)
-
 type EventsV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *EventsV1Client) Events(namespace string) eventsv1.EventInterface {
+	return newFakeEventClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *EventsV1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *EventsV1Client) Events(namespace string) eventsv1.EventInterface {
-	return &eventsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
diff --git a/kubernetes/typed/events/v1/generated_expansion.go b/kubernetes/typed/events/v1/generated_expansion.go
new file mode 100644
index 000000000..ca565e18f
--- /dev/null
+++ b/kubernetes/typed/events/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type EventClusterExpansion interface{}
diff --git a/kubernetes/typed/events/v1beta1/doc.go b/kubernetes/typed/events/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/events/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/events/v1beta1/event.go b/kubernetes/typed/events/v1beta1/event.go
index f402dded8..7299691fa 100644
--- a/kubernetes/typed/events/v1beta1/event.go
+++ b/kubernetes/typed/events/v1beta1/event.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	eventsv1beta1 "k8s.io/api/events/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedeventsv1beta1 "k8s.io/client-go/kubernetes/typed/events/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	eventsv1beta1 "k8s.io/api/events/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	eventsv1beta1client "k8s.io/client-go/kubernetes/typed/events/v1beta1"
 )
 
 // EventsClusterGetter has a method to return a EventClusterInterface.
@@ -43,12 +40,13 @@ type EventsClusterGetter interface {
 // or scope down to one cluster and return a EventsNamespacer.
 type EventClusterInterface interface {
 	Cluster(logicalcluster.Path) EventsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*eventsv1beta1.EventList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*eventsv1beta1.EventList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	EventClusterExpansion
 }
 
 type eventsClusterInterface struct {
-	clientCache kcpclient.Cache[*eventsv1beta1client.EventsV1beta1Client]
+	clientCache kcpclient.Cache[*typedeventsv1beta1.EventsV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *eventsClusterInterface) Cluster(clusterPath logicalcluster.Path) Events
 }
 
 // List returns the entire collection of all Events across all clusters.
-func (c *eventsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*eventsv1beta1.EventList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Events(metav1.NamespaceAll).List(ctx, opts)
+func (c *eventsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*eventsv1beta1.EventList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Events(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all Events across all clusters.
-func (c *eventsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Events(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *eventsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Events(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// EventsNamespacer can scope to objects within a namespace, returning a eventsv1beta1client.EventInterface.
+// EventsNamespacer can scope to objects within a namespace, returning a typedeventsv1beta1.EventInterface.
 type EventsNamespacer interface {
-	Namespace(string) eventsv1beta1client.EventInterface
+	Namespace(string) typedeventsv1beta1.EventInterface
 }
 
 type eventsNamespacer struct {
-	clientCache kcpclient.Cache[*eventsv1beta1client.EventsV1beta1Client]
+	clientCache kcpclient.Cache[*typedeventsv1beta1.EventsV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *eventsNamespacer) Namespace(namespace string) eventsv1beta1client.EventInterface {
+func (n *eventsNamespacer) Namespace(namespace string) typedeventsv1beta1.EventInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Events(namespace)
 }
diff --git a/kubernetes/typed/events/v1beta1/events_client.go b/kubernetes/typed/events/v1beta1/events_client.go
index d3252a208..917c252c2 100644
--- a/kubernetes/typed/events/v1beta1/events_client.go
+++ b/kubernetes/typed/events/v1beta1/events_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apieventsv1beta1 "k8s.io/api/events/v1beta1"
+	eventsv1beta1 "k8s.io/client-go/kubernetes/typed/events/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	eventsv1beta1 "k8s.io/client-go/kubernetes/typed/events/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type EventsV1beta1ClusterInterface interface {
@@ -40,6 +39,7 @@ type EventsV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) eventsv1beta1.EventsV1beta1Interface
 }
 
+// EventsV1beta1ClusterClient is used to interact with features provided by the events.k8s.io group.
 type EventsV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*eventsv1beta1.EventsV1beta1Client]
 }
@@ -59,11 +59,13 @@ func (c *EventsV1beta1ClusterClient) Events() EventClusterInterface {
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*EventsV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new EventsV1beta1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*EventsV1beta1Cluste
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &EventsV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *EventsV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apieventsv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/events/v1beta1/fake/doc.go b/kubernetes/typed/events/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/events/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/events/v1beta1/fake/event.go b/kubernetes/typed/events/v1beta1/fake/event.go
index 5d0a50c7c..f2487403a 100644
--- a/kubernetes/typed/events/v1beta1/fake/event.go
+++ b/kubernetes/typed/events/v1beta1/fake/event.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	eventsv1beta1 "k8s.io/api/events/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationseventsv1beta1 "k8s.io/client-go/applyconfigurations/events/v1beta1"
-	eventsv1beta1client "k8s.io/client-go/kubernetes/typed/events/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/events/v1beta1"
+	typedeventsv1beta1 "k8s.io/client-go/kubernetes/typed/events/v1beta1"
 
-	kcpeventsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1beta1"
+	typedkcpeventsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var eventsResource = schema.GroupVersionResource{Group: "events.k8s.io", Version: "v1beta1", Resource: "events"}
-var eventsKind = schema.GroupVersionKind{Group: "events.k8s.io", Version: "v1beta1", Kind: "Event"}
-
-type eventsClusterClient struct {
-	*kcptesting.Fake
+// eventClusterClient implements EventClusterInterface
+type eventClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*eventsv1beta1.Event, *eventsv1beta1.EventList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *eventsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpeventsv1beta1.EventsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &eventsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Events that match those selectors across all clusters.
-func (c *eventsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*eventsv1beta1.EventList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(eventsResource, eventsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &eventsv1beta1.EventList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeEventClusterClient(fake *EventsV1beta1ClusterClient) typedkcpeventsv1beta1.EventClusterInterface {
+	return &eventClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*eventsv1beta1.Event, *eventsv1beta1.EventList](
+			fake.Fake,
+			eventsv1beta1.SchemeGroupVersion.WithResource("events"),
+			eventsv1beta1.SchemeGroupVersion.WithKind("Event"),
+			func() *eventsv1beta1.Event { return &eventsv1beta1.Event{} },
+			func() *eventsv1beta1.EventList { return &eventsv1beta1.EventList{} },
+			func(dst, src *eventsv1beta1.EventList) { dst.ListMeta = src.ListMeta },
+			func(list *eventsv1beta1.EventList) []*eventsv1beta1.Event {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *eventsv1beta1.EventList, items []*eventsv1beta1.Event) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &eventsv1beta1.EventList{ListMeta: obj.(*eventsv1beta1.EventList).ListMeta}
-	for _, item := range obj.(*eventsv1beta1.EventList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Events across all clusters.
-func (c *eventsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(eventsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *eventClusterClient) Cluster(cluster logicalcluster.Path) typedkcpeventsv1beta1.EventsNamespacer {
+	return &eventNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type eventsNamespacer struct {
+type eventNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *eventsNamespacer) Namespace(namespace string) eventsv1beta1client.EventInterface {
-	return &eventsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *eventNamespacer) Namespace(namespace string) typedeventsv1beta1.EventInterface {
+	return newFakeEventClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type eventsClient struct {
-	*kcptesting.Fake
+// eventScopedClient implements EventInterface
+type eventScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*eventsv1beta1.Event, *eventsv1beta1.EventList, *v1beta1.EventApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *eventsClient) Create(ctx context.Context, event *eventsv1beta1.Event, opts metav1.CreateOptions) (*eventsv1beta1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(eventsResource, c.ClusterPath, c.Namespace, event), &eventsv1beta1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*eventsv1beta1.Event), err
-}
-
-func (c *eventsClient) Update(ctx context.Context, event *eventsv1beta1.Event, opts metav1.UpdateOptions) (*eventsv1beta1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(eventsResource, c.ClusterPath, c.Namespace, event), &eventsv1beta1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*eventsv1beta1.Event), err
-}
-
-func (c *eventsClient) UpdateStatus(ctx context.Context, event *eventsv1beta1.Event, opts metav1.UpdateOptions) (*eventsv1beta1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(eventsResource, c.ClusterPath, "status", c.Namespace, event), &eventsv1beta1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*eventsv1beta1.Event), err
-}
-
-func (c *eventsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(eventsResource, c.ClusterPath, c.Namespace, name, opts), &eventsv1beta1.Event{})
-	return err
 }
 
-func (c *eventsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(eventsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &eventsv1beta1.EventList{})
-	return err
-}
-
-func (c *eventsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*eventsv1beta1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(eventsResource, c.ClusterPath, c.Namespace, name), &eventsv1beta1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*eventsv1beta1.Event), err
-}
-
-// List takes label and field selectors, and returns the list of Events that match those selectors.
-func (c *eventsClient) List(ctx context.Context, opts metav1.ListOptions) (*eventsv1beta1.EventList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(eventsResource, eventsKind, c.ClusterPath, c.Namespace, opts), &eventsv1beta1.EventList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &eventsv1beta1.EventList{ListMeta: obj.(*eventsv1beta1.EventList).ListMeta}
-	for _, item := range obj.(*eventsv1beta1.EventList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *eventsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(eventsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *eventsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*eventsv1beta1.Event, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(eventsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &eventsv1beta1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*eventsv1beta1.Event), err
-}
-
-func (c *eventsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationseventsv1beta1.EventApplyConfiguration, opts metav1.ApplyOptions) (*eventsv1beta1.Event, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(eventsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &eventsv1beta1.Event{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*eventsv1beta1.Event), err
-}
-
-func (c *eventsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationseventsv1beta1.EventApplyConfiguration, opts metav1.ApplyOptions) (*eventsv1beta1.Event, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(eventsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &eventsv1beta1.Event{})
-	if obj == nil {
-		return nil, err
+func newFakeEventClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedeventsv1beta1.EventInterface {
+	return &eventScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*eventsv1beta1.Event, *eventsv1beta1.EventList, *v1beta1.EventApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			eventsv1beta1.SchemeGroupVersion.WithResource("events"),
+			eventsv1beta1.SchemeGroupVersion.WithKind("Event"),
+			func() *eventsv1beta1.Event { return &eventsv1beta1.Event{} },
+			func() *eventsv1beta1.EventList { return &eventsv1beta1.EventList{} },
+			func(dst, src *eventsv1beta1.EventList) { dst.ListMeta = src.ListMeta },
+			func(list *eventsv1beta1.EventList) []*eventsv1beta1.Event {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *eventsv1beta1.EventList, items []*eventsv1beta1.Event) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*eventsv1beta1.Event), err
 }
diff --git a/kubernetes/typed/events/v1beta1/fake/events_client.go b/kubernetes/typed/events/v1beta1/fake/events_client.go
index 5c4f60a38..17e92fad3 100644
--- a/kubernetes/typed/events/v1beta1/fake/events_client.go
+++ b/kubernetes/typed/events/v1beta1/fake/events_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	eventsv1beta1 "k8s.io/client-go/kubernetes/typed/events/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpeventsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/events/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpeventsv1beta1.EventsV1beta1ClusterInterface = (*EventsV1beta1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *EventsV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) ev
 }
 
 func (c *EventsV1beta1ClusterClient) Events() kcpeventsv1beta1.EventClusterInterface {
-	return &eventsClusterClient{Fake: c.Fake}
+	return newFakeEventClusterClient(c)
 }
 
-var _ eventsv1beta1.EventsV1beta1Interface = (*EventsV1beta1Client)(nil)
-
 type EventsV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *EventsV1beta1Client) Events(namespace string) eventsv1beta1.EventInterface {
+	return newFakeEventClient(c.Fake, namespace, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *EventsV1beta1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *EventsV1beta1Client) Events(namespace string) eventsv1beta1.EventInterface {
-	return &eventsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
diff --git a/kubernetes/typed/events/v1beta1/fake/fake_event_expansion.go b/kubernetes/typed/events/v1beta1/fake/fake_event_expansion.go
index d26830a57..0f8a01de2 100644
--- a/kubernetes/typed/events/v1beta1/fake/fake_event_expansion.go
+++ b/kubernetes/typed/events/v1beta1/fake/fake_event_expansion.go
@@ -18,17 +18,17 @@ limitations under the License.
 package fake
 
 import (
-	"k8s.io/api/events/v1beta1"
-	"k8s.io/apimachinery/pkg/types"
+	v1beta1 "k8s.io/api/events/v1beta1"
+	types "k8s.io/apimachinery/pkg/types"
 
 	core "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
 )
 
 // CreateWithEventNamespace creats a new event. Returns the copy of the event the server returns, or an error.
-func (c *eventsClient) CreateWithEventNamespace(event *v1beta1.Event) (*v1beta1.Event, error) {
-	action := core.NewRootCreateAction(eventsResource, c.ClusterPath, event)
-	if c.Namespace != "" {
-		action = core.NewCreateAction(eventsResource, c.ClusterPath, c.Namespace, event)
+func (c *eventScopedClient) CreateWithEventNamespace(event *v1beta1.Event) (*v1beta1.Event, error) {
+	action := core.NewRootCreateAction(c.Resource(), c.ClusterPath, event)
+	if c.Namespace() != "" {
+		action = core.NewCreateAction(c.Resource(), c.ClusterPath, c.Namespace(), event)
 	}
 	obj, err := c.Fake.Invokes(action, event)
 	if obj == nil {
@@ -39,10 +39,10 @@ func (c *eventsClient) CreateWithEventNamespace(event *v1beta1.Event) (*v1beta1.
 }
 
 // UpdateWithEventNamespace replaces an existing event. Returns the copy of the event the server returns, or an error.
-func (c *eventsClient) UpdateWithEventNamespace(event *v1beta1.Event) (*v1beta1.Event, error) {
-	action := core.NewRootUpdateAction(eventsResource, c.ClusterPath, event)
-	if c.Namespace != "" {
-		action = core.NewUpdateAction(eventsResource, c.ClusterPath, c.Namespace, event)
+func (c *eventScopedClient) UpdateWithEventNamespace(event *v1beta1.Event) (*v1beta1.Event, error) {
+	action := core.NewRootUpdateAction(c.Resource(), c.ClusterPath, event)
+	if c.Namespace() != "" {
+		action = core.NewUpdateAction(c.Resource(), c.ClusterPath, c.Namespace(), event)
 	}
 	obj, err := c.Fake.Invokes(action, event)
 	if obj == nil {
@@ -53,11 +53,11 @@ func (c *eventsClient) UpdateWithEventNamespace(event *v1beta1.Event) (*v1beta1.
 }
 
 // PatchWithEventNamespace patches an existing event. Returns the copy of the event the server returns, or an error.
-func (c *eventsClient) PatchWithEventNamespace(event *v1beta1.Event, data []byte) (*v1beta1.Event, error) {
+func (c *eventScopedClient) PatchWithEventNamespace(event *v1beta1.Event, data []byte) (*v1beta1.Event, error) {
 	pt := types.StrategicMergePatchType
-	action := core.NewRootPatchAction(eventsResource, c.ClusterPath, event.Name, pt, data)
-	if c.Namespace != "" {
-		action = core.NewPatchAction(eventsResource, c.ClusterPath, c.Namespace, event.Name, pt, data)
+	action := core.NewRootPatchAction(c.Resource(), c.ClusterPath, event.Name, pt, data)
+	if c.Namespace() != "" {
+		action = core.NewPatchAction(c.Resource(), c.ClusterPath, c.Namespace(), event.Name, pt, data)
 	}
 	obj, err := c.Fake.Invokes(action, event)
 	if obj == nil {
diff --git a/kubernetes/typed/events/v1beta1/generated_expansion.go b/kubernetes/typed/events/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..37c6f1072
--- /dev/null
+++ b/kubernetes/typed/events/v1beta1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type EventClusterExpansion interface{}
diff --git a/kubernetes/typed/extensions/v1beta1/daemonset.go b/kubernetes/typed/extensions/v1beta1/daemonset.go
index 332c3b08c..9b3864a70 100644
--- a/kubernetes/typed/extensions/v1beta1/daemonset.go
+++ b/kubernetes/typed/extensions/v1beta1/daemonset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedextensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	extensionsv1beta1client "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 )
 
 // DaemonSetsClusterGetter has a method to return a DaemonSetClusterInterface.
@@ -43,12 +40,13 @@ type DaemonSetsClusterGetter interface {
 // or scope down to one cluster and return a DaemonSetsNamespacer.
 type DaemonSetClusterInterface interface {
 	Cluster(logicalcluster.Path) DaemonSetsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.DaemonSetList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*extensionsv1beta1.DaemonSetList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	DaemonSetClusterExpansion
 }
 
 type daemonSetsClusterInterface struct {
-	clientCache kcpclient.Cache[*extensionsv1beta1client.ExtensionsV1beta1Client]
+	clientCache kcpclient.Cache[*typedextensionsv1beta1.ExtensionsV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *daemonSetsClusterInterface) Cluster(clusterPath logicalcluster.Path) Da
 }
 
 // List returns the entire collection of all DaemonSets across all clusters.
-func (c *daemonSetsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.DaemonSetList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DaemonSets(metav1.NamespaceAll).List(ctx, opts)
+func (c *daemonSetsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*extensionsv1beta1.DaemonSetList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DaemonSets(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all DaemonSets across all clusters.
-func (c *daemonSetsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DaemonSets(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *daemonSetsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DaemonSets(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// DaemonSetsNamespacer can scope to objects within a namespace, returning a extensionsv1beta1client.DaemonSetInterface.
+// DaemonSetsNamespacer can scope to objects within a namespace, returning a typedextensionsv1beta1.DaemonSetInterface.
 type DaemonSetsNamespacer interface {
-	Namespace(string) extensionsv1beta1client.DaemonSetInterface
+	Namespace(string) typedextensionsv1beta1.DaemonSetInterface
 }
 
 type daemonSetsNamespacer struct {
-	clientCache kcpclient.Cache[*extensionsv1beta1client.ExtensionsV1beta1Client]
+	clientCache kcpclient.Cache[*typedextensionsv1beta1.ExtensionsV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *daemonSetsNamespacer) Namespace(namespace string) extensionsv1beta1client.DaemonSetInterface {
+func (n *daemonSetsNamespacer) Namespace(namespace string) typedextensionsv1beta1.DaemonSetInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).DaemonSets(namespace)
 }
diff --git a/kubernetes/typed/extensions/v1beta1/deployment.go b/kubernetes/typed/extensions/v1beta1/deployment.go
index e86bae00c..e63e9857a 100644
--- a/kubernetes/typed/extensions/v1beta1/deployment.go
+++ b/kubernetes/typed/extensions/v1beta1/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedextensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	extensionsv1beta1client "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 )
 
 // DeploymentsClusterGetter has a method to return a DeploymentClusterInterface.
@@ -43,12 +40,13 @@ type DeploymentsClusterGetter interface {
 // or scope down to one cluster and return a DeploymentsNamespacer.
 type DeploymentClusterInterface interface {
 	Cluster(logicalcluster.Path) DeploymentsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.DeploymentList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*extensionsv1beta1.DeploymentList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	DeploymentClusterExpansion
 }
 
 type deploymentsClusterInterface struct {
-	clientCache kcpclient.Cache[*extensionsv1beta1client.ExtensionsV1beta1Client]
+	clientCache kcpclient.Cache[*typedextensionsv1beta1.ExtensionsV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *deploymentsClusterInterface) Cluster(clusterPath logicalcluster.Path) D
 }
 
 // List returns the entire collection of all Deployments across all clusters.
-func (c *deploymentsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.DeploymentList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(metav1.NamespaceAll).List(ctx, opts)
+func (c *deploymentsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*extensionsv1beta1.DeploymentList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all Deployments across all clusters.
-func (c *deploymentsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *deploymentsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Deployments(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// DeploymentsNamespacer can scope to objects within a namespace, returning a extensionsv1beta1client.DeploymentInterface.
+// DeploymentsNamespacer can scope to objects within a namespace, returning a typedextensionsv1beta1.DeploymentInterface.
 type DeploymentsNamespacer interface {
-	Namespace(string) extensionsv1beta1client.DeploymentInterface
+	Namespace(string) typedextensionsv1beta1.DeploymentInterface
 }
 
 type deploymentsNamespacer struct {
-	clientCache kcpclient.Cache[*extensionsv1beta1client.ExtensionsV1beta1Client]
+	clientCache kcpclient.Cache[*typedextensionsv1beta1.ExtensionsV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *deploymentsNamespacer) Namespace(namespace string) extensionsv1beta1client.DeploymentInterface {
+func (n *deploymentsNamespacer) Namespace(namespace string) typedextensionsv1beta1.DeploymentInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Deployments(namespace)
 }
diff --git a/kubernetes/typed/extensions/v1beta1/doc.go b/kubernetes/typed/extensions/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/extensions/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/extensions/v1beta1/extensions_client.go b/kubernetes/typed/extensions/v1beta1/extensions_client.go
index 592d2179a..265b80787 100644
--- a/kubernetes/typed/extensions/v1beta1/extensions_client.go
+++ b/kubernetes/typed/extensions/v1beta1/extensions_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,34 +14,36 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiextensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	extensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type ExtensionsV1beta1ClusterInterface interface {
 	ExtensionsV1beta1ClusterScoper
-	DeploymentsClusterGetter
 	DaemonSetsClusterGetter
+	DeploymentsClusterGetter
 	IngressesClusterGetter
-	ReplicaSetsClusterGetter
-	PodSecurityPoliciesClusterGetter
 	NetworkPoliciesClusterGetter
+	ReplicaSetsClusterGetter
 }
 
 type ExtensionsV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) extensionsv1beta1.ExtensionsV1beta1Interface
 }
 
+// ExtensionsV1beta1ClusterClient is used to interact with features provided by the extensions group.
 type ExtensionsV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*extensionsv1beta1.ExtensionsV1beta1Client]
 }
@@ -56,39 +55,37 @@ func (c *ExtensionsV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *ExtensionsV1beta1ClusterClient) Deployments() DeploymentClusterInterface {
-	return &deploymentsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *ExtensionsV1beta1ClusterClient) DaemonSets() DaemonSetClusterInterface {
 	return &daemonSetsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *ExtensionsV1beta1ClusterClient) Ingresses() IngressClusterInterface {
-	return &ingressesClusterInterface{clientCache: c.clientCache}
-}
-
-func (c *ExtensionsV1beta1ClusterClient) ReplicaSets() ReplicaSetClusterInterface {
-	return &replicaSetsClusterInterface{clientCache: c.clientCache}
+func (c *ExtensionsV1beta1ClusterClient) Deployments() DeploymentClusterInterface {
+	return &deploymentsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *ExtensionsV1beta1ClusterClient) PodSecurityPolicies() PodSecurityPolicyClusterInterface {
-	return &podSecurityPoliciesClusterInterface{clientCache: c.clientCache}
+func (c *ExtensionsV1beta1ClusterClient) Ingresses() IngressClusterInterface {
+	return &ingressesClusterInterface{clientCache: c.clientCache}
 }
 
 func (c *ExtensionsV1beta1ClusterClient) NetworkPolicies() NetworkPolicyClusterInterface {
 	return &networkPoliciesClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *ExtensionsV1beta1ClusterClient) ReplicaSets() ReplicaSetClusterInterface {
+	return &replicaSetsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new ExtensionsV1beta1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*ExtensionsV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new ExtensionsV1beta1ClusterClient for the given config and http client.
@@ -100,6 +97,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ExtensionsV1beta1Cl
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &ExtensionsV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -112,3 +110,14 @@ func NewForConfigOrDie(c *rest.Config) *ExtensionsV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiextensionsv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/extensions/v1beta1/fake/daemonset.go b/kubernetes/typed/extensions/v1beta1/fake/daemonset.go
index 41edbf3c2..275523fde 100644
--- a/kubernetes/typed/extensions/v1beta1/fake/daemonset.go
+++ b/kubernetes/typed/extensions/v1beta1/fake/daemonset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsextensionsv1beta1 "k8s.io/client-go/applyconfigurations/extensions/v1beta1"
-	extensionsv1beta1client "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/extensions/v1beta1"
+	typedextensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 
-	kcpextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
+	typedkcpextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var daemonSetsResource = schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "daemonsets"}
-var daemonSetsKind = schema.GroupVersionKind{Group: "extensions", Version: "v1beta1", Kind: "DaemonSet"}
-
-type daemonSetsClusterClient struct {
-	*kcptesting.Fake
+// daemonSetClusterClient implements DaemonSetClusterInterface
+type daemonSetClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*extensionsv1beta1.DaemonSet, *extensionsv1beta1.DaemonSetList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *daemonSetsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpextensionsv1beta1.DaemonSetsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &daemonSetsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of DaemonSets that match those selectors across all clusters.
-func (c *daemonSetsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.DaemonSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(daemonSetsResource, daemonSetsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &extensionsv1beta1.DaemonSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeDaemonSetClusterClient(fake *ExtensionsV1beta1ClusterClient) typedkcpextensionsv1beta1.DaemonSetClusterInterface {
+	return &daemonSetClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*extensionsv1beta1.DaemonSet, *extensionsv1beta1.DaemonSetList](
+			fake.Fake,
+			extensionsv1beta1.SchemeGroupVersion.WithResource("daemonsets"),
+			extensionsv1beta1.SchemeGroupVersion.WithKind("DaemonSet"),
+			func() *extensionsv1beta1.DaemonSet { return &extensionsv1beta1.DaemonSet{} },
+			func() *extensionsv1beta1.DaemonSetList { return &extensionsv1beta1.DaemonSetList{} },
+			func(dst, src *extensionsv1beta1.DaemonSetList) { dst.ListMeta = src.ListMeta },
+			func(list *extensionsv1beta1.DaemonSetList) []*extensionsv1beta1.DaemonSet {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *extensionsv1beta1.DaemonSetList, items []*extensionsv1beta1.DaemonSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &extensionsv1beta1.DaemonSetList{ListMeta: obj.(*extensionsv1beta1.DaemonSetList).ListMeta}
-	for _, item := range obj.(*extensionsv1beta1.DaemonSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested DaemonSets across all clusters.
-func (c *daemonSetsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(daemonSetsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *daemonSetClusterClient) Cluster(cluster logicalcluster.Path) typedkcpextensionsv1beta1.DaemonSetsNamespacer {
+	return &daemonSetNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type daemonSetsNamespacer struct {
+type daemonSetNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *daemonSetsNamespacer) Namespace(namespace string) extensionsv1beta1client.DaemonSetInterface {
-	return &daemonSetsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *daemonSetNamespacer) Namespace(namespace string) typedextensionsv1beta1.DaemonSetInterface {
+	return newFakeDaemonSetClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type daemonSetsClient struct {
-	*kcptesting.Fake
+// daemonSetScopedClient implements DaemonSetInterface
+type daemonSetScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*extensionsv1beta1.DaemonSet, *extensionsv1beta1.DaemonSetList, *v1beta1.DaemonSetApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *daemonSetsClient) Create(ctx context.Context, daemonSet *extensionsv1beta1.DaemonSet, opts metav1.CreateOptions) (*extensionsv1beta1.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(daemonSetsResource, c.ClusterPath, c.Namespace, daemonSet), &extensionsv1beta1.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.DaemonSet), err
-}
-
-func (c *daemonSetsClient) Update(ctx context.Context, daemonSet *extensionsv1beta1.DaemonSet, opts metav1.UpdateOptions) (*extensionsv1beta1.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(daemonSetsResource, c.ClusterPath, c.Namespace, daemonSet), &extensionsv1beta1.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.DaemonSet), err
-}
-
-func (c *daemonSetsClient) UpdateStatus(ctx context.Context, daemonSet *extensionsv1beta1.DaemonSet, opts metav1.UpdateOptions) (*extensionsv1beta1.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(daemonSetsResource, c.ClusterPath, "status", c.Namespace, daemonSet), &extensionsv1beta1.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.DaemonSet), err
-}
-
-func (c *daemonSetsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(daemonSetsResource, c.ClusterPath, c.Namespace, name, opts), &extensionsv1beta1.DaemonSet{})
-	return err
 }
 
-func (c *daemonSetsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(daemonSetsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &extensionsv1beta1.DaemonSetList{})
-	return err
-}
-
-func (c *daemonSetsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*extensionsv1beta1.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(daemonSetsResource, c.ClusterPath, c.Namespace, name), &extensionsv1beta1.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.DaemonSet), err
-}
-
-// List takes label and field selectors, and returns the list of DaemonSets that match those selectors.
-func (c *daemonSetsClient) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.DaemonSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(daemonSetsResource, daemonSetsKind, c.ClusterPath, c.Namespace, opts), &extensionsv1beta1.DaemonSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &extensionsv1beta1.DaemonSetList{ListMeta: obj.(*extensionsv1beta1.DaemonSetList).ListMeta}
-	for _, item := range obj.(*extensionsv1beta1.DaemonSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *daemonSetsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(daemonSetsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *daemonSetsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*extensionsv1beta1.DaemonSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(daemonSetsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &extensionsv1beta1.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.DaemonSet), err
-}
-
-func (c *daemonSetsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsextensionsv1beta1.DaemonSetApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.DaemonSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(daemonSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &extensionsv1beta1.DaemonSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.DaemonSet), err
-}
-
-func (c *daemonSetsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsextensionsv1beta1.DaemonSetApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.DaemonSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(daemonSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &extensionsv1beta1.DaemonSet{})
-	if obj == nil {
-		return nil, err
+func newFakeDaemonSetClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedextensionsv1beta1.DaemonSetInterface {
+	return &daemonSetScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*extensionsv1beta1.DaemonSet, *extensionsv1beta1.DaemonSetList, *v1beta1.DaemonSetApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			extensionsv1beta1.SchemeGroupVersion.WithResource("daemonsets"),
+			extensionsv1beta1.SchemeGroupVersion.WithKind("DaemonSet"),
+			func() *extensionsv1beta1.DaemonSet { return &extensionsv1beta1.DaemonSet{} },
+			func() *extensionsv1beta1.DaemonSetList { return &extensionsv1beta1.DaemonSetList{} },
+			func(dst, src *extensionsv1beta1.DaemonSetList) { dst.ListMeta = src.ListMeta },
+			func(list *extensionsv1beta1.DaemonSetList) []*extensionsv1beta1.DaemonSet {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *extensionsv1beta1.DaemonSetList, items []*extensionsv1beta1.DaemonSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*extensionsv1beta1.DaemonSet), err
 }
diff --git a/kubernetes/typed/extensions/v1beta1/fake/deployment.go b/kubernetes/typed/extensions/v1beta1/fake/deployment.go
index 6da3d87e3..53b8c2880 100644
--- a/kubernetes/typed/extensions/v1beta1/fake/deployment.go
+++ b/kubernetes/typed/extensions/v1beta1/fake/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,232 +14,130 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
+	json "encoding/json"
+	fmt "fmt"
 
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsextensionsv1beta1 "k8s.io/client-go/applyconfigurations/extensions/v1beta1"
-	extensionsv1beta1client "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
-	"k8s.io/client-go/testing"
-
-	kcpextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1beta1 "k8s.io/client-go/applyconfigurations/extensions/v1beta1"
+	typedextensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
+
+	typedkcpextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var deploymentsResource = schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "deployments"}
-var deploymentsKind = schema.GroupVersionKind{Group: "extensions", Version: "v1beta1", Kind: "Deployment"}
-
-type deploymentsClusterClient struct {
-	*kcptesting.Fake
+// deploymentClusterClient implements DeploymentClusterInterface
+type deploymentClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*extensionsv1beta1.Deployment, *extensionsv1beta1.DeploymentList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *deploymentsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpextensionsv1beta1.DeploymentsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeDeploymentClusterClient(fake *ExtensionsV1beta1ClusterClient) typedkcpextensionsv1beta1.DeploymentClusterInterface {
+	return &deploymentClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*extensionsv1beta1.Deployment, *extensionsv1beta1.DeploymentList](
+			fake.Fake,
+			extensionsv1beta1.SchemeGroupVersion.WithResource("deployments"),
+			extensionsv1beta1.SchemeGroupVersion.WithKind("Deployment"),
+			func() *extensionsv1beta1.Deployment { return &extensionsv1beta1.Deployment{} },
+			func() *extensionsv1beta1.DeploymentList { return &extensionsv1beta1.DeploymentList{} },
+			func(dst, src *extensionsv1beta1.DeploymentList) { dst.ListMeta = src.ListMeta },
+			func(list *extensionsv1beta1.DeploymentList) []*extensionsv1beta1.Deployment {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *extensionsv1beta1.DeploymentList, items []*extensionsv1beta1.Deployment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-
-	return &deploymentsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-// List takes label and field selectors, and returns the list of Deployments that match those selectors across all clusters.
-func (c *deploymentsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.DeploymentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(deploymentsResource, deploymentsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &extensionsv1beta1.DeploymentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &extensionsv1beta1.DeploymentList{ListMeta: obj.(*extensionsv1beta1.DeploymentList).ListMeta}
-	for _, item := range obj.(*extensionsv1beta1.DeploymentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested Deployments across all clusters.
-func (c *deploymentsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(deploymentsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *deploymentClusterClient) Cluster(cluster logicalcluster.Path) typedkcpextensionsv1beta1.DeploymentsNamespacer {
+	return &deploymentNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type deploymentsNamespacer struct {
+type deploymentNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *deploymentsNamespacer) Namespace(namespace string) extensionsv1beta1client.DeploymentInterface {
-	return &deploymentsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *deploymentNamespacer) Namespace(namespace string) typedextensionsv1beta1.DeploymentInterface {
+	return newFakeDeploymentClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type deploymentsClient struct {
-	*kcptesting.Fake
+// deploymentScopedClient implements DeploymentInterface
+type deploymentScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*extensionsv1beta1.Deployment, *extensionsv1beta1.DeploymentList, *v1beta1.DeploymentApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
 }
 
-func (c *deploymentsClient) Create(ctx context.Context, deployment *extensionsv1beta1.Deployment, opts metav1.CreateOptions) (*extensionsv1beta1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(deploymentsResource, c.ClusterPath, c.Namespace, deployment), &extensionsv1beta1.Deployment{})
+func newFakeDeploymentClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedextensionsv1beta1.DeploymentInterface {
+	return &deploymentScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*extensionsv1beta1.Deployment, *extensionsv1beta1.DeploymentList, *v1beta1.DeploymentApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			extensionsv1beta1.SchemeGroupVersion.WithResource("deployments"),
+			extensionsv1beta1.SchemeGroupVersion.WithKind("Deployment"),
+			func() *extensionsv1beta1.Deployment { return &extensionsv1beta1.Deployment{} },
+			func() *extensionsv1beta1.DeploymentList { return &extensionsv1beta1.DeploymentList{} },
+			func(dst, src *extensionsv1beta1.DeploymentList) { dst.ListMeta = src.ListMeta },
+			func(list *extensionsv1beta1.DeploymentList) []*extensionsv1beta1.Deployment {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *extensionsv1beta1.DeploymentList, items []*extensionsv1beta1.Deployment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
+
+// GetScale takes name of the deployment, and returns the corresponding scale object, and an error if there is any.
+func (c *deploymentScopedClient) GetScale(ctx context.Context, deploymentName string, _ v1.GetOptions) (result *extensionsv1beta1.Scale, err error) {
+	emptyResult := &extensionsv1beta1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), "scale", deploymentName), emptyResult)
 	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Deployment), err
-}
-
-func (c *deploymentsClient) Update(ctx context.Context, deployment *extensionsv1beta1.Deployment, opts metav1.UpdateOptions) (*extensionsv1beta1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(deploymentsResource, c.ClusterPath, c.Namespace, deployment), &extensionsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Deployment), err
-}
-
-func (c *deploymentsClient) UpdateStatus(ctx context.Context, deployment *extensionsv1beta1.Deployment, opts metav1.UpdateOptions) (*extensionsv1beta1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(deploymentsResource, c.ClusterPath, "status", c.Namespace, deployment), &extensionsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Deployment), err
-}
-
-func (c *deploymentsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(deploymentsResource, c.ClusterPath, c.Namespace, name, opts), &extensionsv1beta1.Deployment{})
-	return err
-}
-
-func (c *deploymentsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(deploymentsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &extensionsv1beta1.DeploymentList{})
-	return err
-}
-
-func (c *deploymentsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*extensionsv1beta1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(deploymentsResource, c.ClusterPath, c.Namespace, name), &extensionsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Deployment), err
-}
-
-// List takes label and field selectors, and returns the list of Deployments that match those selectors.
-func (c *deploymentsClient) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.DeploymentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(deploymentsResource, deploymentsKind, c.ClusterPath, c.Namespace, opts), &extensionsv1beta1.DeploymentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &extensionsv1beta1.DeploymentList{ListMeta: obj.(*extensionsv1beta1.DeploymentList).ListMeta}
-	for _, item := range obj.(*extensionsv1beta1.DeploymentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *deploymentsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(deploymentsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *deploymentsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*extensionsv1beta1.Deployment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &extensionsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Deployment), err
-}
-
-func (c *deploymentsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsextensionsv1beta1.DeploymentApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.Deployment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &extensionsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Deployment), err
-}
-
-func (c *deploymentsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsextensionsv1beta1.DeploymentApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.Deployment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &extensionsv1beta1.Deployment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Deployment), err
-}
-
-func (c *deploymentsClient) GetScale(ctx context.Context, deploymentName string, options metav1.GetOptions) (*extensionsv1beta1.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(deploymentsResource, c.ClusterPath, "scale", c.Namespace, deploymentName), &extensionsv1beta1.Scale{})
-	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*extensionsv1beta1.Scale), err
 }
 
-func (c *deploymentsClient) UpdateScale(ctx context.Context, deploymentName string, scale *extensionsv1beta1.Scale, opts metav1.UpdateOptions) (*extensionsv1beta1.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(deploymentsResource, c.ClusterPath, "scale", c.Namespace, scale), &extensionsv1beta1.Scale{})
+// UpdateScale takes the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *deploymentScopedClient) UpdateScale(ctx context.Context, deploymentName string, scale *extensionsv1beta1.Scale, _ v1.UpdateOptions) (result *extensionsv1beta1.Scale, err error) {
+	emptyResult := &extensionsv1beta1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(c.Resource(), c.ClusterPath, "scale", c.Namespace(), scale), &extensionsv1beta1.Scale{})
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*extensionsv1beta1.Scale), err
 }
 
-func (c *deploymentsClient) ApplyScale(ctx context.Context, deploymentName string, applyConfiguration *applyconfigurationsextensionsv1beta1.ScaleApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.Scale, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
+// ApplyScale takes top resource name and the apply declarative configuration for scale,
+// applies it and returns the applied scale, and an error, if there is any.
+func (c *deploymentScopedClient) ApplyScale(ctx context.Context, deploymentName string, scale *v1beta1.ScaleApplyConfiguration, _ v1.ApplyOptions) (result *extensionsv1beta1.Scale, err error) {
+	if scale == nil {
+		return nil, fmt.Errorf("scale provided to ApplyScale must not be nil")
 	}
-	data, err := json.Marshal(applyConfiguration)
+	data, err := json.Marshal(scale)
 	if err != nil {
 		return nil, err
 	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(deploymentsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &extensionsv1beta1.Scale{})
+	emptyResult := &extensionsv1beta1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), deploymentName, types.ApplyPatchType, data, "scale"), emptyResult)
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*extensionsv1beta1.Scale), err
 }
diff --git a/kubernetes/typed/extensions/v1beta1/fake/doc.go b/kubernetes/typed/extensions/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/extensions/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/extensions/v1beta1/fake/extensions_client.go b/kubernetes/typed/extensions/v1beta1/fake/extensions_client.go
index 9a2622a1d..1671f04ab 100644
--- a/kubernetes/typed/extensions/v1beta1/fake/extensions_client.go
+++ b/kubernetes/typed/extensions/v1beta1/fake/extensions_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	extensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpextensionsv1beta1.ExtensionsV1beta1ClusterInterface = (*ExtensionsV1beta1ClusterClient)(nil)
@@ -44,62 +40,54 @@ func (c *ExtensionsV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path
 	return &ExtensionsV1beta1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *ExtensionsV1beta1ClusterClient) Deployments() kcpextensionsv1beta1.DeploymentClusterInterface {
-	return &deploymentsClusterClient{Fake: c.Fake}
-}
-
 func (c *ExtensionsV1beta1ClusterClient) DaemonSets() kcpextensionsv1beta1.DaemonSetClusterInterface {
-	return &daemonSetsClusterClient{Fake: c.Fake}
+	return newFakeDaemonSetClusterClient(c)
 }
 
-func (c *ExtensionsV1beta1ClusterClient) Ingresses() kcpextensionsv1beta1.IngressClusterInterface {
-	return &ingressesClusterClient{Fake: c.Fake}
-}
-
-func (c *ExtensionsV1beta1ClusterClient) ReplicaSets() kcpextensionsv1beta1.ReplicaSetClusterInterface {
-	return &replicaSetsClusterClient{Fake: c.Fake}
+func (c *ExtensionsV1beta1ClusterClient) Deployments() kcpextensionsv1beta1.DeploymentClusterInterface {
+	return newFakeDeploymentClusterClient(c)
 }
 
-func (c *ExtensionsV1beta1ClusterClient) PodSecurityPolicies() kcpextensionsv1beta1.PodSecurityPolicyClusterInterface {
-	return &podSecurityPoliciesClusterClient{Fake: c.Fake}
+func (c *ExtensionsV1beta1ClusterClient) Ingresses() kcpextensionsv1beta1.IngressClusterInterface {
+	return newFakeIngressClusterClient(c)
 }
 
 func (c *ExtensionsV1beta1ClusterClient) NetworkPolicies() kcpextensionsv1beta1.NetworkPolicyClusterInterface {
-	return &networkPoliciesClusterClient{Fake: c.Fake}
+	return newFakeNetworkPolicyClusterClient(c)
 }
 
-var _ extensionsv1beta1.ExtensionsV1beta1Interface = (*ExtensionsV1beta1Client)(nil)
+func (c *ExtensionsV1beta1ClusterClient) ReplicaSets() kcpextensionsv1beta1.ReplicaSetClusterInterface {
+	return newFakeReplicaSetClusterClient(c)
+}
 
 type ExtensionsV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *ExtensionsV1beta1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *ExtensionsV1beta1Client) DaemonSets(namespace string) extensionsv1beta1.DaemonSetInterface {
+	return newFakeDaemonSetClient(c.Fake, namespace, c.ClusterPath)
 }
 
 func (c *ExtensionsV1beta1Client) Deployments(namespace string) extensionsv1beta1.DeploymentInterface {
-	return &deploymentsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
-
-func (c *ExtensionsV1beta1Client) DaemonSets(namespace string) extensionsv1beta1.DaemonSetInterface {
-	return &daemonSetsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+	return newFakeDeploymentClient(c.Fake, namespace, c.ClusterPath)
 }
 
 func (c *ExtensionsV1beta1Client) Ingresses(namespace string) extensionsv1beta1.IngressInterface {
-	return &ingressesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+	return newFakeIngressClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *ExtensionsV1beta1Client) ReplicaSets(namespace string) extensionsv1beta1.ReplicaSetInterface {
-	return &replicaSetsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *ExtensionsV1beta1Client) NetworkPolicies(namespace string) extensionsv1beta1.NetworkPolicyInterface {
+	return newFakeNetworkPolicyClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *ExtensionsV1beta1Client) PodSecurityPolicies() extensionsv1beta1.PodSecurityPolicyInterface {
-	return &podSecurityPoliciesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *ExtensionsV1beta1Client) ReplicaSets(namespace string) extensionsv1beta1.ReplicaSetInterface {
+	return newFakeReplicaSetClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *ExtensionsV1beta1Client) NetworkPolicies(namespace string) extensionsv1beta1.NetworkPolicyInterface {
-	return &networkPoliciesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ExtensionsV1beta1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/extensions/v1beta1/fake/fake_deployment_expansion.go b/kubernetes/typed/extensions/v1beta1/fake/fake_deployment_expansion.go
index 1246e4df6..874a1b280 100644
--- a/kubernetes/typed/extensions/v1beta1/fake/fake_deployment_expansion.go
+++ b/kubernetes/typed/extensions/v1beta1/fake/fake_deployment_expansion.go
@@ -26,10 +26,10 @@ import (
 	core "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
 )
 
-func (c *deploymentsClient) Rollback(ctx context.Context, deploymentRollback *v1beta1.DeploymentRollback, opts metav1.CreateOptions) error {
+func (c *deploymentScopedClient) Rollback(ctx context.Context, deploymentRollback *v1beta1.DeploymentRollback, opts metav1.CreateOptions) error {
 	action := core.CreateActionImpl{}
 	action.Verb = "create"
-	action.Resource = deploymentsResource
+	action.Resource = c.Resource()
 	action.Subresource = "rollback"
 	action.Object = deploymentRollback
 	action.ClusterPath = c.ClusterPath
diff --git a/kubernetes/typed/extensions/v1beta1/fake/ingress.go b/kubernetes/typed/extensions/v1beta1/fake/ingress.go
index e87905058..74038fb1c 100644
--- a/kubernetes/typed/extensions/v1beta1/fake/ingress.go
+++ b/kubernetes/typed/extensions/v1beta1/fake/ingress.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsextensionsv1beta1 "k8s.io/client-go/applyconfigurations/extensions/v1beta1"
-	extensionsv1beta1client "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/extensions/v1beta1"
+	typedextensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 
-	kcpextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
+	typedkcpextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var ingressesResource = schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "ingresses"}
-var ingressesKind = schema.GroupVersionKind{Group: "extensions", Version: "v1beta1", Kind: "Ingress"}
-
-type ingressesClusterClient struct {
-	*kcptesting.Fake
+// ingressClusterClient implements IngressClusterInterface
+type ingressClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*extensionsv1beta1.Ingress, *extensionsv1beta1.IngressList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *ingressesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpextensionsv1beta1.IngressesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &ingressesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Ingresses that match those selectors across all clusters.
-func (c *ingressesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.IngressList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(ingressesResource, ingressesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &extensionsv1beta1.IngressList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeIngressClusterClient(fake *ExtensionsV1beta1ClusterClient) typedkcpextensionsv1beta1.IngressClusterInterface {
+	return &ingressClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*extensionsv1beta1.Ingress, *extensionsv1beta1.IngressList](
+			fake.Fake,
+			extensionsv1beta1.SchemeGroupVersion.WithResource("ingresses"),
+			extensionsv1beta1.SchemeGroupVersion.WithKind("Ingress"),
+			func() *extensionsv1beta1.Ingress { return &extensionsv1beta1.Ingress{} },
+			func() *extensionsv1beta1.IngressList { return &extensionsv1beta1.IngressList{} },
+			func(dst, src *extensionsv1beta1.IngressList) { dst.ListMeta = src.ListMeta },
+			func(list *extensionsv1beta1.IngressList) []*extensionsv1beta1.Ingress {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *extensionsv1beta1.IngressList, items []*extensionsv1beta1.Ingress) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &extensionsv1beta1.IngressList{ListMeta: obj.(*extensionsv1beta1.IngressList).ListMeta}
-	for _, item := range obj.(*extensionsv1beta1.IngressList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Ingresses across all clusters.
-func (c *ingressesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(ingressesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *ingressClusterClient) Cluster(cluster logicalcluster.Path) typedkcpextensionsv1beta1.IngressesNamespacer {
+	return &ingressNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type ingressesNamespacer struct {
+type ingressNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *ingressesNamespacer) Namespace(namespace string) extensionsv1beta1client.IngressInterface {
-	return &ingressesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *ingressNamespacer) Namespace(namespace string) typedextensionsv1beta1.IngressInterface {
+	return newFakeIngressClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type ingressesClient struct {
-	*kcptesting.Fake
+// ingressScopedClient implements IngressInterface
+type ingressScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*extensionsv1beta1.Ingress, *extensionsv1beta1.IngressList, *v1beta1.IngressApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *ingressesClient) Create(ctx context.Context, ingress *extensionsv1beta1.Ingress, opts metav1.CreateOptions) (*extensionsv1beta1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(ingressesResource, c.ClusterPath, c.Namespace, ingress), &extensionsv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Ingress), err
-}
-
-func (c *ingressesClient) Update(ctx context.Context, ingress *extensionsv1beta1.Ingress, opts metav1.UpdateOptions) (*extensionsv1beta1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(ingressesResource, c.ClusterPath, c.Namespace, ingress), &extensionsv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Ingress), err
-}
-
-func (c *ingressesClient) UpdateStatus(ctx context.Context, ingress *extensionsv1beta1.Ingress, opts metav1.UpdateOptions) (*extensionsv1beta1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(ingressesResource, c.ClusterPath, "status", c.Namespace, ingress), &extensionsv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Ingress), err
-}
-
-func (c *ingressesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(ingressesResource, c.ClusterPath, c.Namespace, name, opts), &extensionsv1beta1.Ingress{})
-	return err
 }
 
-func (c *ingressesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(ingressesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &extensionsv1beta1.IngressList{})
-	return err
-}
-
-func (c *ingressesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*extensionsv1beta1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(ingressesResource, c.ClusterPath, c.Namespace, name), &extensionsv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Ingress), err
-}
-
-// List takes label and field selectors, and returns the list of Ingresses that match those selectors.
-func (c *ingressesClient) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.IngressList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(ingressesResource, ingressesKind, c.ClusterPath, c.Namespace, opts), &extensionsv1beta1.IngressList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &extensionsv1beta1.IngressList{ListMeta: obj.(*extensionsv1beta1.IngressList).ListMeta}
-	for _, item := range obj.(*extensionsv1beta1.IngressList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *ingressesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(ingressesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *ingressesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*extensionsv1beta1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(ingressesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &extensionsv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Ingress), err
-}
-
-func (c *ingressesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsextensionsv1beta1.IngressApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.Ingress, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(ingressesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &extensionsv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.Ingress), err
-}
-
-func (c *ingressesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsextensionsv1beta1.IngressApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.Ingress, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(ingressesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &extensionsv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
+func newFakeIngressClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedextensionsv1beta1.IngressInterface {
+	return &ingressScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*extensionsv1beta1.Ingress, *extensionsv1beta1.IngressList, *v1beta1.IngressApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			extensionsv1beta1.SchemeGroupVersion.WithResource("ingresses"),
+			extensionsv1beta1.SchemeGroupVersion.WithKind("Ingress"),
+			func() *extensionsv1beta1.Ingress { return &extensionsv1beta1.Ingress{} },
+			func() *extensionsv1beta1.IngressList { return &extensionsv1beta1.IngressList{} },
+			func(dst, src *extensionsv1beta1.IngressList) { dst.ListMeta = src.ListMeta },
+			func(list *extensionsv1beta1.IngressList) []*extensionsv1beta1.Ingress {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *extensionsv1beta1.IngressList, items []*extensionsv1beta1.Ingress) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*extensionsv1beta1.Ingress), err
 }
diff --git a/kubernetes/typed/extensions/v1beta1/fake/networkpolicy.go b/kubernetes/typed/extensions/v1beta1/fake/networkpolicy.go
index db6f92914..20c8bf184 100644
--- a/kubernetes/typed/extensions/v1beta1/fake/networkpolicy.go
+++ b/kubernetes/typed/extensions/v1beta1/fake/networkpolicy.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsextensionsv1beta1 "k8s.io/client-go/applyconfigurations/extensions/v1beta1"
-	extensionsv1beta1client "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/extensions/v1beta1"
+	typedextensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 
-	kcpextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
+	typedkcpextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var networkPoliciesResource = schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "networkpolicies"}
-var networkPoliciesKind = schema.GroupVersionKind{Group: "extensions", Version: "v1beta1", Kind: "NetworkPolicy"}
-
-type networkPoliciesClusterClient struct {
-	*kcptesting.Fake
+// networkPolicyClusterClient implements NetworkPolicyClusterInterface
+type networkPolicyClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*extensionsv1beta1.NetworkPolicy, *extensionsv1beta1.NetworkPolicyList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *networkPoliciesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpextensionsv1beta1.NetworkPoliciesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &networkPoliciesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of NetworkPolicies that match those selectors across all clusters.
-func (c *networkPoliciesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.NetworkPolicyList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(networkPoliciesResource, networkPoliciesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &extensionsv1beta1.NetworkPolicyList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeNetworkPolicyClusterClient(fake *ExtensionsV1beta1ClusterClient) typedkcpextensionsv1beta1.NetworkPolicyClusterInterface {
+	return &networkPolicyClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*extensionsv1beta1.NetworkPolicy, *extensionsv1beta1.NetworkPolicyList](
+			fake.Fake,
+			extensionsv1beta1.SchemeGroupVersion.WithResource("networkpolicies"),
+			extensionsv1beta1.SchemeGroupVersion.WithKind("NetworkPolicy"),
+			func() *extensionsv1beta1.NetworkPolicy { return &extensionsv1beta1.NetworkPolicy{} },
+			func() *extensionsv1beta1.NetworkPolicyList { return &extensionsv1beta1.NetworkPolicyList{} },
+			func(dst, src *extensionsv1beta1.NetworkPolicyList) { dst.ListMeta = src.ListMeta },
+			func(list *extensionsv1beta1.NetworkPolicyList) []*extensionsv1beta1.NetworkPolicy {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *extensionsv1beta1.NetworkPolicyList, items []*extensionsv1beta1.NetworkPolicy) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &extensionsv1beta1.NetworkPolicyList{ListMeta: obj.(*extensionsv1beta1.NetworkPolicyList).ListMeta}
-	for _, item := range obj.(*extensionsv1beta1.NetworkPolicyList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested NetworkPolicies across all clusters.
-func (c *networkPoliciesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(networkPoliciesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *networkPolicyClusterClient) Cluster(cluster logicalcluster.Path) typedkcpextensionsv1beta1.NetworkPoliciesNamespacer {
+	return &networkPolicyNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type networkPoliciesNamespacer struct {
+type networkPolicyNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *networkPoliciesNamespacer) Namespace(namespace string) extensionsv1beta1client.NetworkPolicyInterface {
-	return &networkPoliciesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *networkPolicyNamespacer) Namespace(namespace string) typedextensionsv1beta1.NetworkPolicyInterface {
+	return newFakeNetworkPolicyClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type networkPoliciesClient struct {
-	*kcptesting.Fake
+// networkPolicyScopedClient implements NetworkPolicyInterface
+type networkPolicyScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*extensionsv1beta1.NetworkPolicy, *extensionsv1beta1.NetworkPolicyList, *v1beta1.NetworkPolicyApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *networkPoliciesClient) Create(ctx context.Context, networkPolicy *extensionsv1beta1.NetworkPolicy, opts metav1.CreateOptions) (*extensionsv1beta1.NetworkPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(networkPoliciesResource, c.ClusterPath, c.Namespace, networkPolicy), &extensionsv1beta1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.NetworkPolicy), err
-}
-
-func (c *networkPoliciesClient) Update(ctx context.Context, networkPolicy *extensionsv1beta1.NetworkPolicy, opts metav1.UpdateOptions) (*extensionsv1beta1.NetworkPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(networkPoliciesResource, c.ClusterPath, c.Namespace, networkPolicy), &extensionsv1beta1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.NetworkPolicy), err
-}
-
-func (c *networkPoliciesClient) UpdateStatus(ctx context.Context, networkPolicy *extensionsv1beta1.NetworkPolicy, opts metav1.UpdateOptions) (*extensionsv1beta1.NetworkPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(networkPoliciesResource, c.ClusterPath, "status", c.Namespace, networkPolicy), &extensionsv1beta1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.NetworkPolicy), err
-}
-
-func (c *networkPoliciesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(networkPoliciesResource, c.ClusterPath, c.Namespace, name, opts), &extensionsv1beta1.NetworkPolicy{})
-	return err
 }
 
-func (c *networkPoliciesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(networkPoliciesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &extensionsv1beta1.NetworkPolicyList{})
-	return err
-}
-
-func (c *networkPoliciesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*extensionsv1beta1.NetworkPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(networkPoliciesResource, c.ClusterPath, c.Namespace, name), &extensionsv1beta1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.NetworkPolicy), err
-}
-
-// List takes label and field selectors, and returns the list of NetworkPolicies that match those selectors.
-func (c *networkPoliciesClient) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.NetworkPolicyList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(networkPoliciesResource, networkPoliciesKind, c.ClusterPath, c.Namespace, opts), &extensionsv1beta1.NetworkPolicyList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &extensionsv1beta1.NetworkPolicyList{ListMeta: obj.(*extensionsv1beta1.NetworkPolicyList).ListMeta}
-	for _, item := range obj.(*extensionsv1beta1.NetworkPolicyList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *networkPoliciesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(networkPoliciesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *networkPoliciesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*extensionsv1beta1.NetworkPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(networkPoliciesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &extensionsv1beta1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.NetworkPolicy), err
-}
-
-func (c *networkPoliciesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsextensionsv1beta1.NetworkPolicyApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.NetworkPolicy, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(networkPoliciesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &extensionsv1beta1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.NetworkPolicy), err
-}
-
-func (c *networkPoliciesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsextensionsv1beta1.NetworkPolicyApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.NetworkPolicy, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(networkPoliciesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &extensionsv1beta1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
+func newFakeNetworkPolicyClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedextensionsv1beta1.NetworkPolicyInterface {
+	return &networkPolicyScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*extensionsv1beta1.NetworkPolicy, *extensionsv1beta1.NetworkPolicyList, *v1beta1.NetworkPolicyApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			extensionsv1beta1.SchemeGroupVersion.WithResource("networkpolicies"),
+			extensionsv1beta1.SchemeGroupVersion.WithKind("NetworkPolicy"),
+			func() *extensionsv1beta1.NetworkPolicy { return &extensionsv1beta1.NetworkPolicy{} },
+			func() *extensionsv1beta1.NetworkPolicyList { return &extensionsv1beta1.NetworkPolicyList{} },
+			func(dst, src *extensionsv1beta1.NetworkPolicyList) { dst.ListMeta = src.ListMeta },
+			func(list *extensionsv1beta1.NetworkPolicyList) []*extensionsv1beta1.NetworkPolicy {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *extensionsv1beta1.NetworkPolicyList, items []*extensionsv1beta1.NetworkPolicy) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*extensionsv1beta1.NetworkPolicy), err
 }
diff --git a/kubernetes/typed/extensions/v1beta1/fake/podsecuritypolicy.go b/kubernetes/typed/extensions/v1beta1/fake/podsecuritypolicy.go
deleted file mode 100644
index c94e0b704..000000000
--- a/kubernetes/typed/extensions/v1beta1/fake/podsecuritypolicy.go
+++ /dev/null
@@ -1,202 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsextensionsv1beta1 "k8s.io/client-go/applyconfigurations/extensions/v1beta1"
-	extensionsv1beta1client "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
-	"k8s.io/client-go/testing"
-
-	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
-)
-
-var podSecurityPoliciesResource = schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "podsecuritypolicies"}
-var podSecurityPoliciesKind = schema.GroupVersionKind{Group: "extensions", Version: "v1beta1", Kind: "PodSecurityPolicy"}
-
-type podSecurityPoliciesClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *podSecurityPoliciesClusterClient) Cluster(clusterPath logicalcluster.Path) extensionsv1beta1client.PodSecurityPolicyInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &podSecurityPoliciesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PodSecurityPolicies that match those selectors across all clusters.
-func (c *podSecurityPoliciesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.PodSecurityPolicyList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(podSecurityPoliciesResource, podSecurityPoliciesKind, logicalcluster.Wildcard, opts), &extensionsv1beta1.PodSecurityPolicyList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &extensionsv1beta1.PodSecurityPolicyList{ListMeta: obj.(*extensionsv1beta1.PodSecurityPolicyList).ListMeta}
-	for _, item := range obj.(*extensionsv1beta1.PodSecurityPolicyList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested PodSecurityPolicies across all clusters.
-func (c *podSecurityPoliciesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(podSecurityPoliciesResource, logicalcluster.Wildcard, opts))
-}
-
-type podSecurityPoliciesClient struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-}
-
-func (c *podSecurityPoliciesClient) Create(ctx context.Context, podSecurityPolicy *extensionsv1beta1.PodSecurityPolicy, opts metav1.CreateOptions) (*extensionsv1beta1.PodSecurityPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(podSecurityPoliciesResource, c.ClusterPath, podSecurityPolicy), &extensionsv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.PodSecurityPolicy), err
-}
-
-func (c *podSecurityPoliciesClient) Update(ctx context.Context, podSecurityPolicy *extensionsv1beta1.PodSecurityPolicy, opts metav1.UpdateOptions) (*extensionsv1beta1.PodSecurityPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(podSecurityPoliciesResource, c.ClusterPath, podSecurityPolicy), &extensionsv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.PodSecurityPolicy), err
-}
-
-func (c *podSecurityPoliciesClient) UpdateStatus(ctx context.Context, podSecurityPolicy *extensionsv1beta1.PodSecurityPolicy, opts metav1.UpdateOptions) (*extensionsv1beta1.PodSecurityPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(podSecurityPoliciesResource, c.ClusterPath, "status", podSecurityPolicy), &extensionsv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.PodSecurityPolicy), err
-}
-
-func (c *podSecurityPoliciesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(podSecurityPoliciesResource, c.ClusterPath, name, opts), &extensionsv1beta1.PodSecurityPolicy{})
-	return err
-}
-
-func (c *podSecurityPoliciesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(podSecurityPoliciesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &extensionsv1beta1.PodSecurityPolicyList{})
-	return err
-}
-
-func (c *podSecurityPoliciesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*extensionsv1beta1.PodSecurityPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(podSecurityPoliciesResource, c.ClusterPath, name), &extensionsv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.PodSecurityPolicy), err
-}
-
-// List takes label and field selectors, and returns the list of PodSecurityPolicies that match those selectors.
-func (c *podSecurityPoliciesClient) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.PodSecurityPolicyList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(podSecurityPoliciesResource, podSecurityPoliciesKind, c.ClusterPath, opts), &extensionsv1beta1.PodSecurityPolicyList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &extensionsv1beta1.PodSecurityPolicyList{ListMeta: obj.(*extensionsv1beta1.PodSecurityPolicyList).ListMeta}
-	for _, item := range obj.(*extensionsv1beta1.PodSecurityPolicyList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *podSecurityPoliciesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(podSecurityPoliciesResource, c.ClusterPath, opts))
-}
-
-func (c *podSecurityPoliciesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*extensionsv1beta1.PodSecurityPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(podSecurityPoliciesResource, c.ClusterPath, name, pt, data, subresources...), &extensionsv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.PodSecurityPolicy), err
-}
-
-func (c *podSecurityPoliciesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsextensionsv1beta1.PodSecurityPolicyApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.PodSecurityPolicy, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(podSecurityPoliciesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &extensionsv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.PodSecurityPolicy), err
-}
-
-func (c *podSecurityPoliciesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsextensionsv1beta1.PodSecurityPolicyApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.PodSecurityPolicy, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(podSecurityPoliciesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &extensionsv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.PodSecurityPolicy), err
-}
diff --git a/kubernetes/typed/extensions/v1beta1/fake/replicaset.go b/kubernetes/typed/extensions/v1beta1/fake/replicaset.go
index 550801fa8..b1d62df7a 100644
--- a/kubernetes/typed/extensions/v1beta1/fake/replicaset.go
+++ b/kubernetes/typed/extensions/v1beta1/fake/replicaset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,232 +14,130 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
+	json "encoding/json"
+	fmt "fmt"
 
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsextensionsv1beta1 "k8s.io/client-go/applyconfigurations/extensions/v1beta1"
-	extensionsv1beta1client "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
-	"k8s.io/client-go/testing"
-
-	kcpextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	v1beta1 "k8s.io/client-go/applyconfigurations/extensions/v1beta1"
+	typedextensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
+
+	typedkcpextensionsv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/extensions/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var replicaSetsResource = schema.GroupVersionResource{Group: "extensions", Version: "v1beta1", Resource: "replicasets"}
-var replicaSetsKind = schema.GroupVersionKind{Group: "extensions", Version: "v1beta1", Kind: "ReplicaSet"}
-
-type replicaSetsClusterClient struct {
-	*kcptesting.Fake
+// replicaSetClusterClient implements ReplicaSetClusterInterface
+type replicaSetClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*extensionsv1beta1.ReplicaSet, *extensionsv1beta1.ReplicaSetList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *replicaSetsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpextensionsv1beta1.ReplicaSetsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeReplicaSetClusterClient(fake *ExtensionsV1beta1ClusterClient) typedkcpextensionsv1beta1.ReplicaSetClusterInterface {
+	return &replicaSetClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*extensionsv1beta1.ReplicaSet, *extensionsv1beta1.ReplicaSetList](
+			fake.Fake,
+			extensionsv1beta1.SchemeGroupVersion.WithResource("replicasets"),
+			extensionsv1beta1.SchemeGroupVersion.WithKind("ReplicaSet"),
+			func() *extensionsv1beta1.ReplicaSet { return &extensionsv1beta1.ReplicaSet{} },
+			func() *extensionsv1beta1.ReplicaSetList { return &extensionsv1beta1.ReplicaSetList{} },
+			func(dst, src *extensionsv1beta1.ReplicaSetList) { dst.ListMeta = src.ListMeta },
+			func(list *extensionsv1beta1.ReplicaSetList) []*extensionsv1beta1.ReplicaSet {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *extensionsv1beta1.ReplicaSetList, items []*extensionsv1beta1.ReplicaSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-
-	return &replicaSetsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-// List takes label and field selectors, and returns the list of ReplicaSets that match those selectors across all clusters.
-func (c *replicaSetsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.ReplicaSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(replicaSetsResource, replicaSetsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &extensionsv1beta1.ReplicaSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &extensionsv1beta1.ReplicaSetList{ListMeta: obj.(*extensionsv1beta1.ReplicaSetList).ListMeta}
-	for _, item := range obj.(*extensionsv1beta1.ReplicaSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested ReplicaSets across all clusters.
-func (c *replicaSetsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(replicaSetsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *replicaSetClusterClient) Cluster(cluster logicalcluster.Path) typedkcpextensionsv1beta1.ReplicaSetsNamespacer {
+	return &replicaSetNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type replicaSetsNamespacer struct {
+type replicaSetNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *replicaSetsNamespacer) Namespace(namespace string) extensionsv1beta1client.ReplicaSetInterface {
-	return &replicaSetsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *replicaSetNamespacer) Namespace(namespace string) typedextensionsv1beta1.ReplicaSetInterface {
+	return newFakeReplicaSetClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type replicaSetsClient struct {
-	*kcptesting.Fake
+// replicaSetScopedClient implements ReplicaSetInterface
+type replicaSetScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*extensionsv1beta1.ReplicaSet, *extensionsv1beta1.ReplicaSetList, *v1beta1.ReplicaSetApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
 }
 
-func (c *replicaSetsClient) Create(ctx context.Context, replicaSet *extensionsv1beta1.ReplicaSet, opts metav1.CreateOptions) (*extensionsv1beta1.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(replicaSetsResource, c.ClusterPath, c.Namespace, replicaSet), &extensionsv1beta1.ReplicaSet{})
+func newFakeReplicaSetClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedextensionsv1beta1.ReplicaSetInterface {
+	return &replicaSetScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*extensionsv1beta1.ReplicaSet, *extensionsv1beta1.ReplicaSetList, *v1beta1.ReplicaSetApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			extensionsv1beta1.SchemeGroupVersion.WithResource("replicasets"),
+			extensionsv1beta1.SchemeGroupVersion.WithKind("ReplicaSet"),
+			func() *extensionsv1beta1.ReplicaSet { return &extensionsv1beta1.ReplicaSet{} },
+			func() *extensionsv1beta1.ReplicaSetList { return &extensionsv1beta1.ReplicaSetList{} },
+			func(dst, src *extensionsv1beta1.ReplicaSetList) { dst.ListMeta = src.ListMeta },
+			func(list *extensionsv1beta1.ReplicaSetList) []*extensionsv1beta1.ReplicaSet {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *extensionsv1beta1.ReplicaSetList, items []*extensionsv1beta1.ReplicaSet) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
+
+// GetScale takes name of the replicaSet, and returns the corresponding scale object, and an error if there is any.
+func (c *replicaSetScopedClient) GetScale(ctx context.Context, replicaSetName string, _ v1.GetOptions) (result *extensionsv1beta1.Scale, err error) {
+	emptyResult := &extensionsv1beta1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), "scale", replicaSetName), emptyResult)
 	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) Update(ctx context.Context, replicaSet *extensionsv1beta1.ReplicaSet, opts metav1.UpdateOptions) (*extensionsv1beta1.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(replicaSetsResource, c.ClusterPath, c.Namespace, replicaSet), &extensionsv1beta1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) UpdateStatus(ctx context.Context, replicaSet *extensionsv1beta1.ReplicaSet, opts metav1.UpdateOptions) (*extensionsv1beta1.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(replicaSetsResource, c.ClusterPath, "status", c.Namespace, replicaSet), &extensionsv1beta1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(replicaSetsResource, c.ClusterPath, c.Namespace, name, opts), &extensionsv1beta1.ReplicaSet{})
-	return err
-}
-
-func (c *replicaSetsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(replicaSetsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &extensionsv1beta1.ReplicaSetList{})
-	return err
-}
-
-func (c *replicaSetsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*extensionsv1beta1.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(replicaSetsResource, c.ClusterPath, c.Namespace, name), &extensionsv1beta1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.ReplicaSet), err
-}
-
-// List takes label and field selectors, and returns the list of ReplicaSets that match those selectors.
-func (c *replicaSetsClient) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.ReplicaSetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(replicaSetsResource, replicaSetsKind, c.ClusterPath, c.Namespace, opts), &extensionsv1beta1.ReplicaSetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &extensionsv1beta1.ReplicaSetList{ListMeta: obj.(*extensionsv1beta1.ReplicaSetList).ListMeta}
-	for _, item := range obj.(*extensionsv1beta1.ReplicaSetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *replicaSetsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(replicaSetsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *replicaSetsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*extensionsv1beta1.ReplicaSet, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicaSetsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &extensionsv1beta1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsextensionsv1beta1.ReplicaSetApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.ReplicaSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicaSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &extensionsv1beta1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsextensionsv1beta1.ReplicaSetApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.ReplicaSet, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicaSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &extensionsv1beta1.ReplicaSet{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*extensionsv1beta1.ReplicaSet), err
-}
-
-func (c *replicaSetsClient) GetScale(ctx context.Context, replicaSetName string, options metav1.GetOptions) (*extensionsv1beta1.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetSubresourceAction(replicaSetsResource, c.ClusterPath, "scale", c.Namespace, replicaSetName), &extensionsv1beta1.Scale{})
-	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*extensionsv1beta1.Scale), err
 }
 
-func (c *replicaSetsClient) UpdateScale(ctx context.Context, replicaSetName string, scale *extensionsv1beta1.Scale, opts metav1.UpdateOptions) (*extensionsv1beta1.Scale, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(replicaSetsResource, c.ClusterPath, "scale", c.Namespace, scale), &extensionsv1beta1.Scale{})
+// UpdateScale takes the representation of a scale and updates it. Returns the server's representation of the scale, and an error, if there is any.
+func (c *replicaSetScopedClient) UpdateScale(ctx context.Context, replicaSetName string, scale *extensionsv1beta1.Scale, _ v1.UpdateOptions) (result *extensionsv1beta1.Scale, err error) {
+	emptyResult := &extensionsv1beta1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(c.Resource(), c.ClusterPath, "scale", c.Namespace(), scale), &extensionsv1beta1.Scale{})
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*extensionsv1beta1.Scale), err
 }
 
-func (c *replicaSetsClient) ApplyScale(ctx context.Context, replicaSetName string, applyConfiguration *applyconfigurationsextensionsv1beta1.ScaleApplyConfiguration, opts metav1.ApplyOptions) (*extensionsv1beta1.Scale, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
+// ApplyScale takes top resource name and the apply declarative configuration for scale,
+// applies it and returns the applied scale, and an error, if there is any.
+func (c *replicaSetScopedClient) ApplyScale(ctx context.Context, replicaSetName string, scale *v1beta1.ScaleApplyConfiguration, _ v1.ApplyOptions) (result *extensionsv1beta1.Scale, err error) {
+	if scale == nil {
+		return nil, fmt.Errorf("scale provided to ApplyScale must not be nil")
 	}
-	data, err := json.Marshal(applyConfiguration)
+	data, err := json.Marshal(scale)
 	if err != nil {
 		return nil, err
 	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(replicaSetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &extensionsv1beta1.Scale{})
+	emptyResult := &extensionsv1beta1.Scale{}
+	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(c.Resource(), c.ClusterPath, c.Namespace(), replicaSetName, types.ApplyPatchType, data, "scale"), emptyResult)
 	if obj == nil {
-		return nil, err
+		return emptyResult, err
 	}
 	return obj.(*extensionsv1beta1.Scale), err
 }
diff --git a/kubernetes/typed/extensions/v1beta1/generated_expansion.go b/kubernetes/typed/extensions/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..a151e1cd4
--- /dev/null
+++ b/kubernetes/typed/extensions/v1beta1/generated_expansion.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type DaemonSetClusterExpansion interface{}
+
+type DeploymentClusterExpansion interface{}
+
+type IngressClusterExpansion interface{}
+
+type NetworkPolicyClusterExpansion interface{}
+
+type ReplicaSetClusterExpansion interface{}
diff --git a/kubernetes/typed/extensions/v1beta1/ingress.go b/kubernetes/typed/extensions/v1beta1/ingress.go
index f3e1f44ae..ef82d3533 100644
--- a/kubernetes/typed/extensions/v1beta1/ingress.go
+++ b/kubernetes/typed/extensions/v1beta1/ingress.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedextensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	extensionsv1beta1client "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 )
 
 // IngressesClusterGetter has a method to return a IngressClusterInterface.
@@ -43,12 +40,13 @@ type IngressesClusterGetter interface {
 // or scope down to one cluster and return a IngressesNamespacer.
 type IngressClusterInterface interface {
 	Cluster(logicalcluster.Path) IngressesNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.IngressList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*extensionsv1beta1.IngressList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	IngressClusterExpansion
 }
 
 type ingressesClusterInterface struct {
-	clientCache kcpclient.Cache[*extensionsv1beta1client.ExtensionsV1beta1Client]
+	clientCache kcpclient.Cache[*typedextensionsv1beta1.ExtensionsV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *ingressesClusterInterface) Cluster(clusterPath logicalcluster.Path) Ing
 }
 
 // List returns the entire collection of all Ingresses across all clusters.
-func (c *ingressesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.IngressList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Ingresses(metav1.NamespaceAll).List(ctx, opts)
+func (c *ingressesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*extensionsv1beta1.IngressList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Ingresses(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all Ingresses across all clusters.
-func (c *ingressesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Ingresses(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *ingressesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Ingresses(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// IngressesNamespacer can scope to objects within a namespace, returning a extensionsv1beta1client.IngressInterface.
+// IngressesNamespacer can scope to objects within a namespace, returning a typedextensionsv1beta1.IngressInterface.
 type IngressesNamespacer interface {
-	Namespace(string) extensionsv1beta1client.IngressInterface
+	Namespace(string) typedextensionsv1beta1.IngressInterface
 }
 
 type ingressesNamespacer struct {
-	clientCache kcpclient.Cache[*extensionsv1beta1client.ExtensionsV1beta1Client]
+	clientCache kcpclient.Cache[*typedextensionsv1beta1.ExtensionsV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *ingressesNamespacer) Namespace(namespace string) extensionsv1beta1client.IngressInterface {
+func (n *ingressesNamespacer) Namespace(namespace string) typedextensionsv1beta1.IngressInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Ingresses(namespace)
 }
diff --git a/kubernetes/typed/extensions/v1beta1/networkpolicy.go b/kubernetes/typed/extensions/v1beta1/networkpolicy.go
index 6dd5d83a7..b2f53d5a4 100644
--- a/kubernetes/typed/extensions/v1beta1/networkpolicy.go
+++ b/kubernetes/typed/extensions/v1beta1/networkpolicy.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedextensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	extensionsv1beta1client "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 )
 
 // NetworkPoliciesClusterGetter has a method to return a NetworkPolicyClusterInterface.
@@ -43,12 +40,13 @@ type NetworkPoliciesClusterGetter interface {
 // or scope down to one cluster and return a NetworkPoliciesNamespacer.
 type NetworkPolicyClusterInterface interface {
 	Cluster(logicalcluster.Path) NetworkPoliciesNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.NetworkPolicyList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*extensionsv1beta1.NetworkPolicyList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	NetworkPolicyClusterExpansion
 }
 
 type networkPoliciesClusterInterface struct {
-	clientCache kcpclient.Cache[*extensionsv1beta1client.ExtensionsV1beta1Client]
+	clientCache kcpclient.Cache[*typedextensionsv1beta1.ExtensionsV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *networkPoliciesClusterInterface) Cluster(clusterPath logicalcluster.Pat
 }
 
 // List returns the entire collection of all NetworkPolicies across all clusters.
-func (c *networkPoliciesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.NetworkPolicyList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).NetworkPolicies(metav1.NamespaceAll).List(ctx, opts)
+func (c *networkPoliciesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*extensionsv1beta1.NetworkPolicyList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).NetworkPolicies(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all NetworkPolicies across all clusters.
-func (c *networkPoliciesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).NetworkPolicies(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *networkPoliciesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).NetworkPolicies(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// NetworkPoliciesNamespacer can scope to objects within a namespace, returning a extensionsv1beta1client.NetworkPolicyInterface.
+// NetworkPoliciesNamespacer can scope to objects within a namespace, returning a typedextensionsv1beta1.NetworkPolicyInterface.
 type NetworkPoliciesNamespacer interface {
-	Namespace(string) extensionsv1beta1client.NetworkPolicyInterface
+	Namespace(string) typedextensionsv1beta1.NetworkPolicyInterface
 }
 
 type networkPoliciesNamespacer struct {
-	clientCache kcpclient.Cache[*extensionsv1beta1client.ExtensionsV1beta1Client]
+	clientCache kcpclient.Cache[*typedextensionsv1beta1.ExtensionsV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *networkPoliciesNamespacer) Namespace(namespace string) extensionsv1beta1client.NetworkPolicyInterface {
+func (n *networkPoliciesNamespacer) Namespace(namespace string) typedextensionsv1beta1.NetworkPolicyInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).NetworkPolicies(namespace)
 }
diff --git a/kubernetes/typed/extensions/v1beta1/podsecuritypolicy.go b/kubernetes/typed/extensions/v1beta1/podsecuritypolicy.go
deleted file mode 100644
index f96d23f03..000000000
--- a/kubernetes/typed/extensions/v1beta1/podsecuritypolicy.go
+++ /dev/null
@@ -1,71 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1beta1
-
-import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	extensionsv1beta1client "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
-)
-
-// PodSecurityPoliciesClusterGetter has a method to return a PodSecurityPolicyClusterInterface.
-// A group's cluster client should implement this interface.
-type PodSecurityPoliciesClusterGetter interface {
-	PodSecurityPolicies() PodSecurityPolicyClusterInterface
-}
-
-// PodSecurityPolicyClusterInterface can operate on PodSecurityPolicies across all clusters,
-// or scope down to one cluster and return a extensionsv1beta1client.PodSecurityPolicyInterface.
-type PodSecurityPolicyClusterInterface interface {
-	Cluster(logicalcluster.Path) extensionsv1beta1client.PodSecurityPolicyInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.PodSecurityPolicyList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
-}
-
-type podSecurityPoliciesClusterInterface struct {
-	clientCache kcpclient.Cache[*extensionsv1beta1client.ExtensionsV1beta1Client]
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *podSecurityPoliciesClusterInterface) Cluster(clusterPath logicalcluster.Path) extensionsv1beta1client.PodSecurityPolicyInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return c.clientCache.ClusterOrDie(clusterPath).PodSecurityPolicies()
-}
-
-// List returns the entire collection of all PodSecurityPolicies across all clusters.
-func (c *podSecurityPoliciesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.PodSecurityPolicyList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PodSecurityPolicies().List(ctx, opts)
-}
-
-// Watch begins to watch all PodSecurityPolicies across all clusters.
-func (c *podSecurityPoliciesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PodSecurityPolicies().Watch(ctx, opts)
-}
diff --git a/kubernetes/typed/extensions/v1beta1/replicaset.go b/kubernetes/typed/extensions/v1beta1/replicaset.go
index 4b284c366..68537ce87 100644
--- a/kubernetes/typed/extensions/v1beta1/replicaset.go
+++ b/kubernetes/typed/extensions/v1beta1/replicaset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedextensionsv1beta1 "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	extensionsv1beta1client "k8s.io/client-go/kubernetes/typed/extensions/v1beta1"
 )
 
 // ReplicaSetsClusterGetter has a method to return a ReplicaSetClusterInterface.
@@ -43,12 +40,13 @@ type ReplicaSetsClusterGetter interface {
 // or scope down to one cluster and return a ReplicaSetsNamespacer.
 type ReplicaSetClusterInterface interface {
 	Cluster(logicalcluster.Path) ReplicaSetsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.ReplicaSetList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*extensionsv1beta1.ReplicaSetList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ReplicaSetClusterExpansion
 }
 
 type replicaSetsClusterInterface struct {
-	clientCache kcpclient.Cache[*extensionsv1beta1client.ExtensionsV1beta1Client]
+	clientCache kcpclient.Cache[*typedextensionsv1beta1.ExtensionsV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *replicaSetsClusterInterface) Cluster(clusterPath logicalcluster.Path) R
 }
 
 // List returns the entire collection of all ReplicaSets across all clusters.
-func (c *replicaSetsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*extensionsv1beta1.ReplicaSetList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ReplicaSets(metav1.NamespaceAll).List(ctx, opts)
+func (c *replicaSetsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*extensionsv1beta1.ReplicaSetList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ReplicaSets(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all ReplicaSets across all clusters.
-func (c *replicaSetsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ReplicaSets(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *replicaSetsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ReplicaSets(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ReplicaSetsNamespacer can scope to objects within a namespace, returning a extensionsv1beta1client.ReplicaSetInterface.
+// ReplicaSetsNamespacer can scope to objects within a namespace, returning a typedextensionsv1beta1.ReplicaSetInterface.
 type ReplicaSetsNamespacer interface {
-	Namespace(string) extensionsv1beta1client.ReplicaSetInterface
+	Namespace(string) typedextensionsv1beta1.ReplicaSetInterface
 }
 
 type replicaSetsNamespacer struct {
-	clientCache kcpclient.Cache[*extensionsv1beta1client.ExtensionsV1beta1Client]
+	clientCache kcpclient.Cache[*typedextensionsv1beta1.ExtensionsV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *replicaSetsNamespacer) Namespace(namespace string) extensionsv1beta1client.ReplicaSetInterface {
+func (n *replicaSetsNamespacer) Namespace(namespace string) typedextensionsv1beta1.ReplicaSetInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).ReplicaSets(namespace)
 }
diff --git a/kubernetes/typed/flowcontrol/v1/doc.go b/kubernetes/typed/flowcontrol/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/flowcontrol/v1/fake/doc.go b/kubernetes/typed/flowcontrol/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/flowcontrol/v1/fake/flowcontrol_client.go b/kubernetes/typed/flowcontrol/v1/fake/flowcontrol_client.go
new file mode 100644
index 000000000..3ea69fdc8
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1/fake/flowcontrol_client.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	flowcontrolv1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1"
+	rest "k8s.io/client-go/rest"
+
+	kcpflowcontrolv1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+var _ kcpflowcontrolv1.FlowcontrolV1ClusterInterface = (*FlowcontrolV1ClusterClient)(nil)
+
+type FlowcontrolV1ClusterClient struct {
+	*kcptesting.Fake
+}
+
+func (c *FlowcontrolV1ClusterClient) Cluster(clusterPath logicalcluster.Path) flowcontrolv1.FlowcontrolV1Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return &FlowcontrolV1Client{Fake: c.Fake, ClusterPath: clusterPath}
+}
+
+func (c *FlowcontrolV1ClusterClient) FlowSchemas() kcpflowcontrolv1.FlowSchemaClusterInterface {
+	return newFakeFlowSchemaClusterClient(c)
+}
+
+func (c *FlowcontrolV1ClusterClient) PriorityLevelConfigurations() kcpflowcontrolv1.PriorityLevelConfigurationClusterInterface {
+	return newFakePriorityLevelConfigurationClusterClient(c)
+}
+
+type FlowcontrolV1Client struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (c *FlowcontrolV1Client) FlowSchemas() flowcontrolv1.FlowSchemaInterface {
+	return newFakeFlowSchemaClient(c.Fake, c.ClusterPath)
+}
+
+func (c *FlowcontrolV1Client) PriorityLevelConfigurations() flowcontrolv1.PriorityLevelConfigurationInterface {
+	return newFakePriorityLevelConfigurationClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FlowcontrolV1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/kubernetes/typed/flowcontrol/v1/fake/flowschema.go b/kubernetes/typed/flowcontrol/v1/fake/flowschema.go
new file mode 100644
index 000000000..bcdc343de
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1/fake/flowschema.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	flowcontrolv1 "k8s.io/api/flowcontrol/v1"
+	v1 "k8s.io/client-go/applyconfigurations/flowcontrol/v1"
+	typedflowcontrolv1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1"
+
+	typedkcpflowcontrolv1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// flowSchemaClusterClient implements FlowSchemaClusterInterface
+type flowSchemaClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*flowcontrolv1.FlowSchema, *flowcontrolv1.FlowSchemaList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeFlowSchemaClusterClient(fake *FlowcontrolV1ClusterClient) typedkcpflowcontrolv1.FlowSchemaClusterInterface {
+	return &flowSchemaClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*flowcontrolv1.FlowSchema, *flowcontrolv1.FlowSchemaList](
+			fake.Fake,
+			flowcontrolv1.SchemeGroupVersion.WithResource("flowschemas"),
+			flowcontrolv1.SchemeGroupVersion.WithKind("FlowSchema"),
+			func() *flowcontrolv1.FlowSchema { return &flowcontrolv1.FlowSchema{} },
+			func() *flowcontrolv1.FlowSchemaList { return &flowcontrolv1.FlowSchemaList{} },
+			func(dst, src *flowcontrolv1.FlowSchemaList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1.FlowSchemaList) []*flowcontrolv1.FlowSchema {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1.FlowSchemaList, items []*flowcontrolv1.FlowSchema) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *flowSchemaClusterClient) Cluster(cluster logicalcluster.Path) typedflowcontrolv1.FlowSchemaInterface {
+	return newFakeFlowSchemaClient(c.Fake, cluster)
+}
+
+// flowSchemaScopedClient implements FlowSchemaInterface
+type flowSchemaScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*flowcontrolv1.FlowSchema, *flowcontrolv1.FlowSchemaList, *v1.FlowSchemaApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeFlowSchemaClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedflowcontrolv1.FlowSchemaInterface {
+	return &flowSchemaScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*flowcontrolv1.FlowSchema, *flowcontrolv1.FlowSchemaList, *v1.FlowSchemaApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			flowcontrolv1.SchemeGroupVersion.WithResource("flowschemas"),
+			flowcontrolv1.SchemeGroupVersion.WithKind("FlowSchema"),
+			func() *flowcontrolv1.FlowSchema { return &flowcontrolv1.FlowSchema{} },
+			func() *flowcontrolv1.FlowSchemaList { return &flowcontrolv1.FlowSchemaList{} },
+			func(dst, src *flowcontrolv1.FlowSchemaList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1.FlowSchemaList) []*flowcontrolv1.FlowSchema {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1.FlowSchemaList, items []*flowcontrolv1.FlowSchema) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/flowcontrol/v1/fake/prioritylevelconfiguration.go b/kubernetes/typed/flowcontrol/v1/fake/prioritylevelconfiguration.go
new file mode 100644
index 000000000..41fe2a568
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1/fake/prioritylevelconfiguration.go
@@ -0,0 +1,94 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	flowcontrolv1 "k8s.io/api/flowcontrol/v1"
+	v1 "k8s.io/client-go/applyconfigurations/flowcontrol/v1"
+	typedflowcontrolv1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1"
+
+	typedkcpflowcontrolv1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// priorityLevelConfigurationClusterClient implements PriorityLevelConfigurationClusterInterface
+type priorityLevelConfigurationClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*flowcontrolv1.PriorityLevelConfiguration, *flowcontrolv1.PriorityLevelConfigurationList]
+	Fake *kcptesting.Fake
+}
+
+func newFakePriorityLevelConfigurationClusterClient(fake *FlowcontrolV1ClusterClient) typedkcpflowcontrolv1.PriorityLevelConfigurationClusterInterface {
+	return &priorityLevelConfigurationClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*flowcontrolv1.PriorityLevelConfiguration, *flowcontrolv1.PriorityLevelConfigurationList](
+			fake.Fake,
+			flowcontrolv1.SchemeGroupVersion.WithResource("prioritylevelconfigurations"),
+			flowcontrolv1.SchemeGroupVersion.WithKind("PriorityLevelConfiguration"),
+			func() *flowcontrolv1.PriorityLevelConfiguration { return &flowcontrolv1.PriorityLevelConfiguration{} },
+			func() *flowcontrolv1.PriorityLevelConfigurationList {
+				return &flowcontrolv1.PriorityLevelConfigurationList{}
+			},
+			func(dst, src *flowcontrolv1.PriorityLevelConfigurationList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1.PriorityLevelConfigurationList) []*flowcontrolv1.PriorityLevelConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1.PriorityLevelConfigurationList, items []*flowcontrolv1.PriorityLevelConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *priorityLevelConfigurationClusterClient) Cluster(cluster logicalcluster.Path) typedflowcontrolv1.PriorityLevelConfigurationInterface {
+	return newFakePriorityLevelConfigurationClient(c.Fake, cluster)
+}
+
+// priorityLevelConfigurationScopedClient implements PriorityLevelConfigurationInterface
+type priorityLevelConfigurationScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*flowcontrolv1.PriorityLevelConfiguration, *flowcontrolv1.PriorityLevelConfigurationList, *v1.PriorityLevelConfigurationApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakePriorityLevelConfigurationClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedflowcontrolv1.PriorityLevelConfigurationInterface {
+	return &priorityLevelConfigurationScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*flowcontrolv1.PriorityLevelConfiguration, *flowcontrolv1.PriorityLevelConfigurationList, *v1.PriorityLevelConfigurationApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			flowcontrolv1.SchemeGroupVersion.WithResource("prioritylevelconfigurations"),
+			flowcontrolv1.SchemeGroupVersion.WithKind("PriorityLevelConfiguration"),
+			func() *flowcontrolv1.PriorityLevelConfiguration { return &flowcontrolv1.PriorityLevelConfiguration{} },
+			func() *flowcontrolv1.PriorityLevelConfigurationList {
+				return &flowcontrolv1.PriorityLevelConfigurationList{}
+			},
+			func(dst, src *flowcontrolv1.PriorityLevelConfigurationList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1.PriorityLevelConfigurationList) []*flowcontrolv1.PriorityLevelConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1.PriorityLevelConfigurationList, items []*flowcontrolv1.PriorityLevelConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/flowcontrol/v1/flowcontrol_client.go b/kubernetes/typed/flowcontrol/v1/flowcontrol_client.go
new file mode 100644
index 000000000..bdce2390e
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1/flowcontrol_client.go
@@ -0,0 +1,108 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	http "net/http"
+
+	apiflowcontrolv1 "k8s.io/api/flowcontrol/v1"
+	flowcontrolv1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1"
+	rest "k8s.io/client-go/rest"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+type FlowcontrolV1ClusterInterface interface {
+	FlowcontrolV1ClusterScoper
+	FlowSchemasClusterGetter
+	PriorityLevelConfigurationsClusterGetter
+}
+
+type FlowcontrolV1ClusterScoper interface {
+	Cluster(logicalcluster.Path) flowcontrolv1.FlowcontrolV1Interface
+}
+
+// FlowcontrolV1ClusterClient is used to interact with features provided by the flowcontrol.apiserver.k8s.io group.
+type FlowcontrolV1ClusterClient struct {
+	clientCache kcpclient.Cache[*flowcontrolv1.FlowcontrolV1Client]
+}
+
+func (c *FlowcontrolV1ClusterClient) Cluster(clusterPath logicalcluster.Path) flowcontrolv1.FlowcontrolV1Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return c.clientCache.ClusterOrDie(clusterPath)
+}
+
+func (c *FlowcontrolV1ClusterClient) FlowSchemas() FlowSchemaClusterInterface {
+	return &flowSchemasClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *FlowcontrolV1ClusterClient) PriorityLevelConfigurations() PriorityLevelConfigurationClusterInterface {
+	return &priorityLevelConfigurationsClusterInterface{clientCache: c.clientCache}
+}
+
+// NewForConfig creates a new FlowcontrolV1ClusterClient for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*FlowcontrolV1ClusterClient, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new FlowcontrolV1ClusterClient for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*FlowcontrolV1ClusterClient, error) {
+	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*flowcontrolv1.FlowcontrolV1Client]{
+		NewForConfigAndClient: flowcontrolv1.NewForConfigAndClient,
+	})
+	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
+		return nil, err
+	}
+
+	return &FlowcontrolV1ClusterClient{clientCache: cache}, nil
+}
+
+// NewForConfigOrDie creates a new FlowcontrolV1ClusterClient for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *FlowcontrolV1ClusterClient {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiflowcontrolv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/flowcontrol/v1alpha1/flowschema.go b/kubernetes/typed/flowcontrol/v1/flowschema.go
similarity index 70%
rename from kubernetes/typed/flowcontrol/v1alpha1/flowschema.go
rename to kubernetes/typed/flowcontrol/v1/flowschema.go
index e142a2f25..f6408de74 100644
--- a/kubernetes/typed/flowcontrol/v1alpha1/flowschema.go
+++ b/kubernetes/typed/flowcontrol/v1/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
-package v1alpha1
+package v1
 
 import (
-	"context"
+	context "context"
+
+	apiflowcontrolv1 "k8s.io/api/flowcontrol/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1alpha1 "k8s.io/api/flowcontrol/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	flowcontrolv1alpha1client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1alpha1"
 )
 
 // FlowSchemasClusterGetter has a method to return a FlowSchemaClusterInterface.
@@ -40,19 +37,20 @@ type FlowSchemasClusterGetter interface {
 }
 
 // FlowSchemaClusterInterface can operate on FlowSchemas across all clusters,
-// or scope down to one cluster and return a flowcontrolv1alpha1client.FlowSchemaInterface.
+// or scope down to one cluster and return a flowcontrolv1.FlowSchemaInterface.
 type FlowSchemaClusterInterface interface {
-	Cluster(logicalcluster.Path) flowcontrolv1alpha1client.FlowSchemaInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1alpha1.FlowSchemaList, error)
+	Cluster(logicalcluster.Path) flowcontrolv1.FlowSchemaInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apiflowcontrolv1.FlowSchemaList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	FlowSchemaClusterExpansion
 }
 
 type flowSchemasClusterInterface struct {
-	clientCache kcpclient.Cache[*flowcontrolv1alpha1client.FlowcontrolV1alpha1Client]
+	clientCache kcpclient.Cache[*flowcontrolv1.FlowcontrolV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *flowSchemasClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1alpha1client.FlowSchemaInterface {
+func (c *flowSchemasClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1.FlowSchemaInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *flowSchemasClusterInterface) Cluster(clusterPath logicalcluster.Path) f
 }
 
 // List returns the entire collection of all FlowSchemas across all clusters.
-func (c *flowSchemasClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1alpha1.FlowSchemaList, error) {
+func (c *flowSchemasClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apiflowcontrolv1.FlowSchemaList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).FlowSchemas().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/flowcontrol/v1/generated_expansion.go b/kubernetes/typed/flowcontrol/v1/generated_expansion.go
new file mode 100644
index 000000000..12f89237d
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type FlowSchemaClusterExpansion interface{}
+
+type PriorityLevelConfigurationClusterExpansion interface{}
diff --git a/kubernetes/typed/flowcontrol/v1alpha1/prioritylevelconfiguration.go b/kubernetes/typed/flowcontrol/v1/prioritylevelconfiguration.go
similarity index 70%
rename from kubernetes/typed/flowcontrol/v1alpha1/prioritylevelconfiguration.go
rename to kubernetes/typed/flowcontrol/v1/prioritylevelconfiguration.go
index a9e4db7a8..9d880b935 100644
--- a/kubernetes/typed/flowcontrol/v1alpha1/prioritylevelconfiguration.go
+++ b/kubernetes/typed/flowcontrol/v1/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
-package v1alpha1
+package v1
 
 import (
-	"context"
+	context "context"
+
+	apiflowcontrolv1 "k8s.io/api/flowcontrol/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1alpha1 "k8s.io/api/flowcontrol/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	flowcontrolv1alpha1client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1alpha1"
 )
 
 // PriorityLevelConfigurationsClusterGetter has a method to return a PriorityLevelConfigurationClusterInterface.
@@ -40,19 +37,20 @@ type PriorityLevelConfigurationsClusterGetter interface {
 }
 
 // PriorityLevelConfigurationClusterInterface can operate on PriorityLevelConfigurations across all clusters,
-// or scope down to one cluster and return a flowcontrolv1alpha1client.PriorityLevelConfigurationInterface.
+// or scope down to one cluster and return a flowcontrolv1.PriorityLevelConfigurationInterface.
 type PriorityLevelConfigurationClusterInterface interface {
-	Cluster(logicalcluster.Path) flowcontrolv1alpha1client.PriorityLevelConfigurationInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1alpha1.PriorityLevelConfigurationList, error)
+	Cluster(logicalcluster.Path) flowcontrolv1.PriorityLevelConfigurationInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apiflowcontrolv1.PriorityLevelConfigurationList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	PriorityLevelConfigurationClusterExpansion
 }
 
 type priorityLevelConfigurationsClusterInterface struct {
-	clientCache kcpclient.Cache[*flowcontrolv1alpha1client.FlowcontrolV1alpha1Client]
+	clientCache kcpclient.Cache[*flowcontrolv1.FlowcontrolV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *priorityLevelConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1alpha1client.PriorityLevelConfigurationInterface {
+func (c *priorityLevelConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1.PriorityLevelConfigurationInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *priorityLevelConfigurationsClusterInterface) Cluster(clusterPath logica
 }
 
 // List returns the entire collection of all PriorityLevelConfigurations across all clusters.
-func (c *priorityLevelConfigurationsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1alpha1.PriorityLevelConfigurationList, error) {
+func (c *priorityLevelConfigurationsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apiflowcontrolv1.PriorityLevelConfigurationList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PriorityLevelConfigurations().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/flowcontrol/v1alpha1/fake/flowcontrol_client.go b/kubernetes/typed/flowcontrol/v1alpha1/fake/flowcontrol_client.go
deleted file mode 100644
index 4afa3a3ad..000000000
--- a/kubernetes/typed/flowcontrol/v1alpha1/fake/flowcontrol_client.go
+++ /dev/null
@@ -1,73 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package fake
-
-import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1alpha1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1alpha1"
-	"k8s.io/client-go/rest"
-
-	kcpflowcontrolv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1alpha1"
-	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
-)
-
-var _ kcpflowcontrolv1alpha1.FlowcontrolV1alpha1ClusterInterface = (*FlowcontrolV1alpha1ClusterClient)(nil)
-
-type FlowcontrolV1alpha1ClusterClient struct {
-	*kcptesting.Fake
-}
-
-func (c *FlowcontrolV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) flowcontrolv1alpha1.FlowcontrolV1alpha1Interface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-	return &FlowcontrolV1alpha1Client{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-func (c *FlowcontrolV1alpha1ClusterClient) FlowSchemas() kcpflowcontrolv1alpha1.FlowSchemaClusterInterface {
-	return &flowSchemasClusterClient{Fake: c.Fake}
-}
-
-func (c *FlowcontrolV1alpha1ClusterClient) PriorityLevelConfigurations() kcpflowcontrolv1alpha1.PriorityLevelConfigurationClusterInterface {
-	return &priorityLevelConfigurationsClusterClient{Fake: c.Fake}
-}
-
-var _ flowcontrolv1alpha1.FlowcontrolV1alpha1Interface = (*FlowcontrolV1alpha1Client)(nil)
-
-type FlowcontrolV1alpha1Client struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-}
-
-func (c *FlowcontrolV1alpha1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
-}
-
-func (c *FlowcontrolV1alpha1Client) FlowSchemas() flowcontrolv1alpha1.FlowSchemaInterface {
-	return &flowSchemasClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
-
-func (c *FlowcontrolV1alpha1Client) PriorityLevelConfigurations() flowcontrolv1alpha1.PriorityLevelConfigurationInterface {
-	return &priorityLevelConfigurationsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
diff --git a/kubernetes/typed/flowcontrol/v1alpha1/fake/flowschema.go b/kubernetes/typed/flowcontrol/v1alpha1/fake/flowschema.go
deleted file mode 100644
index ef228dfa5..000000000
--- a/kubernetes/typed/flowcontrol/v1alpha1/fake/flowschema.go
+++ /dev/null
@@ -1,202 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1alpha1 "k8s.io/api/flowcontrol/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsflowcontrolv1alpha1 "k8s.io/client-go/applyconfigurations/flowcontrol/v1alpha1"
-	flowcontrolv1alpha1client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1alpha1"
-	"k8s.io/client-go/testing"
-
-	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
-)
-
-var flowSchemasResource = schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1alpha1", Resource: "flowschemas"}
-var flowSchemasKind = schema.GroupVersionKind{Group: "flowcontrol.apiserver.k8s.io", Version: "v1alpha1", Kind: "FlowSchema"}
-
-type flowSchemasClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *flowSchemasClusterClient) Cluster(clusterPath logicalcluster.Path) flowcontrolv1alpha1client.FlowSchemaInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &flowSchemasClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of FlowSchemas that match those selectors across all clusters.
-func (c *flowSchemasClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1alpha1.FlowSchemaList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(flowSchemasResource, flowSchemasKind, logicalcluster.Wildcard, opts), &flowcontrolv1alpha1.FlowSchemaList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1alpha1.FlowSchemaList{ListMeta: obj.(*flowcontrolv1alpha1.FlowSchemaList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1alpha1.FlowSchemaList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested FlowSchemas across all clusters.
-func (c *flowSchemasClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(flowSchemasResource, logicalcluster.Wildcard, opts))
-}
-
-type flowSchemasClient struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-}
-
-func (c *flowSchemasClient) Create(ctx context.Context, flowSchema *flowcontrolv1alpha1.FlowSchema, opts metav1.CreateOptions) (*flowcontrolv1alpha1.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(flowSchemasResource, c.ClusterPath, flowSchema), &flowcontrolv1alpha1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.FlowSchema), err
-}
-
-func (c *flowSchemasClient) Update(ctx context.Context, flowSchema *flowcontrolv1alpha1.FlowSchema, opts metav1.UpdateOptions) (*flowcontrolv1alpha1.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(flowSchemasResource, c.ClusterPath, flowSchema), &flowcontrolv1alpha1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.FlowSchema), err
-}
-
-func (c *flowSchemasClient) UpdateStatus(ctx context.Context, flowSchema *flowcontrolv1alpha1.FlowSchema, opts metav1.UpdateOptions) (*flowcontrolv1alpha1.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(flowSchemasResource, c.ClusterPath, "status", flowSchema), &flowcontrolv1alpha1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.FlowSchema), err
-}
-
-func (c *flowSchemasClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(flowSchemasResource, c.ClusterPath, name, opts), &flowcontrolv1alpha1.FlowSchema{})
-	return err
-}
-
-func (c *flowSchemasClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(flowSchemasResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &flowcontrolv1alpha1.FlowSchemaList{})
-	return err
-}
-
-func (c *flowSchemasClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*flowcontrolv1alpha1.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(flowSchemasResource, c.ClusterPath, name), &flowcontrolv1alpha1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.FlowSchema), err
-}
-
-// List takes label and field selectors, and returns the list of FlowSchemas that match those selectors.
-func (c *flowSchemasClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1alpha1.FlowSchemaList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(flowSchemasResource, flowSchemasKind, c.ClusterPath, opts), &flowcontrolv1alpha1.FlowSchemaList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1alpha1.FlowSchemaList{ListMeta: obj.(*flowcontrolv1alpha1.FlowSchemaList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1alpha1.FlowSchemaList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *flowSchemasClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(flowSchemasResource, c.ClusterPath, opts))
-}
-
-func (c *flowSchemasClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*flowcontrolv1alpha1.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(flowSchemasResource, c.ClusterPath, name, pt, data, subresources...), &flowcontrolv1alpha1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.FlowSchema), err
-}
-
-func (c *flowSchemasClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1alpha1.FlowSchemaApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1alpha1.FlowSchema, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(flowSchemasResource, c.ClusterPath, *name, types.ApplyPatchType, data), &flowcontrolv1alpha1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.FlowSchema), err
-}
-
-func (c *flowSchemasClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1alpha1.FlowSchemaApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1alpha1.FlowSchema, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(flowSchemasResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &flowcontrolv1alpha1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.FlowSchema), err
-}
diff --git a/kubernetes/typed/flowcontrol/v1alpha1/fake/prioritylevelconfiguration.go b/kubernetes/typed/flowcontrol/v1alpha1/fake/prioritylevelconfiguration.go
deleted file mode 100644
index f92783652..000000000
--- a/kubernetes/typed/flowcontrol/v1alpha1/fake/prioritylevelconfiguration.go
+++ /dev/null
@@ -1,202 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1alpha1 "k8s.io/api/flowcontrol/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsflowcontrolv1alpha1 "k8s.io/client-go/applyconfigurations/flowcontrol/v1alpha1"
-	flowcontrolv1alpha1client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1alpha1"
-	"k8s.io/client-go/testing"
-
-	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
-)
-
-var priorityLevelConfigurationsResource = schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1alpha1", Resource: "prioritylevelconfigurations"}
-var priorityLevelConfigurationsKind = schema.GroupVersionKind{Group: "flowcontrol.apiserver.k8s.io", Version: "v1alpha1", Kind: "PriorityLevelConfiguration"}
-
-type priorityLevelConfigurationsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *priorityLevelConfigurationsClusterClient) Cluster(clusterPath logicalcluster.Path) flowcontrolv1alpha1client.PriorityLevelConfigurationInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &priorityLevelConfigurationsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PriorityLevelConfigurations that match those selectors across all clusters.
-func (c *priorityLevelConfigurationsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1alpha1.PriorityLevelConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityLevelConfigurationsResource, priorityLevelConfigurationsKind, logicalcluster.Wildcard, opts), &flowcontrolv1alpha1.PriorityLevelConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1alpha1.PriorityLevelConfigurationList{ListMeta: obj.(*flowcontrolv1alpha1.PriorityLevelConfigurationList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1alpha1.PriorityLevelConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested PriorityLevelConfigurations across all clusters.
-func (c *priorityLevelConfigurationsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityLevelConfigurationsResource, logicalcluster.Wildcard, opts))
-}
-
-type priorityLevelConfigurationsClient struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-}
-
-func (c *priorityLevelConfigurationsClient) Create(ctx context.Context, priorityLevelConfiguration *flowcontrolv1alpha1.PriorityLevelConfiguration, opts metav1.CreateOptions) (*flowcontrolv1alpha1.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(priorityLevelConfigurationsResource, c.ClusterPath, priorityLevelConfiguration), &flowcontrolv1alpha1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) Update(ctx context.Context, priorityLevelConfiguration *flowcontrolv1alpha1.PriorityLevelConfiguration, opts metav1.UpdateOptions) (*flowcontrolv1alpha1.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(priorityLevelConfigurationsResource, c.ClusterPath, priorityLevelConfiguration), &flowcontrolv1alpha1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) UpdateStatus(ctx context.Context, priorityLevelConfiguration *flowcontrolv1alpha1.PriorityLevelConfiguration, opts metav1.UpdateOptions) (*flowcontrolv1alpha1.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, "status", priorityLevelConfiguration), &flowcontrolv1alpha1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(priorityLevelConfigurationsResource, c.ClusterPath, name, opts), &flowcontrolv1alpha1.PriorityLevelConfiguration{})
-	return err
-}
-
-func (c *priorityLevelConfigurationsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(priorityLevelConfigurationsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &flowcontrolv1alpha1.PriorityLevelConfigurationList{})
-	return err
-}
-
-func (c *priorityLevelConfigurationsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*flowcontrolv1alpha1.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(priorityLevelConfigurationsResource, c.ClusterPath, name), &flowcontrolv1alpha1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.PriorityLevelConfiguration), err
-}
-
-// List takes label and field selectors, and returns the list of PriorityLevelConfigurations that match those selectors.
-func (c *priorityLevelConfigurationsClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1alpha1.PriorityLevelConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityLevelConfigurationsResource, priorityLevelConfigurationsKind, c.ClusterPath, opts), &flowcontrolv1alpha1.PriorityLevelConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1alpha1.PriorityLevelConfigurationList{ListMeta: obj.(*flowcontrolv1alpha1.PriorityLevelConfigurationList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1alpha1.PriorityLevelConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *priorityLevelConfigurationsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityLevelConfigurationsResource, c.ClusterPath, opts))
-}
-
-func (c *priorityLevelConfigurationsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*flowcontrolv1alpha1.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, name, pt, data, subresources...), &flowcontrolv1alpha1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1alpha1.PriorityLevelConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1alpha1.PriorityLevelConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &flowcontrolv1alpha1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1alpha1.PriorityLevelConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1alpha1.PriorityLevelConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &flowcontrolv1alpha1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1alpha1.PriorityLevelConfiguration), err
-}
diff --git a/kubernetes/typed/flowcontrol/v1alpha1/flowcontrol_client.go b/kubernetes/typed/flowcontrol/v1alpha1/flowcontrol_client.go
deleted file mode 100644
index 6f7138fba..000000000
--- a/kubernetes/typed/flowcontrol/v1alpha1/flowcontrol_client.go
+++ /dev/null
@@ -1,94 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"net/http"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1alpha1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1alpha1"
-	"k8s.io/client-go/rest"
-)
-
-type FlowcontrolV1alpha1ClusterInterface interface {
-	FlowcontrolV1alpha1ClusterScoper
-	FlowSchemasClusterGetter
-	PriorityLevelConfigurationsClusterGetter
-}
-
-type FlowcontrolV1alpha1ClusterScoper interface {
-	Cluster(logicalcluster.Path) flowcontrolv1alpha1.FlowcontrolV1alpha1Interface
-}
-
-type FlowcontrolV1alpha1ClusterClient struct {
-	clientCache kcpclient.Cache[*flowcontrolv1alpha1.FlowcontrolV1alpha1Client]
-}
-
-func (c *FlowcontrolV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) flowcontrolv1alpha1.FlowcontrolV1alpha1Interface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-	return c.clientCache.ClusterOrDie(clusterPath)
-}
-
-func (c *FlowcontrolV1alpha1ClusterClient) FlowSchemas() FlowSchemaClusterInterface {
-	return &flowSchemasClusterInterface{clientCache: c.clientCache}
-}
-
-func (c *FlowcontrolV1alpha1ClusterClient) PriorityLevelConfigurations() PriorityLevelConfigurationClusterInterface {
-	return &priorityLevelConfigurationsClusterInterface{clientCache: c.clientCache}
-}
-
-// NewForConfig creates a new FlowcontrolV1alpha1ClusterClient for the given config.
-// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
-// where httpClient was generated with rest.HTTPClientFor(c).
-func NewForConfig(c *rest.Config) (*FlowcontrolV1alpha1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
-	if err != nil {
-		return nil, err
-	}
-	return NewForConfigAndClient(c, client)
-}
-
-// NewForConfigAndClient creates a new FlowcontrolV1alpha1ClusterClient for the given config and http client.
-// Note the http client provided takes precedence over the configured transport values.
-func NewForConfigAndClient(c *rest.Config, h *http.Client) (*FlowcontrolV1alpha1ClusterClient, error) {
-	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*flowcontrolv1alpha1.FlowcontrolV1alpha1Client]{
-		NewForConfigAndClient: flowcontrolv1alpha1.NewForConfigAndClient,
-	})
-	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
-		return nil, err
-	}
-	return &FlowcontrolV1alpha1ClusterClient{clientCache: cache}, nil
-}
-
-// NewForConfigOrDie creates a new FlowcontrolV1alpha1ClusterClient for the given config and
-// panics if there is an error in the config.
-func NewForConfigOrDie(c *rest.Config) *FlowcontrolV1alpha1ClusterClient {
-	client, err := NewForConfig(c)
-	if err != nil {
-		panic(err)
-	}
-	return client
-}
diff --git a/kubernetes/typed/flowcontrol/v1beta1/doc.go b/kubernetes/typed/flowcontrol/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/flowcontrol/v1beta1/fake/doc.go b/kubernetes/typed/flowcontrol/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/flowcontrol/v1beta1/fake/flowcontrol_client.go b/kubernetes/typed/flowcontrol/v1beta1/fake/flowcontrol_client.go
index b693c1e54..aff6a2953 100644
--- a/kubernetes/typed/flowcontrol/v1beta1/fake/flowcontrol_client.go
+++ b/kubernetes/typed/flowcontrol/v1beta1/fake/flowcontrol_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpflowcontrolv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpflowcontrolv1beta1.FlowcontrolV1beta1ClusterInterface = (*FlowcontrolV1beta1ClusterClient)(nil)
@@ -45,29 +41,29 @@ func (c *FlowcontrolV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Pat
 }
 
 func (c *FlowcontrolV1beta1ClusterClient) FlowSchemas() kcpflowcontrolv1beta1.FlowSchemaClusterInterface {
-	return &flowSchemasClusterClient{Fake: c.Fake}
+	return newFakeFlowSchemaClusterClient(c)
 }
 
 func (c *FlowcontrolV1beta1ClusterClient) PriorityLevelConfigurations() kcpflowcontrolv1beta1.PriorityLevelConfigurationClusterInterface {
-	return &priorityLevelConfigurationsClusterClient{Fake: c.Fake}
+	return newFakePriorityLevelConfigurationClusterClient(c)
 }
 
-var _ flowcontrolv1beta1.FlowcontrolV1beta1Interface = (*FlowcontrolV1beta1Client)(nil)
-
 type FlowcontrolV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *FlowcontrolV1beta1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
-}
-
 func (c *FlowcontrolV1beta1Client) FlowSchemas() flowcontrolv1beta1.FlowSchemaInterface {
-	return &flowSchemasClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakeFlowSchemaClient(c.Fake, c.ClusterPath)
 }
 
 func (c *FlowcontrolV1beta1Client) PriorityLevelConfigurations() flowcontrolv1beta1.PriorityLevelConfigurationInterface {
-	return &priorityLevelConfigurationsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakePriorityLevelConfigurationClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FlowcontrolV1beta1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta1/fake/flowschema.go b/kubernetes/typed/flowcontrol/v1beta1/fake/flowschema.go
index 26a5f1375..83707a0cb 100644
--- a/kubernetes/typed/flowcontrol/v1beta1/fake/flowschema.go
+++ b/kubernetes/typed/flowcontrol/v1beta1/fake/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsflowcontrolv1beta1 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1"
-	flowcontrolv1beta1client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1"
+	typedflowcontrolv1beta1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
 
+	typedkcpflowcontrolv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var flowSchemasResource = schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta1", Resource: "flowschemas"}
-var flowSchemasKind = schema.GroupVersionKind{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta1", Kind: "FlowSchema"}
-
-type flowSchemasClusterClient struct {
-	*kcptesting.Fake
+// flowSchemaClusterClient implements FlowSchemaClusterInterface
+type flowSchemaClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*flowcontrolv1beta1.FlowSchema, *flowcontrolv1beta1.FlowSchemaList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *flowSchemasClusterClient) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta1client.FlowSchemaInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &flowSchemasClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of FlowSchemas that match those selectors across all clusters.
-func (c *flowSchemasClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta1.FlowSchemaList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(flowSchemasResource, flowSchemasKind, logicalcluster.Wildcard, opts), &flowcontrolv1beta1.FlowSchemaList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1beta1.FlowSchemaList{ListMeta: obj.(*flowcontrolv1beta1.FlowSchemaList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1beta1.FlowSchemaList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeFlowSchemaClusterClient(fake *FlowcontrolV1beta1ClusterClient) typedkcpflowcontrolv1beta1.FlowSchemaClusterInterface {
+	return &flowSchemaClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*flowcontrolv1beta1.FlowSchema, *flowcontrolv1beta1.FlowSchemaList](
+			fake.Fake,
+			flowcontrolv1beta1.SchemeGroupVersion.WithResource("flowschemas"),
+			flowcontrolv1beta1.SchemeGroupVersion.WithKind("FlowSchema"),
+			func() *flowcontrolv1beta1.FlowSchema { return &flowcontrolv1beta1.FlowSchema{} },
+			func() *flowcontrolv1beta1.FlowSchemaList { return &flowcontrolv1beta1.FlowSchemaList{} },
+			func(dst, src *flowcontrolv1beta1.FlowSchemaList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1beta1.FlowSchemaList) []*flowcontrolv1beta1.FlowSchema {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1beta1.FlowSchemaList, items []*flowcontrolv1beta1.FlowSchema) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested FlowSchemas across all clusters.
-func (c *flowSchemasClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(flowSchemasResource, logicalcluster.Wildcard, opts))
+func (c *flowSchemaClusterClient) Cluster(cluster logicalcluster.Path) typedflowcontrolv1beta1.FlowSchemaInterface {
+	return newFakeFlowSchemaClient(c.Fake, cluster)
 }
 
-type flowSchemasClient struct {
-	*kcptesting.Fake
+// flowSchemaScopedClient implements FlowSchemaInterface
+type flowSchemaScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*flowcontrolv1beta1.FlowSchema, *flowcontrolv1beta1.FlowSchemaList, *v1beta1.FlowSchemaApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *flowSchemasClient) Create(ctx context.Context, flowSchema *flowcontrolv1beta1.FlowSchema, opts metav1.CreateOptions) (*flowcontrolv1beta1.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(flowSchemasResource, c.ClusterPath, flowSchema), &flowcontrolv1beta1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta1.FlowSchema), err
-}
-
-func (c *flowSchemasClient) Update(ctx context.Context, flowSchema *flowcontrolv1beta1.FlowSchema, opts metav1.UpdateOptions) (*flowcontrolv1beta1.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(flowSchemasResource, c.ClusterPath, flowSchema), &flowcontrolv1beta1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta1.FlowSchema), err
-}
-
-func (c *flowSchemasClient) UpdateStatus(ctx context.Context, flowSchema *flowcontrolv1beta1.FlowSchema, opts metav1.UpdateOptions) (*flowcontrolv1beta1.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(flowSchemasResource, c.ClusterPath, "status", flowSchema), &flowcontrolv1beta1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta1.FlowSchema), err
-}
-
-func (c *flowSchemasClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(flowSchemasResource, c.ClusterPath, name, opts), &flowcontrolv1beta1.FlowSchema{})
-	return err
-}
-
-func (c *flowSchemasClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(flowSchemasResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &flowcontrolv1beta1.FlowSchemaList{})
-	return err
-}
-
-func (c *flowSchemasClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*flowcontrolv1beta1.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(flowSchemasResource, c.ClusterPath, name), &flowcontrolv1beta1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta1.FlowSchema), err
-}
-
-// List takes label and field selectors, and returns the list of FlowSchemas that match those selectors.
-func (c *flowSchemasClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta1.FlowSchemaList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(flowSchemasResource, flowSchemasKind, c.ClusterPath, opts), &flowcontrolv1beta1.FlowSchemaList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1beta1.FlowSchemaList{ListMeta: obj.(*flowcontrolv1beta1.FlowSchemaList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1beta1.FlowSchemaList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *flowSchemasClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(flowSchemasResource, c.ClusterPath, opts))
-}
-
-func (c *flowSchemasClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*flowcontrolv1beta1.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(flowSchemasResource, c.ClusterPath, name, pt, data, subresources...), &flowcontrolv1beta1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta1.FlowSchema), err
-}
-
-func (c *flowSchemasClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1beta1.FlowSchemaApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1beta1.FlowSchema, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(flowSchemasResource, c.ClusterPath, *name, types.ApplyPatchType, data), &flowcontrolv1beta1.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta1.FlowSchema), err
-}
-
-func (c *flowSchemasClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1beta1.FlowSchemaApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1beta1.FlowSchema, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(flowSchemasResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &flowcontrolv1beta1.FlowSchema{})
-	if obj == nil {
-		return nil, err
+func newFakeFlowSchemaClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedflowcontrolv1beta1.FlowSchemaInterface {
+	return &flowSchemaScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*flowcontrolv1beta1.FlowSchema, *flowcontrolv1beta1.FlowSchemaList, *v1beta1.FlowSchemaApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			flowcontrolv1beta1.SchemeGroupVersion.WithResource("flowschemas"),
+			flowcontrolv1beta1.SchemeGroupVersion.WithKind("FlowSchema"),
+			func() *flowcontrolv1beta1.FlowSchema { return &flowcontrolv1beta1.FlowSchema{} },
+			func() *flowcontrolv1beta1.FlowSchemaList { return &flowcontrolv1beta1.FlowSchemaList{} },
+			func(dst, src *flowcontrolv1beta1.FlowSchemaList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1beta1.FlowSchemaList) []*flowcontrolv1beta1.FlowSchema {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1beta1.FlowSchemaList, items []*flowcontrolv1beta1.FlowSchema) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*flowcontrolv1beta1.FlowSchema), err
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta1/fake/prioritylevelconfiguration.go b/kubernetes/typed/flowcontrol/v1beta1/fake/prioritylevelconfiguration.go
index 82b1ba749..b8ef22417 100644
--- a/kubernetes/typed/flowcontrol/v1beta1/fake/prioritylevelconfiguration.go
+++ b/kubernetes/typed/flowcontrol/v1beta1/fake/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,85 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsflowcontrolv1beta1 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1"
-	flowcontrolv1beta1client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta1"
+	typedflowcontrolv1beta1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
 
+	typedkcpflowcontrolv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var priorityLevelConfigurationsResource = schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta1", Resource: "prioritylevelconfigurations"}
-var priorityLevelConfigurationsKind = schema.GroupVersionKind{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta1", Kind: "PriorityLevelConfiguration"}
-
-type priorityLevelConfigurationsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *priorityLevelConfigurationsClusterClient) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta1client.PriorityLevelConfigurationInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &priorityLevelConfigurationsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PriorityLevelConfigurations that match those selectors across all clusters.
-func (c *priorityLevelConfigurationsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta1.PriorityLevelConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityLevelConfigurationsResource, priorityLevelConfigurationsKind, logicalcluster.Wildcard, opts), &flowcontrolv1beta1.PriorityLevelConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1beta1.PriorityLevelConfigurationList{ListMeta: obj.(*flowcontrolv1beta1.PriorityLevelConfigurationList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1beta1.PriorityLevelConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested PriorityLevelConfigurations across all clusters.
-func (c *priorityLevelConfigurationsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityLevelConfigurationsResource, logicalcluster.Wildcard, opts))
-}
-
-type priorityLevelConfigurationsClient struct {
-	*kcptesting.Fake
+// priorityLevelConfigurationClusterClient implements PriorityLevelConfigurationClusterInterface
+type priorityLevelConfigurationClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*flowcontrolv1beta1.PriorityLevelConfiguration, *flowcontrolv1beta1.PriorityLevelConfigurationList]
+	Fake *kcptesting.Fake
+}
+
+func newFakePriorityLevelConfigurationClusterClient(fake *FlowcontrolV1beta1ClusterClient) typedkcpflowcontrolv1beta1.PriorityLevelConfigurationClusterInterface {
+	return &priorityLevelConfigurationClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*flowcontrolv1beta1.PriorityLevelConfiguration, *flowcontrolv1beta1.PriorityLevelConfigurationList](
+			fake.Fake,
+			flowcontrolv1beta1.SchemeGroupVersion.WithResource("prioritylevelconfigurations"),
+			flowcontrolv1beta1.SchemeGroupVersion.WithKind("PriorityLevelConfiguration"),
+			func() *flowcontrolv1beta1.PriorityLevelConfiguration {
+				return &flowcontrolv1beta1.PriorityLevelConfiguration{}
+			},
+			func() *flowcontrolv1beta1.PriorityLevelConfigurationList {
+				return &flowcontrolv1beta1.PriorityLevelConfigurationList{}
+			},
+			func(dst, src *flowcontrolv1beta1.PriorityLevelConfigurationList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1beta1.PriorityLevelConfigurationList) []*flowcontrolv1beta1.PriorityLevelConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1beta1.PriorityLevelConfigurationList, items []*flowcontrolv1beta1.PriorityLevelConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *priorityLevelConfigurationClusterClient) Cluster(cluster logicalcluster.Path) typedflowcontrolv1beta1.PriorityLevelConfigurationInterface {
+	return newFakePriorityLevelConfigurationClient(c.Fake, cluster)
+}
+
+// priorityLevelConfigurationScopedClient implements PriorityLevelConfigurationInterface
+type priorityLevelConfigurationScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*flowcontrolv1beta1.PriorityLevelConfiguration, *flowcontrolv1beta1.PriorityLevelConfigurationList, *v1beta1.PriorityLevelConfigurationApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *priorityLevelConfigurationsClient) Create(ctx context.Context, priorityLevelConfiguration *flowcontrolv1beta1.PriorityLevelConfiguration, opts metav1.CreateOptions) (*flowcontrolv1beta1.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(priorityLevelConfigurationsResource, c.ClusterPath, priorityLevelConfiguration), &flowcontrolv1beta1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta1.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) Update(ctx context.Context, priorityLevelConfiguration *flowcontrolv1beta1.PriorityLevelConfiguration, opts metav1.UpdateOptions) (*flowcontrolv1beta1.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(priorityLevelConfigurationsResource, c.ClusterPath, priorityLevelConfiguration), &flowcontrolv1beta1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta1.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) UpdateStatus(ctx context.Context, priorityLevelConfiguration *flowcontrolv1beta1.PriorityLevelConfiguration, opts metav1.UpdateOptions) (*flowcontrolv1beta1.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, "status", priorityLevelConfiguration), &flowcontrolv1beta1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta1.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(priorityLevelConfigurationsResource, c.ClusterPath, name, opts), &flowcontrolv1beta1.PriorityLevelConfiguration{})
-	return err
-}
-
-func (c *priorityLevelConfigurationsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(priorityLevelConfigurationsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &flowcontrolv1beta1.PriorityLevelConfigurationList{})
-	return err
-}
-
-func (c *priorityLevelConfigurationsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*flowcontrolv1beta1.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(priorityLevelConfigurationsResource, c.ClusterPath, name), &flowcontrolv1beta1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta1.PriorityLevelConfiguration), err
-}
-
-// List takes label and field selectors, and returns the list of PriorityLevelConfigurations that match those selectors.
-func (c *priorityLevelConfigurationsClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta1.PriorityLevelConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityLevelConfigurationsResource, priorityLevelConfigurationsKind, c.ClusterPath, opts), &flowcontrolv1beta1.PriorityLevelConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1beta1.PriorityLevelConfigurationList{ListMeta: obj.(*flowcontrolv1beta1.PriorityLevelConfigurationList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1beta1.PriorityLevelConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *priorityLevelConfigurationsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityLevelConfigurationsResource, c.ClusterPath, opts))
-}
-
-func (c *priorityLevelConfigurationsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*flowcontrolv1beta1.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, name, pt, data, subresources...), &flowcontrolv1beta1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta1.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1beta1.PriorityLevelConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1beta1.PriorityLevelConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &flowcontrolv1beta1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta1.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1beta1.PriorityLevelConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1beta1.PriorityLevelConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &flowcontrolv1beta1.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
+func newFakePriorityLevelConfigurationClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedflowcontrolv1beta1.PriorityLevelConfigurationInterface {
+	return &priorityLevelConfigurationScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*flowcontrolv1beta1.PriorityLevelConfiguration, *flowcontrolv1beta1.PriorityLevelConfigurationList, *v1beta1.PriorityLevelConfigurationApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			flowcontrolv1beta1.SchemeGroupVersion.WithResource("prioritylevelconfigurations"),
+			flowcontrolv1beta1.SchemeGroupVersion.WithKind("PriorityLevelConfiguration"),
+			func() *flowcontrolv1beta1.PriorityLevelConfiguration {
+				return &flowcontrolv1beta1.PriorityLevelConfiguration{}
+			},
+			func() *flowcontrolv1beta1.PriorityLevelConfigurationList {
+				return &flowcontrolv1beta1.PriorityLevelConfigurationList{}
+			},
+			func(dst, src *flowcontrolv1beta1.PriorityLevelConfigurationList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1beta1.PriorityLevelConfigurationList) []*flowcontrolv1beta1.PriorityLevelConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1beta1.PriorityLevelConfigurationList, items []*flowcontrolv1beta1.PriorityLevelConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*flowcontrolv1beta1.PriorityLevelConfiguration), err
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta1/flowcontrol_client.go b/kubernetes/typed/flowcontrol/v1beta1/flowcontrol_client.go
index 44f4fab7d..6cf0ddc59 100644
--- a/kubernetes/typed/flowcontrol/v1beta1/flowcontrol_client.go
+++ b/kubernetes/typed/flowcontrol/v1beta1/flowcontrol_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiflowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
+	flowcontrolv1beta1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type FlowcontrolV1beta1ClusterInterface interface {
@@ -41,6 +40,7 @@ type FlowcontrolV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) flowcontrolv1beta1.FlowcontrolV1beta1Interface
 }
 
+// FlowcontrolV1beta1ClusterClient is used to interact with features provided by the flowcontrol.apiserver.k8s.io group.
 type FlowcontrolV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*flowcontrolv1beta1.FlowcontrolV1beta1Client]
 }
@@ -64,11 +64,13 @@ func (c *FlowcontrolV1beta1ClusterClient) PriorityLevelConfigurations() Priority
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*FlowcontrolV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new FlowcontrolV1beta1ClusterClient for the given config and http client.
@@ -80,6 +82,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*FlowcontrolV1beta1C
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &FlowcontrolV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -92,3 +95,14 @@ func NewForConfigOrDie(c *rest.Config) *FlowcontrolV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiflowcontrolv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/flowcontrol/v1beta1/flowschema.go b/kubernetes/typed/flowcontrol/v1beta1/flowschema.go
index e8d13c889..08d95fcc9 100644
--- a/kubernetes/typed/flowcontrol/v1beta1/flowschema.go
+++ b/kubernetes/typed/flowcontrol/v1beta1/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apiflowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1beta1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	flowcontrolv1beta1client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
 )
 
 // FlowSchemasClusterGetter has a method to return a FlowSchemaClusterInterface.
@@ -40,19 +37,20 @@ type FlowSchemasClusterGetter interface {
 }
 
 // FlowSchemaClusterInterface can operate on FlowSchemas across all clusters,
-// or scope down to one cluster and return a flowcontrolv1beta1client.FlowSchemaInterface.
+// or scope down to one cluster and return a flowcontrolv1beta1.FlowSchemaInterface.
 type FlowSchemaClusterInterface interface {
-	Cluster(logicalcluster.Path) flowcontrolv1beta1client.FlowSchemaInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta1.FlowSchemaList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) flowcontrolv1beta1.FlowSchemaInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiflowcontrolv1beta1.FlowSchemaList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	FlowSchemaClusterExpansion
 }
 
 type flowSchemasClusterInterface struct {
-	clientCache kcpclient.Cache[*flowcontrolv1beta1client.FlowcontrolV1beta1Client]
+	clientCache kcpclient.Cache[*flowcontrolv1beta1.FlowcontrolV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *flowSchemasClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta1client.FlowSchemaInterface {
+func (c *flowSchemasClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta1.FlowSchemaInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *flowSchemasClusterInterface) Cluster(clusterPath logicalcluster.Path) f
 }
 
 // List returns the entire collection of all FlowSchemas across all clusters.
-func (c *flowSchemasClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta1.FlowSchemaList, error) {
+func (c *flowSchemasClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiflowcontrolv1beta1.FlowSchemaList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).FlowSchemas().List(ctx, opts)
 }
 
 // Watch begins to watch all FlowSchemas across all clusters.
-func (c *flowSchemasClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *flowSchemasClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).FlowSchemas().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta1/generated_expansion.go b/kubernetes/typed/flowcontrol/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..44a436261
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1beta1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type FlowSchemaClusterExpansion interface{}
+
+type PriorityLevelConfigurationClusterExpansion interface{}
diff --git a/kubernetes/typed/flowcontrol/v1beta1/prioritylevelconfiguration.go b/kubernetes/typed/flowcontrol/v1beta1/prioritylevelconfiguration.go
index 67f5003dd..77c14d14d 100644
--- a/kubernetes/typed/flowcontrol/v1beta1/prioritylevelconfiguration.go
+++ b/kubernetes/typed/flowcontrol/v1beta1/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apiflowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1beta1 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	flowcontrolv1beta1client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta1"
 )
 
 // PriorityLevelConfigurationsClusterGetter has a method to return a PriorityLevelConfigurationClusterInterface.
@@ -40,19 +37,20 @@ type PriorityLevelConfigurationsClusterGetter interface {
 }
 
 // PriorityLevelConfigurationClusterInterface can operate on PriorityLevelConfigurations across all clusters,
-// or scope down to one cluster and return a flowcontrolv1beta1client.PriorityLevelConfigurationInterface.
+// or scope down to one cluster and return a flowcontrolv1beta1.PriorityLevelConfigurationInterface.
 type PriorityLevelConfigurationClusterInterface interface {
-	Cluster(logicalcluster.Path) flowcontrolv1beta1client.PriorityLevelConfigurationInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta1.PriorityLevelConfigurationList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) flowcontrolv1beta1.PriorityLevelConfigurationInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiflowcontrolv1beta1.PriorityLevelConfigurationList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	PriorityLevelConfigurationClusterExpansion
 }
 
 type priorityLevelConfigurationsClusterInterface struct {
-	clientCache kcpclient.Cache[*flowcontrolv1beta1client.FlowcontrolV1beta1Client]
+	clientCache kcpclient.Cache[*flowcontrolv1beta1.FlowcontrolV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *priorityLevelConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta1client.PriorityLevelConfigurationInterface {
+func (c *priorityLevelConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta1.PriorityLevelConfigurationInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *priorityLevelConfigurationsClusterInterface) Cluster(clusterPath logica
 }
 
 // List returns the entire collection of all PriorityLevelConfigurations across all clusters.
-func (c *priorityLevelConfigurationsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta1.PriorityLevelConfigurationList, error) {
+func (c *priorityLevelConfigurationsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiflowcontrolv1beta1.PriorityLevelConfigurationList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PriorityLevelConfigurations().List(ctx, opts)
 }
 
 // Watch begins to watch all PriorityLevelConfigurations across all clusters.
-func (c *priorityLevelConfigurationsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *priorityLevelConfigurationsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PriorityLevelConfigurations().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta2/doc.go b/kubernetes/typed/flowcontrol/v1beta2/doc.go
new file mode 100644
index 000000000..3f0720c40
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1beta2/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta2
diff --git a/kubernetes/typed/flowcontrol/v1beta2/fake/doc.go b/kubernetes/typed/flowcontrol/v1beta2/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1beta2/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/flowcontrol/v1beta2/fake/flowcontrol_client.go b/kubernetes/typed/flowcontrol/v1beta2/fake/flowcontrol_client.go
index 25aa3f99c..baec70c8c 100644
--- a/kubernetes/typed/flowcontrol/v1beta2/fake/flowcontrol_client.go
+++ b/kubernetes/typed/flowcontrol/v1beta2/fake/flowcontrol_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta2 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpflowcontrolv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta2"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpflowcontrolv1beta2.FlowcontrolV1beta2ClusterInterface = (*FlowcontrolV1beta2ClusterClient)(nil)
@@ -45,29 +41,29 @@ func (c *FlowcontrolV1beta2ClusterClient) Cluster(clusterPath logicalcluster.Pat
 }
 
 func (c *FlowcontrolV1beta2ClusterClient) FlowSchemas() kcpflowcontrolv1beta2.FlowSchemaClusterInterface {
-	return &flowSchemasClusterClient{Fake: c.Fake}
+	return newFakeFlowSchemaClusterClient(c)
 }
 
 func (c *FlowcontrolV1beta2ClusterClient) PriorityLevelConfigurations() kcpflowcontrolv1beta2.PriorityLevelConfigurationClusterInterface {
-	return &priorityLevelConfigurationsClusterClient{Fake: c.Fake}
+	return newFakePriorityLevelConfigurationClusterClient(c)
 }
 
-var _ flowcontrolv1beta2.FlowcontrolV1beta2Interface = (*FlowcontrolV1beta2Client)(nil)
-
 type FlowcontrolV1beta2Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *FlowcontrolV1beta2Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
-}
-
 func (c *FlowcontrolV1beta2Client) FlowSchemas() flowcontrolv1beta2.FlowSchemaInterface {
-	return &flowSchemasClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakeFlowSchemaClient(c.Fake, c.ClusterPath)
 }
 
 func (c *FlowcontrolV1beta2Client) PriorityLevelConfigurations() flowcontrolv1beta2.PriorityLevelConfigurationInterface {
-	return &priorityLevelConfigurationsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakePriorityLevelConfigurationClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FlowcontrolV1beta2Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta2/fake/flowschema.go b/kubernetes/typed/flowcontrol/v1beta2/fake/flowschema.go
index b6004ba44..cf559b721 100644
--- a/kubernetes/typed/flowcontrol/v1beta2/fake/flowschema.go
+++ b/kubernetes/typed/flowcontrol/v1beta2/fake/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsflowcontrolv1beta2 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2"
-	flowcontrolv1beta2client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
-	"k8s.io/client-go/testing"
+	v1beta2 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2"
+	typedflowcontrolv1beta2 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
 
+	typedkcpflowcontrolv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var flowSchemasResource = schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta2", Resource: "flowschemas"}
-var flowSchemasKind = schema.GroupVersionKind{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta2", Kind: "FlowSchema"}
-
-type flowSchemasClusterClient struct {
-	*kcptesting.Fake
+// flowSchemaClusterClient implements FlowSchemaClusterInterface
+type flowSchemaClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*flowcontrolv1beta2.FlowSchema, *flowcontrolv1beta2.FlowSchemaList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *flowSchemasClusterClient) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta2client.FlowSchemaInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &flowSchemasClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of FlowSchemas that match those selectors across all clusters.
-func (c *flowSchemasClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta2.FlowSchemaList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(flowSchemasResource, flowSchemasKind, logicalcluster.Wildcard, opts), &flowcontrolv1beta2.FlowSchemaList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1beta2.FlowSchemaList{ListMeta: obj.(*flowcontrolv1beta2.FlowSchemaList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1beta2.FlowSchemaList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeFlowSchemaClusterClient(fake *FlowcontrolV1beta2ClusterClient) typedkcpflowcontrolv1beta2.FlowSchemaClusterInterface {
+	return &flowSchemaClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*flowcontrolv1beta2.FlowSchema, *flowcontrolv1beta2.FlowSchemaList](
+			fake.Fake,
+			flowcontrolv1beta2.SchemeGroupVersion.WithResource("flowschemas"),
+			flowcontrolv1beta2.SchemeGroupVersion.WithKind("FlowSchema"),
+			func() *flowcontrolv1beta2.FlowSchema { return &flowcontrolv1beta2.FlowSchema{} },
+			func() *flowcontrolv1beta2.FlowSchemaList { return &flowcontrolv1beta2.FlowSchemaList{} },
+			func(dst, src *flowcontrolv1beta2.FlowSchemaList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1beta2.FlowSchemaList) []*flowcontrolv1beta2.FlowSchema {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1beta2.FlowSchemaList, items []*flowcontrolv1beta2.FlowSchema) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested FlowSchemas across all clusters.
-func (c *flowSchemasClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(flowSchemasResource, logicalcluster.Wildcard, opts))
+func (c *flowSchemaClusterClient) Cluster(cluster logicalcluster.Path) typedflowcontrolv1beta2.FlowSchemaInterface {
+	return newFakeFlowSchemaClient(c.Fake, cluster)
 }
 
-type flowSchemasClient struct {
-	*kcptesting.Fake
+// flowSchemaScopedClient implements FlowSchemaInterface
+type flowSchemaScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*flowcontrolv1beta2.FlowSchema, *flowcontrolv1beta2.FlowSchemaList, *v1beta2.FlowSchemaApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *flowSchemasClient) Create(ctx context.Context, flowSchema *flowcontrolv1beta2.FlowSchema, opts metav1.CreateOptions) (*flowcontrolv1beta2.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(flowSchemasResource, c.ClusterPath, flowSchema), &flowcontrolv1beta2.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta2.FlowSchema), err
-}
-
-func (c *flowSchemasClient) Update(ctx context.Context, flowSchema *flowcontrolv1beta2.FlowSchema, opts metav1.UpdateOptions) (*flowcontrolv1beta2.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(flowSchemasResource, c.ClusterPath, flowSchema), &flowcontrolv1beta2.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta2.FlowSchema), err
-}
-
-func (c *flowSchemasClient) UpdateStatus(ctx context.Context, flowSchema *flowcontrolv1beta2.FlowSchema, opts metav1.UpdateOptions) (*flowcontrolv1beta2.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(flowSchemasResource, c.ClusterPath, "status", flowSchema), &flowcontrolv1beta2.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta2.FlowSchema), err
-}
-
-func (c *flowSchemasClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(flowSchemasResource, c.ClusterPath, name, opts), &flowcontrolv1beta2.FlowSchema{})
-	return err
-}
-
-func (c *flowSchemasClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(flowSchemasResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &flowcontrolv1beta2.FlowSchemaList{})
-	return err
-}
-
-func (c *flowSchemasClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*flowcontrolv1beta2.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(flowSchemasResource, c.ClusterPath, name), &flowcontrolv1beta2.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta2.FlowSchema), err
-}
-
-// List takes label and field selectors, and returns the list of FlowSchemas that match those selectors.
-func (c *flowSchemasClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta2.FlowSchemaList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(flowSchemasResource, flowSchemasKind, c.ClusterPath, opts), &flowcontrolv1beta2.FlowSchemaList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1beta2.FlowSchemaList{ListMeta: obj.(*flowcontrolv1beta2.FlowSchemaList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1beta2.FlowSchemaList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *flowSchemasClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(flowSchemasResource, c.ClusterPath, opts))
-}
-
-func (c *flowSchemasClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*flowcontrolv1beta2.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(flowSchemasResource, c.ClusterPath, name, pt, data, subresources...), &flowcontrolv1beta2.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta2.FlowSchema), err
-}
-
-func (c *flowSchemasClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1beta2.FlowSchemaApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1beta2.FlowSchema, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(flowSchemasResource, c.ClusterPath, *name, types.ApplyPatchType, data), &flowcontrolv1beta2.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta2.FlowSchema), err
-}
-
-func (c *flowSchemasClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1beta2.FlowSchemaApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1beta2.FlowSchema, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(flowSchemasResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &flowcontrolv1beta2.FlowSchema{})
-	if obj == nil {
-		return nil, err
+func newFakeFlowSchemaClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedflowcontrolv1beta2.FlowSchemaInterface {
+	return &flowSchemaScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*flowcontrolv1beta2.FlowSchema, *flowcontrolv1beta2.FlowSchemaList, *v1beta2.FlowSchemaApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			flowcontrolv1beta2.SchemeGroupVersion.WithResource("flowschemas"),
+			flowcontrolv1beta2.SchemeGroupVersion.WithKind("FlowSchema"),
+			func() *flowcontrolv1beta2.FlowSchema { return &flowcontrolv1beta2.FlowSchema{} },
+			func() *flowcontrolv1beta2.FlowSchemaList { return &flowcontrolv1beta2.FlowSchemaList{} },
+			func(dst, src *flowcontrolv1beta2.FlowSchemaList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1beta2.FlowSchemaList) []*flowcontrolv1beta2.FlowSchema {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1beta2.FlowSchemaList, items []*flowcontrolv1beta2.FlowSchema) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*flowcontrolv1beta2.FlowSchema), err
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta2/fake/prioritylevelconfiguration.go b/kubernetes/typed/flowcontrol/v1beta2/fake/prioritylevelconfiguration.go
index 5de38d73f..1b9bd6f52 100644
--- a/kubernetes/typed/flowcontrol/v1beta2/fake/prioritylevelconfiguration.go
+++ b/kubernetes/typed/flowcontrol/v1beta2/fake/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,85 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsflowcontrolv1beta2 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2"
-	flowcontrolv1beta2client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
-	"k8s.io/client-go/testing"
+	v1beta2 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta2"
+	typedflowcontrolv1beta2 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
 
+	typedkcpflowcontrolv1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var priorityLevelConfigurationsResource = schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta2", Resource: "prioritylevelconfigurations"}
-var priorityLevelConfigurationsKind = schema.GroupVersionKind{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta2", Kind: "PriorityLevelConfiguration"}
-
-type priorityLevelConfigurationsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *priorityLevelConfigurationsClusterClient) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta2client.PriorityLevelConfigurationInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &priorityLevelConfigurationsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PriorityLevelConfigurations that match those selectors across all clusters.
-func (c *priorityLevelConfigurationsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta2.PriorityLevelConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityLevelConfigurationsResource, priorityLevelConfigurationsKind, logicalcluster.Wildcard, opts), &flowcontrolv1beta2.PriorityLevelConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1beta2.PriorityLevelConfigurationList{ListMeta: obj.(*flowcontrolv1beta2.PriorityLevelConfigurationList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1beta2.PriorityLevelConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested PriorityLevelConfigurations across all clusters.
-func (c *priorityLevelConfigurationsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityLevelConfigurationsResource, logicalcluster.Wildcard, opts))
-}
-
-type priorityLevelConfigurationsClient struct {
-	*kcptesting.Fake
+// priorityLevelConfigurationClusterClient implements PriorityLevelConfigurationClusterInterface
+type priorityLevelConfigurationClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*flowcontrolv1beta2.PriorityLevelConfiguration, *flowcontrolv1beta2.PriorityLevelConfigurationList]
+	Fake *kcptesting.Fake
+}
+
+func newFakePriorityLevelConfigurationClusterClient(fake *FlowcontrolV1beta2ClusterClient) typedkcpflowcontrolv1beta2.PriorityLevelConfigurationClusterInterface {
+	return &priorityLevelConfigurationClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*flowcontrolv1beta2.PriorityLevelConfiguration, *flowcontrolv1beta2.PriorityLevelConfigurationList](
+			fake.Fake,
+			flowcontrolv1beta2.SchemeGroupVersion.WithResource("prioritylevelconfigurations"),
+			flowcontrolv1beta2.SchemeGroupVersion.WithKind("PriorityLevelConfiguration"),
+			func() *flowcontrolv1beta2.PriorityLevelConfiguration {
+				return &flowcontrolv1beta2.PriorityLevelConfiguration{}
+			},
+			func() *flowcontrolv1beta2.PriorityLevelConfigurationList {
+				return &flowcontrolv1beta2.PriorityLevelConfigurationList{}
+			},
+			func(dst, src *flowcontrolv1beta2.PriorityLevelConfigurationList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1beta2.PriorityLevelConfigurationList) []*flowcontrolv1beta2.PriorityLevelConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1beta2.PriorityLevelConfigurationList, items []*flowcontrolv1beta2.PriorityLevelConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *priorityLevelConfigurationClusterClient) Cluster(cluster logicalcluster.Path) typedflowcontrolv1beta2.PriorityLevelConfigurationInterface {
+	return newFakePriorityLevelConfigurationClient(c.Fake, cluster)
+}
+
+// priorityLevelConfigurationScopedClient implements PriorityLevelConfigurationInterface
+type priorityLevelConfigurationScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*flowcontrolv1beta2.PriorityLevelConfiguration, *flowcontrolv1beta2.PriorityLevelConfigurationList, *v1beta2.PriorityLevelConfigurationApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *priorityLevelConfigurationsClient) Create(ctx context.Context, priorityLevelConfiguration *flowcontrolv1beta2.PriorityLevelConfiguration, opts metav1.CreateOptions) (*flowcontrolv1beta2.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(priorityLevelConfigurationsResource, c.ClusterPath, priorityLevelConfiguration), &flowcontrolv1beta2.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta2.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) Update(ctx context.Context, priorityLevelConfiguration *flowcontrolv1beta2.PriorityLevelConfiguration, opts metav1.UpdateOptions) (*flowcontrolv1beta2.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(priorityLevelConfigurationsResource, c.ClusterPath, priorityLevelConfiguration), &flowcontrolv1beta2.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta2.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) UpdateStatus(ctx context.Context, priorityLevelConfiguration *flowcontrolv1beta2.PriorityLevelConfiguration, opts metav1.UpdateOptions) (*flowcontrolv1beta2.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, "status", priorityLevelConfiguration), &flowcontrolv1beta2.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta2.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(priorityLevelConfigurationsResource, c.ClusterPath, name, opts), &flowcontrolv1beta2.PriorityLevelConfiguration{})
-	return err
-}
-
-func (c *priorityLevelConfigurationsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(priorityLevelConfigurationsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &flowcontrolv1beta2.PriorityLevelConfigurationList{})
-	return err
-}
-
-func (c *priorityLevelConfigurationsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*flowcontrolv1beta2.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(priorityLevelConfigurationsResource, c.ClusterPath, name), &flowcontrolv1beta2.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta2.PriorityLevelConfiguration), err
-}
-
-// List takes label and field selectors, and returns the list of PriorityLevelConfigurations that match those selectors.
-func (c *priorityLevelConfigurationsClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta2.PriorityLevelConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityLevelConfigurationsResource, priorityLevelConfigurationsKind, c.ClusterPath, opts), &flowcontrolv1beta2.PriorityLevelConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1beta2.PriorityLevelConfigurationList{ListMeta: obj.(*flowcontrolv1beta2.PriorityLevelConfigurationList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1beta2.PriorityLevelConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *priorityLevelConfigurationsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityLevelConfigurationsResource, c.ClusterPath, opts))
-}
-
-func (c *priorityLevelConfigurationsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*flowcontrolv1beta2.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, name, pt, data, subresources...), &flowcontrolv1beta2.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta2.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1beta2.PriorityLevelConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1beta2.PriorityLevelConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &flowcontrolv1beta2.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta2.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1beta2.PriorityLevelConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1beta2.PriorityLevelConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &flowcontrolv1beta2.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
+func newFakePriorityLevelConfigurationClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedflowcontrolv1beta2.PriorityLevelConfigurationInterface {
+	return &priorityLevelConfigurationScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*flowcontrolv1beta2.PriorityLevelConfiguration, *flowcontrolv1beta2.PriorityLevelConfigurationList, *v1beta2.PriorityLevelConfigurationApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			flowcontrolv1beta2.SchemeGroupVersion.WithResource("prioritylevelconfigurations"),
+			flowcontrolv1beta2.SchemeGroupVersion.WithKind("PriorityLevelConfiguration"),
+			func() *flowcontrolv1beta2.PriorityLevelConfiguration {
+				return &flowcontrolv1beta2.PriorityLevelConfiguration{}
+			},
+			func() *flowcontrolv1beta2.PriorityLevelConfigurationList {
+				return &flowcontrolv1beta2.PriorityLevelConfigurationList{}
+			},
+			func(dst, src *flowcontrolv1beta2.PriorityLevelConfigurationList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1beta2.PriorityLevelConfigurationList) []*flowcontrolv1beta2.PriorityLevelConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1beta2.PriorityLevelConfigurationList, items []*flowcontrolv1beta2.PriorityLevelConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*flowcontrolv1beta2.PriorityLevelConfiguration), err
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta2/flowcontrol_client.go b/kubernetes/typed/flowcontrol/v1beta2/flowcontrol_client.go
index 82af16068..fc6a70479 100644
--- a/kubernetes/typed/flowcontrol/v1beta2/flowcontrol_client.go
+++ b/kubernetes/typed/flowcontrol/v1beta2/flowcontrol_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiflowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
+	flowcontrolv1beta2 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta2 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
-	"k8s.io/client-go/rest"
 )
 
 type FlowcontrolV1beta2ClusterInterface interface {
@@ -41,6 +40,7 @@ type FlowcontrolV1beta2ClusterScoper interface {
 	Cluster(logicalcluster.Path) flowcontrolv1beta2.FlowcontrolV1beta2Interface
 }
 
+// FlowcontrolV1beta2ClusterClient is used to interact with features provided by the flowcontrol.apiserver.k8s.io group.
 type FlowcontrolV1beta2ClusterClient struct {
 	clientCache kcpclient.Cache[*flowcontrolv1beta2.FlowcontrolV1beta2Client]
 }
@@ -64,11 +64,13 @@ func (c *FlowcontrolV1beta2ClusterClient) PriorityLevelConfigurations() Priority
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*FlowcontrolV1beta2ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new FlowcontrolV1beta2ClusterClient for the given config and http client.
@@ -80,6 +82,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*FlowcontrolV1beta2C
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &FlowcontrolV1beta2ClusterClient{clientCache: cache}, nil
 }
 
@@ -92,3 +95,14 @@ func NewForConfigOrDie(c *rest.Config) *FlowcontrolV1beta2ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiflowcontrolv1beta2.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/flowcontrol/v1beta2/flowschema.go b/kubernetes/typed/flowcontrol/v1beta2/flowschema.go
index 6fd5578c6..73db9a34b 100644
--- a/kubernetes/typed/flowcontrol/v1beta2/flowschema.go
+++ b/kubernetes/typed/flowcontrol/v1beta2/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
+	context "context"
+
+	apiflowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1beta2 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	flowcontrolv1beta2client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
 )
 
 // FlowSchemasClusterGetter has a method to return a FlowSchemaClusterInterface.
@@ -40,19 +37,20 @@ type FlowSchemasClusterGetter interface {
 }
 
 // FlowSchemaClusterInterface can operate on FlowSchemas across all clusters,
-// or scope down to one cluster and return a flowcontrolv1beta2client.FlowSchemaInterface.
+// or scope down to one cluster and return a flowcontrolv1beta2.FlowSchemaInterface.
 type FlowSchemaClusterInterface interface {
-	Cluster(logicalcluster.Path) flowcontrolv1beta2client.FlowSchemaInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta2.FlowSchemaList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) flowcontrolv1beta2.FlowSchemaInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiflowcontrolv1beta2.FlowSchemaList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	FlowSchemaClusterExpansion
 }
 
 type flowSchemasClusterInterface struct {
-	clientCache kcpclient.Cache[*flowcontrolv1beta2client.FlowcontrolV1beta2Client]
+	clientCache kcpclient.Cache[*flowcontrolv1beta2.FlowcontrolV1beta2Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *flowSchemasClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta2client.FlowSchemaInterface {
+func (c *flowSchemasClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta2.FlowSchemaInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *flowSchemasClusterInterface) Cluster(clusterPath logicalcluster.Path) f
 }
 
 // List returns the entire collection of all FlowSchemas across all clusters.
-func (c *flowSchemasClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta2.FlowSchemaList, error) {
+func (c *flowSchemasClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiflowcontrolv1beta2.FlowSchemaList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).FlowSchemas().List(ctx, opts)
 }
 
 // Watch begins to watch all FlowSchemas across all clusters.
-func (c *flowSchemasClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *flowSchemasClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).FlowSchemas().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta2/generated_expansion.go b/kubernetes/typed/flowcontrol/v1beta2/generated_expansion.go
new file mode 100644
index 000000000..4988b1583
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1beta2/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta2
+
+type FlowSchemaClusterExpansion interface{}
+
+type PriorityLevelConfigurationClusterExpansion interface{}
diff --git a/kubernetes/typed/flowcontrol/v1beta2/prioritylevelconfiguration.go b/kubernetes/typed/flowcontrol/v1beta2/prioritylevelconfiguration.go
index 3c5e55fbc..8f769a3dd 100644
--- a/kubernetes/typed/flowcontrol/v1beta2/prioritylevelconfiguration.go
+++ b/kubernetes/typed/flowcontrol/v1beta2/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	"context"
+	context "context"
+
+	apiflowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1beta2 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	flowcontrolv1beta2client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta2"
 )
 
 // PriorityLevelConfigurationsClusterGetter has a method to return a PriorityLevelConfigurationClusterInterface.
@@ -40,19 +37,20 @@ type PriorityLevelConfigurationsClusterGetter interface {
 }
 
 // PriorityLevelConfigurationClusterInterface can operate on PriorityLevelConfigurations across all clusters,
-// or scope down to one cluster and return a flowcontrolv1beta2client.PriorityLevelConfigurationInterface.
+// or scope down to one cluster and return a flowcontrolv1beta2.PriorityLevelConfigurationInterface.
 type PriorityLevelConfigurationClusterInterface interface {
-	Cluster(logicalcluster.Path) flowcontrolv1beta2client.PriorityLevelConfigurationInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta2.PriorityLevelConfigurationList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) flowcontrolv1beta2.PriorityLevelConfigurationInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiflowcontrolv1beta2.PriorityLevelConfigurationList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	PriorityLevelConfigurationClusterExpansion
 }
 
 type priorityLevelConfigurationsClusterInterface struct {
-	clientCache kcpclient.Cache[*flowcontrolv1beta2client.FlowcontrolV1beta2Client]
+	clientCache kcpclient.Cache[*flowcontrolv1beta2.FlowcontrolV1beta2Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *priorityLevelConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta2client.PriorityLevelConfigurationInterface {
+func (c *priorityLevelConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta2.PriorityLevelConfigurationInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *priorityLevelConfigurationsClusterInterface) Cluster(clusterPath logica
 }
 
 // List returns the entire collection of all PriorityLevelConfigurations across all clusters.
-func (c *priorityLevelConfigurationsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta2.PriorityLevelConfigurationList, error) {
+func (c *priorityLevelConfigurationsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiflowcontrolv1beta2.PriorityLevelConfigurationList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PriorityLevelConfigurations().List(ctx, opts)
 }
 
 // Watch begins to watch all PriorityLevelConfigurations across all clusters.
-func (c *priorityLevelConfigurationsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *priorityLevelConfigurationsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PriorityLevelConfigurations().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta3/doc.go b/kubernetes/typed/flowcontrol/v1beta3/doc.go
new file mode 100644
index 000000000..032758d66
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1beta3/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta3
diff --git a/kubernetes/typed/flowcontrol/v1beta3/fake/doc.go b/kubernetes/typed/flowcontrol/v1beta3/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1beta3/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/flowcontrol/v1beta3/fake/flowcontrol_client.go b/kubernetes/typed/flowcontrol/v1beta3/fake/flowcontrol_client.go
index 4a2ccfa80..920a787bd 100644
--- a/kubernetes/typed/flowcontrol/v1beta3/fake/flowcontrol_client.go
+++ b/kubernetes/typed/flowcontrol/v1beta3/fake/flowcontrol_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta3 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpflowcontrolv1beta3 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta3"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpflowcontrolv1beta3.FlowcontrolV1beta3ClusterInterface = (*FlowcontrolV1beta3ClusterClient)(nil)
@@ -45,29 +41,29 @@ func (c *FlowcontrolV1beta3ClusterClient) Cluster(clusterPath logicalcluster.Pat
 }
 
 func (c *FlowcontrolV1beta3ClusterClient) FlowSchemas() kcpflowcontrolv1beta3.FlowSchemaClusterInterface {
-	return &flowSchemasClusterClient{Fake: c.Fake}
+	return newFakeFlowSchemaClusterClient(c)
 }
 
 func (c *FlowcontrolV1beta3ClusterClient) PriorityLevelConfigurations() kcpflowcontrolv1beta3.PriorityLevelConfigurationClusterInterface {
-	return &priorityLevelConfigurationsClusterClient{Fake: c.Fake}
+	return newFakePriorityLevelConfigurationClusterClient(c)
 }
 
-var _ flowcontrolv1beta3.FlowcontrolV1beta3Interface = (*FlowcontrolV1beta3Client)(nil)
-
 type FlowcontrolV1beta3Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *FlowcontrolV1beta3Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
-}
-
 func (c *FlowcontrolV1beta3Client) FlowSchemas() flowcontrolv1beta3.FlowSchemaInterface {
-	return &flowSchemasClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakeFlowSchemaClient(c.Fake, c.ClusterPath)
 }
 
 func (c *FlowcontrolV1beta3Client) PriorityLevelConfigurations() flowcontrolv1beta3.PriorityLevelConfigurationInterface {
-	return &priorityLevelConfigurationsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakePriorityLevelConfigurationClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FlowcontrolV1beta3Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta3/fake/flowschema.go b/kubernetes/typed/flowcontrol/v1beta3/fake/flowschema.go
index 8628d3a5c..4ab6e61d3 100644
--- a/kubernetes/typed/flowcontrol/v1beta3/fake/flowschema.go
+++ b/kubernetes/typed/flowcontrol/v1beta3/fake/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsflowcontrolv1beta3 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3"
-	flowcontrolv1beta3client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
-	"k8s.io/client-go/testing"
+	v1beta3 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3"
+	typedflowcontrolv1beta3 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
 
+	typedkcpflowcontrolv1beta3 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta3"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var flowSchemasResource = schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta3", Resource: "flowschemas"}
-var flowSchemasKind = schema.GroupVersionKind{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta3", Kind: "FlowSchema"}
-
-type flowSchemasClusterClient struct {
-	*kcptesting.Fake
+// flowSchemaClusterClient implements FlowSchemaClusterInterface
+type flowSchemaClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*flowcontrolv1beta3.FlowSchema, *flowcontrolv1beta3.FlowSchemaList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *flowSchemasClusterClient) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta3client.FlowSchemaInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &flowSchemasClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of FlowSchemas that match those selectors across all clusters.
-func (c *flowSchemasClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta3.FlowSchemaList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(flowSchemasResource, flowSchemasKind, logicalcluster.Wildcard, opts), &flowcontrolv1beta3.FlowSchemaList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1beta3.FlowSchemaList{ListMeta: obj.(*flowcontrolv1beta3.FlowSchemaList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1beta3.FlowSchemaList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeFlowSchemaClusterClient(fake *FlowcontrolV1beta3ClusterClient) typedkcpflowcontrolv1beta3.FlowSchemaClusterInterface {
+	return &flowSchemaClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*flowcontrolv1beta3.FlowSchema, *flowcontrolv1beta3.FlowSchemaList](
+			fake.Fake,
+			flowcontrolv1beta3.SchemeGroupVersion.WithResource("flowschemas"),
+			flowcontrolv1beta3.SchemeGroupVersion.WithKind("FlowSchema"),
+			func() *flowcontrolv1beta3.FlowSchema { return &flowcontrolv1beta3.FlowSchema{} },
+			func() *flowcontrolv1beta3.FlowSchemaList { return &flowcontrolv1beta3.FlowSchemaList{} },
+			func(dst, src *flowcontrolv1beta3.FlowSchemaList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1beta3.FlowSchemaList) []*flowcontrolv1beta3.FlowSchema {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1beta3.FlowSchemaList, items []*flowcontrolv1beta3.FlowSchema) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested FlowSchemas across all clusters.
-func (c *flowSchemasClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(flowSchemasResource, logicalcluster.Wildcard, opts))
+func (c *flowSchemaClusterClient) Cluster(cluster logicalcluster.Path) typedflowcontrolv1beta3.FlowSchemaInterface {
+	return newFakeFlowSchemaClient(c.Fake, cluster)
 }
 
-type flowSchemasClient struct {
-	*kcptesting.Fake
+// flowSchemaScopedClient implements FlowSchemaInterface
+type flowSchemaScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*flowcontrolv1beta3.FlowSchema, *flowcontrolv1beta3.FlowSchemaList, *v1beta3.FlowSchemaApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *flowSchemasClient) Create(ctx context.Context, flowSchema *flowcontrolv1beta3.FlowSchema, opts metav1.CreateOptions) (*flowcontrolv1beta3.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(flowSchemasResource, c.ClusterPath, flowSchema), &flowcontrolv1beta3.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta3.FlowSchema), err
-}
-
-func (c *flowSchemasClient) Update(ctx context.Context, flowSchema *flowcontrolv1beta3.FlowSchema, opts metav1.UpdateOptions) (*flowcontrolv1beta3.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(flowSchemasResource, c.ClusterPath, flowSchema), &flowcontrolv1beta3.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta3.FlowSchema), err
-}
-
-func (c *flowSchemasClient) UpdateStatus(ctx context.Context, flowSchema *flowcontrolv1beta3.FlowSchema, opts metav1.UpdateOptions) (*flowcontrolv1beta3.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(flowSchemasResource, c.ClusterPath, "status", flowSchema), &flowcontrolv1beta3.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta3.FlowSchema), err
-}
-
-func (c *flowSchemasClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(flowSchemasResource, c.ClusterPath, name, opts), &flowcontrolv1beta3.FlowSchema{})
-	return err
-}
-
-func (c *flowSchemasClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(flowSchemasResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &flowcontrolv1beta3.FlowSchemaList{})
-	return err
-}
-
-func (c *flowSchemasClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*flowcontrolv1beta3.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(flowSchemasResource, c.ClusterPath, name), &flowcontrolv1beta3.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta3.FlowSchema), err
-}
-
-// List takes label and field selectors, and returns the list of FlowSchemas that match those selectors.
-func (c *flowSchemasClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta3.FlowSchemaList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(flowSchemasResource, flowSchemasKind, c.ClusterPath, opts), &flowcontrolv1beta3.FlowSchemaList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1beta3.FlowSchemaList{ListMeta: obj.(*flowcontrolv1beta3.FlowSchemaList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1beta3.FlowSchemaList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *flowSchemasClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(flowSchemasResource, c.ClusterPath, opts))
-}
-
-func (c *flowSchemasClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*flowcontrolv1beta3.FlowSchema, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(flowSchemasResource, c.ClusterPath, name, pt, data, subresources...), &flowcontrolv1beta3.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta3.FlowSchema), err
-}
-
-func (c *flowSchemasClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1beta3.FlowSchemaApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1beta3.FlowSchema, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(flowSchemasResource, c.ClusterPath, *name, types.ApplyPatchType, data), &flowcontrolv1beta3.FlowSchema{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta3.FlowSchema), err
-}
-
-func (c *flowSchemasClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1beta3.FlowSchemaApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1beta3.FlowSchema, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(flowSchemasResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &flowcontrolv1beta3.FlowSchema{})
-	if obj == nil {
-		return nil, err
+func newFakeFlowSchemaClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedflowcontrolv1beta3.FlowSchemaInterface {
+	return &flowSchemaScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*flowcontrolv1beta3.FlowSchema, *flowcontrolv1beta3.FlowSchemaList, *v1beta3.FlowSchemaApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			flowcontrolv1beta3.SchemeGroupVersion.WithResource("flowschemas"),
+			flowcontrolv1beta3.SchemeGroupVersion.WithKind("FlowSchema"),
+			func() *flowcontrolv1beta3.FlowSchema { return &flowcontrolv1beta3.FlowSchema{} },
+			func() *flowcontrolv1beta3.FlowSchemaList { return &flowcontrolv1beta3.FlowSchemaList{} },
+			func(dst, src *flowcontrolv1beta3.FlowSchemaList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1beta3.FlowSchemaList) []*flowcontrolv1beta3.FlowSchema {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1beta3.FlowSchemaList, items []*flowcontrolv1beta3.FlowSchema) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*flowcontrolv1beta3.FlowSchema), err
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta3/fake/prioritylevelconfiguration.go b/kubernetes/typed/flowcontrol/v1beta3/fake/prioritylevelconfiguration.go
index 11c6ca115..c01edaa5b 100644
--- a/kubernetes/typed/flowcontrol/v1beta3/fake/prioritylevelconfiguration.go
+++ b/kubernetes/typed/flowcontrol/v1beta3/fake/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,85 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsflowcontrolv1beta3 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3"
-	flowcontrolv1beta3client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
-	"k8s.io/client-go/testing"
+	v1beta3 "k8s.io/client-go/applyconfigurations/flowcontrol/v1beta3"
+	typedflowcontrolv1beta3 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
 
+	typedkcpflowcontrolv1beta3 "github.com/kcp-dev/client-go/kubernetes/typed/flowcontrol/v1beta3"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var priorityLevelConfigurationsResource = schema.GroupVersionResource{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta3", Resource: "prioritylevelconfigurations"}
-var priorityLevelConfigurationsKind = schema.GroupVersionKind{Group: "flowcontrol.apiserver.k8s.io", Version: "v1beta3", Kind: "PriorityLevelConfiguration"}
-
-type priorityLevelConfigurationsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *priorityLevelConfigurationsClusterClient) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta3client.PriorityLevelConfigurationInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &priorityLevelConfigurationsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PriorityLevelConfigurations that match those selectors across all clusters.
-func (c *priorityLevelConfigurationsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta3.PriorityLevelConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityLevelConfigurationsResource, priorityLevelConfigurationsKind, logicalcluster.Wildcard, opts), &flowcontrolv1beta3.PriorityLevelConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1beta3.PriorityLevelConfigurationList{ListMeta: obj.(*flowcontrolv1beta3.PriorityLevelConfigurationList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1beta3.PriorityLevelConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested PriorityLevelConfigurations across all clusters.
-func (c *priorityLevelConfigurationsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityLevelConfigurationsResource, logicalcluster.Wildcard, opts))
-}
-
-type priorityLevelConfigurationsClient struct {
-	*kcptesting.Fake
+// priorityLevelConfigurationClusterClient implements PriorityLevelConfigurationClusterInterface
+type priorityLevelConfigurationClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*flowcontrolv1beta3.PriorityLevelConfiguration, *flowcontrolv1beta3.PriorityLevelConfigurationList]
+	Fake *kcptesting.Fake
+}
+
+func newFakePriorityLevelConfigurationClusterClient(fake *FlowcontrolV1beta3ClusterClient) typedkcpflowcontrolv1beta3.PriorityLevelConfigurationClusterInterface {
+	return &priorityLevelConfigurationClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*flowcontrolv1beta3.PriorityLevelConfiguration, *flowcontrolv1beta3.PriorityLevelConfigurationList](
+			fake.Fake,
+			flowcontrolv1beta3.SchemeGroupVersion.WithResource("prioritylevelconfigurations"),
+			flowcontrolv1beta3.SchemeGroupVersion.WithKind("PriorityLevelConfiguration"),
+			func() *flowcontrolv1beta3.PriorityLevelConfiguration {
+				return &flowcontrolv1beta3.PriorityLevelConfiguration{}
+			},
+			func() *flowcontrolv1beta3.PriorityLevelConfigurationList {
+				return &flowcontrolv1beta3.PriorityLevelConfigurationList{}
+			},
+			func(dst, src *flowcontrolv1beta3.PriorityLevelConfigurationList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1beta3.PriorityLevelConfigurationList) []*flowcontrolv1beta3.PriorityLevelConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1beta3.PriorityLevelConfigurationList, items []*flowcontrolv1beta3.PriorityLevelConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *priorityLevelConfigurationClusterClient) Cluster(cluster logicalcluster.Path) typedflowcontrolv1beta3.PriorityLevelConfigurationInterface {
+	return newFakePriorityLevelConfigurationClient(c.Fake, cluster)
+}
+
+// priorityLevelConfigurationScopedClient implements PriorityLevelConfigurationInterface
+type priorityLevelConfigurationScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*flowcontrolv1beta3.PriorityLevelConfiguration, *flowcontrolv1beta3.PriorityLevelConfigurationList, *v1beta3.PriorityLevelConfigurationApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *priorityLevelConfigurationsClient) Create(ctx context.Context, priorityLevelConfiguration *flowcontrolv1beta3.PriorityLevelConfiguration, opts metav1.CreateOptions) (*flowcontrolv1beta3.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(priorityLevelConfigurationsResource, c.ClusterPath, priorityLevelConfiguration), &flowcontrolv1beta3.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta3.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) Update(ctx context.Context, priorityLevelConfiguration *flowcontrolv1beta3.PriorityLevelConfiguration, opts metav1.UpdateOptions) (*flowcontrolv1beta3.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(priorityLevelConfigurationsResource, c.ClusterPath, priorityLevelConfiguration), &flowcontrolv1beta3.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta3.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) UpdateStatus(ctx context.Context, priorityLevelConfiguration *flowcontrolv1beta3.PriorityLevelConfiguration, opts metav1.UpdateOptions) (*flowcontrolv1beta3.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, "status", priorityLevelConfiguration), &flowcontrolv1beta3.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta3.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(priorityLevelConfigurationsResource, c.ClusterPath, name, opts), &flowcontrolv1beta3.PriorityLevelConfiguration{})
-	return err
-}
-
-func (c *priorityLevelConfigurationsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(priorityLevelConfigurationsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &flowcontrolv1beta3.PriorityLevelConfigurationList{})
-	return err
-}
-
-func (c *priorityLevelConfigurationsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*flowcontrolv1beta3.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(priorityLevelConfigurationsResource, c.ClusterPath, name), &flowcontrolv1beta3.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta3.PriorityLevelConfiguration), err
-}
-
-// List takes label and field selectors, and returns the list of PriorityLevelConfigurations that match those selectors.
-func (c *priorityLevelConfigurationsClient) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta3.PriorityLevelConfigurationList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityLevelConfigurationsResource, priorityLevelConfigurationsKind, c.ClusterPath, opts), &flowcontrolv1beta3.PriorityLevelConfigurationList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &flowcontrolv1beta3.PriorityLevelConfigurationList{ListMeta: obj.(*flowcontrolv1beta3.PriorityLevelConfigurationList).ListMeta}
-	for _, item := range obj.(*flowcontrolv1beta3.PriorityLevelConfigurationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *priorityLevelConfigurationsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityLevelConfigurationsResource, c.ClusterPath, opts))
-}
-
-func (c *priorityLevelConfigurationsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*flowcontrolv1beta3.PriorityLevelConfiguration, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, name, pt, data, subresources...), &flowcontrolv1beta3.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta3.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1beta3.PriorityLevelConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1beta3.PriorityLevelConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &flowcontrolv1beta3.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*flowcontrolv1beta3.PriorityLevelConfiguration), err
-}
-
-func (c *priorityLevelConfigurationsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsflowcontrolv1beta3.PriorityLevelConfigurationApplyConfiguration, opts metav1.ApplyOptions) (*flowcontrolv1beta3.PriorityLevelConfiguration, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityLevelConfigurationsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &flowcontrolv1beta3.PriorityLevelConfiguration{})
-	if obj == nil {
-		return nil, err
+func newFakePriorityLevelConfigurationClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedflowcontrolv1beta3.PriorityLevelConfigurationInterface {
+	return &priorityLevelConfigurationScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*flowcontrolv1beta3.PriorityLevelConfiguration, *flowcontrolv1beta3.PriorityLevelConfigurationList, *v1beta3.PriorityLevelConfigurationApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			flowcontrolv1beta3.SchemeGroupVersion.WithResource("prioritylevelconfigurations"),
+			flowcontrolv1beta3.SchemeGroupVersion.WithKind("PriorityLevelConfiguration"),
+			func() *flowcontrolv1beta3.PriorityLevelConfiguration {
+				return &flowcontrolv1beta3.PriorityLevelConfiguration{}
+			},
+			func() *flowcontrolv1beta3.PriorityLevelConfigurationList {
+				return &flowcontrolv1beta3.PriorityLevelConfigurationList{}
+			},
+			func(dst, src *flowcontrolv1beta3.PriorityLevelConfigurationList) { dst.ListMeta = src.ListMeta },
+			func(list *flowcontrolv1beta3.PriorityLevelConfigurationList) []*flowcontrolv1beta3.PriorityLevelConfiguration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *flowcontrolv1beta3.PriorityLevelConfigurationList, items []*flowcontrolv1beta3.PriorityLevelConfiguration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*flowcontrolv1beta3.PriorityLevelConfiguration), err
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta3/flowcontrol_client.go b/kubernetes/typed/flowcontrol/v1beta3/flowcontrol_client.go
index d372a7b78..6ae3d82f9 100644
--- a/kubernetes/typed/flowcontrol/v1beta3/flowcontrol_client.go
+++ b/kubernetes/typed/flowcontrol/v1beta3/flowcontrol_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta3
 
 import (
-	"net/http"
+	http "net/http"
+
+	apiflowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
+	flowcontrolv1beta3 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta3 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
-	"k8s.io/client-go/rest"
 )
 
 type FlowcontrolV1beta3ClusterInterface interface {
@@ -41,6 +40,7 @@ type FlowcontrolV1beta3ClusterScoper interface {
 	Cluster(logicalcluster.Path) flowcontrolv1beta3.FlowcontrolV1beta3Interface
 }
 
+// FlowcontrolV1beta3ClusterClient is used to interact with features provided by the flowcontrol.apiserver.k8s.io group.
 type FlowcontrolV1beta3ClusterClient struct {
 	clientCache kcpclient.Cache[*flowcontrolv1beta3.FlowcontrolV1beta3Client]
 }
@@ -64,11 +64,13 @@ func (c *FlowcontrolV1beta3ClusterClient) PriorityLevelConfigurations() Priority
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*FlowcontrolV1beta3ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new FlowcontrolV1beta3ClusterClient for the given config and http client.
@@ -80,6 +82,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*FlowcontrolV1beta3C
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &FlowcontrolV1beta3ClusterClient{clientCache: cache}, nil
 }
 
@@ -92,3 +95,14 @@ func NewForConfigOrDie(c *rest.Config) *FlowcontrolV1beta3ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiflowcontrolv1beta3.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/flowcontrol/v1beta3/flowschema.go b/kubernetes/typed/flowcontrol/v1beta3/flowschema.go
index cbe431e68..77a9477a5 100644
--- a/kubernetes/typed/flowcontrol/v1beta3/flowschema.go
+++ b/kubernetes/typed/flowcontrol/v1beta3/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta3
 
 import (
-	"context"
+	context "context"
+
+	apiflowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1beta3 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	flowcontrolv1beta3client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
 )
 
 // FlowSchemasClusterGetter has a method to return a FlowSchemaClusterInterface.
@@ -40,19 +37,20 @@ type FlowSchemasClusterGetter interface {
 }
 
 // FlowSchemaClusterInterface can operate on FlowSchemas across all clusters,
-// or scope down to one cluster and return a flowcontrolv1beta3client.FlowSchemaInterface.
+// or scope down to one cluster and return a flowcontrolv1beta3.FlowSchemaInterface.
 type FlowSchemaClusterInterface interface {
-	Cluster(logicalcluster.Path) flowcontrolv1beta3client.FlowSchemaInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta3.FlowSchemaList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) flowcontrolv1beta3.FlowSchemaInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiflowcontrolv1beta3.FlowSchemaList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	FlowSchemaClusterExpansion
 }
 
 type flowSchemasClusterInterface struct {
-	clientCache kcpclient.Cache[*flowcontrolv1beta3client.FlowcontrolV1beta3Client]
+	clientCache kcpclient.Cache[*flowcontrolv1beta3.FlowcontrolV1beta3Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *flowSchemasClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta3client.FlowSchemaInterface {
+func (c *flowSchemasClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta3.FlowSchemaInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *flowSchemasClusterInterface) Cluster(clusterPath logicalcluster.Path) f
 }
 
 // List returns the entire collection of all FlowSchemas across all clusters.
-func (c *flowSchemasClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta3.FlowSchemaList, error) {
+func (c *flowSchemasClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiflowcontrolv1beta3.FlowSchemaList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).FlowSchemas().List(ctx, opts)
 }
 
 // Watch begins to watch all FlowSchemas across all clusters.
-func (c *flowSchemasClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *flowSchemasClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).FlowSchemas().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/flowcontrol/v1beta3/generated_expansion.go b/kubernetes/typed/flowcontrol/v1beta3/generated_expansion.go
new file mode 100644
index 000000000..d8400ec71
--- /dev/null
+++ b/kubernetes/typed/flowcontrol/v1beta3/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta3
+
+type FlowSchemaClusterExpansion interface{}
+
+type PriorityLevelConfigurationClusterExpansion interface{}
diff --git a/kubernetes/typed/flowcontrol/v1beta3/prioritylevelconfiguration.go b/kubernetes/typed/flowcontrol/v1beta3/prioritylevelconfiguration.go
index fc92c778f..dc99e4b6f 100644
--- a/kubernetes/typed/flowcontrol/v1beta3/prioritylevelconfiguration.go
+++ b/kubernetes/typed/flowcontrol/v1beta3/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta3
 
 import (
-	"context"
+	context "context"
+
+	apiflowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	flowcontrolv1beta3 "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	flowcontrolv1beta3client "k8s.io/client-go/kubernetes/typed/flowcontrol/v1beta3"
 )
 
 // PriorityLevelConfigurationsClusterGetter has a method to return a PriorityLevelConfigurationClusterInterface.
@@ -40,19 +37,20 @@ type PriorityLevelConfigurationsClusterGetter interface {
 }
 
 // PriorityLevelConfigurationClusterInterface can operate on PriorityLevelConfigurations across all clusters,
-// or scope down to one cluster and return a flowcontrolv1beta3client.PriorityLevelConfigurationInterface.
+// or scope down to one cluster and return a flowcontrolv1beta3.PriorityLevelConfigurationInterface.
 type PriorityLevelConfigurationClusterInterface interface {
-	Cluster(logicalcluster.Path) flowcontrolv1beta3client.PriorityLevelConfigurationInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta3.PriorityLevelConfigurationList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) flowcontrolv1beta3.PriorityLevelConfigurationInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiflowcontrolv1beta3.PriorityLevelConfigurationList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	PriorityLevelConfigurationClusterExpansion
 }
 
 type priorityLevelConfigurationsClusterInterface struct {
-	clientCache kcpclient.Cache[*flowcontrolv1beta3client.FlowcontrolV1beta3Client]
+	clientCache kcpclient.Cache[*flowcontrolv1beta3.FlowcontrolV1beta3Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *priorityLevelConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta3client.PriorityLevelConfigurationInterface {
+func (c *priorityLevelConfigurationsClusterInterface) Cluster(clusterPath logicalcluster.Path) flowcontrolv1beta3.PriorityLevelConfigurationInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *priorityLevelConfigurationsClusterInterface) Cluster(clusterPath logica
 }
 
 // List returns the entire collection of all PriorityLevelConfigurations across all clusters.
-func (c *priorityLevelConfigurationsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*flowcontrolv1beta3.PriorityLevelConfigurationList, error) {
+func (c *priorityLevelConfigurationsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiflowcontrolv1beta3.PriorityLevelConfigurationList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PriorityLevelConfigurations().List(ctx, opts)
 }
 
 // Watch begins to watch all PriorityLevelConfigurations across all clusters.
-func (c *priorityLevelConfigurationsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *priorityLevelConfigurationsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PriorityLevelConfigurations().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/networking/v1/doc.go b/kubernetes/typed/networking/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/networking/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/networking/v1/fake/doc.go b/kubernetes/typed/networking/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/networking/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/networking/v1/fake/ingress.go b/kubernetes/typed/networking/v1/fake/ingress.go
index f38df5c8f..11b0cdb4d 100644
--- a/kubernetes/typed/networking/v1/fake/ingress.go
+++ b/kubernetes/typed/networking/v1/fake/ingress.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1 "k8s.io/api/networking/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsnetworkingv1 "k8s.io/client-go/applyconfigurations/networking/v1"
-	networkingv1client "k8s.io/client-go/kubernetes/typed/networking/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/networking/v1"
+	typednetworkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
 
-	kcpnetworkingv1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1"
+	typedkcpnetworkingv1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var ingressesResource = schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "ingresses"}
-var ingressesKind = schema.GroupVersionKind{Group: "networking.k8s.io", Version: "v1", Kind: "Ingress"}
-
-type ingressesClusterClient struct {
-	*kcptesting.Fake
+// ingressClusterClient implements IngressClusterInterface
+type ingressClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*networkingv1.Ingress, *networkingv1.IngressList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *ingressesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpnetworkingv1.IngressesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &ingressesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Ingresses that match those selectors across all clusters.
-func (c *ingressesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1.IngressList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(ingressesResource, ingressesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &networkingv1.IngressList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeIngressClusterClient(fake *NetworkingV1ClusterClient) typedkcpnetworkingv1.IngressClusterInterface {
+	return &ingressClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*networkingv1.Ingress, *networkingv1.IngressList](
+			fake.Fake,
+			networkingv1.SchemeGroupVersion.WithResource("ingresses"),
+			networkingv1.SchemeGroupVersion.WithKind("Ingress"),
+			func() *networkingv1.Ingress { return &networkingv1.Ingress{} },
+			func() *networkingv1.IngressList { return &networkingv1.IngressList{} },
+			func(dst, src *networkingv1.IngressList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1.IngressList) []*networkingv1.Ingress {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1.IngressList, items []*networkingv1.Ingress) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &networkingv1.IngressList{ListMeta: obj.(*networkingv1.IngressList).ListMeta}
-	for _, item := range obj.(*networkingv1.IngressList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Ingresses across all clusters.
-func (c *ingressesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(ingressesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *ingressClusterClient) Cluster(cluster logicalcluster.Path) typedkcpnetworkingv1.IngressesNamespacer {
+	return &ingressNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type ingressesNamespacer struct {
+type ingressNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *ingressesNamespacer) Namespace(namespace string) networkingv1client.IngressInterface {
-	return &ingressesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *ingressNamespacer) Namespace(namespace string) typednetworkingv1.IngressInterface {
+	return newFakeIngressClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type ingressesClient struct {
-	*kcptesting.Fake
+// ingressScopedClient implements IngressInterface
+type ingressScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*networkingv1.Ingress, *networkingv1.IngressList, *v1.IngressApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *ingressesClient) Create(ctx context.Context, ingress *networkingv1.Ingress, opts metav1.CreateOptions) (*networkingv1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(ingressesResource, c.ClusterPath, c.Namespace, ingress), &networkingv1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.Ingress), err
-}
-
-func (c *ingressesClient) Update(ctx context.Context, ingress *networkingv1.Ingress, opts metav1.UpdateOptions) (*networkingv1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(ingressesResource, c.ClusterPath, c.Namespace, ingress), &networkingv1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.Ingress), err
-}
-
-func (c *ingressesClient) UpdateStatus(ctx context.Context, ingress *networkingv1.Ingress, opts metav1.UpdateOptions) (*networkingv1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(ingressesResource, c.ClusterPath, "status", c.Namespace, ingress), &networkingv1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.Ingress), err
-}
-
-func (c *ingressesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(ingressesResource, c.ClusterPath, c.Namespace, name, opts), &networkingv1.Ingress{})
-	return err
 }
 
-func (c *ingressesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(ingressesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &networkingv1.IngressList{})
-	return err
-}
-
-func (c *ingressesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*networkingv1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(ingressesResource, c.ClusterPath, c.Namespace, name), &networkingv1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.Ingress), err
-}
-
-// List takes label and field selectors, and returns the list of Ingresses that match those selectors.
-func (c *ingressesClient) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1.IngressList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(ingressesResource, ingressesKind, c.ClusterPath, c.Namespace, opts), &networkingv1.IngressList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &networkingv1.IngressList{ListMeta: obj.(*networkingv1.IngressList).ListMeta}
-	for _, item := range obj.(*networkingv1.IngressList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *ingressesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(ingressesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *ingressesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*networkingv1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(ingressesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &networkingv1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.Ingress), err
-}
-
-func (c *ingressesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsnetworkingv1.IngressApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1.Ingress, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(ingressesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &networkingv1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.Ingress), err
-}
-
-func (c *ingressesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsnetworkingv1.IngressApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1.Ingress, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(ingressesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &networkingv1.Ingress{})
-	if obj == nil {
-		return nil, err
+func newFakeIngressClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typednetworkingv1.IngressInterface {
+	return &ingressScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*networkingv1.Ingress, *networkingv1.IngressList, *v1.IngressApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			networkingv1.SchemeGroupVersion.WithResource("ingresses"),
+			networkingv1.SchemeGroupVersion.WithKind("Ingress"),
+			func() *networkingv1.Ingress { return &networkingv1.Ingress{} },
+			func() *networkingv1.IngressList { return &networkingv1.IngressList{} },
+			func(dst, src *networkingv1.IngressList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1.IngressList) []*networkingv1.Ingress {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1.IngressList, items []*networkingv1.Ingress) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*networkingv1.Ingress), err
 }
diff --git a/kubernetes/typed/networking/v1/fake/ingressclass.go b/kubernetes/typed/networking/v1/fake/ingressclass.go
index 24f9f154c..dddd3bdd4 100644
--- a/kubernetes/typed/networking/v1/fake/ingressclass.go
+++ b/kubernetes/typed/networking/v1/fake/ingressclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1 "k8s.io/api/networking/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsnetworkingv1 "k8s.io/client-go/applyconfigurations/networking/v1"
-	networkingv1client "k8s.io/client-go/kubernetes/typed/networking/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/networking/v1"
+	typednetworkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
 
+	typedkcpnetworkingv1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var ingressClassesResource = schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "ingressclasses"}
-var ingressClassesKind = schema.GroupVersionKind{Group: "networking.k8s.io", Version: "v1", Kind: "IngressClass"}
-
-type ingressClassesClusterClient struct {
-	*kcptesting.Fake
+// ingressClassClusterClient implements IngressClassClusterInterface
+type ingressClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*networkingv1.IngressClass, *networkingv1.IngressClassList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *ingressClassesClusterClient) Cluster(clusterPath logicalcluster.Path) networkingv1client.IngressClassInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &ingressClassesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of IngressClasses that match those selectors across all clusters.
-func (c *ingressClassesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1.IngressClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(ingressClassesResource, ingressClassesKind, logicalcluster.Wildcard, opts), &networkingv1.IngressClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &networkingv1.IngressClassList{ListMeta: obj.(*networkingv1.IngressClassList).ListMeta}
-	for _, item := range obj.(*networkingv1.IngressClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeIngressClassClusterClient(fake *NetworkingV1ClusterClient) typedkcpnetworkingv1.IngressClassClusterInterface {
+	return &ingressClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*networkingv1.IngressClass, *networkingv1.IngressClassList](
+			fake.Fake,
+			networkingv1.SchemeGroupVersion.WithResource("ingressclasses"),
+			networkingv1.SchemeGroupVersion.WithKind("IngressClass"),
+			func() *networkingv1.IngressClass { return &networkingv1.IngressClass{} },
+			func() *networkingv1.IngressClassList { return &networkingv1.IngressClassList{} },
+			func(dst, src *networkingv1.IngressClassList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1.IngressClassList) []*networkingv1.IngressClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1.IngressClassList, items []*networkingv1.IngressClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested IngressClasses across all clusters.
-func (c *ingressClassesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(ingressClassesResource, logicalcluster.Wildcard, opts))
+func (c *ingressClassClusterClient) Cluster(cluster logicalcluster.Path) typednetworkingv1.IngressClassInterface {
+	return newFakeIngressClassClient(c.Fake, cluster)
 }
 
-type ingressClassesClient struct {
-	*kcptesting.Fake
+// ingressClassScopedClient implements IngressClassInterface
+type ingressClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*networkingv1.IngressClass, *networkingv1.IngressClassList, *v1.IngressClassApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *ingressClassesClient) Create(ctx context.Context, ingressClass *networkingv1.IngressClass, opts metav1.CreateOptions) (*networkingv1.IngressClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(ingressClassesResource, c.ClusterPath, ingressClass), &networkingv1.IngressClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.IngressClass), err
-}
-
-func (c *ingressClassesClient) Update(ctx context.Context, ingressClass *networkingv1.IngressClass, opts metav1.UpdateOptions) (*networkingv1.IngressClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(ingressClassesResource, c.ClusterPath, ingressClass), &networkingv1.IngressClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.IngressClass), err
-}
-
-func (c *ingressClassesClient) UpdateStatus(ctx context.Context, ingressClass *networkingv1.IngressClass, opts metav1.UpdateOptions) (*networkingv1.IngressClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(ingressClassesResource, c.ClusterPath, "status", ingressClass), &networkingv1.IngressClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.IngressClass), err
-}
-
-func (c *ingressClassesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(ingressClassesResource, c.ClusterPath, name, opts), &networkingv1.IngressClass{})
-	return err
-}
-
-func (c *ingressClassesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(ingressClassesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &networkingv1.IngressClassList{})
-	return err
-}
-
-func (c *ingressClassesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*networkingv1.IngressClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(ingressClassesResource, c.ClusterPath, name), &networkingv1.IngressClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.IngressClass), err
-}
-
-// List takes label and field selectors, and returns the list of IngressClasses that match those selectors.
-func (c *ingressClassesClient) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1.IngressClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(ingressClassesResource, ingressClassesKind, c.ClusterPath, opts), &networkingv1.IngressClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &networkingv1.IngressClassList{ListMeta: obj.(*networkingv1.IngressClassList).ListMeta}
-	for _, item := range obj.(*networkingv1.IngressClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *ingressClassesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(ingressClassesResource, c.ClusterPath, opts))
-}
-
-func (c *ingressClassesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*networkingv1.IngressClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(ingressClassesResource, c.ClusterPath, name, pt, data, subresources...), &networkingv1.IngressClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.IngressClass), err
-}
-
-func (c *ingressClassesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsnetworkingv1.IngressClassApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1.IngressClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(ingressClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &networkingv1.IngressClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.IngressClass), err
-}
-
-func (c *ingressClassesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsnetworkingv1.IngressClassApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1.IngressClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(ingressClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &networkingv1.IngressClass{})
-	if obj == nil {
-		return nil, err
+func newFakeIngressClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typednetworkingv1.IngressClassInterface {
+	return &ingressClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*networkingv1.IngressClass, *networkingv1.IngressClassList, *v1.IngressClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			networkingv1.SchemeGroupVersion.WithResource("ingressclasses"),
+			networkingv1.SchemeGroupVersion.WithKind("IngressClass"),
+			func() *networkingv1.IngressClass { return &networkingv1.IngressClass{} },
+			func() *networkingv1.IngressClassList { return &networkingv1.IngressClassList{} },
+			func(dst, src *networkingv1.IngressClassList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1.IngressClassList) []*networkingv1.IngressClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1.IngressClassList, items []*networkingv1.IngressClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*networkingv1.IngressClass), err
 }
diff --git a/kubernetes/typed/networking/v1/fake/ipaddress.go b/kubernetes/typed/networking/v1/fake/ipaddress.go
new file mode 100644
index 000000000..0ec6904aa
--- /dev/null
+++ b/kubernetes/typed/networking/v1/fake/ipaddress.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	networkingv1 "k8s.io/api/networking/v1"
+	v1 "k8s.io/client-go/applyconfigurations/networking/v1"
+	typednetworkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
+
+	typedkcpnetworkingv1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// iPAddressClusterClient implements IPAddressClusterInterface
+type iPAddressClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*networkingv1.IPAddress, *networkingv1.IPAddressList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeIPAddressClusterClient(fake *NetworkingV1ClusterClient) typedkcpnetworkingv1.IPAddressClusterInterface {
+	return &iPAddressClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*networkingv1.IPAddress, *networkingv1.IPAddressList](
+			fake.Fake,
+			networkingv1.SchemeGroupVersion.WithResource("ipaddresses"),
+			networkingv1.SchemeGroupVersion.WithKind("IPAddress"),
+			func() *networkingv1.IPAddress { return &networkingv1.IPAddress{} },
+			func() *networkingv1.IPAddressList { return &networkingv1.IPAddressList{} },
+			func(dst, src *networkingv1.IPAddressList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1.IPAddressList) []*networkingv1.IPAddress {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1.IPAddressList, items []*networkingv1.IPAddress) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *iPAddressClusterClient) Cluster(cluster logicalcluster.Path) typednetworkingv1.IPAddressInterface {
+	return newFakeIPAddressClient(c.Fake, cluster)
+}
+
+// iPAddressScopedClient implements IPAddressInterface
+type iPAddressScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*networkingv1.IPAddress, *networkingv1.IPAddressList, *v1.IPAddressApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeIPAddressClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typednetworkingv1.IPAddressInterface {
+	return &iPAddressScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*networkingv1.IPAddress, *networkingv1.IPAddressList, *v1.IPAddressApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			networkingv1.SchemeGroupVersion.WithResource("ipaddresses"),
+			networkingv1.SchemeGroupVersion.WithKind("IPAddress"),
+			func() *networkingv1.IPAddress { return &networkingv1.IPAddress{} },
+			func() *networkingv1.IPAddressList { return &networkingv1.IPAddressList{} },
+			func(dst, src *networkingv1.IPAddressList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1.IPAddressList) []*networkingv1.IPAddress {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1.IPAddressList, items []*networkingv1.IPAddress) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/networking/v1/fake/networking_client.go b/kubernetes/typed/networking/v1/fake/networking_client.go
index a41eab223..98f104cb5 100644
--- a/kubernetes/typed/networking/v1/fake/networking_client.go
+++ b/kubernetes/typed/networking/v1/fake/networking_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpnetworkingv1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpnetworkingv1.NetworkingV1ClusterInterface = (*NetworkingV1ClusterClient)(nil)
@@ -44,38 +40,54 @@ func (c *NetworkingV1ClusterClient) Cluster(clusterPath logicalcluster.Path) net
 	return &NetworkingV1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *NetworkingV1ClusterClient) NetworkPolicies() kcpnetworkingv1.NetworkPolicyClusterInterface {
-	return &networkPoliciesClusterClient{Fake: c.Fake}
+func (c *NetworkingV1ClusterClient) IPAddresses() kcpnetworkingv1.IPAddressClusterInterface {
+	return newFakeIPAddressClusterClient(c)
 }
 
 func (c *NetworkingV1ClusterClient) Ingresses() kcpnetworkingv1.IngressClusterInterface {
-	return &ingressesClusterClient{Fake: c.Fake}
+	return newFakeIngressClusterClient(c)
 }
 
 func (c *NetworkingV1ClusterClient) IngressClasses() kcpnetworkingv1.IngressClassClusterInterface {
-	return &ingressClassesClusterClient{Fake: c.Fake}
+	return newFakeIngressClassClusterClient(c)
+}
+
+func (c *NetworkingV1ClusterClient) NetworkPolicies() kcpnetworkingv1.NetworkPolicyClusterInterface {
+	return newFakeNetworkPolicyClusterClient(c)
 }
 
-var _ networkingv1.NetworkingV1Interface = (*NetworkingV1Client)(nil)
+func (c *NetworkingV1ClusterClient) ServiceCIDRs() kcpnetworkingv1.ServiceCIDRClusterInterface {
+	return newFakeServiceCIDRClusterClient(c)
+}
 
 type NetworkingV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *NetworkingV1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *NetworkingV1Client) IPAddresses() networkingv1.IPAddressInterface {
+	return newFakeIPAddressClient(c.Fake, c.ClusterPath)
+}
+
+func (c *NetworkingV1Client) Ingresses(namespace string) networkingv1.IngressInterface {
+	return newFakeIngressClient(c.Fake, namespace, c.ClusterPath)
+}
+
+func (c *NetworkingV1Client) IngressClasses() networkingv1.IngressClassInterface {
+	return newFakeIngressClassClient(c.Fake, c.ClusterPath)
 }
 
 func (c *NetworkingV1Client) NetworkPolicies(namespace string) networkingv1.NetworkPolicyInterface {
-	return &networkPoliciesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+	return newFakeNetworkPolicyClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *NetworkingV1Client) Ingresses(namespace string) networkingv1.IngressInterface {
-	return &ingressesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *NetworkingV1Client) ServiceCIDRs() networkingv1.ServiceCIDRInterface {
+	return newFakeServiceCIDRClient(c.Fake, c.ClusterPath)
 }
 
-func (c *NetworkingV1Client) IngressClasses() networkingv1.IngressClassInterface {
-	return &ingressClassesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *NetworkingV1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/networking/v1/fake/networkpolicy.go b/kubernetes/typed/networking/v1/fake/networkpolicy.go
index 2571257ae..062133c2d 100644
--- a/kubernetes/typed/networking/v1/fake/networkpolicy.go
+++ b/kubernetes/typed/networking/v1/fake/networkpolicy.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1 "k8s.io/api/networking/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsnetworkingv1 "k8s.io/client-go/applyconfigurations/networking/v1"
-	networkingv1client "k8s.io/client-go/kubernetes/typed/networking/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/networking/v1"
+	typednetworkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
 
-	kcpnetworkingv1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1"
+	typedkcpnetworkingv1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var networkPoliciesResource = schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1", Resource: "networkpolicies"}
-var networkPoliciesKind = schema.GroupVersionKind{Group: "networking.k8s.io", Version: "v1", Kind: "NetworkPolicy"}
-
-type networkPoliciesClusterClient struct {
-	*kcptesting.Fake
+// networkPolicyClusterClient implements NetworkPolicyClusterInterface
+type networkPolicyClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*networkingv1.NetworkPolicy, *networkingv1.NetworkPolicyList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *networkPoliciesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpnetworkingv1.NetworkPoliciesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &networkPoliciesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of NetworkPolicies that match those selectors across all clusters.
-func (c *networkPoliciesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1.NetworkPolicyList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(networkPoliciesResource, networkPoliciesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &networkingv1.NetworkPolicyList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeNetworkPolicyClusterClient(fake *NetworkingV1ClusterClient) typedkcpnetworkingv1.NetworkPolicyClusterInterface {
+	return &networkPolicyClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*networkingv1.NetworkPolicy, *networkingv1.NetworkPolicyList](
+			fake.Fake,
+			networkingv1.SchemeGroupVersion.WithResource("networkpolicies"),
+			networkingv1.SchemeGroupVersion.WithKind("NetworkPolicy"),
+			func() *networkingv1.NetworkPolicy { return &networkingv1.NetworkPolicy{} },
+			func() *networkingv1.NetworkPolicyList { return &networkingv1.NetworkPolicyList{} },
+			func(dst, src *networkingv1.NetworkPolicyList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1.NetworkPolicyList) []*networkingv1.NetworkPolicy {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1.NetworkPolicyList, items []*networkingv1.NetworkPolicy) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &networkingv1.NetworkPolicyList{ListMeta: obj.(*networkingv1.NetworkPolicyList).ListMeta}
-	for _, item := range obj.(*networkingv1.NetworkPolicyList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested NetworkPolicies across all clusters.
-func (c *networkPoliciesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(networkPoliciesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *networkPolicyClusterClient) Cluster(cluster logicalcluster.Path) typedkcpnetworkingv1.NetworkPoliciesNamespacer {
+	return &networkPolicyNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type networkPoliciesNamespacer struct {
+type networkPolicyNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *networkPoliciesNamespacer) Namespace(namespace string) networkingv1client.NetworkPolicyInterface {
-	return &networkPoliciesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *networkPolicyNamespacer) Namespace(namespace string) typednetworkingv1.NetworkPolicyInterface {
+	return newFakeNetworkPolicyClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type networkPoliciesClient struct {
-	*kcptesting.Fake
+// networkPolicyScopedClient implements NetworkPolicyInterface
+type networkPolicyScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*networkingv1.NetworkPolicy, *networkingv1.NetworkPolicyList, *v1.NetworkPolicyApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *networkPoliciesClient) Create(ctx context.Context, networkPolicy *networkingv1.NetworkPolicy, opts metav1.CreateOptions) (*networkingv1.NetworkPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(networkPoliciesResource, c.ClusterPath, c.Namespace, networkPolicy), &networkingv1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.NetworkPolicy), err
-}
-
-func (c *networkPoliciesClient) Update(ctx context.Context, networkPolicy *networkingv1.NetworkPolicy, opts metav1.UpdateOptions) (*networkingv1.NetworkPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(networkPoliciesResource, c.ClusterPath, c.Namespace, networkPolicy), &networkingv1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.NetworkPolicy), err
-}
-
-func (c *networkPoliciesClient) UpdateStatus(ctx context.Context, networkPolicy *networkingv1.NetworkPolicy, opts metav1.UpdateOptions) (*networkingv1.NetworkPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(networkPoliciesResource, c.ClusterPath, "status", c.Namespace, networkPolicy), &networkingv1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.NetworkPolicy), err
-}
-
-func (c *networkPoliciesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(networkPoliciesResource, c.ClusterPath, c.Namespace, name, opts), &networkingv1.NetworkPolicy{})
-	return err
 }
 
-func (c *networkPoliciesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(networkPoliciesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &networkingv1.NetworkPolicyList{})
-	return err
-}
-
-func (c *networkPoliciesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*networkingv1.NetworkPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(networkPoliciesResource, c.ClusterPath, c.Namespace, name), &networkingv1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.NetworkPolicy), err
-}
-
-// List takes label and field selectors, and returns the list of NetworkPolicies that match those selectors.
-func (c *networkPoliciesClient) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1.NetworkPolicyList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(networkPoliciesResource, networkPoliciesKind, c.ClusterPath, c.Namespace, opts), &networkingv1.NetworkPolicyList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &networkingv1.NetworkPolicyList{ListMeta: obj.(*networkingv1.NetworkPolicyList).ListMeta}
-	for _, item := range obj.(*networkingv1.NetworkPolicyList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *networkPoliciesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(networkPoliciesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *networkPoliciesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*networkingv1.NetworkPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(networkPoliciesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &networkingv1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.NetworkPolicy), err
-}
-
-func (c *networkPoliciesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsnetworkingv1.NetworkPolicyApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1.NetworkPolicy, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(networkPoliciesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &networkingv1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1.NetworkPolicy), err
-}
-
-func (c *networkPoliciesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsnetworkingv1.NetworkPolicyApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1.NetworkPolicy, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(networkPoliciesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &networkingv1.NetworkPolicy{})
-	if obj == nil {
-		return nil, err
+func newFakeNetworkPolicyClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typednetworkingv1.NetworkPolicyInterface {
+	return &networkPolicyScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*networkingv1.NetworkPolicy, *networkingv1.NetworkPolicyList, *v1.NetworkPolicyApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			networkingv1.SchemeGroupVersion.WithResource("networkpolicies"),
+			networkingv1.SchemeGroupVersion.WithKind("NetworkPolicy"),
+			func() *networkingv1.NetworkPolicy { return &networkingv1.NetworkPolicy{} },
+			func() *networkingv1.NetworkPolicyList { return &networkingv1.NetworkPolicyList{} },
+			func(dst, src *networkingv1.NetworkPolicyList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1.NetworkPolicyList) []*networkingv1.NetworkPolicy {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1.NetworkPolicyList, items []*networkingv1.NetworkPolicy) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*networkingv1.NetworkPolicy), err
 }
diff --git a/kubernetes/typed/networking/v1/fake/servicecidr.go b/kubernetes/typed/networking/v1/fake/servicecidr.go
new file mode 100644
index 000000000..1f2baac1a
--- /dev/null
+++ b/kubernetes/typed/networking/v1/fake/servicecidr.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	networkingv1 "k8s.io/api/networking/v1"
+	v1 "k8s.io/client-go/applyconfigurations/networking/v1"
+	typednetworkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
+
+	typedkcpnetworkingv1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// serviceCIDRClusterClient implements ServiceCIDRClusterInterface
+type serviceCIDRClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*networkingv1.ServiceCIDR, *networkingv1.ServiceCIDRList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeServiceCIDRClusterClient(fake *NetworkingV1ClusterClient) typedkcpnetworkingv1.ServiceCIDRClusterInterface {
+	return &serviceCIDRClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*networkingv1.ServiceCIDR, *networkingv1.ServiceCIDRList](
+			fake.Fake,
+			networkingv1.SchemeGroupVersion.WithResource("servicecidrs"),
+			networkingv1.SchemeGroupVersion.WithKind("ServiceCIDR"),
+			func() *networkingv1.ServiceCIDR { return &networkingv1.ServiceCIDR{} },
+			func() *networkingv1.ServiceCIDRList { return &networkingv1.ServiceCIDRList{} },
+			func(dst, src *networkingv1.ServiceCIDRList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1.ServiceCIDRList) []*networkingv1.ServiceCIDR {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1.ServiceCIDRList, items []*networkingv1.ServiceCIDR) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *serviceCIDRClusterClient) Cluster(cluster logicalcluster.Path) typednetworkingv1.ServiceCIDRInterface {
+	return newFakeServiceCIDRClient(c.Fake, cluster)
+}
+
+// serviceCIDRScopedClient implements ServiceCIDRInterface
+type serviceCIDRScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*networkingv1.ServiceCIDR, *networkingv1.ServiceCIDRList, *v1.ServiceCIDRApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeServiceCIDRClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typednetworkingv1.ServiceCIDRInterface {
+	return &serviceCIDRScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*networkingv1.ServiceCIDR, *networkingv1.ServiceCIDRList, *v1.ServiceCIDRApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			networkingv1.SchemeGroupVersion.WithResource("servicecidrs"),
+			networkingv1.SchemeGroupVersion.WithKind("ServiceCIDR"),
+			func() *networkingv1.ServiceCIDR { return &networkingv1.ServiceCIDR{} },
+			func() *networkingv1.ServiceCIDRList { return &networkingv1.ServiceCIDRList{} },
+			func(dst, src *networkingv1.ServiceCIDRList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1.ServiceCIDRList) []*networkingv1.ServiceCIDR {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1.ServiceCIDRList, items []*networkingv1.ServiceCIDR) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/networking/v1/generated_expansion.go b/kubernetes/typed/networking/v1/generated_expansion.go
new file mode 100644
index 000000000..384ea08ce
--- /dev/null
+++ b/kubernetes/typed/networking/v1/generated_expansion.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type IPAddressClusterExpansion interface{}
+
+type IngressClusterExpansion interface{}
+
+type IngressClassClusterExpansion interface{}
+
+type NetworkPolicyClusterExpansion interface{}
+
+type ServiceCIDRClusterExpansion interface{}
diff --git a/kubernetes/typed/networking/v1/ingress.go b/kubernetes/typed/networking/v1/ingress.go
index 3db5621ba..209fc36b2 100644
--- a/kubernetes/typed/networking/v1/ingress.go
+++ b/kubernetes/typed/networking/v1/ingress.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	networkingv1client "k8s.io/client-go/kubernetes/typed/networking/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typednetworkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // IngressesClusterGetter has a method to return a IngressClusterInterface.
@@ -45,10 +42,11 @@ type IngressClusterInterface interface {
 	Cluster(logicalcluster.Path) IngressesNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*networkingv1.IngressList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	IngressClusterExpansion
 }
 
 type ingressesClusterInterface struct {
-	clientCache kcpclient.Cache[*networkingv1client.NetworkingV1Client]
+	clientCache kcpclient.Cache[*typednetworkingv1.NetworkingV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *ingressesClusterInterface) Watch(ctx context.Context, opts metav1.ListO
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Ingresses(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// IngressesNamespacer can scope to objects within a namespace, returning a networkingv1client.IngressInterface.
+// IngressesNamespacer can scope to objects within a namespace, returning a typednetworkingv1.IngressInterface.
 type IngressesNamespacer interface {
-	Namespace(string) networkingv1client.IngressInterface
+	Namespace(string) typednetworkingv1.IngressInterface
 }
 
 type ingressesNamespacer struct {
-	clientCache kcpclient.Cache[*networkingv1client.NetworkingV1Client]
+	clientCache kcpclient.Cache[*typednetworkingv1.NetworkingV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *ingressesNamespacer) Namespace(namespace string) networkingv1client.IngressInterface {
+func (n *ingressesNamespacer) Namespace(namespace string) typednetworkingv1.IngressInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Ingresses(namespace)
 }
diff --git a/kubernetes/typed/networking/v1/ingressclass.go b/kubernetes/typed/networking/v1/ingressclass.go
index 2a4206d88..8c3683965 100644
--- a/kubernetes/typed/networking/v1/ingressclass.go
+++ b/kubernetes/typed/networking/v1/ingressclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apinetworkingv1 "k8s.io/api/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1 "k8s.io/api/networking/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	networkingv1client "k8s.io/client-go/kubernetes/typed/networking/v1"
 )
 
 // IngressClassesClusterGetter has a method to return a IngressClassClusterInterface.
@@ -40,19 +37,20 @@ type IngressClassesClusterGetter interface {
 }
 
 // IngressClassClusterInterface can operate on IngressClasses across all clusters,
-// or scope down to one cluster and return a networkingv1client.IngressClassInterface.
+// or scope down to one cluster and return a networkingv1.IngressClassInterface.
 type IngressClassClusterInterface interface {
-	Cluster(logicalcluster.Path) networkingv1client.IngressClassInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*networkingv1.IngressClassList, error)
+	Cluster(logicalcluster.Path) networkingv1.IngressClassInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apinetworkingv1.IngressClassList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	IngressClassClusterExpansion
 }
 
 type ingressClassesClusterInterface struct {
-	clientCache kcpclient.Cache[*networkingv1client.NetworkingV1Client]
+	clientCache kcpclient.Cache[*networkingv1.NetworkingV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *ingressClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) networkingv1client.IngressClassInterface {
+func (c *ingressClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) networkingv1.IngressClassInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *ingressClassesClusterInterface) Cluster(clusterPath logicalcluster.Path
 }
 
 // List returns the entire collection of all IngressClasses across all clusters.
-func (c *ingressClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1.IngressClassList, error) {
+func (c *ingressClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apinetworkingv1.IngressClassList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).IngressClasses().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/networking/v1/ipaddress.go b/kubernetes/typed/networking/v1/ipaddress.go
new file mode 100644
index 000000000..d7522030d
--- /dev/null
+++ b/kubernetes/typed/networking/v1/ipaddress.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	apinetworkingv1 "k8s.io/api/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// IPAddressesClusterGetter has a method to return a IPAddressClusterInterface.
+// A group's cluster client should implement this interface.
+type IPAddressesClusterGetter interface {
+	IPAddresses() IPAddressClusterInterface
+}
+
+// IPAddressClusterInterface can operate on IPAddresses across all clusters,
+// or scope down to one cluster and return a networkingv1.IPAddressInterface.
+type IPAddressClusterInterface interface {
+	Cluster(logicalcluster.Path) networkingv1.IPAddressInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apinetworkingv1.IPAddressList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	IPAddressClusterExpansion
+}
+
+type iPAddressesClusterInterface struct {
+	clientCache kcpclient.Cache[*networkingv1.NetworkingV1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *iPAddressesClusterInterface) Cluster(clusterPath logicalcluster.Path) networkingv1.IPAddressInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).IPAddresses()
+}
+
+// List returns the entire collection of all IPAddresses across all clusters.
+func (c *iPAddressesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apinetworkingv1.IPAddressList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).IPAddresses().List(ctx, opts)
+}
+
+// Watch begins to watch all IPAddresses across all clusters.
+func (c *iPAddressesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).IPAddresses().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/networking/v1/networking_client.go b/kubernetes/typed/networking/v1/networking_client.go
index 575a462bc..cb0e2d761 100644
--- a/kubernetes/typed/networking/v1/networking_client.go
+++ b/kubernetes/typed/networking/v1/networking_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,31 +14,36 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apinetworkingv1 "k8s.io/api/networking/v1"
+	networkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
-	"k8s.io/client-go/rest"
 )
 
 type NetworkingV1ClusterInterface interface {
 	NetworkingV1ClusterScoper
-	NetworkPoliciesClusterGetter
+	IPAddressesClusterGetter
 	IngressesClusterGetter
 	IngressClassesClusterGetter
+	NetworkPoliciesClusterGetter
+	ServiceCIDRsClusterGetter
 }
 
 type NetworkingV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) networkingv1.NetworkingV1Interface
 }
 
+// NetworkingV1ClusterClient is used to interact with features provided by the networking.k8s.io group.
 type NetworkingV1ClusterClient struct {
 	clientCache kcpclient.Cache[*networkingv1.NetworkingV1Client]
 }
@@ -53,8 +55,8 @@ func (c *NetworkingV1ClusterClient) Cluster(clusterPath logicalcluster.Path) net
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *NetworkingV1ClusterClient) NetworkPolicies() NetworkPolicyClusterInterface {
-	return &networkPoliciesClusterInterface{clientCache: c.clientCache}
+func (c *NetworkingV1ClusterClient) IPAddresses() IPAddressClusterInterface {
+	return &iPAddressesClusterInterface{clientCache: c.clientCache}
 }
 
 func (c *NetworkingV1ClusterClient) Ingresses() IngressClusterInterface {
@@ -65,15 +67,25 @@ func (c *NetworkingV1ClusterClient) IngressClasses() IngressClassClusterInterfac
 	return &ingressClassesClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *NetworkingV1ClusterClient) NetworkPolicies() NetworkPolicyClusterInterface {
+	return &networkPoliciesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *NetworkingV1ClusterClient) ServiceCIDRs() ServiceCIDRClusterInterface {
+	return &serviceCIDRsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new NetworkingV1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*NetworkingV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new NetworkingV1ClusterClient for the given config and http client.
@@ -85,6 +97,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*NetworkingV1Cluster
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &NetworkingV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -97,3 +110,14 @@ func NewForConfigOrDie(c *rest.Config) *NetworkingV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apinetworkingv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/networking/v1/networkpolicy.go b/kubernetes/typed/networking/v1/networkpolicy.go
index 6965ea432..71c403f27 100644
--- a/kubernetes/typed/networking/v1/networkpolicy.go
+++ b/kubernetes/typed/networking/v1/networkpolicy.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	networkingv1client "k8s.io/client-go/kubernetes/typed/networking/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typednetworkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // NetworkPoliciesClusterGetter has a method to return a NetworkPolicyClusterInterface.
@@ -45,10 +42,11 @@ type NetworkPolicyClusterInterface interface {
 	Cluster(logicalcluster.Path) NetworkPoliciesNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*networkingv1.NetworkPolicyList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	NetworkPolicyClusterExpansion
 }
 
 type networkPoliciesClusterInterface struct {
-	clientCache kcpclient.Cache[*networkingv1client.NetworkingV1Client]
+	clientCache kcpclient.Cache[*typednetworkingv1.NetworkingV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *networkPoliciesClusterInterface) Watch(ctx context.Context, opts metav1
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).NetworkPolicies(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// NetworkPoliciesNamespacer can scope to objects within a namespace, returning a networkingv1client.NetworkPolicyInterface.
+// NetworkPoliciesNamespacer can scope to objects within a namespace, returning a typednetworkingv1.NetworkPolicyInterface.
 type NetworkPoliciesNamespacer interface {
-	Namespace(string) networkingv1client.NetworkPolicyInterface
+	Namespace(string) typednetworkingv1.NetworkPolicyInterface
 }
 
 type networkPoliciesNamespacer struct {
-	clientCache kcpclient.Cache[*networkingv1client.NetworkingV1Client]
+	clientCache kcpclient.Cache[*typednetworkingv1.NetworkingV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *networkPoliciesNamespacer) Namespace(namespace string) networkingv1client.NetworkPolicyInterface {
+func (n *networkPoliciesNamespacer) Namespace(namespace string) typednetworkingv1.NetworkPolicyInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).NetworkPolicies(namespace)
 }
diff --git a/kubernetes/typed/networking/v1/servicecidr.go b/kubernetes/typed/networking/v1/servicecidr.go
new file mode 100644
index 000000000..d1da394dc
--- /dev/null
+++ b/kubernetes/typed/networking/v1/servicecidr.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	context "context"
+
+	apinetworkingv1 "k8s.io/api/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1 "k8s.io/client-go/kubernetes/typed/networking/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ServiceCIDRsClusterGetter has a method to return a ServiceCIDRClusterInterface.
+// A group's cluster client should implement this interface.
+type ServiceCIDRsClusterGetter interface {
+	ServiceCIDRs() ServiceCIDRClusterInterface
+}
+
+// ServiceCIDRClusterInterface can operate on ServiceCIDRs across all clusters,
+// or scope down to one cluster and return a networkingv1.ServiceCIDRInterface.
+type ServiceCIDRClusterInterface interface {
+	Cluster(logicalcluster.Path) networkingv1.ServiceCIDRInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apinetworkingv1.ServiceCIDRList, error)
+	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ServiceCIDRClusterExpansion
+}
+
+type serviceCIDRsClusterInterface struct {
+	clientCache kcpclient.Cache[*networkingv1.NetworkingV1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *serviceCIDRsClusterInterface) Cluster(clusterPath logicalcluster.Path) networkingv1.ServiceCIDRInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).ServiceCIDRs()
+}
+
+// List returns the entire collection of all ServiceCIDRs across all clusters.
+func (c *serviceCIDRsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apinetworkingv1.ServiceCIDRList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ServiceCIDRs().List(ctx, opts)
+}
+
+// Watch begins to watch all ServiceCIDRs across all clusters.
+func (c *serviceCIDRsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ServiceCIDRs().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/networking/v1alpha1/clustercidr.go b/kubernetes/typed/networking/v1alpha1/clustercidr.go
deleted file mode 100644
index c1991e959..000000000
--- a/kubernetes/typed/networking/v1alpha1/clustercidr.go
+++ /dev/null
@@ -1,71 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1alpha1 "k8s.io/api/networking/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	networkingv1alpha1client "k8s.io/client-go/kubernetes/typed/networking/v1alpha1"
-)
-
-// ClusterCIDRsClusterGetter has a method to return a ClusterCIDRClusterInterface.
-// A group's cluster client should implement this interface.
-type ClusterCIDRsClusterGetter interface {
-	ClusterCIDRs() ClusterCIDRClusterInterface
-}
-
-// ClusterCIDRClusterInterface can operate on ClusterCIDRs across all clusters,
-// or scope down to one cluster and return a networkingv1alpha1client.ClusterCIDRInterface.
-type ClusterCIDRClusterInterface interface {
-	Cluster(logicalcluster.Path) networkingv1alpha1client.ClusterCIDRInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*networkingv1alpha1.ClusterCIDRList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
-}
-
-type clusterCIDRsClusterInterface struct {
-	clientCache kcpclient.Cache[*networkingv1alpha1client.NetworkingV1alpha1Client]
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *clusterCIDRsClusterInterface) Cluster(clusterPath logicalcluster.Path) networkingv1alpha1client.ClusterCIDRInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return c.clientCache.ClusterOrDie(clusterPath).ClusterCIDRs()
-}
-
-// List returns the entire collection of all ClusterCIDRs across all clusters.
-func (c *clusterCIDRsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1alpha1.ClusterCIDRList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterCIDRs().List(ctx, opts)
-}
-
-// Watch begins to watch all ClusterCIDRs across all clusters.
-func (c *clusterCIDRsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterCIDRs().Watch(ctx, opts)
-}
diff --git a/kubernetes/typed/networking/v1alpha1/doc.go b/kubernetes/typed/networking/v1alpha1/doc.go
new file mode 100644
index 000000000..08b80237c
--- /dev/null
+++ b/kubernetes/typed/networking/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/kubernetes/typed/networking/v1alpha1/fake/clustercidr.go b/kubernetes/typed/networking/v1alpha1/fake/clustercidr.go
deleted file mode 100644
index 964ba9c15..000000000
--- a/kubernetes/typed/networking/v1alpha1/fake/clustercidr.go
+++ /dev/null
@@ -1,202 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1alpha1 "k8s.io/api/networking/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsnetworkingv1alpha1 "k8s.io/client-go/applyconfigurations/networking/v1alpha1"
-	networkingv1alpha1client "k8s.io/client-go/kubernetes/typed/networking/v1alpha1"
-	"k8s.io/client-go/testing"
-
-	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
-)
-
-var clusterCIDRsResource = schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1alpha1", Resource: "clustercidrs"}
-var clusterCIDRsKind = schema.GroupVersionKind{Group: "networking.k8s.io", Version: "v1alpha1", Kind: "ClusterCIDR"}
-
-type clusterCIDRsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *clusterCIDRsClusterClient) Cluster(clusterPath logicalcluster.Path) networkingv1alpha1client.ClusterCIDRInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &clusterCIDRsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ClusterCIDRs that match those selectors across all clusters.
-func (c *clusterCIDRsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1alpha1.ClusterCIDRList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterCIDRsResource, clusterCIDRsKind, logicalcluster.Wildcard, opts), &networkingv1alpha1.ClusterCIDRList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &networkingv1alpha1.ClusterCIDRList{ListMeta: obj.(*networkingv1alpha1.ClusterCIDRList).ListMeta}
-	for _, item := range obj.(*networkingv1alpha1.ClusterCIDRList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested ClusterCIDRs across all clusters.
-func (c *clusterCIDRsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterCIDRsResource, logicalcluster.Wildcard, opts))
-}
-
-type clusterCIDRsClient struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-}
-
-func (c *clusterCIDRsClient) Create(ctx context.Context, clusterCIDR *networkingv1alpha1.ClusterCIDR, opts metav1.CreateOptions) (*networkingv1alpha1.ClusterCIDR, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(clusterCIDRsResource, c.ClusterPath, clusterCIDR), &networkingv1alpha1.ClusterCIDR{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1alpha1.ClusterCIDR), err
-}
-
-func (c *clusterCIDRsClient) Update(ctx context.Context, clusterCIDR *networkingv1alpha1.ClusterCIDR, opts metav1.UpdateOptions) (*networkingv1alpha1.ClusterCIDR, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(clusterCIDRsResource, c.ClusterPath, clusterCIDR), &networkingv1alpha1.ClusterCIDR{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1alpha1.ClusterCIDR), err
-}
-
-func (c *clusterCIDRsClient) UpdateStatus(ctx context.Context, clusterCIDR *networkingv1alpha1.ClusterCIDR, opts metav1.UpdateOptions) (*networkingv1alpha1.ClusterCIDR, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(clusterCIDRsResource, c.ClusterPath, "status", clusterCIDR), &networkingv1alpha1.ClusterCIDR{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1alpha1.ClusterCIDR), err
-}
-
-func (c *clusterCIDRsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(clusterCIDRsResource, c.ClusterPath, name, opts), &networkingv1alpha1.ClusterCIDR{})
-	return err
-}
-
-func (c *clusterCIDRsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(clusterCIDRsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &networkingv1alpha1.ClusterCIDRList{})
-	return err
-}
-
-func (c *clusterCIDRsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*networkingv1alpha1.ClusterCIDR, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(clusterCIDRsResource, c.ClusterPath, name), &networkingv1alpha1.ClusterCIDR{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1alpha1.ClusterCIDR), err
-}
-
-// List takes label and field selectors, and returns the list of ClusterCIDRs that match those selectors.
-func (c *clusterCIDRsClient) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1alpha1.ClusterCIDRList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterCIDRsResource, clusterCIDRsKind, c.ClusterPath, opts), &networkingv1alpha1.ClusterCIDRList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &networkingv1alpha1.ClusterCIDRList{ListMeta: obj.(*networkingv1alpha1.ClusterCIDRList).ListMeta}
-	for _, item := range obj.(*networkingv1alpha1.ClusterCIDRList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *clusterCIDRsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterCIDRsResource, c.ClusterPath, opts))
-}
-
-func (c *clusterCIDRsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*networkingv1alpha1.ClusterCIDR, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterCIDRsResource, c.ClusterPath, name, pt, data, subresources...), &networkingv1alpha1.ClusterCIDR{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1alpha1.ClusterCIDR), err
-}
-
-func (c *clusterCIDRsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsnetworkingv1alpha1.ClusterCIDRApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1alpha1.ClusterCIDR, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterCIDRsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &networkingv1alpha1.ClusterCIDR{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1alpha1.ClusterCIDR), err
-}
-
-func (c *clusterCIDRsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsnetworkingv1alpha1.ClusterCIDRApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1alpha1.ClusterCIDR, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterCIDRsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &networkingv1alpha1.ClusterCIDR{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1alpha1.ClusterCIDR), err
-}
diff --git a/kubernetes/typed/networking/v1alpha1/fake/doc.go b/kubernetes/typed/networking/v1alpha1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/networking/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/networking/v1alpha1/fake/ipaddress.go b/kubernetes/typed/networking/v1alpha1/fake/ipaddress.go
new file mode 100644
index 000000000..38e66e98b
--- /dev/null
+++ b/kubernetes/typed/networking/v1alpha1/fake/ipaddress.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	networkingv1alpha1 "k8s.io/api/networking/v1alpha1"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/networking/v1alpha1"
+	typednetworkingv1alpha1 "k8s.io/client-go/kubernetes/typed/networking/v1alpha1"
+
+	typedkcpnetworkingv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// iPAddressClusterClient implements IPAddressClusterInterface
+type iPAddressClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*networkingv1alpha1.IPAddress, *networkingv1alpha1.IPAddressList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeIPAddressClusterClient(fake *NetworkingV1alpha1ClusterClient) typedkcpnetworkingv1alpha1.IPAddressClusterInterface {
+	return &iPAddressClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*networkingv1alpha1.IPAddress, *networkingv1alpha1.IPAddressList](
+			fake.Fake,
+			networkingv1alpha1.SchemeGroupVersion.WithResource("ipaddresses"),
+			networkingv1alpha1.SchemeGroupVersion.WithKind("IPAddress"),
+			func() *networkingv1alpha1.IPAddress { return &networkingv1alpha1.IPAddress{} },
+			func() *networkingv1alpha1.IPAddressList { return &networkingv1alpha1.IPAddressList{} },
+			func(dst, src *networkingv1alpha1.IPAddressList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1alpha1.IPAddressList) []*networkingv1alpha1.IPAddress {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1alpha1.IPAddressList, items []*networkingv1alpha1.IPAddress) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *iPAddressClusterClient) Cluster(cluster logicalcluster.Path) typednetworkingv1alpha1.IPAddressInterface {
+	return newFakeIPAddressClient(c.Fake, cluster)
+}
+
+// iPAddressScopedClient implements IPAddressInterface
+type iPAddressScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*networkingv1alpha1.IPAddress, *networkingv1alpha1.IPAddressList, *v1alpha1.IPAddressApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeIPAddressClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typednetworkingv1alpha1.IPAddressInterface {
+	return &iPAddressScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*networkingv1alpha1.IPAddress, *networkingv1alpha1.IPAddressList, *v1alpha1.IPAddressApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			networkingv1alpha1.SchemeGroupVersion.WithResource("ipaddresses"),
+			networkingv1alpha1.SchemeGroupVersion.WithKind("IPAddress"),
+			func() *networkingv1alpha1.IPAddress { return &networkingv1alpha1.IPAddress{} },
+			func() *networkingv1alpha1.IPAddressList { return &networkingv1alpha1.IPAddressList{} },
+			func(dst, src *networkingv1alpha1.IPAddressList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1alpha1.IPAddressList) []*networkingv1alpha1.IPAddress {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1alpha1.IPAddressList, items []*networkingv1alpha1.IPAddress) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/networking/v1alpha1/fake/networking_client.go b/kubernetes/typed/networking/v1alpha1/fake/networking_client.go
index 140af964f..49f290404 100644
--- a/kubernetes/typed/networking/v1alpha1/fake/networking_client.go
+++ b/kubernetes/typed/networking/v1alpha1/fake/networking_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1alpha1 "k8s.io/client-go/kubernetes/typed/networking/v1alpha1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpnetworkingv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1alpha1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpnetworkingv1alpha1.NetworkingV1alpha1ClusterInterface = (*NetworkingV1alpha1ClusterClient)(nil)
@@ -44,22 +40,30 @@ func (c *NetworkingV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Pat
 	return &NetworkingV1alpha1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *NetworkingV1alpha1ClusterClient) ClusterCIDRs() kcpnetworkingv1alpha1.ClusterCIDRClusterInterface {
-	return &clusterCIDRsClusterClient{Fake: c.Fake}
+func (c *NetworkingV1alpha1ClusterClient) IPAddresses() kcpnetworkingv1alpha1.IPAddressClusterInterface {
+	return newFakeIPAddressClusterClient(c)
 }
 
-var _ networkingv1alpha1.NetworkingV1alpha1Interface = (*NetworkingV1alpha1Client)(nil)
+func (c *NetworkingV1alpha1ClusterClient) ServiceCIDRs() kcpnetworkingv1alpha1.ServiceCIDRClusterInterface {
+	return newFakeServiceCIDRClusterClient(c)
+}
 
 type NetworkingV1alpha1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *NetworkingV1alpha1Client) IPAddresses() networkingv1alpha1.IPAddressInterface {
+	return newFakeIPAddressClient(c.Fake, c.ClusterPath)
+}
+
+func (c *NetworkingV1alpha1Client) ServiceCIDRs() networkingv1alpha1.ServiceCIDRInterface {
+	return newFakeServiceCIDRClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *NetworkingV1alpha1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *NetworkingV1alpha1Client) ClusterCIDRs() networkingv1alpha1.ClusterCIDRInterface {
-	return &clusterCIDRsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
diff --git a/kubernetes/typed/networking/v1alpha1/fake/servicecidr.go b/kubernetes/typed/networking/v1alpha1/fake/servicecidr.go
new file mode 100644
index 000000000..43c1f0abb
--- /dev/null
+++ b/kubernetes/typed/networking/v1alpha1/fake/servicecidr.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	networkingv1alpha1 "k8s.io/api/networking/v1alpha1"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/networking/v1alpha1"
+	typednetworkingv1alpha1 "k8s.io/client-go/kubernetes/typed/networking/v1alpha1"
+
+	typedkcpnetworkingv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// serviceCIDRClusterClient implements ServiceCIDRClusterInterface
+type serviceCIDRClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*networkingv1alpha1.ServiceCIDR, *networkingv1alpha1.ServiceCIDRList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeServiceCIDRClusterClient(fake *NetworkingV1alpha1ClusterClient) typedkcpnetworkingv1alpha1.ServiceCIDRClusterInterface {
+	return &serviceCIDRClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*networkingv1alpha1.ServiceCIDR, *networkingv1alpha1.ServiceCIDRList](
+			fake.Fake,
+			networkingv1alpha1.SchemeGroupVersion.WithResource("servicecidrs"),
+			networkingv1alpha1.SchemeGroupVersion.WithKind("ServiceCIDR"),
+			func() *networkingv1alpha1.ServiceCIDR { return &networkingv1alpha1.ServiceCIDR{} },
+			func() *networkingv1alpha1.ServiceCIDRList { return &networkingv1alpha1.ServiceCIDRList{} },
+			func(dst, src *networkingv1alpha1.ServiceCIDRList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1alpha1.ServiceCIDRList) []*networkingv1alpha1.ServiceCIDR {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1alpha1.ServiceCIDRList, items []*networkingv1alpha1.ServiceCIDR) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *serviceCIDRClusterClient) Cluster(cluster logicalcluster.Path) typednetworkingv1alpha1.ServiceCIDRInterface {
+	return newFakeServiceCIDRClient(c.Fake, cluster)
+}
+
+// serviceCIDRScopedClient implements ServiceCIDRInterface
+type serviceCIDRScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*networkingv1alpha1.ServiceCIDR, *networkingv1alpha1.ServiceCIDRList, *v1alpha1.ServiceCIDRApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeServiceCIDRClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typednetworkingv1alpha1.ServiceCIDRInterface {
+	return &serviceCIDRScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*networkingv1alpha1.ServiceCIDR, *networkingv1alpha1.ServiceCIDRList, *v1alpha1.ServiceCIDRApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			networkingv1alpha1.SchemeGroupVersion.WithResource("servicecidrs"),
+			networkingv1alpha1.SchemeGroupVersion.WithKind("ServiceCIDR"),
+			func() *networkingv1alpha1.ServiceCIDR { return &networkingv1alpha1.ServiceCIDR{} },
+			func() *networkingv1alpha1.ServiceCIDRList { return &networkingv1alpha1.ServiceCIDRList{} },
+			func(dst, src *networkingv1alpha1.ServiceCIDRList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1alpha1.ServiceCIDRList) []*networkingv1alpha1.ServiceCIDR {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1alpha1.ServiceCIDRList, items []*networkingv1alpha1.ServiceCIDR) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/networking/v1alpha1/generated_expansion.go b/kubernetes/typed/networking/v1alpha1/generated_expansion.go
new file mode 100644
index 000000000..2c80d7e71
--- /dev/null
+++ b/kubernetes/typed/networking/v1alpha1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type IPAddressClusterExpansion interface{}
+
+type ServiceCIDRClusterExpansion interface{}
diff --git a/kubernetes/typed/networking/v1alpha1/ipaddress.go b/kubernetes/typed/networking/v1alpha1/ipaddress.go
new file mode 100644
index 000000000..9fb819838
--- /dev/null
+++ b/kubernetes/typed/networking/v1alpha1/ipaddress.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	apinetworkingv1alpha1 "k8s.io/api/networking/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1alpha1 "k8s.io/client-go/kubernetes/typed/networking/v1alpha1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// IPAddressesClusterGetter has a method to return a IPAddressClusterInterface.
+// A group's cluster client should implement this interface.
+type IPAddressesClusterGetter interface {
+	IPAddresses() IPAddressClusterInterface
+}
+
+// IPAddressClusterInterface can operate on IPAddresses across all clusters,
+// or scope down to one cluster and return a networkingv1alpha1.IPAddressInterface.
+type IPAddressClusterInterface interface {
+	Cluster(logicalcluster.Path) networkingv1alpha1.IPAddressInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apinetworkingv1alpha1.IPAddressList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	IPAddressClusterExpansion
+}
+
+type iPAddressesClusterInterface struct {
+	clientCache kcpclient.Cache[*networkingv1alpha1.NetworkingV1alpha1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *iPAddressesClusterInterface) Cluster(clusterPath logicalcluster.Path) networkingv1alpha1.IPAddressInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).IPAddresses()
+}
+
+// List returns the entire collection of all IPAddresses across all clusters.
+func (c *iPAddressesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apinetworkingv1alpha1.IPAddressList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).IPAddresses().List(ctx, opts)
+}
+
+// Watch begins to watch all IPAddresses across all clusters.
+func (c *iPAddressesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).IPAddresses().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/networking/v1alpha1/networking_client.go b/kubernetes/typed/networking/v1alpha1/networking_client.go
index 0ffe7505a..f33aec75a 100644
--- a/kubernetes/typed/networking/v1alpha1/networking_client.go
+++ b/kubernetes/typed/networking/v1alpha1/networking_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,29 +14,33 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apinetworkingv1alpha1 "k8s.io/api/networking/v1alpha1"
+	networkingv1alpha1 "k8s.io/client-go/kubernetes/typed/networking/v1alpha1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1alpha1 "k8s.io/client-go/kubernetes/typed/networking/v1alpha1"
-	"k8s.io/client-go/rest"
 )
 
 type NetworkingV1alpha1ClusterInterface interface {
 	NetworkingV1alpha1ClusterScoper
-	ClusterCIDRsClusterGetter
+	IPAddressesClusterGetter
+	ServiceCIDRsClusterGetter
 }
 
 type NetworkingV1alpha1ClusterScoper interface {
 	Cluster(logicalcluster.Path) networkingv1alpha1.NetworkingV1alpha1Interface
 }
 
+// NetworkingV1alpha1ClusterClient is used to interact with features provided by the networking.k8s.io group.
 type NetworkingV1alpha1ClusterClient struct {
 	clientCache kcpclient.Cache[*networkingv1alpha1.NetworkingV1alpha1Client]
 }
@@ -51,19 +52,25 @@ func (c *NetworkingV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Pat
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *NetworkingV1alpha1ClusterClient) ClusterCIDRs() ClusterCIDRClusterInterface {
-	return &clusterCIDRsClusterInterface{clientCache: c.clientCache}
+func (c *NetworkingV1alpha1ClusterClient) IPAddresses() IPAddressClusterInterface {
+	return &iPAddressesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *NetworkingV1alpha1ClusterClient) ServiceCIDRs() ServiceCIDRClusterInterface {
+	return &serviceCIDRsClusterInterface{clientCache: c.clientCache}
 }
 
 // NewForConfig creates a new NetworkingV1alpha1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*NetworkingV1alpha1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new NetworkingV1alpha1ClusterClient for the given config and http client.
@@ -75,6 +82,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*NetworkingV1alpha1C
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &NetworkingV1alpha1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +95,14 @@ func NewForConfigOrDie(c *rest.Config) *NetworkingV1alpha1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apinetworkingv1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/networking/v1alpha1/servicecidr.go b/kubernetes/typed/networking/v1alpha1/servicecidr.go
new file mode 100644
index 000000000..80ad0abf5
--- /dev/null
+++ b/kubernetes/typed/networking/v1alpha1/servicecidr.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	apinetworkingv1alpha1 "k8s.io/api/networking/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1alpha1 "k8s.io/client-go/kubernetes/typed/networking/v1alpha1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ServiceCIDRsClusterGetter has a method to return a ServiceCIDRClusterInterface.
+// A group's cluster client should implement this interface.
+type ServiceCIDRsClusterGetter interface {
+	ServiceCIDRs() ServiceCIDRClusterInterface
+}
+
+// ServiceCIDRClusterInterface can operate on ServiceCIDRs across all clusters,
+// or scope down to one cluster and return a networkingv1alpha1.ServiceCIDRInterface.
+type ServiceCIDRClusterInterface interface {
+	Cluster(logicalcluster.Path) networkingv1alpha1.ServiceCIDRInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apinetworkingv1alpha1.ServiceCIDRList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ServiceCIDRClusterExpansion
+}
+
+type serviceCIDRsClusterInterface struct {
+	clientCache kcpclient.Cache[*networkingv1alpha1.NetworkingV1alpha1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *serviceCIDRsClusterInterface) Cluster(clusterPath logicalcluster.Path) networkingv1alpha1.ServiceCIDRInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).ServiceCIDRs()
+}
+
+// List returns the entire collection of all ServiceCIDRs across all clusters.
+func (c *serviceCIDRsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apinetworkingv1alpha1.ServiceCIDRList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ServiceCIDRs().List(ctx, opts)
+}
+
+// Watch begins to watch all ServiceCIDRs across all clusters.
+func (c *serviceCIDRsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ServiceCIDRs().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/networking/v1beta1/doc.go b/kubernetes/typed/networking/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/networking/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/networking/v1beta1/fake/doc.go b/kubernetes/typed/networking/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/networking/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/networking/v1beta1/fake/ingress.go b/kubernetes/typed/networking/v1beta1/fake/ingress.go
index a8af2e884..eafea60c9 100644
--- a/kubernetes/typed/networking/v1beta1/fake/ingress.go
+++ b/kubernetes/typed/networking/v1beta1/fake/ingress.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1beta1 "k8s.io/api/networking/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsnetworkingv1beta1 "k8s.io/client-go/applyconfigurations/networking/v1beta1"
-	networkingv1beta1client "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/networking/v1beta1"
+	typednetworkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
 
-	kcpnetworkingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1beta1"
+	typedkcpnetworkingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var ingressesResource = schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1beta1", Resource: "ingresses"}
-var ingressesKind = schema.GroupVersionKind{Group: "networking.k8s.io", Version: "v1beta1", Kind: "Ingress"}
-
-type ingressesClusterClient struct {
-	*kcptesting.Fake
+// ingressClusterClient implements IngressClusterInterface
+type ingressClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*networkingv1beta1.Ingress, *networkingv1beta1.IngressList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *ingressesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpnetworkingv1beta1.IngressesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &ingressesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Ingresses that match those selectors across all clusters.
-func (c *ingressesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1beta1.IngressList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(ingressesResource, ingressesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &networkingv1beta1.IngressList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeIngressClusterClient(fake *NetworkingV1beta1ClusterClient) typedkcpnetworkingv1beta1.IngressClusterInterface {
+	return &ingressClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*networkingv1beta1.Ingress, *networkingv1beta1.IngressList](
+			fake.Fake,
+			networkingv1beta1.SchemeGroupVersion.WithResource("ingresses"),
+			networkingv1beta1.SchemeGroupVersion.WithKind("Ingress"),
+			func() *networkingv1beta1.Ingress { return &networkingv1beta1.Ingress{} },
+			func() *networkingv1beta1.IngressList { return &networkingv1beta1.IngressList{} },
+			func(dst, src *networkingv1beta1.IngressList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1beta1.IngressList) []*networkingv1beta1.Ingress {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1beta1.IngressList, items []*networkingv1beta1.Ingress) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &networkingv1beta1.IngressList{ListMeta: obj.(*networkingv1beta1.IngressList).ListMeta}
-	for _, item := range obj.(*networkingv1beta1.IngressList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Ingresses across all clusters.
-func (c *ingressesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(ingressesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *ingressClusterClient) Cluster(cluster logicalcluster.Path) typedkcpnetworkingv1beta1.IngressesNamespacer {
+	return &ingressNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type ingressesNamespacer struct {
+type ingressNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *ingressesNamespacer) Namespace(namespace string) networkingv1beta1client.IngressInterface {
-	return &ingressesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *ingressNamespacer) Namespace(namespace string) typednetworkingv1beta1.IngressInterface {
+	return newFakeIngressClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type ingressesClient struct {
-	*kcptesting.Fake
+// ingressScopedClient implements IngressInterface
+type ingressScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*networkingv1beta1.Ingress, *networkingv1beta1.IngressList, *v1beta1.IngressApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *ingressesClient) Create(ctx context.Context, ingress *networkingv1beta1.Ingress, opts metav1.CreateOptions) (*networkingv1beta1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(ingressesResource, c.ClusterPath, c.Namespace, ingress), &networkingv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1beta1.Ingress), err
-}
-
-func (c *ingressesClient) Update(ctx context.Context, ingress *networkingv1beta1.Ingress, opts metav1.UpdateOptions) (*networkingv1beta1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(ingressesResource, c.ClusterPath, c.Namespace, ingress), &networkingv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1beta1.Ingress), err
-}
-
-func (c *ingressesClient) UpdateStatus(ctx context.Context, ingress *networkingv1beta1.Ingress, opts metav1.UpdateOptions) (*networkingv1beta1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(ingressesResource, c.ClusterPath, "status", c.Namespace, ingress), &networkingv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1beta1.Ingress), err
-}
-
-func (c *ingressesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(ingressesResource, c.ClusterPath, c.Namespace, name, opts), &networkingv1beta1.Ingress{})
-	return err
 }
 
-func (c *ingressesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(ingressesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &networkingv1beta1.IngressList{})
-	return err
-}
-
-func (c *ingressesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*networkingv1beta1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(ingressesResource, c.ClusterPath, c.Namespace, name), &networkingv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1beta1.Ingress), err
-}
-
-// List takes label and field selectors, and returns the list of Ingresses that match those selectors.
-func (c *ingressesClient) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1beta1.IngressList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(ingressesResource, ingressesKind, c.ClusterPath, c.Namespace, opts), &networkingv1beta1.IngressList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &networkingv1beta1.IngressList{ListMeta: obj.(*networkingv1beta1.IngressList).ListMeta}
-	for _, item := range obj.(*networkingv1beta1.IngressList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *ingressesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(ingressesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *ingressesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*networkingv1beta1.Ingress, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(ingressesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &networkingv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1beta1.Ingress), err
-}
-
-func (c *ingressesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsnetworkingv1beta1.IngressApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1beta1.Ingress, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(ingressesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &networkingv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1beta1.Ingress), err
-}
-
-func (c *ingressesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsnetworkingv1beta1.IngressApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1beta1.Ingress, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(ingressesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &networkingv1beta1.Ingress{})
-	if obj == nil {
-		return nil, err
+func newFakeIngressClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typednetworkingv1beta1.IngressInterface {
+	return &ingressScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*networkingv1beta1.Ingress, *networkingv1beta1.IngressList, *v1beta1.IngressApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			networkingv1beta1.SchemeGroupVersion.WithResource("ingresses"),
+			networkingv1beta1.SchemeGroupVersion.WithKind("Ingress"),
+			func() *networkingv1beta1.Ingress { return &networkingv1beta1.Ingress{} },
+			func() *networkingv1beta1.IngressList { return &networkingv1beta1.IngressList{} },
+			func(dst, src *networkingv1beta1.IngressList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1beta1.IngressList) []*networkingv1beta1.Ingress {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1beta1.IngressList, items []*networkingv1beta1.Ingress) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*networkingv1beta1.Ingress), err
 }
diff --git a/kubernetes/typed/networking/v1beta1/fake/ingressclass.go b/kubernetes/typed/networking/v1beta1/fake/ingressclass.go
index ec3e6d9de..7f8dc6403 100644
--- a/kubernetes/typed/networking/v1beta1/fake/ingressclass.go
+++ b/kubernetes/typed/networking/v1beta1/fake/ingressclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1beta1 "k8s.io/api/networking/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsnetworkingv1beta1 "k8s.io/client-go/applyconfigurations/networking/v1beta1"
-	networkingv1beta1client "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/networking/v1beta1"
+	typednetworkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
 
+	typedkcpnetworkingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var ingressClassesResource = schema.GroupVersionResource{Group: "networking.k8s.io", Version: "v1beta1", Resource: "ingressclasses"}
-var ingressClassesKind = schema.GroupVersionKind{Group: "networking.k8s.io", Version: "v1beta1", Kind: "IngressClass"}
-
-type ingressClassesClusterClient struct {
-	*kcptesting.Fake
+// ingressClassClusterClient implements IngressClassClusterInterface
+type ingressClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*networkingv1beta1.IngressClass, *networkingv1beta1.IngressClassList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *ingressClassesClusterClient) Cluster(clusterPath logicalcluster.Path) networkingv1beta1client.IngressClassInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &ingressClassesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of IngressClasses that match those selectors across all clusters.
-func (c *ingressClassesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1beta1.IngressClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(ingressClassesResource, ingressClassesKind, logicalcluster.Wildcard, opts), &networkingv1beta1.IngressClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &networkingv1beta1.IngressClassList{ListMeta: obj.(*networkingv1beta1.IngressClassList).ListMeta}
-	for _, item := range obj.(*networkingv1beta1.IngressClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeIngressClassClusterClient(fake *NetworkingV1beta1ClusterClient) typedkcpnetworkingv1beta1.IngressClassClusterInterface {
+	return &ingressClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*networkingv1beta1.IngressClass, *networkingv1beta1.IngressClassList](
+			fake.Fake,
+			networkingv1beta1.SchemeGroupVersion.WithResource("ingressclasses"),
+			networkingv1beta1.SchemeGroupVersion.WithKind("IngressClass"),
+			func() *networkingv1beta1.IngressClass { return &networkingv1beta1.IngressClass{} },
+			func() *networkingv1beta1.IngressClassList { return &networkingv1beta1.IngressClassList{} },
+			func(dst, src *networkingv1beta1.IngressClassList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1beta1.IngressClassList) []*networkingv1beta1.IngressClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1beta1.IngressClassList, items []*networkingv1beta1.IngressClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested IngressClasses across all clusters.
-func (c *ingressClassesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(ingressClassesResource, logicalcluster.Wildcard, opts))
+func (c *ingressClassClusterClient) Cluster(cluster logicalcluster.Path) typednetworkingv1beta1.IngressClassInterface {
+	return newFakeIngressClassClient(c.Fake, cluster)
 }
 
-type ingressClassesClient struct {
-	*kcptesting.Fake
+// ingressClassScopedClient implements IngressClassInterface
+type ingressClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*networkingv1beta1.IngressClass, *networkingv1beta1.IngressClassList, *v1beta1.IngressClassApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *ingressClassesClient) Create(ctx context.Context, ingressClass *networkingv1beta1.IngressClass, opts metav1.CreateOptions) (*networkingv1beta1.IngressClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(ingressClassesResource, c.ClusterPath, ingressClass), &networkingv1beta1.IngressClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1beta1.IngressClass), err
-}
-
-func (c *ingressClassesClient) Update(ctx context.Context, ingressClass *networkingv1beta1.IngressClass, opts metav1.UpdateOptions) (*networkingv1beta1.IngressClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(ingressClassesResource, c.ClusterPath, ingressClass), &networkingv1beta1.IngressClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1beta1.IngressClass), err
-}
-
-func (c *ingressClassesClient) UpdateStatus(ctx context.Context, ingressClass *networkingv1beta1.IngressClass, opts metav1.UpdateOptions) (*networkingv1beta1.IngressClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(ingressClassesResource, c.ClusterPath, "status", ingressClass), &networkingv1beta1.IngressClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1beta1.IngressClass), err
-}
-
-func (c *ingressClassesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(ingressClassesResource, c.ClusterPath, name, opts), &networkingv1beta1.IngressClass{})
-	return err
-}
-
-func (c *ingressClassesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(ingressClassesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &networkingv1beta1.IngressClassList{})
-	return err
-}
-
-func (c *ingressClassesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*networkingv1beta1.IngressClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(ingressClassesResource, c.ClusterPath, name), &networkingv1beta1.IngressClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1beta1.IngressClass), err
-}
-
-// List takes label and field selectors, and returns the list of IngressClasses that match those selectors.
-func (c *ingressClassesClient) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1beta1.IngressClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(ingressClassesResource, ingressClassesKind, c.ClusterPath, opts), &networkingv1beta1.IngressClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &networkingv1beta1.IngressClassList{ListMeta: obj.(*networkingv1beta1.IngressClassList).ListMeta}
-	for _, item := range obj.(*networkingv1beta1.IngressClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *ingressClassesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(ingressClassesResource, c.ClusterPath, opts))
-}
-
-func (c *ingressClassesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*networkingv1beta1.IngressClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(ingressClassesResource, c.ClusterPath, name, pt, data, subresources...), &networkingv1beta1.IngressClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1beta1.IngressClass), err
-}
-
-func (c *ingressClassesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsnetworkingv1beta1.IngressClassApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1beta1.IngressClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(ingressClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &networkingv1beta1.IngressClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*networkingv1beta1.IngressClass), err
-}
-
-func (c *ingressClassesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsnetworkingv1beta1.IngressClassApplyConfiguration, opts metav1.ApplyOptions) (*networkingv1beta1.IngressClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(ingressClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &networkingv1beta1.IngressClass{})
-	if obj == nil {
-		return nil, err
+func newFakeIngressClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typednetworkingv1beta1.IngressClassInterface {
+	return &ingressClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*networkingv1beta1.IngressClass, *networkingv1beta1.IngressClassList, *v1beta1.IngressClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			networkingv1beta1.SchemeGroupVersion.WithResource("ingressclasses"),
+			networkingv1beta1.SchemeGroupVersion.WithKind("IngressClass"),
+			func() *networkingv1beta1.IngressClass { return &networkingv1beta1.IngressClass{} },
+			func() *networkingv1beta1.IngressClassList { return &networkingv1beta1.IngressClassList{} },
+			func(dst, src *networkingv1beta1.IngressClassList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1beta1.IngressClassList) []*networkingv1beta1.IngressClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1beta1.IngressClassList, items []*networkingv1beta1.IngressClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*networkingv1beta1.IngressClass), err
 }
diff --git a/kubernetes/typed/networking/v1beta1/fake/ipaddress.go b/kubernetes/typed/networking/v1beta1/fake/ipaddress.go
new file mode 100644
index 000000000..42d78648d
--- /dev/null
+++ b/kubernetes/typed/networking/v1beta1/fake/ipaddress.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	networkingv1beta1 "k8s.io/api/networking/v1beta1"
+	v1beta1 "k8s.io/client-go/applyconfigurations/networking/v1beta1"
+	typednetworkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
+
+	typedkcpnetworkingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// iPAddressClusterClient implements IPAddressClusterInterface
+type iPAddressClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*networkingv1beta1.IPAddress, *networkingv1beta1.IPAddressList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeIPAddressClusterClient(fake *NetworkingV1beta1ClusterClient) typedkcpnetworkingv1beta1.IPAddressClusterInterface {
+	return &iPAddressClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*networkingv1beta1.IPAddress, *networkingv1beta1.IPAddressList](
+			fake.Fake,
+			networkingv1beta1.SchemeGroupVersion.WithResource("ipaddresses"),
+			networkingv1beta1.SchemeGroupVersion.WithKind("IPAddress"),
+			func() *networkingv1beta1.IPAddress { return &networkingv1beta1.IPAddress{} },
+			func() *networkingv1beta1.IPAddressList { return &networkingv1beta1.IPAddressList{} },
+			func(dst, src *networkingv1beta1.IPAddressList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1beta1.IPAddressList) []*networkingv1beta1.IPAddress {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1beta1.IPAddressList, items []*networkingv1beta1.IPAddress) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *iPAddressClusterClient) Cluster(cluster logicalcluster.Path) typednetworkingv1beta1.IPAddressInterface {
+	return newFakeIPAddressClient(c.Fake, cluster)
+}
+
+// iPAddressScopedClient implements IPAddressInterface
+type iPAddressScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*networkingv1beta1.IPAddress, *networkingv1beta1.IPAddressList, *v1beta1.IPAddressApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeIPAddressClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typednetworkingv1beta1.IPAddressInterface {
+	return &iPAddressScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*networkingv1beta1.IPAddress, *networkingv1beta1.IPAddressList, *v1beta1.IPAddressApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			networkingv1beta1.SchemeGroupVersion.WithResource("ipaddresses"),
+			networkingv1beta1.SchemeGroupVersion.WithKind("IPAddress"),
+			func() *networkingv1beta1.IPAddress { return &networkingv1beta1.IPAddress{} },
+			func() *networkingv1beta1.IPAddressList { return &networkingv1beta1.IPAddressList{} },
+			func(dst, src *networkingv1beta1.IPAddressList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1beta1.IPAddressList) []*networkingv1beta1.IPAddress {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1beta1.IPAddressList, items []*networkingv1beta1.IPAddress) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/networking/v1beta1/fake/networking_client.go b/kubernetes/typed/networking/v1beta1/fake/networking_client.go
index d14a8d75a..567acce14 100644
--- a/kubernetes/typed/networking/v1beta1/fake/networking_client.go
+++ b/kubernetes/typed/networking/v1beta1/fake/networking_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpnetworkingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpnetworkingv1beta1.NetworkingV1beta1ClusterInterface = (*NetworkingV1beta1ClusterClient)(nil)
@@ -44,30 +40,46 @@ func (c *NetworkingV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path
 	return &NetworkingV1beta1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
+func (c *NetworkingV1beta1ClusterClient) IPAddresses() kcpnetworkingv1beta1.IPAddressClusterInterface {
+	return newFakeIPAddressClusterClient(c)
+}
+
 func (c *NetworkingV1beta1ClusterClient) Ingresses() kcpnetworkingv1beta1.IngressClusterInterface {
-	return &ingressesClusterClient{Fake: c.Fake}
+	return newFakeIngressClusterClient(c)
 }
 
 func (c *NetworkingV1beta1ClusterClient) IngressClasses() kcpnetworkingv1beta1.IngressClassClusterInterface {
-	return &ingressClassesClusterClient{Fake: c.Fake}
+	return newFakeIngressClassClusterClient(c)
 }
 
-var _ networkingv1beta1.NetworkingV1beta1Interface = (*NetworkingV1beta1Client)(nil)
+func (c *NetworkingV1beta1ClusterClient) ServiceCIDRs() kcpnetworkingv1beta1.ServiceCIDRClusterInterface {
+	return newFakeServiceCIDRClusterClient(c)
+}
 
 type NetworkingV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *NetworkingV1beta1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *NetworkingV1beta1Client) IPAddresses() networkingv1beta1.IPAddressInterface {
+	return newFakeIPAddressClient(c.Fake, c.ClusterPath)
 }
 
 func (c *NetworkingV1beta1Client) Ingresses(namespace string) networkingv1beta1.IngressInterface {
-	return &ingressesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+	return newFakeIngressClient(c.Fake, namespace, c.ClusterPath)
 }
 
 func (c *NetworkingV1beta1Client) IngressClasses() networkingv1beta1.IngressClassInterface {
-	return &ingressClassesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakeIngressClassClient(c.Fake, c.ClusterPath)
+}
+
+func (c *NetworkingV1beta1Client) ServiceCIDRs() networkingv1beta1.ServiceCIDRInterface {
+	return newFakeServiceCIDRClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *NetworkingV1beta1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/networking/v1beta1/fake/servicecidr.go b/kubernetes/typed/networking/v1beta1/fake/servicecidr.go
new file mode 100644
index 000000000..17c7cf711
--- /dev/null
+++ b/kubernetes/typed/networking/v1beta1/fake/servicecidr.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	networkingv1beta1 "k8s.io/api/networking/v1beta1"
+	v1beta1 "k8s.io/client-go/applyconfigurations/networking/v1beta1"
+	typednetworkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
+
+	typedkcpnetworkingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/networking/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// serviceCIDRClusterClient implements ServiceCIDRClusterInterface
+type serviceCIDRClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*networkingv1beta1.ServiceCIDR, *networkingv1beta1.ServiceCIDRList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeServiceCIDRClusterClient(fake *NetworkingV1beta1ClusterClient) typedkcpnetworkingv1beta1.ServiceCIDRClusterInterface {
+	return &serviceCIDRClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*networkingv1beta1.ServiceCIDR, *networkingv1beta1.ServiceCIDRList](
+			fake.Fake,
+			networkingv1beta1.SchemeGroupVersion.WithResource("servicecidrs"),
+			networkingv1beta1.SchemeGroupVersion.WithKind("ServiceCIDR"),
+			func() *networkingv1beta1.ServiceCIDR { return &networkingv1beta1.ServiceCIDR{} },
+			func() *networkingv1beta1.ServiceCIDRList { return &networkingv1beta1.ServiceCIDRList{} },
+			func(dst, src *networkingv1beta1.ServiceCIDRList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1beta1.ServiceCIDRList) []*networkingv1beta1.ServiceCIDR {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1beta1.ServiceCIDRList, items []*networkingv1beta1.ServiceCIDR) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *serviceCIDRClusterClient) Cluster(cluster logicalcluster.Path) typednetworkingv1beta1.ServiceCIDRInterface {
+	return newFakeServiceCIDRClient(c.Fake, cluster)
+}
+
+// serviceCIDRScopedClient implements ServiceCIDRInterface
+type serviceCIDRScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*networkingv1beta1.ServiceCIDR, *networkingv1beta1.ServiceCIDRList, *v1beta1.ServiceCIDRApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeServiceCIDRClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typednetworkingv1beta1.ServiceCIDRInterface {
+	return &serviceCIDRScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*networkingv1beta1.ServiceCIDR, *networkingv1beta1.ServiceCIDRList, *v1beta1.ServiceCIDRApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			networkingv1beta1.SchemeGroupVersion.WithResource("servicecidrs"),
+			networkingv1beta1.SchemeGroupVersion.WithKind("ServiceCIDR"),
+			func() *networkingv1beta1.ServiceCIDR { return &networkingv1beta1.ServiceCIDR{} },
+			func() *networkingv1beta1.ServiceCIDRList { return &networkingv1beta1.ServiceCIDRList{} },
+			func(dst, src *networkingv1beta1.ServiceCIDRList) { dst.ListMeta = src.ListMeta },
+			func(list *networkingv1beta1.ServiceCIDRList) []*networkingv1beta1.ServiceCIDR {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *networkingv1beta1.ServiceCIDRList, items []*networkingv1beta1.ServiceCIDR) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/networking/v1beta1/generated_expansion.go b/kubernetes/typed/networking/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..244d7979f
--- /dev/null
+++ b/kubernetes/typed/networking/v1beta1/generated_expansion.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type IPAddressClusterExpansion interface{}
+
+type IngressClusterExpansion interface{}
+
+type IngressClassClusterExpansion interface{}
+
+type ServiceCIDRClusterExpansion interface{}
diff --git a/kubernetes/typed/networking/v1beta1/ingress.go b/kubernetes/typed/networking/v1beta1/ingress.go
index 339781673..e13d02bbe 100644
--- a/kubernetes/typed/networking/v1beta1/ingress.go
+++ b/kubernetes/typed/networking/v1beta1/ingress.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	networkingv1beta1 "k8s.io/api/networking/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typednetworkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1beta1 "k8s.io/api/networking/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	networkingv1beta1client "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
 )
 
 // IngressesClusterGetter has a method to return a IngressClusterInterface.
@@ -43,12 +40,13 @@ type IngressesClusterGetter interface {
 // or scope down to one cluster and return a IngressesNamespacer.
 type IngressClusterInterface interface {
 	Cluster(logicalcluster.Path) IngressesNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*networkingv1beta1.IngressList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*networkingv1beta1.IngressList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	IngressClusterExpansion
 }
 
 type ingressesClusterInterface struct {
-	clientCache kcpclient.Cache[*networkingv1beta1client.NetworkingV1beta1Client]
+	clientCache kcpclient.Cache[*typednetworkingv1beta1.NetworkingV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *ingressesClusterInterface) Cluster(clusterPath logicalcluster.Path) Ing
 }
 
 // List returns the entire collection of all Ingresses across all clusters.
-func (c *ingressesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1beta1.IngressList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Ingresses(metav1.NamespaceAll).List(ctx, opts)
+func (c *ingressesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*networkingv1beta1.IngressList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Ingresses(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all Ingresses across all clusters.
-func (c *ingressesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Ingresses(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *ingressesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Ingresses(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// IngressesNamespacer can scope to objects within a namespace, returning a networkingv1beta1client.IngressInterface.
+// IngressesNamespacer can scope to objects within a namespace, returning a typednetworkingv1beta1.IngressInterface.
 type IngressesNamespacer interface {
-	Namespace(string) networkingv1beta1client.IngressInterface
+	Namespace(string) typednetworkingv1beta1.IngressInterface
 }
 
 type ingressesNamespacer struct {
-	clientCache kcpclient.Cache[*networkingv1beta1client.NetworkingV1beta1Client]
+	clientCache kcpclient.Cache[*typednetworkingv1beta1.NetworkingV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *ingressesNamespacer) Namespace(namespace string) networkingv1beta1client.IngressInterface {
+func (n *ingressesNamespacer) Namespace(namespace string) typednetworkingv1beta1.IngressInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Ingresses(namespace)
 }
diff --git a/kubernetes/typed/networking/v1beta1/ingressclass.go b/kubernetes/typed/networking/v1beta1/ingressclass.go
index 2aa2f47ea..08b34984d 100644
--- a/kubernetes/typed/networking/v1beta1/ingressclass.go
+++ b/kubernetes/typed/networking/v1beta1/ingressclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apinetworkingv1beta1 "k8s.io/api/networking/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1beta1 "k8s.io/api/networking/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	networkingv1beta1client "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
 )
 
 // IngressClassesClusterGetter has a method to return a IngressClassClusterInterface.
@@ -40,19 +37,20 @@ type IngressClassesClusterGetter interface {
 }
 
 // IngressClassClusterInterface can operate on IngressClasses across all clusters,
-// or scope down to one cluster and return a networkingv1beta1client.IngressClassInterface.
+// or scope down to one cluster and return a networkingv1beta1.IngressClassInterface.
 type IngressClassClusterInterface interface {
-	Cluster(logicalcluster.Path) networkingv1beta1client.IngressClassInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*networkingv1beta1.IngressClassList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) networkingv1beta1.IngressClassInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apinetworkingv1beta1.IngressClassList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	IngressClassClusterExpansion
 }
 
 type ingressClassesClusterInterface struct {
-	clientCache kcpclient.Cache[*networkingv1beta1client.NetworkingV1beta1Client]
+	clientCache kcpclient.Cache[*networkingv1beta1.NetworkingV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *ingressClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) networkingv1beta1client.IngressClassInterface {
+func (c *ingressClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) networkingv1beta1.IngressClassInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *ingressClassesClusterInterface) Cluster(clusterPath logicalcluster.Path
 }
 
 // List returns the entire collection of all IngressClasses across all clusters.
-func (c *ingressClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*networkingv1beta1.IngressClassList, error) {
+func (c *ingressClassesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apinetworkingv1beta1.IngressClassList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).IngressClasses().List(ctx, opts)
 }
 
 // Watch begins to watch all IngressClasses across all clusters.
-func (c *ingressClassesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *ingressClassesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).IngressClasses().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/networking/v1beta1/ipaddress.go b/kubernetes/typed/networking/v1beta1/ipaddress.go
new file mode 100644
index 000000000..e9c219ebc
--- /dev/null
+++ b/kubernetes/typed/networking/v1beta1/ipaddress.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	apinetworkingv1beta1 "k8s.io/api/networking/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// IPAddressesClusterGetter has a method to return a IPAddressClusterInterface.
+// A group's cluster client should implement this interface.
+type IPAddressesClusterGetter interface {
+	IPAddresses() IPAddressClusterInterface
+}
+
+// IPAddressClusterInterface can operate on IPAddresses across all clusters,
+// or scope down to one cluster and return a networkingv1beta1.IPAddressInterface.
+type IPAddressClusterInterface interface {
+	Cluster(logicalcluster.Path) networkingv1beta1.IPAddressInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apinetworkingv1beta1.IPAddressList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	IPAddressClusterExpansion
+}
+
+type iPAddressesClusterInterface struct {
+	clientCache kcpclient.Cache[*networkingv1beta1.NetworkingV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *iPAddressesClusterInterface) Cluster(clusterPath logicalcluster.Path) networkingv1beta1.IPAddressInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).IPAddresses()
+}
+
+// List returns the entire collection of all IPAddresses across all clusters.
+func (c *iPAddressesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apinetworkingv1beta1.IPAddressList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).IPAddresses().List(ctx, opts)
+}
+
+// Watch begins to watch all IPAddresses across all clusters.
+func (c *iPAddressesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).IPAddresses().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/networking/v1beta1/networking_client.go b/kubernetes/typed/networking/v1beta1/networking_client.go
index 8337773db..a700ebde7 100644
--- a/kubernetes/typed/networking/v1beta1/networking_client.go
+++ b/kubernetes/typed/networking/v1beta1/networking_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,35 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apinetworkingv1beta1 "k8s.io/api/networking/v1beta1"
+	networkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type NetworkingV1beta1ClusterInterface interface {
 	NetworkingV1beta1ClusterScoper
+	IPAddressesClusterGetter
 	IngressesClusterGetter
 	IngressClassesClusterGetter
+	ServiceCIDRsClusterGetter
 }
 
 type NetworkingV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) networkingv1beta1.NetworkingV1beta1Interface
 }
 
+// NetworkingV1beta1ClusterClient is used to interact with features provided by the networking.k8s.io group.
 type NetworkingV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*networkingv1beta1.NetworkingV1beta1Client]
 }
@@ -52,6 +54,10 @@ func (c *NetworkingV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
+func (c *NetworkingV1beta1ClusterClient) IPAddresses() IPAddressClusterInterface {
+	return &iPAddressesClusterInterface{clientCache: c.clientCache}
+}
+
 func (c *NetworkingV1beta1ClusterClient) Ingresses() IngressClusterInterface {
 	return &ingressesClusterInterface{clientCache: c.clientCache}
 }
@@ -60,15 +66,21 @@ func (c *NetworkingV1beta1ClusterClient) IngressClasses() IngressClassClusterInt
 	return &ingressClassesClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *NetworkingV1beta1ClusterClient) ServiceCIDRs() ServiceCIDRClusterInterface {
+	return &serviceCIDRsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new NetworkingV1beta1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*NetworkingV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new NetworkingV1beta1ClusterClient for the given config and http client.
@@ -80,6 +92,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*NetworkingV1beta1Cl
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &NetworkingV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -92,3 +105,14 @@ func NewForConfigOrDie(c *rest.Config) *NetworkingV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apinetworkingv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/networking/v1beta1/servicecidr.go b/kubernetes/typed/networking/v1beta1/servicecidr.go
new file mode 100644
index 000000000..7a3b16a7d
--- /dev/null
+++ b/kubernetes/typed/networking/v1beta1/servicecidr.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	apinetworkingv1beta1 "k8s.io/api/networking/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	networkingv1beta1 "k8s.io/client-go/kubernetes/typed/networking/v1beta1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ServiceCIDRsClusterGetter has a method to return a ServiceCIDRClusterInterface.
+// A group's cluster client should implement this interface.
+type ServiceCIDRsClusterGetter interface {
+	ServiceCIDRs() ServiceCIDRClusterInterface
+}
+
+// ServiceCIDRClusterInterface can operate on ServiceCIDRs across all clusters,
+// or scope down to one cluster and return a networkingv1beta1.ServiceCIDRInterface.
+type ServiceCIDRClusterInterface interface {
+	Cluster(logicalcluster.Path) networkingv1beta1.ServiceCIDRInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apinetworkingv1beta1.ServiceCIDRList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ServiceCIDRClusterExpansion
+}
+
+type serviceCIDRsClusterInterface struct {
+	clientCache kcpclient.Cache[*networkingv1beta1.NetworkingV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *serviceCIDRsClusterInterface) Cluster(clusterPath logicalcluster.Path) networkingv1beta1.ServiceCIDRInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).ServiceCIDRs()
+}
+
+// List returns the entire collection of all ServiceCIDRs across all clusters.
+func (c *serviceCIDRsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apinetworkingv1beta1.ServiceCIDRList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ServiceCIDRs().List(ctx, opts)
+}
+
+// Watch begins to watch all ServiceCIDRs across all clusters.
+func (c *serviceCIDRsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ServiceCIDRs().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/node/v1/doc.go b/kubernetes/typed/node/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/node/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/node/v1/fake/doc.go b/kubernetes/typed/node/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/node/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/node/v1/fake/node_client.go b/kubernetes/typed/node/v1/fake/node_client.go
index 6b8a534ea..cc34aabcd 100644
--- a/kubernetes/typed/node/v1/fake/node_client.go
+++ b/kubernetes/typed/node/v1/fake/node_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	nodev1 "k8s.io/client-go/kubernetes/typed/node/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpnodev1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpnodev1.NodeV1ClusterInterface = (*NodeV1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *NodeV1ClusterClient) Cluster(clusterPath logicalcluster.Path) nodev1.No
 }
 
 func (c *NodeV1ClusterClient) RuntimeClasses() kcpnodev1.RuntimeClassClusterInterface {
-	return &runtimeClassesClusterClient{Fake: c.Fake}
+	return newFakeRuntimeClassClusterClient(c)
 }
 
-var _ nodev1.NodeV1Interface = (*NodeV1Client)(nil)
-
 type NodeV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *NodeV1Client) RuntimeClasses() nodev1.RuntimeClassInterface {
+	return newFakeRuntimeClassClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *NodeV1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *NodeV1Client) RuntimeClasses() nodev1.RuntimeClassInterface {
-	return &runtimeClassesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
diff --git a/kubernetes/typed/node/v1/fake/runtimeclass.go b/kubernetes/typed/node/v1/fake/runtimeclass.go
index 67680af05..bb47d8a8e 100644
--- a/kubernetes/typed/node/v1/fake/runtimeclass.go
+++ b/kubernetes/typed/node/v1/fake/runtimeclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	nodev1 "k8s.io/api/node/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsnodev1 "k8s.io/client-go/applyconfigurations/node/v1"
-	nodev1client "k8s.io/client-go/kubernetes/typed/node/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/node/v1"
+	typednodev1 "k8s.io/client-go/kubernetes/typed/node/v1"
 
+	typedkcpnodev1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var runtimeClassesResource = schema.GroupVersionResource{Group: "node.k8s.io", Version: "v1", Resource: "runtimeclasses"}
-var runtimeClassesKind = schema.GroupVersionKind{Group: "node.k8s.io", Version: "v1", Kind: "RuntimeClass"}
-
-type runtimeClassesClusterClient struct {
-	*kcptesting.Fake
+// runtimeClassClusterClient implements RuntimeClassClusterInterface
+type runtimeClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*nodev1.RuntimeClass, *nodev1.RuntimeClassList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *runtimeClassesClusterClient) Cluster(clusterPath logicalcluster.Path) nodev1client.RuntimeClassInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &runtimeClassesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of RuntimeClasses that match those selectors across all clusters.
-func (c *runtimeClassesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*nodev1.RuntimeClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(runtimeClassesResource, runtimeClassesKind, logicalcluster.Wildcard, opts), &nodev1.RuntimeClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &nodev1.RuntimeClassList{ListMeta: obj.(*nodev1.RuntimeClassList).ListMeta}
-	for _, item := range obj.(*nodev1.RuntimeClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeRuntimeClassClusterClient(fake *NodeV1ClusterClient) typedkcpnodev1.RuntimeClassClusterInterface {
+	return &runtimeClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*nodev1.RuntimeClass, *nodev1.RuntimeClassList](
+			fake.Fake,
+			nodev1.SchemeGroupVersion.WithResource("runtimeclasses"),
+			nodev1.SchemeGroupVersion.WithKind("RuntimeClass"),
+			func() *nodev1.RuntimeClass { return &nodev1.RuntimeClass{} },
+			func() *nodev1.RuntimeClassList { return &nodev1.RuntimeClassList{} },
+			func(dst, src *nodev1.RuntimeClassList) { dst.ListMeta = src.ListMeta },
+			func(list *nodev1.RuntimeClassList) []*nodev1.RuntimeClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *nodev1.RuntimeClassList, items []*nodev1.RuntimeClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested RuntimeClasses across all clusters.
-func (c *runtimeClassesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(runtimeClassesResource, logicalcluster.Wildcard, opts))
+func (c *runtimeClassClusterClient) Cluster(cluster logicalcluster.Path) typednodev1.RuntimeClassInterface {
+	return newFakeRuntimeClassClient(c.Fake, cluster)
 }
 
-type runtimeClassesClient struct {
-	*kcptesting.Fake
+// runtimeClassScopedClient implements RuntimeClassInterface
+type runtimeClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*nodev1.RuntimeClass, *nodev1.RuntimeClassList, *v1.RuntimeClassApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *runtimeClassesClient) Create(ctx context.Context, runtimeClass *nodev1.RuntimeClass, opts metav1.CreateOptions) (*nodev1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(runtimeClassesResource, c.ClusterPath, runtimeClass), &nodev1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) Update(ctx context.Context, runtimeClass *nodev1.RuntimeClass, opts metav1.UpdateOptions) (*nodev1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(runtimeClassesResource, c.ClusterPath, runtimeClass), &nodev1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) UpdateStatus(ctx context.Context, runtimeClass *nodev1.RuntimeClass, opts metav1.UpdateOptions) (*nodev1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(runtimeClassesResource, c.ClusterPath, "status", runtimeClass), &nodev1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(runtimeClassesResource, c.ClusterPath, name, opts), &nodev1.RuntimeClass{})
-	return err
-}
-
-func (c *runtimeClassesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(runtimeClassesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &nodev1.RuntimeClassList{})
-	return err
-}
-
-func (c *runtimeClassesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*nodev1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(runtimeClassesResource, c.ClusterPath, name), &nodev1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1.RuntimeClass), err
-}
-
-// List takes label and field selectors, and returns the list of RuntimeClasses that match those selectors.
-func (c *runtimeClassesClient) List(ctx context.Context, opts metav1.ListOptions) (*nodev1.RuntimeClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(runtimeClassesResource, runtimeClassesKind, c.ClusterPath, opts), &nodev1.RuntimeClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &nodev1.RuntimeClassList{ListMeta: obj.(*nodev1.RuntimeClassList).ListMeta}
-	for _, item := range obj.(*nodev1.RuntimeClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *runtimeClassesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(runtimeClassesResource, c.ClusterPath, opts))
-}
-
-func (c *runtimeClassesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*nodev1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(runtimeClassesResource, c.ClusterPath, name, pt, data, subresources...), &nodev1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsnodev1.RuntimeClassApplyConfiguration, opts metav1.ApplyOptions) (*nodev1.RuntimeClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(runtimeClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &nodev1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsnodev1.RuntimeClassApplyConfiguration, opts metav1.ApplyOptions) (*nodev1.RuntimeClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(runtimeClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &nodev1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
+func newFakeRuntimeClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typednodev1.RuntimeClassInterface {
+	return &runtimeClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*nodev1.RuntimeClass, *nodev1.RuntimeClassList, *v1.RuntimeClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			nodev1.SchemeGroupVersion.WithResource("runtimeclasses"),
+			nodev1.SchemeGroupVersion.WithKind("RuntimeClass"),
+			func() *nodev1.RuntimeClass { return &nodev1.RuntimeClass{} },
+			func() *nodev1.RuntimeClassList { return &nodev1.RuntimeClassList{} },
+			func(dst, src *nodev1.RuntimeClassList) { dst.ListMeta = src.ListMeta },
+			func(list *nodev1.RuntimeClassList) []*nodev1.RuntimeClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *nodev1.RuntimeClassList, items []*nodev1.RuntimeClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*nodev1.RuntimeClass), err
 }
diff --git a/kubernetes/typed/node/v1/generated_expansion.go b/kubernetes/typed/node/v1/generated_expansion.go
new file mode 100644
index 000000000..3e0fa37f6
--- /dev/null
+++ b/kubernetes/typed/node/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type RuntimeClassClusterExpansion interface{}
diff --git a/kubernetes/typed/node/v1/node_client.go b/kubernetes/typed/node/v1/node_client.go
index aa0c91cbf..d7f8ebe13 100644
--- a/kubernetes/typed/node/v1/node_client.go
+++ b/kubernetes/typed/node/v1/node_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apinodev1 "k8s.io/api/node/v1"
+	nodev1 "k8s.io/client-go/kubernetes/typed/node/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	nodev1 "k8s.io/client-go/kubernetes/typed/node/v1"
-	"k8s.io/client-go/rest"
 )
 
 type NodeV1ClusterInterface interface {
@@ -40,6 +39,7 @@ type NodeV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) nodev1.NodeV1Interface
 }
 
+// NodeV1ClusterClient is used to interact with features provided by the node.k8s.io group.
 type NodeV1ClusterClient struct {
 	clientCache kcpclient.Cache[*nodev1.NodeV1Client]
 }
@@ -59,11 +59,13 @@ func (c *NodeV1ClusterClient) RuntimeClasses() RuntimeClassClusterInterface {
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*NodeV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new NodeV1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*NodeV1ClusterClient
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &NodeV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *NodeV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apinodev1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/node/v1/runtimeclass.go b/kubernetes/typed/node/v1/runtimeclass.go
index 0a01d776f..44a8ff9e2 100644
--- a/kubernetes/typed/node/v1/runtimeclass.go
+++ b/kubernetes/typed/node/v1/runtimeclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apinodev1 "k8s.io/api/node/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	nodev1 "k8s.io/client-go/kubernetes/typed/node/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	nodev1 "k8s.io/api/node/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	nodev1client "k8s.io/client-go/kubernetes/typed/node/v1"
 )
 
 // RuntimeClassesClusterGetter has a method to return a RuntimeClassClusterInterface.
@@ -40,19 +37,20 @@ type RuntimeClassesClusterGetter interface {
 }
 
 // RuntimeClassClusterInterface can operate on RuntimeClasses across all clusters,
-// or scope down to one cluster and return a nodev1client.RuntimeClassInterface.
+// or scope down to one cluster and return a nodev1.RuntimeClassInterface.
 type RuntimeClassClusterInterface interface {
-	Cluster(logicalcluster.Path) nodev1client.RuntimeClassInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*nodev1.RuntimeClassList, error)
+	Cluster(logicalcluster.Path) nodev1.RuntimeClassInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apinodev1.RuntimeClassList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	RuntimeClassClusterExpansion
 }
 
 type runtimeClassesClusterInterface struct {
-	clientCache kcpclient.Cache[*nodev1client.NodeV1Client]
+	clientCache kcpclient.Cache[*nodev1.NodeV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *runtimeClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) nodev1client.RuntimeClassInterface {
+func (c *runtimeClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) nodev1.RuntimeClassInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *runtimeClassesClusterInterface) Cluster(clusterPath logicalcluster.Path
 }
 
 // List returns the entire collection of all RuntimeClasses across all clusters.
-func (c *runtimeClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*nodev1.RuntimeClassList, error) {
+func (c *runtimeClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apinodev1.RuntimeClassList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RuntimeClasses().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/node/v1alpha1/doc.go b/kubernetes/typed/node/v1alpha1/doc.go
new file mode 100644
index 000000000..08b80237c
--- /dev/null
+++ b/kubernetes/typed/node/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/kubernetes/typed/node/v1alpha1/fake/doc.go b/kubernetes/typed/node/v1alpha1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/node/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/node/v1alpha1/fake/node_client.go b/kubernetes/typed/node/v1alpha1/fake/node_client.go
index 9fccaf7ba..07277f384 100644
--- a/kubernetes/typed/node/v1alpha1/fake/node_client.go
+++ b/kubernetes/typed/node/v1alpha1/fake/node_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	nodev1alpha1 "k8s.io/client-go/kubernetes/typed/node/v1alpha1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpnodev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1alpha1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpnodev1alpha1.NodeV1alpha1ClusterInterface = (*NodeV1alpha1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *NodeV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) nod
 }
 
 func (c *NodeV1alpha1ClusterClient) RuntimeClasses() kcpnodev1alpha1.RuntimeClassClusterInterface {
-	return &runtimeClassesClusterClient{Fake: c.Fake}
+	return newFakeRuntimeClassClusterClient(c)
 }
 
-var _ nodev1alpha1.NodeV1alpha1Interface = (*NodeV1alpha1Client)(nil)
-
 type NodeV1alpha1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *NodeV1alpha1Client) RuntimeClasses() nodev1alpha1.RuntimeClassInterface {
+	return newFakeRuntimeClassClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *NodeV1alpha1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *NodeV1alpha1Client) RuntimeClasses() nodev1alpha1.RuntimeClassInterface {
-	return &runtimeClassesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
diff --git a/kubernetes/typed/node/v1alpha1/fake/runtimeclass.go b/kubernetes/typed/node/v1alpha1/fake/runtimeclass.go
index 864fd44ae..ab2e2ffce 100644
--- a/kubernetes/typed/node/v1alpha1/fake/runtimeclass.go
+++ b/kubernetes/typed/node/v1alpha1/fake/runtimeclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	nodev1alpha1 "k8s.io/api/node/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsnodev1alpha1 "k8s.io/client-go/applyconfigurations/node/v1alpha1"
-	nodev1alpha1client "k8s.io/client-go/kubernetes/typed/node/v1alpha1"
-	"k8s.io/client-go/testing"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/node/v1alpha1"
+	typednodev1alpha1 "k8s.io/client-go/kubernetes/typed/node/v1alpha1"
 
+	typedkcpnodev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var runtimeClassesResource = schema.GroupVersionResource{Group: "node.k8s.io", Version: "v1alpha1", Resource: "runtimeclasses"}
-var runtimeClassesKind = schema.GroupVersionKind{Group: "node.k8s.io", Version: "v1alpha1", Kind: "RuntimeClass"}
-
-type runtimeClassesClusterClient struct {
-	*kcptesting.Fake
+// runtimeClassClusterClient implements RuntimeClassClusterInterface
+type runtimeClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*nodev1alpha1.RuntimeClass, *nodev1alpha1.RuntimeClassList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *runtimeClassesClusterClient) Cluster(clusterPath logicalcluster.Path) nodev1alpha1client.RuntimeClassInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &runtimeClassesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of RuntimeClasses that match those selectors across all clusters.
-func (c *runtimeClassesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*nodev1alpha1.RuntimeClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(runtimeClassesResource, runtimeClassesKind, logicalcluster.Wildcard, opts), &nodev1alpha1.RuntimeClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &nodev1alpha1.RuntimeClassList{ListMeta: obj.(*nodev1alpha1.RuntimeClassList).ListMeta}
-	for _, item := range obj.(*nodev1alpha1.RuntimeClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeRuntimeClassClusterClient(fake *NodeV1alpha1ClusterClient) typedkcpnodev1alpha1.RuntimeClassClusterInterface {
+	return &runtimeClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*nodev1alpha1.RuntimeClass, *nodev1alpha1.RuntimeClassList](
+			fake.Fake,
+			nodev1alpha1.SchemeGroupVersion.WithResource("runtimeclasses"),
+			nodev1alpha1.SchemeGroupVersion.WithKind("RuntimeClass"),
+			func() *nodev1alpha1.RuntimeClass { return &nodev1alpha1.RuntimeClass{} },
+			func() *nodev1alpha1.RuntimeClassList { return &nodev1alpha1.RuntimeClassList{} },
+			func(dst, src *nodev1alpha1.RuntimeClassList) { dst.ListMeta = src.ListMeta },
+			func(list *nodev1alpha1.RuntimeClassList) []*nodev1alpha1.RuntimeClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *nodev1alpha1.RuntimeClassList, items []*nodev1alpha1.RuntimeClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested RuntimeClasses across all clusters.
-func (c *runtimeClassesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(runtimeClassesResource, logicalcluster.Wildcard, opts))
+func (c *runtimeClassClusterClient) Cluster(cluster logicalcluster.Path) typednodev1alpha1.RuntimeClassInterface {
+	return newFakeRuntimeClassClient(c.Fake, cluster)
 }
 
-type runtimeClassesClient struct {
-	*kcptesting.Fake
+// runtimeClassScopedClient implements RuntimeClassInterface
+type runtimeClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*nodev1alpha1.RuntimeClass, *nodev1alpha1.RuntimeClassList, *v1alpha1.RuntimeClassApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *runtimeClassesClient) Create(ctx context.Context, runtimeClass *nodev1alpha1.RuntimeClass, opts metav1.CreateOptions) (*nodev1alpha1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(runtimeClassesResource, c.ClusterPath, runtimeClass), &nodev1alpha1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1alpha1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) Update(ctx context.Context, runtimeClass *nodev1alpha1.RuntimeClass, opts metav1.UpdateOptions) (*nodev1alpha1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(runtimeClassesResource, c.ClusterPath, runtimeClass), &nodev1alpha1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1alpha1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) UpdateStatus(ctx context.Context, runtimeClass *nodev1alpha1.RuntimeClass, opts metav1.UpdateOptions) (*nodev1alpha1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(runtimeClassesResource, c.ClusterPath, "status", runtimeClass), &nodev1alpha1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1alpha1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(runtimeClassesResource, c.ClusterPath, name, opts), &nodev1alpha1.RuntimeClass{})
-	return err
-}
-
-func (c *runtimeClassesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(runtimeClassesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &nodev1alpha1.RuntimeClassList{})
-	return err
-}
-
-func (c *runtimeClassesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*nodev1alpha1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(runtimeClassesResource, c.ClusterPath, name), &nodev1alpha1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1alpha1.RuntimeClass), err
-}
-
-// List takes label and field selectors, and returns the list of RuntimeClasses that match those selectors.
-func (c *runtimeClassesClient) List(ctx context.Context, opts metav1.ListOptions) (*nodev1alpha1.RuntimeClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(runtimeClassesResource, runtimeClassesKind, c.ClusterPath, opts), &nodev1alpha1.RuntimeClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &nodev1alpha1.RuntimeClassList{ListMeta: obj.(*nodev1alpha1.RuntimeClassList).ListMeta}
-	for _, item := range obj.(*nodev1alpha1.RuntimeClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *runtimeClassesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(runtimeClassesResource, c.ClusterPath, opts))
-}
-
-func (c *runtimeClassesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*nodev1alpha1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(runtimeClassesResource, c.ClusterPath, name, pt, data, subresources...), &nodev1alpha1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1alpha1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsnodev1alpha1.RuntimeClassApplyConfiguration, opts metav1.ApplyOptions) (*nodev1alpha1.RuntimeClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(runtimeClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &nodev1alpha1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1alpha1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsnodev1alpha1.RuntimeClassApplyConfiguration, opts metav1.ApplyOptions) (*nodev1alpha1.RuntimeClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(runtimeClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &nodev1alpha1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
+func newFakeRuntimeClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typednodev1alpha1.RuntimeClassInterface {
+	return &runtimeClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*nodev1alpha1.RuntimeClass, *nodev1alpha1.RuntimeClassList, *v1alpha1.RuntimeClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			nodev1alpha1.SchemeGroupVersion.WithResource("runtimeclasses"),
+			nodev1alpha1.SchemeGroupVersion.WithKind("RuntimeClass"),
+			func() *nodev1alpha1.RuntimeClass { return &nodev1alpha1.RuntimeClass{} },
+			func() *nodev1alpha1.RuntimeClassList { return &nodev1alpha1.RuntimeClassList{} },
+			func(dst, src *nodev1alpha1.RuntimeClassList) { dst.ListMeta = src.ListMeta },
+			func(list *nodev1alpha1.RuntimeClassList) []*nodev1alpha1.RuntimeClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *nodev1alpha1.RuntimeClassList, items []*nodev1alpha1.RuntimeClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*nodev1alpha1.RuntimeClass), err
 }
diff --git a/kubernetes/typed/node/v1alpha1/generated_expansion.go b/kubernetes/typed/node/v1alpha1/generated_expansion.go
new file mode 100644
index 000000000..db8e708bc
--- /dev/null
+++ b/kubernetes/typed/node/v1alpha1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type RuntimeClassClusterExpansion interface{}
diff --git a/kubernetes/typed/node/v1alpha1/node_client.go b/kubernetes/typed/node/v1alpha1/node_client.go
index 6bac32e34..4578e634d 100644
--- a/kubernetes/typed/node/v1alpha1/node_client.go
+++ b/kubernetes/typed/node/v1alpha1/node_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apinodev1alpha1 "k8s.io/api/node/v1alpha1"
+	nodev1alpha1 "k8s.io/client-go/kubernetes/typed/node/v1alpha1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	nodev1alpha1 "k8s.io/client-go/kubernetes/typed/node/v1alpha1"
-	"k8s.io/client-go/rest"
 )
 
 type NodeV1alpha1ClusterInterface interface {
@@ -40,6 +39,7 @@ type NodeV1alpha1ClusterScoper interface {
 	Cluster(logicalcluster.Path) nodev1alpha1.NodeV1alpha1Interface
 }
 
+// NodeV1alpha1ClusterClient is used to interact with features provided by the node.k8s.io group.
 type NodeV1alpha1ClusterClient struct {
 	clientCache kcpclient.Cache[*nodev1alpha1.NodeV1alpha1Client]
 }
@@ -59,11 +59,13 @@ func (c *NodeV1alpha1ClusterClient) RuntimeClasses() RuntimeClassClusterInterfac
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*NodeV1alpha1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new NodeV1alpha1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*NodeV1alpha1Cluster
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &NodeV1alpha1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *NodeV1alpha1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apinodev1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/node/v1alpha1/runtimeclass.go b/kubernetes/typed/node/v1alpha1/runtimeclass.go
index e545380dc..80008af2e 100644
--- a/kubernetes/typed/node/v1alpha1/runtimeclass.go
+++ b/kubernetes/typed/node/v1alpha1/runtimeclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
+	context "context"
+
+	apinodev1alpha1 "k8s.io/api/node/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	nodev1alpha1 "k8s.io/client-go/kubernetes/typed/node/v1alpha1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	nodev1alpha1 "k8s.io/api/node/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	nodev1alpha1client "k8s.io/client-go/kubernetes/typed/node/v1alpha1"
 )
 
 // RuntimeClassesClusterGetter has a method to return a RuntimeClassClusterInterface.
@@ -40,19 +37,20 @@ type RuntimeClassesClusterGetter interface {
 }
 
 // RuntimeClassClusterInterface can operate on RuntimeClasses across all clusters,
-// or scope down to one cluster and return a nodev1alpha1client.RuntimeClassInterface.
+// or scope down to one cluster and return a nodev1alpha1.RuntimeClassInterface.
 type RuntimeClassClusterInterface interface {
-	Cluster(logicalcluster.Path) nodev1alpha1client.RuntimeClassInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*nodev1alpha1.RuntimeClassList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) nodev1alpha1.RuntimeClassInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apinodev1alpha1.RuntimeClassList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	RuntimeClassClusterExpansion
 }
 
 type runtimeClassesClusterInterface struct {
-	clientCache kcpclient.Cache[*nodev1alpha1client.NodeV1alpha1Client]
+	clientCache kcpclient.Cache[*nodev1alpha1.NodeV1alpha1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *runtimeClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) nodev1alpha1client.RuntimeClassInterface {
+func (c *runtimeClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) nodev1alpha1.RuntimeClassInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *runtimeClassesClusterInterface) Cluster(clusterPath logicalcluster.Path
 }
 
 // List returns the entire collection of all RuntimeClasses across all clusters.
-func (c *runtimeClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*nodev1alpha1.RuntimeClassList, error) {
+func (c *runtimeClassesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apinodev1alpha1.RuntimeClassList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RuntimeClasses().List(ctx, opts)
 }
 
 // Watch begins to watch all RuntimeClasses across all clusters.
-func (c *runtimeClassesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *runtimeClassesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RuntimeClasses().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/node/v1beta1/doc.go b/kubernetes/typed/node/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/node/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/node/v1beta1/fake/doc.go b/kubernetes/typed/node/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/node/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/node/v1beta1/fake/node_client.go b/kubernetes/typed/node/v1beta1/fake/node_client.go
index 90f42bf00..ec6eeab46 100644
--- a/kubernetes/typed/node/v1beta1/fake/node_client.go
+++ b/kubernetes/typed/node/v1beta1/fake/node_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	nodev1beta1 "k8s.io/client-go/kubernetes/typed/node/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpnodev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpnodev1beta1.NodeV1beta1ClusterInterface = (*NodeV1beta1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *NodeV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) node
 }
 
 func (c *NodeV1beta1ClusterClient) RuntimeClasses() kcpnodev1beta1.RuntimeClassClusterInterface {
-	return &runtimeClassesClusterClient{Fake: c.Fake}
+	return newFakeRuntimeClassClusterClient(c)
 }
 
-var _ nodev1beta1.NodeV1beta1Interface = (*NodeV1beta1Client)(nil)
-
 type NodeV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *NodeV1beta1Client) RuntimeClasses() nodev1beta1.RuntimeClassInterface {
+	return newFakeRuntimeClassClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *NodeV1beta1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *NodeV1beta1Client) RuntimeClasses() nodev1beta1.RuntimeClassInterface {
-	return &runtimeClassesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
diff --git a/kubernetes/typed/node/v1beta1/fake/runtimeclass.go b/kubernetes/typed/node/v1beta1/fake/runtimeclass.go
index 40b4df0fd..050ccd951 100644
--- a/kubernetes/typed/node/v1beta1/fake/runtimeclass.go
+++ b/kubernetes/typed/node/v1beta1/fake/runtimeclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	nodev1beta1 "k8s.io/api/node/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsnodev1beta1 "k8s.io/client-go/applyconfigurations/node/v1beta1"
-	nodev1beta1client "k8s.io/client-go/kubernetes/typed/node/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/node/v1beta1"
+	typednodev1beta1 "k8s.io/client-go/kubernetes/typed/node/v1beta1"
 
+	typedkcpnodev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/node/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var runtimeClassesResource = schema.GroupVersionResource{Group: "node.k8s.io", Version: "v1beta1", Resource: "runtimeclasses"}
-var runtimeClassesKind = schema.GroupVersionKind{Group: "node.k8s.io", Version: "v1beta1", Kind: "RuntimeClass"}
-
-type runtimeClassesClusterClient struct {
-	*kcptesting.Fake
+// runtimeClassClusterClient implements RuntimeClassClusterInterface
+type runtimeClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*nodev1beta1.RuntimeClass, *nodev1beta1.RuntimeClassList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *runtimeClassesClusterClient) Cluster(clusterPath logicalcluster.Path) nodev1beta1client.RuntimeClassInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &runtimeClassesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of RuntimeClasses that match those selectors across all clusters.
-func (c *runtimeClassesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*nodev1beta1.RuntimeClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(runtimeClassesResource, runtimeClassesKind, logicalcluster.Wildcard, opts), &nodev1beta1.RuntimeClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &nodev1beta1.RuntimeClassList{ListMeta: obj.(*nodev1beta1.RuntimeClassList).ListMeta}
-	for _, item := range obj.(*nodev1beta1.RuntimeClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeRuntimeClassClusterClient(fake *NodeV1beta1ClusterClient) typedkcpnodev1beta1.RuntimeClassClusterInterface {
+	return &runtimeClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*nodev1beta1.RuntimeClass, *nodev1beta1.RuntimeClassList](
+			fake.Fake,
+			nodev1beta1.SchemeGroupVersion.WithResource("runtimeclasses"),
+			nodev1beta1.SchemeGroupVersion.WithKind("RuntimeClass"),
+			func() *nodev1beta1.RuntimeClass { return &nodev1beta1.RuntimeClass{} },
+			func() *nodev1beta1.RuntimeClassList { return &nodev1beta1.RuntimeClassList{} },
+			func(dst, src *nodev1beta1.RuntimeClassList) { dst.ListMeta = src.ListMeta },
+			func(list *nodev1beta1.RuntimeClassList) []*nodev1beta1.RuntimeClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *nodev1beta1.RuntimeClassList, items []*nodev1beta1.RuntimeClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested RuntimeClasses across all clusters.
-func (c *runtimeClassesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(runtimeClassesResource, logicalcluster.Wildcard, opts))
+func (c *runtimeClassClusterClient) Cluster(cluster logicalcluster.Path) typednodev1beta1.RuntimeClassInterface {
+	return newFakeRuntimeClassClient(c.Fake, cluster)
 }
 
-type runtimeClassesClient struct {
-	*kcptesting.Fake
+// runtimeClassScopedClient implements RuntimeClassInterface
+type runtimeClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*nodev1beta1.RuntimeClass, *nodev1beta1.RuntimeClassList, *v1beta1.RuntimeClassApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *runtimeClassesClient) Create(ctx context.Context, runtimeClass *nodev1beta1.RuntimeClass, opts metav1.CreateOptions) (*nodev1beta1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(runtimeClassesResource, c.ClusterPath, runtimeClass), &nodev1beta1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1beta1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) Update(ctx context.Context, runtimeClass *nodev1beta1.RuntimeClass, opts metav1.UpdateOptions) (*nodev1beta1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(runtimeClassesResource, c.ClusterPath, runtimeClass), &nodev1beta1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1beta1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) UpdateStatus(ctx context.Context, runtimeClass *nodev1beta1.RuntimeClass, opts metav1.UpdateOptions) (*nodev1beta1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(runtimeClassesResource, c.ClusterPath, "status", runtimeClass), &nodev1beta1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1beta1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(runtimeClassesResource, c.ClusterPath, name, opts), &nodev1beta1.RuntimeClass{})
-	return err
-}
-
-func (c *runtimeClassesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(runtimeClassesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &nodev1beta1.RuntimeClassList{})
-	return err
-}
-
-func (c *runtimeClassesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*nodev1beta1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(runtimeClassesResource, c.ClusterPath, name), &nodev1beta1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1beta1.RuntimeClass), err
-}
-
-// List takes label and field selectors, and returns the list of RuntimeClasses that match those selectors.
-func (c *runtimeClassesClient) List(ctx context.Context, opts metav1.ListOptions) (*nodev1beta1.RuntimeClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(runtimeClassesResource, runtimeClassesKind, c.ClusterPath, opts), &nodev1beta1.RuntimeClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &nodev1beta1.RuntimeClassList{ListMeta: obj.(*nodev1beta1.RuntimeClassList).ListMeta}
-	for _, item := range obj.(*nodev1beta1.RuntimeClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *runtimeClassesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(runtimeClassesResource, c.ClusterPath, opts))
-}
-
-func (c *runtimeClassesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*nodev1beta1.RuntimeClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(runtimeClassesResource, c.ClusterPath, name, pt, data, subresources...), &nodev1beta1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1beta1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsnodev1beta1.RuntimeClassApplyConfiguration, opts metav1.ApplyOptions) (*nodev1beta1.RuntimeClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(runtimeClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &nodev1beta1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*nodev1beta1.RuntimeClass), err
-}
-
-func (c *runtimeClassesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsnodev1beta1.RuntimeClassApplyConfiguration, opts metav1.ApplyOptions) (*nodev1beta1.RuntimeClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(runtimeClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &nodev1beta1.RuntimeClass{})
-	if obj == nil {
-		return nil, err
+func newFakeRuntimeClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typednodev1beta1.RuntimeClassInterface {
+	return &runtimeClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*nodev1beta1.RuntimeClass, *nodev1beta1.RuntimeClassList, *v1beta1.RuntimeClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			nodev1beta1.SchemeGroupVersion.WithResource("runtimeclasses"),
+			nodev1beta1.SchemeGroupVersion.WithKind("RuntimeClass"),
+			func() *nodev1beta1.RuntimeClass { return &nodev1beta1.RuntimeClass{} },
+			func() *nodev1beta1.RuntimeClassList { return &nodev1beta1.RuntimeClassList{} },
+			func(dst, src *nodev1beta1.RuntimeClassList) { dst.ListMeta = src.ListMeta },
+			func(list *nodev1beta1.RuntimeClassList) []*nodev1beta1.RuntimeClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *nodev1beta1.RuntimeClassList, items []*nodev1beta1.RuntimeClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*nodev1beta1.RuntimeClass), err
 }
diff --git a/kubernetes/typed/node/v1beta1/generated_expansion.go b/kubernetes/typed/node/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..4d52810aa
--- /dev/null
+++ b/kubernetes/typed/node/v1beta1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type RuntimeClassClusterExpansion interface{}
diff --git a/kubernetes/typed/node/v1beta1/node_client.go b/kubernetes/typed/node/v1beta1/node_client.go
index fabe01a5d..2c9cab281 100644
--- a/kubernetes/typed/node/v1beta1/node_client.go
+++ b/kubernetes/typed/node/v1beta1/node_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apinodev1beta1 "k8s.io/api/node/v1beta1"
+	nodev1beta1 "k8s.io/client-go/kubernetes/typed/node/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	nodev1beta1 "k8s.io/client-go/kubernetes/typed/node/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type NodeV1beta1ClusterInterface interface {
@@ -40,6 +39,7 @@ type NodeV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) nodev1beta1.NodeV1beta1Interface
 }
 
+// NodeV1beta1ClusterClient is used to interact with features provided by the node.k8s.io group.
 type NodeV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*nodev1beta1.NodeV1beta1Client]
 }
@@ -59,11 +59,13 @@ func (c *NodeV1beta1ClusterClient) RuntimeClasses() RuntimeClassClusterInterface
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*NodeV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new NodeV1beta1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*NodeV1beta1ClusterC
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &NodeV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *NodeV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apinodev1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/node/v1beta1/runtimeclass.go b/kubernetes/typed/node/v1beta1/runtimeclass.go
index 2467db77d..15a279454 100644
--- a/kubernetes/typed/node/v1beta1/runtimeclass.go
+++ b/kubernetes/typed/node/v1beta1/runtimeclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apinodev1beta1 "k8s.io/api/node/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	nodev1beta1 "k8s.io/client-go/kubernetes/typed/node/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	nodev1beta1 "k8s.io/api/node/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	nodev1beta1client "k8s.io/client-go/kubernetes/typed/node/v1beta1"
 )
 
 // RuntimeClassesClusterGetter has a method to return a RuntimeClassClusterInterface.
@@ -40,19 +37,20 @@ type RuntimeClassesClusterGetter interface {
 }
 
 // RuntimeClassClusterInterface can operate on RuntimeClasses across all clusters,
-// or scope down to one cluster and return a nodev1beta1client.RuntimeClassInterface.
+// or scope down to one cluster and return a nodev1beta1.RuntimeClassInterface.
 type RuntimeClassClusterInterface interface {
-	Cluster(logicalcluster.Path) nodev1beta1client.RuntimeClassInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*nodev1beta1.RuntimeClassList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) nodev1beta1.RuntimeClassInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apinodev1beta1.RuntimeClassList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	RuntimeClassClusterExpansion
 }
 
 type runtimeClassesClusterInterface struct {
-	clientCache kcpclient.Cache[*nodev1beta1client.NodeV1beta1Client]
+	clientCache kcpclient.Cache[*nodev1beta1.NodeV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *runtimeClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) nodev1beta1client.RuntimeClassInterface {
+func (c *runtimeClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) nodev1beta1.RuntimeClassInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *runtimeClassesClusterInterface) Cluster(clusterPath logicalcluster.Path
 }
 
 // List returns the entire collection of all RuntimeClasses across all clusters.
-func (c *runtimeClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*nodev1beta1.RuntimeClassList, error) {
+func (c *runtimeClassesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apinodev1beta1.RuntimeClassList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RuntimeClasses().List(ctx, opts)
 }
 
 // Watch begins to watch all RuntimeClasses across all clusters.
-func (c *runtimeClassesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *runtimeClassesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RuntimeClasses().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/policy/v1/doc.go b/kubernetes/typed/policy/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/policy/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/policy/v1/eviction.go b/kubernetes/typed/policy/v1/eviction.go
index a168a1466..0123eaf25 100644
--- a/kubernetes/typed/policy/v1/eviction.go
+++ b/kubernetes/typed/policy/v1/eviction.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
+	policyv1 "k8s.io/client-go/kubernetes/typed/policy/v1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	policyv1client "k8s.io/client-go/kubernetes/typed/policy/v1"
 )
 
 // EvictionsClusterGetter has a method to return a EvictionClusterInterface.
@@ -37,10 +34,12 @@ type EvictionsClusterGetter interface {
 // EvictionClusterInterface can scope down to one cluster and return a EvictionsNamespacer.
 type EvictionClusterInterface interface {
 	Cluster(logicalcluster.Path) EvictionsNamespacer
+
+	EvictionClusterExpansion
 }
 
 type evictionsClusterInterface struct {
-	clientCache kcpclient.Cache[*policyv1client.PolicyV1Client]
+	clientCache kcpclient.Cache[*policyv1.PolicyV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -52,16 +51,16 @@ func (c *evictionsClusterInterface) Cluster(clusterPath logicalcluster.Path) Evi
 	return &evictionsNamespacer{clientCache: c.clientCache, clusterPath: clusterPath}
 }
 
-// EvictionsNamespacer can scope to objects within a namespace, returning a policyv1client.EvictionInterface.
+// EvictionsNamespacer can scope to objects within a namespace, returning a policyv1.EvictionInterface.
 type EvictionsNamespacer interface {
-	Namespace(string) policyv1client.EvictionInterface
+	Namespace(string) policyv1.EvictionInterface
 }
 
 type evictionsNamespacer struct {
-	clientCache kcpclient.Cache[*policyv1client.PolicyV1Client]
+	clientCache kcpclient.Cache[*policyv1.PolicyV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *evictionsNamespacer) Namespace(namespace string) policyv1client.EvictionInterface {
+func (n *evictionsNamespacer) Namespace(namespace string) policyv1.EvictionInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Evictions(namespace)
 }
diff --git a/kubernetes/typed/policy/v1/fake/doc.go b/kubernetes/typed/policy/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/policy/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/policy/v1/fake/eviction.go b/kubernetes/typed/policy/v1/fake/eviction.go
index d89c8482d..637cfdaba 100644
--- a/kubernetes/typed/policy/v1/fake/eviction.go
+++ b/kubernetes/typed/policy/v1/fake/eviction.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,47 +14,69 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	policyv1client "k8s.io/client-go/kubernetes/typed/policy/v1"
+	policyv1 "k8s.io/api/policy/v1"
+	typedpolicyv1 "k8s.io/client-go/kubernetes/typed/policy/v1"
 
-	kcppolicyv1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1"
+	typedkcppolicyv1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var evictionsResource = schema.GroupVersionResource{Group: "policy", Version: "v1", Resource: "evictions"}
-var evictionsKind = schema.GroupVersionKind{Group: "policy", Version: "v1", Kind: "Eviction"}
-
-type evictionsClusterClient struct {
-	*kcptesting.Fake
+// evictionClusterClient implements EvictionClusterInterface
+type evictionClusterClient struct {
+	*kcpgentype.FakeClusterClient[*policyv1.Eviction]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *evictionsClusterClient) Cluster(clusterPath logicalcluster.Path) kcppolicyv1.EvictionsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeEvictionClusterClient(fake *PolicyV1ClusterClient) typedkcppolicyv1.EvictionClusterInterface {
+	return &evictionClusterClient{
+		kcpgentype.NewFakeClusterClient[*policyv1.Eviction](
+			fake.Fake,
+			policyv1.SchemeGroupVersion.WithResource("evictions"),
+			policyv1.SchemeGroupVersion.WithKind("Eviction"),
+			func() *policyv1.Eviction { return &policyv1.Eviction{} },
+		),
+		fake.Fake,
 	}
+}
 
-	return &evictionsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *evictionClusterClient) Cluster(cluster logicalcluster.Path) typedkcppolicyv1.EvictionsNamespacer {
+	return &evictionNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type evictionsNamespacer struct {
+type evictionNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *evictionsNamespacer) Namespace(namespace string) policyv1client.EvictionInterface {
-	return &evictionsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *evictionNamespacer) Namespace(namespace string) typedpolicyv1.EvictionInterface {
+	return newFakeEvictionClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type evictionsClient struct {
-	*kcptesting.Fake
+// evictionScopedClient implements EvictionInterface
+type evictionScopedClient struct {
+	*kcpgentype.FakeClient[*policyv1.Eviction]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
+}
+
+func newFakeEvictionClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedpolicyv1.EvictionInterface {
+	return &evictionScopedClient{
+		kcpgentype.NewFakeClient[*policyv1.Eviction](
+			fake,
+			clusterPath,
+			namespace,
+			policyv1.SchemeGroupVersion.WithResource("evictions"),
+			policyv1.SchemeGroupVersion.WithKind("Eviction"),
+			func() *policyv1.Eviction { return &policyv1.Eviction{} },
+		),
+		fake,
+		clusterPath,
+	}
 }
diff --git a/kubernetes/typed/policy/v1/fake/fake_eviction_expansion.go b/kubernetes/typed/policy/v1/fake/fake_eviction_expansion.go
index 49a77864e..9b981e9e2 100644
--- a/kubernetes/typed/policy/v1/fake/fake_eviction_expansion.go
+++ b/kubernetes/typed/policy/v1/fake/fake_eviction_expansion.go
@@ -26,10 +26,10 @@ import (
 	core "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
 )
 
-func (c *evictionsClient) Evict(ctx context.Context, eviction *policy.Eviction) error {
+func (c *evictionScopedClient) Evict(ctx context.Context, eviction *policy.Eviction) error {
 	action := core.CreateActionImpl{}
 	action.Verb = "create"
-	action.Namespace = c.Namespace
+	action.Namespace = c.Namespace()
 	action.ClusterPath = c.ClusterPath
 	action.Resource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"}
 	action.Subresource = "eviction"
diff --git a/kubernetes/typed/policy/v1/fake/poddisruptionbudget.go b/kubernetes/typed/policy/v1/fake/poddisruptionbudget.go
index 50f38dfe4..ce988936a 100644
--- a/kubernetes/typed/policy/v1/fake/poddisruptionbudget.go
+++ b/kubernetes/typed/policy/v1/fake/poddisruptionbudget.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	policyv1 "k8s.io/api/policy/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationspolicyv1 "k8s.io/client-go/applyconfigurations/policy/v1"
-	policyv1client "k8s.io/client-go/kubernetes/typed/policy/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/policy/v1"
+	typedpolicyv1 "k8s.io/client-go/kubernetes/typed/policy/v1"
 
-	kcppolicyv1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1"
+	typedkcppolicyv1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var podDisruptionBudgetsResource = schema.GroupVersionResource{Group: "policy", Version: "v1", Resource: "poddisruptionbudgets"}
-var podDisruptionBudgetsKind = schema.GroupVersionKind{Group: "policy", Version: "v1", Kind: "PodDisruptionBudget"}
-
-type podDisruptionBudgetsClusterClient struct {
-	*kcptesting.Fake
+// podDisruptionBudgetClusterClient implements PodDisruptionBudgetClusterInterface
+type podDisruptionBudgetClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*policyv1.PodDisruptionBudget, *policyv1.PodDisruptionBudgetList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *podDisruptionBudgetsClusterClient) Cluster(clusterPath logicalcluster.Path) kcppolicyv1.PodDisruptionBudgetsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &podDisruptionBudgetsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PodDisruptionBudgets that match those selectors across all clusters.
-func (c *podDisruptionBudgetsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*policyv1.PodDisruptionBudgetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(podDisruptionBudgetsResource, podDisruptionBudgetsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &policyv1.PodDisruptionBudgetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakePodDisruptionBudgetClusterClient(fake *PolicyV1ClusterClient) typedkcppolicyv1.PodDisruptionBudgetClusterInterface {
+	return &podDisruptionBudgetClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*policyv1.PodDisruptionBudget, *policyv1.PodDisruptionBudgetList](
+			fake.Fake,
+			policyv1.SchemeGroupVersion.WithResource("poddisruptionbudgets"),
+			policyv1.SchemeGroupVersion.WithKind("PodDisruptionBudget"),
+			func() *policyv1.PodDisruptionBudget { return &policyv1.PodDisruptionBudget{} },
+			func() *policyv1.PodDisruptionBudgetList { return &policyv1.PodDisruptionBudgetList{} },
+			func(dst, src *policyv1.PodDisruptionBudgetList) { dst.ListMeta = src.ListMeta },
+			func(list *policyv1.PodDisruptionBudgetList) []*policyv1.PodDisruptionBudget {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *policyv1.PodDisruptionBudgetList, items []*policyv1.PodDisruptionBudget) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &policyv1.PodDisruptionBudgetList{ListMeta: obj.(*policyv1.PodDisruptionBudgetList).ListMeta}
-	for _, item := range obj.(*policyv1.PodDisruptionBudgetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested PodDisruptionBudgets across all clusters.
-func (c *podDisruptionBudgetsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(podDisruptionBudgetsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *podDisruptionBudgetClusterClient) Cluster(cluster logicalcluster.Path) typedkcppolicyv1.PodDisruptionBudgetsNamespacer {
+	return &podDisruptionBudgetNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type podDisruptionBudgetsNamespacer struct {
+type podDisruptionBudgetNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *podDisruptionBudgetsNamespacer) Namespace(namespace string) policyv1client.PodDisruptionBudgetInterface {
-	return &podDisruptionBudgetsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *podDisruptionBudgetNamespacer) Namespace(namespace string) typedpolicyv1.PodDisruptionBudgetInterface {
+	return newFakePodDisruptionBudgetClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type podDisruptionBudgetsClient struct {
-	*kcptesting.Fake
+// podDisruptionBudgetScopedClient implements PodDisruptionBudgetInterface
+type podDisruptionBudgetScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*policyv1.PodDisruptionBudget, *policyv1.PodDisruptionBudgetList, *v1.PodDisruptionBudgetApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *podDisruptionBudgetsClient) Create(ctx context.Context, podDisruptionBudget *policyv1.PodDisruptionBudget, opts metav1.CreateOptions) (*policyv1.PodDisruptionBudget, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, podDisruptionBudget), &policyv1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1.PodDisruptionBudget), err
-}
-
-func (c *podDisruptionBudgetsClient) Update(ctx context.Context, podDisruptionBudget *policyv1.PodDisruptionBudget, opts metav1.UpdateOptions) (*policyv1.PodDisruptionBudget, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, podDisruptionBudget), &policyv1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1.PodDisruptionBudget), err
-}
-
-func (c *podDisruptionBudgetsClient) UpdateStatus(ctx context.Context, podDisruptionBudget *policyv1.PodDisruptionBudget, opts metav1.UpdateOptions) (*policyv1.PodDisruptionBudget, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(podDisruptionBudgetsResource, c.ClusterPath, "status", c.Namespace, podDisruptionBudget), &policyv1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1.PodDisruptionBudget), err
-}
-
-func (c *podDisruptionBudgetsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, name, opts), &policyv1.PodDisruptionBudget{})
-	return err
 }
 
-func (c *podDisruptionBudgetsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &policyv1.PodDisruptionBudgetList{})
-	return err
-}
-
-func (c *podDisruptionBudgetsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*policyv1.PodDisruptionBudget, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, name), &policyv1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1.PodDisruptionBudget), err
-}
-
-// List takes label and field selectors, and returns the list of PodDisruptionBudgets that match those selectors.
-func (c *podDisruptionBudgetsClient) List(ctx context.Context, opts metav1.ListOptions) (*policyv1.PodDisruptionBudgetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(podDisruptionBudgetsResource, podDisruptionBudgetsKind, c.ClusterPath, c.Namespace, opts), &policyv1.PodDisruptionBudgetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &policyv1.PodDisruptionBudgetList{ListMeta: obj.(*policyv1.PodDisruptionBudgetList).ListMeta}
-	for _, item := range obj.(*policyv1.PodDisruptionBudgetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *podDisruptionBudgetsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *podDisruptionBudgetsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*policyv1.PodDisruptionBudget, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &policyv1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1.PodDisruptionBudget), err
-}
-
-func (c *podDisruptionBudgetsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationspolicyv1.PodDisruptionBudgetApplyConfiguration, opts metav1.ApplyOptions) (*policyv1.PodDisruptionBudget, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &policyv1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1.PodDisruptionBudget), err
-}
-
-func (c *podDisruptionBudgetsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationspolicyv1.PodDisruptionBudgetApplyConfiguration, opts metav1.ApplyOptions) (*policyv1.PodDisruptionBudget, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &policyv1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
+func newFakePodDisruptionBudgetClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedpolicyv1.PodDisruptionBudgetInterface {
+	return &podDisruptionBudgetScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*policyv1.PodDisruptionBudget, *policyv1.PodDisruptionBudgetList, *v1.PodDisruptionBudgetApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			policyv1.SchemeGroupVersion.WithResource("poddisruptionbudgets"),
+			policyv1.SchemeGroupVersion.WithKind("PodDisruptionBudget"),
+			func() *policyv1.PodDisruptionBudget { return &policyv1.PodDisruptionBudget{} },
+			func() *policyv1.PodDisruptionBudgetList { return &policyv1.PodDisruptionBudgetList{} },
+			func(dst, src *policyv1.PodDisruptionBudgetList) { dst.ListMeta = src.ListMeta },
+			func(list *policyv1.PodDisruptionBudgetList) []*policyv1.PodDisruptionBudget {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *policyv1.PodDisruptionBudgetList, items []*policyv1.PodDisruptionBudget) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*policyv1.PodDisruptionBudget), err
 }
diff --git a/kubernetes/typed/policy/v1/fake/policy_client.go b/kubernetes/typed/policy/v1/fake/policy_client.go
index 37708c6c5..9f91275a3 100644
--- a/kubernetes/typed/policy/v1/fake/policy_client.go
+++ b/kubernetes/typed/policy/v1/fake/policy_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	policyv1 "k8s.io/client-go/kubernetes/typed/policy/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcppolicyv1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcppolicyv1.PolicyV1ClusterInterface = (*PolicyV1ClusterClient)(nil)
@@ -44,30 +40,30 @@ func (c *PolicyV1ClusterClient) Cluster(clusterPath logicalcluster.Path) policyv
 	return &PolicyV1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *PolicyV1ClusterClient) PodDisruptionBudgets() kcppolicyv1.PodDisruptionBudgetClusterInterface {
-	return &podDisruptionBudgetsClusterClient{Fake: c.Fake}
-}
-
 func (c *PolicyV1ClusterClient) Evictions() kcppolicyv1.EvictionClusterInterface {
-	return &evictionsClusterClient{Fake: c.Fake}
+	return newFakeEvictionClusterClient(c)
 }
 
-var _ policyv1.PolicyV1Interface = (*PolicyV1Client)(nil)
+func (c *PolicyV1ClusterClient) PodDisruptionBudgets() kcppolicyv1.PodDisruptionBudgetClusterInterface {
+	return newFakePodDisruptionBudgetClusterClient(c)
+}
 
 type PolicyV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *PolicyV1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *PolicyV1Client) Evictions(namespace string) policyv1.EvictionInterface {
+	return newFakeEvictionClient(c.Fake, namespace, c.ClusterPath)
 }
 
 func (c *PolicyV1Client) PodDisruptionBudgets(namespace string) policyv1.PodDisruptionBudgetInterface {
-	return &podDisruptionBudgetsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+	return newFakePodDisruptionBudgetClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *PolicyV1Client) Evictions(namespace string) policyv1.EvictionInterface {
-	return &evictionsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *PolicyV1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/policy/v1/generated_expansion.go b/kubernetes/typed/policy/v1/generated_expansion.go
new file mode 100644
index 000000000..c2df4356b
--- /dev/null
+++ b/kubernetes/typed/policy/v1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type EvictionClusterExpansion interface{}
+
+type PodDisruptionBudgetClusterExpansion interface{}
diff --git a/kubernetes/typed/policy/v1/poddisruptionbudget.go b/kubernetes/typed/policy/v1/poddisruptionbudget.go
index ace0108ca..c442f0389 100644
--- a/kubernetes/typed/policy/v1/poddisruptionbudget.go
+++ b/kubernetes/typed/policy/v1/poddisruptionbudget.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	policyv1 "k8s.io/api/policy/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	policyv1client "k8s.io/client-go/kubernetes/typed/policy/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedpolicyv1 "k8s.io/client-go/kubernetes/typed/policy/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // PodDisruptionBudgetsClusterGetter has a method to return a PodDisruptionBudgetClusterInterface.
@@ -45,10 +42,11 @@ type PodDisruptionBudgetClusterInterface interface {
 	Cluster(logicalcluster.Path) PodDisruptionBudgetsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*policyv1.PodDisruptionBudgetList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	PodDisruptionBudgetClusterExpansion
 }
 
 type podDisruptionBudgetsClusterInterface struct {
-	clientCache kcpclient.Cache[*policyv1client.PolicyV1Client]
+	clientCache kcpclient.Cache[*typedpolicyv1.PolicyV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *podDisruptionBudgetsClusterInterface) Watch(ctx context.Context, opts m
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PodDisruptionBudgets(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// PodDisruptionBudgetsNamespacer can scope to objects within a namespace, returning a policyv1client.PodDisruptionBudgetInterface.
+// PodDisruptionBudgetsNamespacer can scope to objects within a namespace, returning a typedpolicyv1.PodDisruptionBudgetInterface.
 type PodDisruptionBudgetsNamespacer interface {
-	Namespace(string) policyv1client.PodDisruptionBudgetInterface
+	Namespace(string) typedpolicyv1.PodDisruptionBudgetInterface
 }
 
 type podDisruptionBudgetsNamespacer struct {
-	clientCache kcpclient.Cache[*policyv1client.PolicyV1Client]
+	clientCache kcpclient.Cache[*typedpolicyv1.PolicyV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *podDisruptionBudgetsNamespacer) Namespace(namespace string) policyv1client.PodDisruptionBudgetInterface {
+func (n *podDisruptionBudgetsNamespacer) Namespace(namespace string) typedpolicyv1.PodDisruptionBudgetInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).PodDisruptionBudgets(namespace)
 }
diff --git a/kubernetes/typed/policy/v1/policy_client.go b/kubernetes/typed/policy/v1/policy_client.go
index 15536982f..1b5a3d035 100644
--- a/kubernetes/typed/policy/v1/policy_client.go
+++ b/kubernetes/typed/policy/v1/policy_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,33 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apipolicyv1 "k8s.io/api/policy/v1"
+	policyv1 "k8s.io/client-go/kubernetes/typed/policy/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	policyv1 "k8s.io/client-go/kubernetes/typed/policy/v1"
-	"k8s.io/client-go/rest"
 )
 
 type PolicyV1ClusterInterface interface {
 	PolicyV1ClusterScoper
-	PodDisruptionBudgetsClusterGetter
 	EvictionsClusterGetter
+	PodDisruptionBudgetsClusterGetter
 }
 
 type PolicyV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) policyv1.PolicyV1Interface
 }
 
+// PolicyV1ClusterClient is used to interact with features provided by the policy group.
 type PolicyV1ClusterClient struct {
 	clientCache kcpclient.Cache[*policyv1.PolicyV1Client]
 }
@@ -52,23 +52,25 @@ func (c *PolicyV1ClusterClient) Cluster(clusterPath logicalcluster.Path) policyv
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *PolicyV1ClusterClient) PodDisruptionBudgets() PodDisruptionBudgetClusterInterface {
-	return &podDisruptionBudgetsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *PolicyV1ClusterClient) Evictions() EvictionClusterInterface {
 	return &evictionsClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *PolicyV1ClusterClient) PodDisruptionBudgets() PodDisruptionBudgetClusterInterface {
+	return &podDisruptionBudgetsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new PolicyV1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*PolicyV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new PolicyV1ClusterClient for the given config and http client.
@@ -80,6 +82,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*PolicyV1ClusterClie
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &PolicyV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -92,3 +95,14 @@ func NewForConfigOrDie(c *rest.Config) *PolicyV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apipolicyv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/policy/v1beta1/doc.go b/kubernetes/typed/policy/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/policy/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/policy/v1beta1/eviction.go b/kubernetes/typed/policy/v1beta1/eviction.go
index bd5093463..f184e965b 100644
--- a/kubernetes/typed/policy/v1beta1/eviction.go
+++ b/kubernetes/typed/policy/v1beta1/eviction.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,15 +14,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
+	policyv1beta1 "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
+
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	policyv1beta1client "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
 )
 
 // EvictionsClusterGetter has a method to return a EvictionClusterInterface.
@@ -37,10 +34,12 @@ type EvictionsClusterGetter interface {
 // EvictionClusterInterface can scope down to one cluster and return a EvictionsNamespacer.
 type EvictionClusterInterface interface {
 	Cluster(logicalcluster.Path) EvictionsNamespacer
+
+	EvictionClusterExpansion
 }
 
 type evictionsClusterInterface struct {
-	clientCache kcpclient.Cache[*policyv1beta1client.PolicyV1beta1Client]
+	clientCache kcpclient.Cache[*policyv1beta1.PolicyV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -52,16 +51,16 @@ func (c *evictionsClusterInterface) Cluster(clusterPath logicalcluster.Path) Evi
 	return &evictionsNamespacer{clientCache: c.clientCache, clusterPath: clusterPath}
 }
 
-// EvictionsNamespacer can scope to objects within a namespace, returning a policyv1beta1client.EvictionInterface.
+// EvictionsNamespacer can scope to objects within a namespace, returning a policyv1beta1.EvictionInterface.
 type EvictionsNamespacer interface {
-	Namespace(string) policyv1beta1client.EvictionInterface
+	Namespace(string) policyv1beta1.EvictionInterface
 }
 
 type evictionsNamespacer struct {
-	clientCache kcpclient.Cache[*policyv1beta1client.PolicyV1beta1Client]
+	clientCache kcpclient.Cache[*policyv1beta1.PolicyV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *evictionsNamespacer) Namespace(namespace string) policyv1beta1client.EvictionInterface {
+func (n *evictionsNamespacer) Namespace(namespace string) policyv1beta1.EvictionInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Evictions(namespace)
 }
diff --git a/kubernetes/typed/policy/v1beta1/fake/doc.go b/kubernetes/typed/policy/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/policy/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/policy/v1beta1/fake/eviction.go b/kubernetes/typed/policy/v1beta1/fake/eviction.go
index 4eb6f39c2..de6d34800 100644
--- a/kubernetes/typed/policy/v1beta1/fake/eviction.go
+++ b/kubernetes/typed/policy/v1beta1/fake/eviction.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,47 +14,69 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	policyv1beta1client "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
+	policyv1beta1 "k8s.io/api/policy/v1beta1"
+	typedpolicyv1beta1 "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
 
-	kcppolicyv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1beta1"
+	typedkcppolicyv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var evictionsResource = schema.GroupVersionResource{Group: "policy", Version: "v1beta1", Resource: "evictions"}
-var evictionsKind = schema.GroupVersionKind{Group: "policy", Version: "v1beta1", Kind: "Eviction"}
-
-type evictionsClusterClient struct {
-	*kcptesting.Fake
+// evictionClusterClient implements EvictionClusterInterface
+type evictionClusterClient struct {
+	*kcpgentype.FakeClusterClient[*policyv1beta1.Eviction]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *evictionsClusterClient) Cluster(clusterPath logicalcluster.Path) kcppolicyv1beta1.EvictionsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
+func newFakeEvictionClusterClient(fake *PolicyV1beta1ClusterClient) typedkcppolicyv1beta1.EvictionClusterInterface {
+	return &evictionClusterClient{
+		kcpgentype.NewFakeClusterClient[*policyv1beta1.Eviction](
+			fake.Fake,
+			policyv1beta1.SchemeGroupVersion.WithResource("evictions"),
+			policyv1beta1.SchemeGroupVersion.WithKind("Eviction"),
+			func() *policyv1beta1.Eviction { return &policyv1beta1.Eviction{} },
+		),
+		fake.Fake,
 	}
+}
 
-	return &evictionsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
+func (c *evictionClusterClient) Cluster(cluster logicalcluster.Path) typedkcppolicyv1beta1.EvictionsNamespacer {
+	return &evictionNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type evictionsNamespacer struct {
+type evictionNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *evictionsNamespacer) Namespace(namespace string) policyv1beta1client.EvictionInterface {
-	return &evictionsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *evictionNamespacer) Namespace(namespace string) typedpolicyv1beta1.EvictionInterface {
+	return newFakeEvictionClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type evictionsClient struct {
-	*kcptesting.Fake
+// evictionScopedClient implements EvictionInterface
+type evictionScopedClient struct {
+	*kcpgentype.FakeClient[*policyv1beta1.Eviction]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
+}
+
+func newFakeEvictionClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedpolicyv1beta1.EvictionInterface {
+	return &evictionScopedClient{
+		kcpgentype.NewFakeClient[*policyv1beta1.Eviction](
+			fake,
+			clusterPath,
+			namespace,
+			policyv1beta1.SchemeGroupVersion.WithResource("evictions"),
+			policyv1beta1.SchemeGroupVersion.WithKind("Eviction"),
+			func() *policyv1beta1.Eviction { return &policyv1beta1.Eviction{} },
+		),
+		fake,
+		clusterPath,
+	}
 }
diff --git a/kubernetes/typed/policy/v1beta1/fake/fake_eviction_expansion.go b/kubernetes/typed/policy/v1beta1/fake/fake_eviction_expansion.go
index e3cfd40ac..1199d32a0 100644
--- a/kubernetes/typed/policy/v1beta1/fake/fake_eviction_expansion.go
+++ b/kubernetes/typed/policy/v1beta1/fake/fake_eviction_expansion.go
@@ -26,10 +26,10 @@ import (
 	core "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
 )
 
-func (c *evictionsClient) Evict(ctx context.Context, eviction *policy.Eviction) error {
+func (c *evictionScopedClient) Evict(ctx context.Context, eviction *policy.Eviction) error {
 	action := core.CreateActionImpl{}
 	action.Verb = "create"
-	action.Namespace = c.Namespace
+	action.Namespace = c.Namespace()
 	action.ClusterPath = c.ClusterPath
 	action.Resource = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "pods"}
 	action.Subresource = "eviction"
diff --git a/kubernetes/typed/policy/v1beta1/fake/poddisruptionbudget.go b/kubernetes/typed/policy/v1beta1/fake/poddisruptionbudget.go
index 3a07ff015..7a8e7a7f8 100644
--- a/kubernetes/typed/policy/v1beta1/fake/poddisruptionbudget.go
+++ b/kubernetes/typed/policy/v1beta1/fake/poddisruptionbudget.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	policyv1beta1 "k8s.io/api/policy/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationspolicyv1beta1 "k8s.io/client-go/applyconfigurations/policy/v1beta1"
-	policyv1beta1client "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/policy/v1beta1"
+	typedpolicyv1beta1 "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
 
-	kcppolicyv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1beta1"
+	typedkcppolicyv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var podDisruptionBudgetsResource = schema.GroupVersionResource{Group: "policy", Version: "v1beta1", Resource: "poddisruptionbudgets"}
-var podDisruptionBudgetsKind = schema.GroupVersionKind{Group: "policy", Version: "v1beta1", Kind: "PodDisruptionBudget"}
-
-type podDisruptionBudgetsClusterClient struct {
-	*kcptesting.Fake
+// podDisruptionBudgetClusterClient implements PodDisruptionBudgetClusterInterface
+type podDisruptionBudgetClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*policyv1beta1.PodDisruptionBudget, *policyv1beta1.PodDisruptionBudgetList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *podDisruptionBudgetsClusterClient) Cluster(clusterPath logicalcluster.Path) kcppolicyv1beta1.PodDisruptionBudgetsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &podDisruptionBudgetsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PodDisruptionBudgets that match those selectors across all clusters.
-func (c *podDisruptionBudgetsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*policyv1beta1.PodDisruptionBudgetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(podDisruptionBudgetsResource, podDisruptionBudgetsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &policyv1beta1.PodDisruptionBudgetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakePodDisruptionBudgetClusterClient(fake *PolicyV1beta1ClusterClient) typedkcppolicyv1beta1.PodDisruptionBudgetClusterInterface {
+	return &podDisruptionBudgetClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*policyv1beta1.PodDisruptionBudget, *policyv1beta1.PodDisruptionBudgetList](
+			fake.Fake,
+			policyv1beta1.SchemeGroupVersion.WithResource("poddisruptionbudgets"),
+			policyv1beta1.SchemeGroupVersion.WithKind("PodDisruptionBudget"),
+			func() *policyv1beta1.PodDisruptionBudget { return &policyv1beta1.PodDisruptionBudget{} },
+			func() *policyv1beta1.PodDisruptionBudgetList { return &policyv1beta1.PodDisruptionBudgetList{} },
+			func(dst, src *policyv1beta1.PodDisruptionBudgetList) { dst.ListMeta = src.ListMeta },
+			func(list *policyv1beta1.PodDisruptionBudgetList) []*policyv1beta1.PodDisruptionBudget {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *policyv1beta1.PodDisruptionBudgetList, items []*policyv1beta1.PodDisruptionBudget) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &policyv1beta1.PodDisruptionBudgetList{ListMeta: obj.(*policyv1beta1.PodDisruptionBudgetList).ListMeta}
-	for _, item := range obj.(*policyv1beta1.PodDisruptionBudgetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested PodDisruptionBudgets across all clusters.
-func (c *podDisruptionBudgetsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(podDisruptionBudgetsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *podDisruptionBudgetClusterClient) Cluster(cluster logicalcluster.Path) typedkcppolicyv1beta1.PodDisruptionBudgetsNamespacer {
+	return &podDisruptionBudgetNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type podDisruptionBudgetsNamespacer struct {
+type podDisruptionBudgetNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *podDisruptionBudgetsNamespacer) Namespace(namespace string) policyv1beta1client.PodDisruptionBudgetInterface {
-	return &podDisruptionBudgetsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *podDisruptionBudgetNamespacer) Namespace(namespace string) typedpolicyv1beta1.PodDisruptionBudgetInterface {
+	return newFakePodDisruptionBudgetClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type podDisruptionBudgetsClient struct {
-	*kcptesting.Fake
+// podDisruptionBudgetScopedClient implements PodDisruptionBudgetInterface
+type podDisruptionBudgetScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*policyv1beta1.PodDisruptionBudget, *policyv1beta1.PodDisruptionBudgetList, *v1beta1.PodDisruptionBudgetApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *podDisruptionBudgetsClient) Create(ctx context.Context, podDisruptionBudget *policyv1beta1.PodDisruptionBudget, opts metav1.CreateOptions) (*policyv1beta1.PodDisruptionBudget, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, podDisruptionBudget), &policyv1beta1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodDisruptionBudget), err
-}
-
-func (c *podDisruptionBudgetsClient) Update(ctx context.Context, podDisruptionBudget *policyv1beta1.PodDisruptionBudget, opts metav1.UpdateOptions) (*policyv1beta1.PodDisruptionBudget, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, podDisruptionBudget), &policyv1beta1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodDisruptionBudget), err
-}
-
-func (c *podDisruptionBudgetsClient) UpdateStatus(ctx context.Context, podDisruptionBudget *policyv1beta1.PodDisruptionBudget, opts metav1.UpdateOptions) (*policyv1beta1.PodDisruptionBudget, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(podDisruptionBudgetsResource, c.ClusterPath, "status", c.Namespace, podDisruptionBudget), &policyv1beta1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodDisruptionBudget), err
-}
-
-func (c *podDisruptionBudgetsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, name, opts), &policyv1beta1.PodDisruptionBudget{})
-	return err
 }
 
-func (c *podDisruptionBudgetsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &policyv1beta1.PodDisruptionBudgetList{})
-	return err
-}
-
-func (c *podDisruptionBudgetsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*policyv1beta1.PodDisruptionBudget, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, name), &policyv1beta1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodDisruptionBudget), err
-}
-
-// List takes label and field selectors, and returns the list of PodDisruptionBudgets that match those selectors.
-func (c *podDisruptionBudgetsClient) List(ctx context.Context, opts metav1.ListOptions) (*policyv1beta1.PodDisruptionBudgetList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(podDisruptionBudgetsResource, podDisruptionBudgetsKind, c.ClusterPath, c.Namespace, opts), &policyv1beta1.PodDisruptionBudgetList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &policyv1beta1.PodDisruptionBudgetList{ListMeta: obj.(*policyv1beta1.PodDisruptionBudgetList).ListMeta}
-	for _, item := range obj.(*policyv1beta1.PodDisruptionBudgetList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *podDisruptionBudgetsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *podDisruptionBudgetsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*policyv1beta1.PodDisruptionBudget, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &policyv1beta1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodDisruptionBudget), err
-}
-
-func (c *podDisruptionBudgetsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationspolicyv1beta1.PodDisruptionBudgetApplyConfiguration, opts metav1.ApplyOptions) (*policyv1beta1.PodDisruptionBudget, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &policyv1beta1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodDisruptionBudget), err
-}
-
-func (c *podDisruptionBudgetsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationspolicyv1beta1.PodDisruptionBudgetApplyConfiguration, opts metav1.ApplyOptions) (*policyv1beta1.PodDisruptionBudget, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podDisruptionBudgetsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &policyv1beta1.PodDisruptionBudget{})
-	if obj == nil {
-		return nil, err
+func newFakePodDisruptionBudgetClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedpolicyv1beta1.PodDisruptionBudgetInterface {
+	return &podDisruptionBudgetScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*policyv1beta1.PodDisruptionBudget, *policyv1beta1.PodDisruptionBudgetList, *v1beta1.PodDisruptionBudgetApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			policyv1beta1.SchemeGroupVersion.WithResource("poddisruptionbudgets"),
+			policyv1beta1.SchemeGroupVersion.WithKind("PodDisruptionBudget"),
+			func() *policyv1beta1.PodDisruptionBudget { return &policyv1beta1.PodDisruptionBudget{} },
+			func() *policyv1beta1.PodDisruptionBudgetList { return &policyv1beta1.PodDisruptionBudgetList{} },
+			func(dst, src *policyv1beta1.PodDisruptionBudgetList) { dst.ListMeta = src.ListMeta },
+			func(list *policyv1beta1.PodDisruptionBudgetList) []*policyv1beta1.PodDisruptionBudget {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *policyv1beta1.PodDisruptionBudgetList, items []*policyv1beta1.PodDisruptionBudget) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*policyv1beta1.PodDisruptionBudget), err
 }
diff --git a/kubernetes/typed/policy/v1beta1/fake/podsecuritypolicy.go b/kubernetes/typed/policy/v1beta1/fake/podsecuritypolicy.go
deleted file mode 100644
index eee24ded5..000000000
--- a/kubernetes/typed/policy/v1beta1/fake/podsecuritypolicy.go
+++ /dev/null
@@ -1,202 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	policyv1beta1 "k8s.io/api/policy/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationspolicyv1beta1 "k8s.io/client-go/applyconfigurations/policy/v1beta1"
-	policyv1beta1client "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
-	"k8s.io/client-go/testing"
-
-	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
-)
-
-var podSecurityPoliciesResource = schema.GroupVersionResource{Group: "policy", Version: "v1beta1", Resource: "podsecuritypolicies"}
-var podSecurityPoliciesKind = schema.GroupVersionKind{Group: "policy", Version: "v1beta1", Kind: "PodSecurityPolicy"}
-
-type podSecurityPoliciesClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *podSecurityPoliciesClusterClient) Cluster(clusterPath logicalcluster.Path) policyv1beta1client.PodSecurityPolicyInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &podSecurityPoliciesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PodSecurityPolicies that match those selectors across all clusters.
-func (c *podSecurityPoliciesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*policyv1beta1.PodSecurityPolicyList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(podSecurityPoliciesResource, podSecurityPoliciesKind, logicalcluster.Wildcard, opts), &policyv1beta1.PodSecurityPolicyList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &policyv1beta1.PodSecurityPolicyList{ListMeta: obj.(*policyv1beta1.PodSecurityPolicyList).ListMeta}
-	for _, item := range obj.(*policyv1beta1.PodSecurityPolicyList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested PodSecurityPolicies across all clusters.
-func (c *podSecurityPoliciesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(podSecurityPoliciesResource, logicalcluster.Wildcard, opts))
-}
-
-type podSecurityPoliciesClient struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-}
-
-func (c *podSecurityPoliciesClient) Create(ctx context.Context, podSecurityPolicy *policyv1beta1.PodSecurityPolicy, opts metav1.CreateOptions) (*policyv1beta1.PodSecurityPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(podSecurityPoliciesResource, c.ClusterPath, podSecurityPolicy), &policyv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodSecurityPolicy), err
-}
-
-func (c *podSecurityPoliciesClient) Update(ctx context.Context, podSecurityPolicy *policyv1beta1.PodSecurityPolicy, opts metav1.UpdateOptions) (*policyv1beta1.PodSecurityPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(podSecurityPoliciesResource, c.ClusterPath, podSecurityPolicy), &policyv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodSecurityPolicy), err
-}
-
-func (c *podSecurityPoliciesClient) UpdateStatus(ctx context.Context, podSecurityPolicy *policyv1beta1.PodSecurityPolicy, opts metav1.UpdateOptions) (*policyv1beta1.PodSecurityPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(podSecurityPoliciesResource, c.ClusterPath, "status", podSecurityPolicy), &policyv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodSecurityPolicy), err
-}
-
-func (c *podSecurityPoliciesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(podSecurityPoliciesResource, c.ClusterPath, name, opts), &policyv1beta1.PodSecurityPolicy{})
-	return err
-}
-
-func (c *podSecurityPoliciesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(podSecurityPoliciesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &policyv1beta1.PodSecurityPolicyList{})
-	return err
-}
-
-func (c *podSecurityPoliciesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*policyv1beta1.PodSecurityPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(podSecurityPoliciesResource, c.ClusterPath, name), &policyv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodSecurityPolicy), err
-}
-
-// List takes label and field selectors, and returns the list of PodSecurityPolicies that match those selectors.
-func (c *podSecurityPoliciesClient) List(ctx context.Context, opts metav1.ListOptions) (*policyv1beta1.PodSecurityPolicyList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(podSecurityPoliciesResource, podSecurityPoliciesKind, c.ClusterPath, opts), &policyv1beta1.PodSecurityPolicyList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &policyv1beta1.PodSecurityPolicyList{ListMeta: obj.(*policyv1beta1.PodSecurityPolicyList).ListMeta}
-	for _, item := range obj.(*policyv1beta1.PodSecurityPolicyList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *podSecurityPoliciesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(podSecurityPoliciesResource, c.ClusterPath, opts))
-}
-
-func (c *podSecurityPoliciesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*policyv1beta1.PodSecurityPolicy, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(podSecurityPoliciesResource, c.ClusterPath, name, pt, data, subresources...), &policyv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodSecurityPolicy), err
-}
-
-func (c *podSecurityPoliciesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationspolicyv1beta1.PodSecurityPolicyApplyConfiguration, opts metav1.ApplyOptions) (*policyv1beta1.PodSecurityPolicy, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(podSecurityPoliciesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &policyv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodSecurityPolicy), err
-}
-
-func (c *podSecurityPoliciesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationspolicyv1beta1.PodSecurityPolicyApplyConfiguration, opts metav1.ApplyOptions) (*policyv1beta1.PodSecurityPolicy, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(podSecurityPoliciesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &policyv1beta1.PodSecurityPolicy{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*policyv1beta1.PodSecurityPolicy), err
-}
diff --git a/kubernetes/typed/policy/v1beta1/fake/policy_client.go b/kubernetes/typed/policy/v1beta1/fake/policy_client.go
index 6da0ba5cb..f729352f4 100644
--- a/kubernetes/typed/policy/v1beta1/fake/policy_client.go
+++ b/kubernetes/typed/policy/v1beta1/fake/policy_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	policyv1beta1 "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcppolicyv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/policy/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcppolicyv1beta1.PolicyV1beta1ClusterInterface = (*PolicyV1beta1ClusterClient)(nil)
@@ -44,38 +40,30 @@ func (c *PolicyV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) po
 	return &PolicyV1beta1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *PolicyV1beta1ClusterClient) PodDisruptionBudgets() kcppolicyv1beta1.PodDisruptionBudgetClusterInterface {
-	return &podDisruptionBudgetsClusterClient{Fake: c.Fake}
-}
-
 func (c *PolicyV1beta1ClusterClient) Evictions() kcppolicyv1beta1.EvictionClusterInterface {
-	return &evictionsClusterClient{Fake: c.Fake}
+	return newFakeEvictionClusterClient(c)
 }
 
-func (c *PolicyV1beta1ClusterClient) PodSecurityPolicies() kcppolicyv1beta1.PodSecurityPolicyClusterInterface {
-	return &podSecurityPoliciesClusterClient{Fake: c.Fake}
+func (c *PolicyV1beta1ClusterClient) PodDisruptionBudgets() kcppolicyv1beta1.PodDisruptionBudgetClusterInterface {
+	return newFakePodDisruptionBudgetClusterClient(c)
 }
 
-var _ policyv1beta1.PolicyV1beta1Interface = (*PolicyV1beta1Client)(nil)
-
 type PolicyV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *PolicyV1beta1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *PolicyV1beta1Client) Evictions(namespace string) policyv1beta1.EvictionInterface {
+	return newFakeEvictionClient(c.Fake, namespace, c.ClusterPath)
 }
 
 func (c *PolicyV1beta1Client) PodDisruptionBudgets(namespace string) policyv1beta1.PodDisruptionBudgetInterface {
-	return &podDisruptionBudgetsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+	return newFakePodDisruptionBudgetClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *PolicyV1beta1Client) Evictions(namespace string) policyv1beta1.EvictionInterface {
-	return &evictionsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
-
-func (c *PolicyV1beta1Client) PodSecurityPolicies() policyv1beta1.PodSecurityPolicyInterface {
-	return &podSecurityPoliciesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *PolicyV1beta1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/policy/v1beta1/generated_expansion.go b/kubernetes/typed/policy/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..fb03d2192
--- /dev/null
+++ b/kubernetes/typed/policy/v1beta1/generated_expansion.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type EvictionClusterExpansion interface{}
+
+type PodDisruptionBudgetClusterExpansion interface{}
diff --git a/kubernetes/typed/policy/v1beta1/poddisruptionbudget.go b/kubernetes/typed/policy/v1beta1/poddisruptionbudget.go
index 4d6ed8a52..411a36a6d 100644
--- a/kubernetes/typed/policy/v1beta1/poddisruptionbudget.go
+++ b/kubernetes/typed/policy/v1beta1/poddisruptionbudget.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	policyv1beta1 "k8s.io/api/policy/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedpolicyv1beta1 "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	policyv1beta1 "k8s.io/api/policy/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	policyv1beta1client "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
 )
 
 // PodDisruptionBudgetsClusterGetter has a method to return a PodDisruptionBudgetClusterInterface.
@@ -43,12 +40,13 @@ type PodDisruptionBudgetsClusterGetter interface {
 // or scope down to one cluster and return a PodDisruptionBudgetsNamespacer.
 type PodDisruptionBudgetClusterInterface interface {
 	Cluster(logicalcluster.Path) PodDisruptionBudgetsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*policyv1beta1.PodDisruptionBudgetList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*policyv1beta1.PodDisruptionBudgetList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	PodDisruptionBudgetClusterExpansion
 }
 
 type podDisruptionBudgetsClusterInterface struct {
-	clientCache kcpclient.Cache[*policyv1beta1client.PolicyV1beta1Client]
+	clientCache kcpclient.Cache[*typedpolicyv1beta1.PolicyV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *podDisruptionBudgetsClusterInterface) Cluster(clusterPath logicalcluste
 }
 
 // List returns the entire collection of all PodDisruptionBudgets across all clusters.
-func (c *podDisruptionBudgetsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*policyv1beta1.PodDisruptionBudgetList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PodDisruptionBudgets(metav1.NamespaceAll).List(ctx, opts)
+func (c *podDisruptionBudgetsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*policyv1beta1.PodDisruptionBudgetList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PodDisruptionBudgets(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all PodDisruptionBudgets across all clusters.
-func (c *podDisruptionBudgetsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PodDisruptionBudgets(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *podDisruptionBudgetsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PodDisruptionBudgets(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// PodDisruptionBudgetsNamespacer can scope to objects within a namespace, returning a policyv1beta1client.PodDisruptionBudgetInterface.
+// PodDisruptionBudgetsNamespacer can scope to objects within a namespace, returning a typedpolicyv1beta1.PodDisruptionBudgetInterface.
 type PodDisruptionBudgetsNamespacer interface {
-	Namespace(string) policyv1beta1client.PodDisruptionBudgetInterface
+	Namespace(string) typedpolicyv1beta1.PodDisruptionBudgetInterface
 }
 
 type podDisruptionBudgetsNamespacer struct {
-	clientCache kcpclient.Cache[*policyv1beta1client.PolicyV1beta1Client]
+	clientCache kcpclient.Cache[*typedpolicyv1beta1.PolicyV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *podDisruptionBudgetsNamespacer) Namespace(namespace string) policyv1beta1client.PodDisruptionBudgetInterface {
+func (n *podDisruptionBudgetsNamespacer) Namespace(namespace string) typedpolicyv1beta1.PodDisruptionBudgetInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).PodDisruptionBudgets(namespace)
 }
diff --git a/kubernetes/typed/policy/v1beta1/podsecuritypolicy.go b/kubernetes/typed/policy/v1beta1/podsecuritypolicy.go
deleted file mode 100644
index 4b4361c1e..000000000
--- a/kubernetes/typed/policy/v1beta1/podsecuritypolicy.go
+++ /dev/null
@@ -1,71 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1beta1
-
-import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	policyv1beta1 "k8s.io/api/policy/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	policyv1beta1client "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
-)
-
-// PodSecurityPoliciesClusterGetter has a method to return a PodSecurityPolicyClusterInterface.
-// A group's cluster client should implement this interface.
-type PodSecurityPoliciesClusterGetter interface {
-	PodSecurityPolicies() PodSecurityPolicyClusterInterface
-}
-
-// PodSecurityPolicyClusterInterface can operate on PodSecurityPolicies across all clusters,
-// or scope down to one cluster and return a policyv1beta1client.PodSecurityPolicyInterface.
-type PodSecurityPolicyClusterInterface interface {
-	Cluster(logicalcluster.Path) policyv1beta1client.PodSecurityPolicyInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*policyv1beta1.PodSecurityPolicyList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
-}
-
-type podSecurityPoliciesClusterInterface struct {
-	clientCache kcpclient.Cache[*policyv1beta1client.PolicyV1beta1Client]
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *podSecurityPoliciesClusterInterface) Cluster(clusterPath logicalcluster.Path) policyv1beta1client.PodSecurityPolicyInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return c.clientCache.ClusterOrDie(clusterPath).PodSecurityPolicies()
-}
-
-// List returns the entire collection of all PodSecurityPolicies across all clusters.
-func (c *podSecurityPoliciesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*policyv1beta1.PodSecurityPolicyList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PodSecurityPolicies().List(ctx, opts)
-}
-
-// Watch begins to watch all PodSecurityPolicies across all clusters.
-func (c *podSecurityPoliciesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PodSecurityPolicies().Watch(ctx, opts)
-}
diff --git a/kubernetes/typed/policy/v1beta1/policy_client.go b/kubernetes/typed/policy/v1beta1/policy_client.go
index b0cbd5460..82695cee2 100644
--- a/kubernetes/typed/policy/v1beta1/policy_client.go
+++ b/kubernetes/typed/policy/v1beta1/policy_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,31 +14,33 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apipolicyv1beta1 "k8s.io/api/policy/v1beta1"
+	policyv1beta1 "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	policyv1beta1 "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type PolicyV1beta1ClusterInterface interface {
 	PolicyV1beta1ClusterScoper
-	PodDisruptionBudgetsClusterGetter
 	EvictionsClusterGetter
-	PodSecurityPoliciesClusterGetter
+	PodDisruptionBudgetsClusterGetter
 }
 
 type PolicyV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) policyv1beta1.PolicyV1beta1Interface
 }
 
+// PolicyV1beta1ClusterClient is used to interact with features provided by the policy group.
 type PolicyV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*policyv1beta1.PolicyV1beta1Client]
 }
@@ -53,27 +52,25 @@ func (c *PolicyV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) po
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *PolicyV1beta1ClusterClient) PodDisruptionBudgets() PodDisruptionBudgetClusterInterface {
-	return &podDisruptionBudgetsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *PolicyV1beta1ClusterClient) Evictions() EvictionClusterInterface {
 	return &evictionsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *PolicyV1beta1ClusterClient) PodSecurityPolicies() PodSecurityPolicyClusterInterface {
-	return &podSecurityPoliciesClusterInterface{clientCache: c.clientCache}
+func (c *PolicyV1beta1ClusterClient) PodDisruptionBudgets() PodDisruptionBudgetClusterInterface {
+	return &podDisruptionBudgetsClusterInterface{clientCache: c.clientCache}
 }
 
 // NewForConfig creates a new PolicyV1beta1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*PolicyV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new PolicyV1beta1ClusterClient for the given config and http client.
@@ -85,6 +82,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*PolicyV1beta1Cluste
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &PolicyV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -97,3 +95,14 @@ func NewForConfigOrDie(c *rest.Config) *PolicyV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apipolicyv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/rbac/v1/clusterrole.go b/kubernetes/typed/rbac/v1/clusterrole.go
index 3dbd1c356..e33cef278 100644
--- a/kubernetes/typed/rbac/v1/clusterrole.go
+++ b/kubernetes/typed/rbac/v1/clusterrole.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apirbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1 "k8s.io/client-go/kubernetes/typed/rbac/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	rbacv1client "k8s.io/client-go/kubernetes/typed/rbac/v1"
 )
 
 // ClusterRolesClusterGetter has a method to return a ClusterRoleClusterInterface.
@@ -40,19 +37,20 @@ type ClusterRolesClusterGetter interface {
 }
 
 // ClusterRoleClusterInterface can operate on ClusterRoles across all clusters,
-// or scope down to one cluster and return a rbacv1client.ClusterRoleInterface.
+// or scope down to one cluster and return a rbacv1.ClusterRoleInterface.
 type ClusterRoleClusterInterface interface {
-	Cluster(logicalcluster.Path) rbacv1client.ClusterRoleInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.ClusterRoleList, error)
+	Cluster(logicalcluster.Path) rbacv1.ClusterRoleInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apirbacv1.ClusterRoleList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ClusterRoleClusterExpansion
 }
 
 type clusterRolesClusterInterface struct {
-	clientCache kcpclient.Cache[*rbacv1client.RbacV1Client]
+	clientCache kcpclient.Cache[*rbacv1.RbacV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *clusterRolesClusterInterface) Cluster(clusterPath logicalcluster.Path) rbacv1client.ClusterRoleInterface {
+func (c *clusterRolesClusterInterface) Cluster(clusterPath logicalcluster.Path) rbacv1.ClusterRoleInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *clusterRolesClusterInterface) Cluster(clusterPath logicalcluster.Path)
 }
 
 // List returns the entire collection of all ClusterRoles across all clusters.
-func (c *clusterRolesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.ClusterRoleList, error) {
+func (c *clusterRolesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apirbacv1.ClusterRoleList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterRoles().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/rbac/v1/clusterrolebinding.go b/kubernetes/typed/rbac/v1/clusterrolebinding.go
index 7ba43c6ab..3cceb5d21 100644
--- a/kubernetes/typed/rbac/v1/clusterrolebinding.go
+++ b/kubernetes/typed/rbac/v1/clusterrolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apirbacv1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1 "k8s.io/client-go/kubernetes/typed/rbac/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	rbacv1client "k8s.io/client-go/kubernetes/typed/rbac/v1"
 )
 
 // ClusterRoleBindingsClusterGetter has a method to return a ClusterRoleBindingClusterInterface.
@@ -40,19 +37,20 @@ type ClusterRoleBindingsClusterGetter interface {
 }
 
 // ClusterRoleBindingClusterInterface can operate on ClusterRoleBindings across all clusters,
-// or scope down to one cluster and return a rbacv1client.ClusterRoleBindingInterface.
+// or scope down to one cluster and return a rbacv1.ClusterRoleBindingInterface.
 type ClusterRoleBindingClusterInterface interface {
-	Cluster(logicalcluster.Path) rbacv1client.ClusterRoleBindingInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.ClusterRoleBindingList, error)
+	Cluster(logicalcluster.Path) rbacv1.ClusterRoleBindingInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apirbacv1.ClusterRoleBindingList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	ClusterRoleBindingClusterExpansion
 }
 
 type clusterRoleBindingsClusterInterface struct {
-	clientCache kcpclient.Cache[*rbacv1client.RbacV1Client]
+	clientCache kcpclient.Cache[*rbacv1.RbacV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *clusterRoleBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path) rbacv1client.ClusterRoleBindingInterface {
+func (c *clusterRoleBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path) rbacv1.ClusterRoleBindingInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *clusterRoleBindingsClusterInterface) Cluster(clusterPath logicalcluster
 }
 
 // List returns the entire collection of all ClusterRoleBindings across all clusters.
-func (c *clusterRoleBindingsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.ClusterRoleBindingList, error) {
+func (c *clusterRoleBindingsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apirbacv1.ClusterRoleBindingList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterRoleBindings().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/rbac/v1/doc.go b/kubernetes/typed/rbac/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/rbac/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/rbac/v1/fake/clusterrole.go b/kubernetes/typed/rbac/v1/fake/clusterrole.go
index 1e2d3d321..3e98289d4 100644
--- a/kubernetes/typed/rbac/v1/fake/clusterrole.go
+++ b/kubernetes/typed/rbac/v1/fake/clusterrole.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,73 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsrbacv1 "k8s.io/client-go/applyconfigurations/rbac/v1"
-	rbacv1client "k8s.io/client-go/kubernetes/typed/rbac/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/rbac/v1"
+	typedrbacv1 "k8s.io/client-go/kubernetes/typed/rbac/v1"
 
+	typedkcprbacv1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var clusterRolesResource = schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1", Resource: "clusterroles"}
-var clusterRolesKind = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1", Kind: "ClusterRole"}
-
-type clusterRolesClusterClient struct {
-	*kcptesting.Fake
+// clusterRoleClusterClient implements ClusterRoleClusterInterface
+type clusterRoleClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*rbacv1.ClusterRole, *rbacv1.ClusterRoleList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *clusterRolesClusterClient) Cluster(clusterPath logicalcluster.Path) rbacv1client.ClusterRoleInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &clusterRolesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ClusterRoles that match those selectors across all clusters.
-func (c *clusterRolesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.ClusterRoleList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterRolesResource, clusterRolesKind, logicalcluster.Wildcard, opts), &rbacv1.ClusterRoleList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1.ClusterRoleList{ListMeta: obj.(*rbacv1.ClusterRoleList).ListMeta}
-	for _, item := range obj.(*rbacv1.ClusterRoleList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeClusterRoleClusterClient(fake *RbacV1ClusterClient) typedkcprbacv1.ClusterRoleClusterInterface {
+	return &clusterRoleClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*rbacv1.ClusterRole, *rbacv1.ClusterRoleList](
+			fake.Fake,
+			rbacv1.SchemeGroupVersion.WithResource("clusterroles"),
+			rbacv1.SchemeGroupVersion.WithKind("ClusterRole"),
+			func() *rbacv1.ClusterRole { return &rbacv1.ClusterRole{} },
+			func() *rbacv1.ClusterRoleList { return &rbacv1.ClusterRoleList{} },
+			func(dst, src *rbacv1.ClusterRoleList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1.ClusterRoleList) []*rbacv1.ClusterRole { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *rbacv1.ClusterRoleList, items []*rbacv1.ClusterRole) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ClusterRoles across all clusters.
-func (c *clusterRolesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterRolesResource, logicalcluster.Wildcard, opts))
+func (c *clusterRoleClusterClient) Cluster(cluster logicalcluster.Path) typedrbacv1.ClusterRoleInterface {
+	return newFakeClusterRoleClient(c.Fake, cluster)
 }
 
-type clusterRolesClient struct {
-	*kcptesting.Fake
+// clusterRoleScopedClient implements ClusterRoleInterface
+type clusterRoleScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*rbacv1.ClusterRole, *rbacv1.ClusterRoleList, *v1.ClusterRoleApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *clusterRolesClient) Create(ctx context.Context, clusterRole *rbacv1.ClusterRole, opts metav1.CreateOptions) (*rbacv1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(clusterRolesResource, c.ClusterPath, clusterRole), &rbacv1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) Update(ctx context.Context, clusterRole *rbacv1.ClusterRole, opts metav1.UpdateOptions) (*rbacv1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(clusterRolesResource, c.ClusterPath, clusterRole), &rbacv1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) UpdateStatus(ctx context.Context, clusterRole *rbacv1.ClusterRole, opts metav1.UpdateOptions) (*rbacv1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(clusterRolesResource, c.ClusterPath, "status", clusterRole), &rbacv1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(clusterRolesResource, c.ClusterPath, name, opts), &rbacv1.ClusterRole{})
-	return err
-}
-
-func (c *clusterRolesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(clusterRolesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &rbacv1.ClusterRoleList{})
-	return err
-}
-
-func (c *clusterRolesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*rbacv1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(clusterRolesResource, c.ClusterPath, name), &rbacv1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.ClusterRole), err
-}
-
-// List takes label and field selectors, and returns the list of ClusterRoles that match those selectors.
-func (c *clusterRolesClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.ClusterRoleList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterRolesResource, clusterRolesKind, c.ClusterPath, opts), &rbacv1.ClusterRoleList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1.ClusterRoleList{ListMeta: obj.(*rbacv1.ClusterRoleList).ListMeta}
-	for _, item := range obj.(*rbacv1.ClusterRoleList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *clusterRolesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterRolesResource, c.ClusterPath, opts))
-}
-
-func (c *clusterRolesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*rbacv1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRolesResource, c.ClusterPath, name, pt, data, subresources...), &rbacv1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1.ClusterRoleApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1.ClusterRole, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRolesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &rbacv1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1.ClusterRoleApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1.ClusterRole, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRolesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &rbacv1.ClusterRole{})
-	if obj == nil {
-		return nil, err
+func newFakeClusterRoleClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedrbacv1.ClusterRoleInterface {
+	return &clusterRoleScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*rbacv1.ClusterRole, *rbacv1.ClusterRoleList, *v1.ClusterRoleApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			rbacv1.SchemeGroupVersion.WithResource("clusterroles"),
+			rbacv1.SchemeGroupVersion.WithKind("ClusterRole"),
+			func() *rbacv1.ClusterRole { return &rbacv1.ClusterRole{} },
+			func() *rbacv1.ClusterRoleList { return &rbacv1.ClusterRoleList{} },
+			func(dst, src *rbacv1.ClusterRoleList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1.ClusterRoleList) []*rbacv1.ClusterRole { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *rbacv1.ClusterRoleList, items []*rbacv1.ClusterRole) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*rbacv1.ClusterRole), err
 }
diff --git a/kubernetes/typed/rbac/v1/fake/clusterrolebinding.go b/kubernetes/typed/rbac/v1/fake/clusterrolebinding.go
index 656c9a2d6..dc08c5d55 100644
--- a/kubernetes/typed/rbac/v1/fake/clusterrolebinding.go
+++ b/kubernetes/typed/rbac/v1/fake/clusterrolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsrbacv1 "k8s.io/client-go/applyconfigurations/rbac/v1"
-	rbacv1client "k8s.io/client-go/kubernetes/typed/rbac/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/rbac/v1"
+	typedrbacv1 "k8s.io/client-go/kubernetes/typed/rbac/v1"
 
+	typedkcprbacv1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var clusterRoleBindingsResource = schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1", Resource: "clusterrolebindings"}
-var clusterRoleBindingsKind = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1", Kind: "ClusterRoleBinding"}
-
-type clusterRoleBindingsClusterClient struct {
-	*kcptesting.Fake
+// clusterRoleBindingClusterClient implements ClusterRoleBindingClusterInterface
+type clusterRoleBindingClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*rbacv1.ClusterRoleBinding, *rbacv1.ClusterRoleBindingList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *clusterRoleBindingsClusterClient) Cluster(clusterPath logicalcluster.Path) rbacv1client.ClusterRoleBindingInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &clusterRoleBindingsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ClusterRoleBindings that match those selectors across all clusters.
-func (c *clusterRoleBindingsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.ClusterRoleBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterRoleBindingsResource, clusterRoleBindingsKind, logicalcluster.Wildcard, opts), &rbacv1.ClusterRoleBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1.ClusterRoleBindingList{ListMeta: obj.(*rbacv1.ClusterRoleBindingList).ListMeta}
-	for _, item := range obj.(*rbacv1.ClusterRoleBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeClusterRoleBindingClusterClient(fake *RbacV1ClusterClient) typedkcprbacv1.ClusterRoleBindingClusterInterface {
+	return &clusterRoleBindingClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*rbacv1.ClusterRoleBinding, *rbacv1.ClusterRoleBindingList](
+			fake.Fake,
+			rbacv1.SchemeGroupVersion.WithResource("clusterrolebindings"),
+			rbacv1.SchemeGroupVersion.WithKind("ClusterRoleBinding"),
+			func() *rbacv1.ClusterRoleBinding { return &rbacv1.ClusterRoleBinding{} },
+			func() *rbacv1.ClusterRoleBindingList { return &rbacv1.ClusterRoleBindingList{} },
+			func(dst, src *rbacv1.ClusterRoleBindingList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1.ClusterRoleBindingList) []*rbacv1.ClusterRoleBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1.ClusterRoleBindingList, items []*rbacv1.ClusterRoleBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ClusterRoleBindings across all clusters.
-func (c *clusterRoleBindingsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterRoleBindingsResource, logicalcluster.Wildcard, opts))
+func (c *clusterRoleBindingClusterClient) Cluster(cluster logicalcluster.Path) typedrbacv1.ClusterRoleBindingInterface {
+	return newFakeClusterRoleBindingClient(c.Fake, cluster)
 }
 
-type clusterRoleBindingsClient struct {
-	*kcptesting.Fake
+// clusterRoleBindingScopedClient implements ClusterRoleBindingInterface
+type clusterRoleBindingScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*rbacv1.ClusterRoleBinding, *rbacv1.ClusterRoleBindingList, *v1.ClusterRoleBindingApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *clusterRoleBindingsClient) Create(ctx context.Context, clusterRoleBinding *rbacv1.ClusterRoleBinding, opts metav1.CreateOptions) (*rbacv1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(clusterRoleBindingsResource, c.ClusterPath, clusterRoleBinding), &rbacv1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) Update(ctx context.Context, clusterRoleBinding *rbacv1.ClusterRoleBinding, opts metav1.UpdateOptions) (*rbacv1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(clusterRoleBindingsResource, c.ClusterPath, clusterRoleBinding), &rbacv1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) UpdateStatus(ctx context.Context, clusterRoleBinding *rbacv1.ClusterRoleBinding, opts metav1.UpdateOptions) (*rbacv1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(clusterRoleBindingsResource, c.ClusterPath, "status", clusterRoleBinding), &rbacv1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(clusterRoleBindingsResource, c.ClusterPath, name, opts), &rbacv1.ClusterRoleBinding{})
-	return err
-}
-
-func (c *clusterRoleBindingsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(clusterRoleBindingsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &rbacv1.ClusterRoleBindingList{})
-	return err
-}
-
-func (c *clusterRoleBindingsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*rbacv1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(clusterRoleBindingsResource, c.ClusterPath, name), &rbacv1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.ClusterRoleBinding), err
-}
-
-// List takes label and field selectors, and returns the list of ClusterRoleBindings that match those selectors.
-func (c *clusterRoleBindingsClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.ClusterRoleBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterRoleBindingsResource, clusterRoleBindingsKind, c.ClusterPath, opts), &rbacv1.ClusterRoleBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1.ClusterRoleBindingList{ListMeta: obj.(*rbacv1.ClusterRoleBindingList).ListMeta}
-	for _, item := range obj.(*rbacv1.ClusterRoleBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *clusterRoleBindingsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterRoleBindingsResource, c.ClusterPath, opts))
-}
-
-func (c *clusterRoleBindingsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*rbacv1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRoleBindingsResource, c.ClusterPath, name, pt, data, subresources...), &rbacv1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1.ClusterRoleBindingApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1.ClusterRoleBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRoleBindingsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &rbacv1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1.ClusterRoleBindingApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1.ClusterRoleBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRoleBindingsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &rbacv1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
+func newFakeClusterRoleBindingClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedrbacv1.ClusterRoleBindingInterface {
+	return &clusterRoleBindingScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*rbacv1.ClusterRoleBinding, *rbacv1.ClusterRoleBindingList, *v1.ClusterRoleBindingApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			rbacv1.SchemeGroupVersion.WithResource("clusterrolebindings"),
+			rbacv1.SchemeGroupVersion.WithKind("ClusterRoleBinding"),
+			func() *rbacv1.ClusterRoleBinding { return &rbacv1.ClusterRoleBinding{} },
+			func() *rbacv1.ClusterRoleBindingList { return &rbacv1.ClusterRoleBindingList{} },
+			func(dst, src *rbacv1.ClusterRoleBindingList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1.ClusterRoleBindingList) []*rbacv1.ClusterRoleBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1.ClusterRoleBindingList, items []*rbacv1.ClusterRoleBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*rbacv1.ClusterRoleBinding), err
 }
diff --git a/kubernetes/typed/rbac/v1/fake/doc.go b/kubernetes/typed/rbac/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/rbac/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/rbac/v1/fake/rbac_client.go b/kubernetes/typed/rbac/v1/fake/rbac_client.go
index 6b8b43011..819a18298 100644
--- a/kubernetes/typed/rbac/v1/fake/rbac_client.go
+++ b/kubernetes/typed/rbac/v1/fake/rbac_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1 "k8s.io/client-go/kubernetes/typed/rbac/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcprbacv1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcprbacv1.RbacV1ClusterInterface = (*RbacV1ClusterClient)(nil)
@@ -44,46 +40,46 @@ func (c *RbacV1ClusterClient) Cluster(clusterPath logicalcluster.Path) rbacv1.Rb
 	return &RbacV1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *RbacV1ClusterClient) Roles() kcprbacv1.RoleClusterInterface {
-	return &rolesClusterClient{Fake: c.Fake}
+func (c *RbacV1ClusterClient) ClusterRoles() kcprbacv1.ClusterRoleClusterInterface {
+	return newFakeClusterRoleClusterClient(c)
 }
 
-func (c *RbacV1ClusterClient) RoleBindings() kcprbacv1.RoleBindingClusterInterface {
-	return &roleBindingsClusterClient{Fake: c.Fake}
+func (c *RbacV1ClusterClient) ClusterRoleBindings() kcprbacv1.ClusterRoleBindingClusterInterface {
+	return newFakeClusterRoleBindingClusterClient(c)
 }
 
-func (c *RbacV1ClusterClient) ClusterRoles() kcprbacv1.ClusterRoleClusterInterface {
-	return &clusterRolesClusterClient{Fake: c.Fake}
+func (c *RbacV1ClusterClient) Roles() kcprbacv1.RoleClusterInterface {
+	return newFakeRoleClusterClient(c)
 }
 
-func (c *RbacV1ClusterClient) ClusterRoleBindings() kcprbacv1.ClusterRoleBindingClusterInterface {
-	return &clusterRoleBindingsClusterClient{Fake: c.Fake}
+func (c *RbacV1ClusterClient) RoleBindings() kcprbacv1.RoleBindingClusterInterface {
+	return newFakeRoleBindingClusterClient(c)
 }
 
-var _ rbacv1.RbacV1Interface = (*RbacV1Client)(nil)
-
 type RbacV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *RbacV1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *RbacV1Client) ClusterRoles() rbacv1.ClusterRoleInterface {
+	return newFakeClusterRoleClient(c.Fake, c.ClusterPath)
 }
 
-func (c *RbacV1Client) Roles(namespace string) rbacv1.RoleInterface {
-	return &rolesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *RbacV1Client) ClusterRoleBindings() rbacv1.ClusterRoleBindingInterface {
+	return newFakeClusterRoleBindingClient(c.Fake, c.ClusterPath)
 }
 
-func (c *RbacV1Client) RoleBindings(namespace string) rbacv1.RoleBindingInterface {
-	return &roleBindingsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *RbacV1Client) Roles(namespace string) rbacv1.RoleInterface {
+	return newFakeRoleClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *RbacV1Client) ClusterRoles() rbacv1.ClusterRoleInterface {
-	return &clusterRolesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *RbacV1Client) RoleBindings(namespace string) rbacv1.RoleBindingInterface {
+	return newFakeRoleBindingClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *RbacV1Client) ClusterRoleBindings() rbacv1.ClusterRoleBindingInterface {
-	return &clusterRoleBindingsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *RbacV1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/rbac/v1/fake/role.go b/kubernetes/typed/rbac/v1/fake/role.go
index e6b3d5eab..bb585c17c 100644
--- a/kubernetes/typed/rbac/v1/fake/role.go
+++ b/kubernetes/typed/rbac/v1/fake/role.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsrbacv1 "k8s.io/client-go/applyconfigurations/rbac/v1"
-	rbacv1client "k8s.io/client-go/kubernetes/typed/rbac/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/rbac/v1"
+	typedrbacv1 "k8s.io/client-go/kubernetes/typed/rbac/v1"
 
-	kcprbacv1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1"
+	typedkcprbacv1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var rolesResource = schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1", Resource: "roles"}
-var rolesKind = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1", Kind: "Role"}
-
-type rolesClusterClient struct {
-	*kcptesting.Fake
+// roleClusterClient implements RoleClusterInterface
+type roleClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*rbacv1.Role, *rbacv1.RoleList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *rolesClusterClient) Cluster(clusterPath logicalcluster.Path) kcprbacv1.RolesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &rolesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Roles that match those selectors across all clusters.
-func (c *rolesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.RoleList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(rolesResource, rolesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &rbacv1.RoleList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeRoleClusterClient(fake *RbacV1ClusterClient) typedkcprbacv1.RoleClusterInterface {
+	return &roleClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*rbacv1.Role, *rbacv1.RoleList](
+			fake.Fake,
+			rbacv1.SchemeGroupVersion.WithResource("roles"),
+			rbacv1.SchemeGroupVersion.WithKind("Role"),
+			func() *rbacv1.Role { return &rbacv1.Role{} },
+			func() *rbacv1.RoleList { return &rbacv1.RoleList{} },
+			func(dst, src *rbacv1.RoleList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1.RoleList) []*rbacv1.Role { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *rbacv1.RoleList, items []*rbacv1.Role) { list.Items = kcpgentype.FromPointerSlice(items) },
+		),
+		fake.Fake,
 	}
-	list := &rbacv1.RoleList{ListMeta: obj.(*rbacv1.RoleList).ListMeta}
-	for _, item := range obj.(*rbacv1.RoleList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Roles across all clusters.
-func (c *rolesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(rolesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *roleClusterClient) Cluster(cluster logicalcluster.Path) typedkcprbacv1.RolesNamespacer {
+	return &roleNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type rolesNamespacer struct {
+type roleNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *rolesNamespacer) Namespace(namespace string) rbacv1client.RoleInterface {
-	return &rolesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *roleNamespacer) Namespace(namespace string) typedrbacv1.RoleInterface {
+	return newFakeRoleClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type rolesClient struct {
-	*kcptesting.Fake
+// roleScopedClient implements RoleInterface
+type roleScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*rbacv1.Role, *rbacv1.RoleList, *v1.RoleApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *rolesClient) Create(ctx context.Context, role *rbacv1.Role, opts metav1.CreateOptions) (*rbacv1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(rolesResource, c.ClusterPath, c.Namespace, role), &rbacv1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.Role), err
-}
-
-func (c *rolesClient) Update(ctx context.Context, role *rbacv1.Role, opts metav1.UpdateOptions) (*rbacv1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(rolesResource, c.ClusterPath, c.Namespace, role), &rbacv1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.Role), err
-}
-
-func (c *rolesClient) UpdateStatus(ctx context.Context, role *rbacv1.Role, opts metav1.UpdateOptions) (*rbacv1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(rolesResource, c.ClusterPath, "status", c.Namespace, role), &rbacv1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.Role), err
-}
-
-func (c *rolesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(rolesResource, c.ClusterPath, c.Namespace, name, opts), &rbacv1.Role{})
-	return err
 }
 
-func (c *rolesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(rolesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &rbacv1.RoleList{})
-	return err
-}
-
-func (c *rolesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*rbacv1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(rolesResource, c.ClusterPath, c.Namespace, name), &rbacv1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.Role), err
-}
-
-// List takes label and field selectors, and returns the list of Roles that match those selectors.
-func (c *rolesClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.RoleList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(rolesResource, rolesKind, c.ClusterPath, c.Namespace, opts), &rbacv1.RoleList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1.RoleList{ListMeta: obj.(*rbacv1.RoleList).ListMeta}
-	for _, item := range obj.(*rbacv1.RoleList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *rolesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(rolesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *rolesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*rbacv1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(rolesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &rbacv1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.Role), err
-}
-
-func (c *rolesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1.RoleApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1.Role, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(rolesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &rbacv1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.Role), err
-}
-
-func (c *rolesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1.RoleApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1.Role, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(rolesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &rbacv1.Role{})
-	if obj == nil {
-		return nil, err
+func newFakeRoleClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedrbacv1.RoleInterface {
+	return &roleScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*rbacv1.Role, *rbacv1.RoleList, *v1.RoleApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			rbacv1.SchemeGroupVersion.WithResource("roles"),
+			rbacv1.SchemeGroupVersion.WithKind("Role"),
+			func() *rbacv1.Role { return &rbacv1.Role{} },
+			func() *rbacv1.RoleList { return &rbacv1.RoleList{} },
+			func(dst, src *rbacv1.RoleList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1.RoleList) []*rbacv1.Role { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *rbacv1.RoleList, items []*rbacv1.Role) { list.Items = kcpgentype.FromPointerSlice(items) },
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*rbacv1.Role), err
 }
diff --git a/kubernetes/typed/rbac/v1/fake/rolebinding.go b/kubernetes/typed/rbac/v1/fake/rolebinding.go
index e2696b177..1c1cc00e3 100644
--- a/kubernetes/typed/rbac/v1/fake/rolebinding.go
+++ b/kubernetes/typed/rbac/v1/fake/rolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,82 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1 "k8s.io/api/rbac/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsrbacv1 "k8s.io/client-go/applyconfigurations/rbac/v1"
-	rbacv1client "k8s.io/client-go/kubernetes/typed/rbac/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/rbac/v1"
+	typedrbacv1 "k8s.io/client-go/kubernetes/typed/rbac/v1"
 
-	kcprbacv1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1"
+	typedkcprbacv1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var roleBindingsResource = schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1", Resource: "rolebindings"}
-var roleBindingsKind = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1", Kind: "RoleBinding"}
-
-type roleBindingsClusterClient struct {
-	*kcptesting.Fake
+// roleBindingClusterClient implements RoleBindingClusterInterface
+type roleBindingClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*rbacv1.RoleBinding, *rbacv1.RoleBindingList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *roleBindingsClusterClient) Cluster(clusterPath logicalcluster.Path) kcprbacv1.RoleBindingsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &roleBindingsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of RoleBindings that match those selectors across all clusters.
-func (c *roleBindingsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.RoleBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(roleBindingsResource, roleBindingsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &rbacv1.RoleBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeRoleBindingClusterClient(fake *RbacV1ClusterClient) typedkcprbacv1.RoleBindingClusterInterface {
+	return &roleBindingClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*rbacv1.RoleBinding, *rbacv1.RoleBindingList](
+			fake.Fake,
+			rbacv1.SchemeGroupVersion.WithResource("rolebindings"),
+			rbacv1.SchemeGroupVersion.WithKind("RoleBinding"),
+			func() *rbacv1.RoleBinding { return &rbacv1.RoleBinding{} },
+			func() *rbacv1.RoleBindingList { return &rbacv1.RoleBindingList{} },
+			func(dst, src *rbacv1.RoleBindingList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1.RoleBindingList) []*rbacv1.RoleBinding { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *rbacv1.RoleBindingList, items []*rbacv1.RoleBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &rbacv1.RoleBindingList{ListMeta: obj.(*rbacv1.RoleBindingList).ListMeta}
-	for _, item := range obj.(*rbacv1.RoleBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested RoleBindings across all clusters.
-func (c *roleBindingsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(roleBindingsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *roleBindingClusterClient) Cluster(cluster logicalcluster.Path) typedkcprbacv1.RoleBindingsNamespacer {
+	return &roleBindingNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type roleBindingsNamespacer struct {
+type roleBindingNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *roleBindingsNamespacer) Namespace(namespace string) rbacv1client.RoleBindingInterface {
-	return &roleBindingsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *roleBindingNamespacer) Namespace(namespace string) typedrbacv1.RoleBindingInterface {
+	return newFakeRoleBindingClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type roleBindingsClient struct {
-	*kcptesting.Fake
+// roleBindingScopedClient implements RoleBindingInterface
+type roleBindingScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*rbacv1.RoleBinding, *rbacv1.RoleBindingList, *v1.RoleBindingApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *roleBindingsClient) Create(ctx context.Context, roleBinding *rbacv1.RoleBinding, opts metav1.CreateOptions) (*rbacv1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(roleBindingsResource, c.ClusterPath, c.Namespace, roleBinding), &rbacv1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) Update(ctx context.Context, roleBinding *rbacv1.RoleBinding, opts metav1.UpdateOptions) (*rbacv1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(roleBindingsResource, c.ClusterPath, c.Namespace, roleBinding), &rbacv1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) UpdateStatus(ctx context.Context, roleBinding *rbacv1.RoleBinding, opts metav1.UpdateOptions) (*rbacv1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(roleBindingsResource, c.ClusterPath, "status", c.Namespace, roleBinding), &rbacv1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(roleBindingsResource, c.ClusterPath, c.Namespace, name, opts), &rbacv1.RoleBinding{})
-	return err
 }
 
-func (c *roleBindingsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(roleBindingsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &rbacv1.RoleBindingList{})
-	return err
-}
-
-func (c *roleBindingsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*rbacv1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(roleBindingsResource, c.ClusterPath, c.Namespace, name), &rbacv1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.RoleBinding), err
-}
-
-// List takes label and field selectors, and returns the list of RoleBindings that match those selectors.
-func (c *roleBindingsClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.RoleBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(roleBindingsResource, roleBindingsKind, c.ClusterPath, c.Namespace, opts), &rbacv1.RoleBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1.RoleBindingList{ListMeta: obj.(*rbacv1.RoleBindingList).ListMeta}
-	for _, item := range obj.(*rbacv1.RoleBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *roleBindingsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(roleBindingsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *roleBindingsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*rbacv1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(roleBindingsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &rbacv1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1.RoleBindingApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1.RoleBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(roleBindingsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &rbacv1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1.RoleBindingApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1.RoleBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(roleBindingsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &rbacv1.RoleBinding{})
-	if obj == nil {
-		return nil, err
+func newFakeRoleBindingClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedrbacv1.RoleBindingInterface {
+	return &roleBindingScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*rbacv1.RoleBinding, *rbacv1.RoleBindingList, *v1.RoleBindingApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			rbacv1.SchemeGroupVersion.WithResource("rolebindings"),
+			rbacv1.SchemeGroupVersion.WithKind("RoleBinding"),
+			func() *rbacv1.RoleBinding { return &rbacv1.RoleBinding{} },
+			func() *rbacv1.RoleBindingList { return &rbacv1.RoleBindingList{} },
+			func(dst, src *rbacv1.RoleBindingList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1.RoleBindingList) []*rbacv1.RoleBinding { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *rbacv1.RoleBindingList, items []*rbacv1.RoleBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*rbacv1.RoleBinding), err
 }
diff --git a/kubernetes/typed/rbac/v1/generated_expansion.go b/kubernetes/typed/rbac/v1/generated_expansion.go
new file mode 100644
index 000000000..89a3a52c2
--- /dev/null
+++ b/kubernetes/typed/rbac/v1/generated_expansion.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type ClusterRoleClusterExpansion interface{}
+
+type ClusterRoleBindingClusterExpansion interface{}
+
+type RoleClusterExpansion interface{}
+
+type RoleBindingClusterExpansion interface{}
diff --git a/kubernetes/typed/rbac/v1/rbac_client.go b/kubernetes/typed/rbac/v1/rbac_client.go
index bd21f92b8..96dec5256 100644
--- a/kubernetes/typed/rbac/v1/rbac_client.go
+++ b/kubernetes/typed/rbac/v1/rbac_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,32 +14,35 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apirbacv1 "k8s.io/api/rbac/v1"
+	rbacv1 "k8s.io/client-go/kubernetes/typed/rbac/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1 "k8s.io/client-go/kubernetes/typed/rbac/v1"
-	"k8s.io/client-go/rest"
 )
 
 type RbacV1ClusterInterface interface {
 	RbacV1ClusterScoper
-	RolesClusterGetter
-	RoleBindingsClusterGetter
 	ClusterRolesClusterGetter
 	ClusterRoleBindingsClusterGetter
+	RolesClusterGetter
+	RoleBindingsClusterGetter
 }
 
 type RbacV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) rbacv1.RbacV1Interface
 }
 
+// RbacV1ClusterClient is used to interact with features provided by the rbac.authorization.k8s.io group.
 type RbacV1ClusterClient struct {
 	clientCache kcpclient.Cache[*rbacv1.RbacV1Client]
 }
@@ -54,14 +54,6 @@ func (c *RbacV1ClusterClient) Cluster(clusterPath logicalcluster.Path) rbacv1.Rb
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *RbacV1ClusterClient) Roles() RoleClusterInterface {
-	return &rolesClusterInterface{clientCache: c.clientCache}
-}
-
-func (c *RbacV1ClusterClient) RoleBindings() RoleBindingClusterInterface {
-	return &roleBindingsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *RbacV1ClusterClient) ClusterRoles() ClusterRoleClusterInterface {
 	return &clusterRolesClusterInterface{clientCache: c.clientCache}
 }
@@ -70,15 +62,25 @@ func (c *RbacV1ClusterClient) ClusterRoleBindings() ClusterRoleBindingClusterInt
 	return &clusterRoleBindingsClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *RbacV1ClusterClient) Roles() RoleClusterInterface {
+	return &rolesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *RbacV1ClusterClient) RoleBindings() RoleBindingClusterInterface {
+	return &roleBindingsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new RbacV1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*RbacV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new RbacV1ClusterClient for the given config and http client.
@@ -90,6 +92,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*RbacV1ClusterClient
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &RbacV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -102,3 +105,14 @@ func NewForConfigOrDie(c *rest.Config) *RbacV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apirbacv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/rbac/v1/role.go b/kubernetes/typed/rbac/v1/role.go
index 799a1e805..7658900b2 100644
--- a/kubernetes/typed/rbac/v1/role.go
+++ b/kubernetes/typed/rbac/v1/role.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	rbacv1client "k8s.io/client-go/kubernetes/typed/rbac/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedrbacv1 "k8s.io/client-go/kubernetes/typed/rbac/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // RolesClusterGetter has a method to return a RoleClusterInterface.
@@ -45,10 +42,11 @@ type RoleClusterInterface interface {
 	Cluster(logicalcluster.Path) RolesNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.RoleList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	RoleClusterExpansion
 }
 
 type rolesClusterInterface struct {
-	clientCache kcpclient.Cache[*rbacv1client.RbacV1Client]
+	clientCache kcpclient.Cache[*typedrbacv1.RbacV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *rolesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptio
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Roles(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// RolesNamespacer can scope to objects within a namespace, returning a rbacv1client.RoleInterface.
+// RolesNamespacer can scope to objects within a namespace, returning a typedrbacv1.RoleInterface.
 type RolesNamespacer interface {
-	Namespace(string) rbacv1client.RoleInterface
+	Namespace(string) typedrbacv1.RoleInterface
 }
 
 type rolesNamespacer struct {
-	clientCache kcpclient.Cache[*rbacv1client.RbacV1Client]
+	clientCache kcpclient.Cache[*typedrbacv1.RbacV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *rolesNamespacer) Namespace(namespace string) rbacv1client.RoleInterface {
+func (n *rolesNamespacer) Namespace(namespace string) typedrbacv1.RoleInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Roles(namespace)
 }
diff --git a/kubernetes/typed/rbac/v1/rolebinding.go b/kubernetes/typed/rbac/v1/rolebinding.go
index 01e3fcfd4..8af3eca4a 100644
--- a/kubernetes/typed/rbac/v1/rolebinding.go
+++ b/kubernetes/typed/rbac/v1/rolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	rbacv1client "k8s.io/client-go/kubernetes/typed/rbac/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedrbacv1 "k8s.io/client-go/kubernetes/typed/rbac/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // RoleBindingsClusterGetter has a method to return a RoleBindingClusterInterface.
@@ -45,10 +42,11 @@ type RoleBindingClusterInterface interface {
 	Cluster(logicalcluster.Path) RoleBindingsNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*rbacv1.RoleBindingList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	RoleBindingClusterExpansion
 }
 
 type roleBindingsClusterInterface struct {
-	clientCache kcpclient.Cache[*rbacv1client.RbacV1Client]
+	clientCache kcpclient.Cache[*typedrbacv1.RbacV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *roleBindingsClusterInterface) Watch(ctx context.Context, opts metav1.Li
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RoleBindings(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// RoleBindingsNamespacer can scope to objects within a namespace, returning a rbacv1client.RoleBindingInterface.
+// RoleBindingsNamespacer can scope to objects within a namespace, returning a typedrbacv1.RoleBindingInterface.
 type RoleBindingsNamespacer interface {
-	Namespace(string) rbacv1client.RoleBindingInterface
+	Namespace(string) typedrbacv1.RoleBindingInterface
 }
 
 type roleBindingsNamespacer struct {
-	clientCache kcpclient.Cache[*rbacv1client.RbacV1Client]
+	clientCache kcpclient.Cache[*typedrbacv1.RbacV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *roleBindingsNamespacer) Namespace(namespace string) rbacv1client.RoleBindingInterface {
+func (n *roleBindingsNamespacer) Namespace(namespace string) typedrbacv1.RoleBindingInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).RoleBindings(namespace)
 }
diff --git a/kubernetes/typed/rbac/v1alpha1/clusterrole.go b/kubernetes/typed/rbac/v1alpha1/clusterrole.go
index cf22dbff2..61a4106a8 100644
--- a/kubernetes/typed/rbac/v1alpha1/clusterrole.go
+++ b/kubernetes/typed/rbac/v1alpha1/clusterrole.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
+	context "context"
+
+	apirbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1alpha1 "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	rbacv1alpha1client "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 )
 
 // ClusterRolesClusterGetter has a method to return a ClusterRoleClusterInterface.
@@ -40,19 +37,20 @@ type ClusterRolesClusterGetter interface {
 }
 
 // ClusterRoleClusterInterface can operate on ClusterRoles across all clusters,
-// or scope down to one cluster and return a rbacv1alpha1client.ClusterRoleInterface.
+// or scope down to one cluster and return a rbacv1alpha1.ClusterRoleInterface.
 type ClusterRoleClusterInterface interface {
-	Cluster(logicalcluster.Path) rbacv1alpha1client.ClusterRoleInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.ClusterRoleList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) rbacv1alpha1.ClusterRoleInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apirbacv1alpha1.ClusterRoleList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ClusterRoleClusterExpansion
 }
 
 type clusterRolesClusterInterface struct {
-	clientCache kcpclient.Cache[*rbacv1alpha1client.RbacV1alpha1Client]
+	clientCache kcpclient.Cache[*rbacv1alpha1.RbacV1alpha1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *clusterRolesClusterInterface) Cluster(clusterPath logicalcluster.Path) rbacv1alpha1client.ClusterRoleInterface {
+func (c *clusterRolesClusterInterface) Cluster(clusterPath logicalcluster.Path) rbacv1alpha1.ClusterRoleInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *clusterRolesClusterInterface) Cluster(clusterPath logicalcluster.Path)
 }
 
 // List returns the entire collection of all ClusterRoles across all clusters.
-func (c *clusterRolesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.ClusterRoleList, error) {
+func (c *clusterRolesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apirbacv1alpha1.ClusterRoleList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterRoles().List(ctx, opts)
 }
 
 // Watch begins to watch all ClusterRoles across all clusters.
-func (c *clusterRolesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *clusterRolesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterRoles().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/rbac/v1alpha1/clusterrolebinding.go b/kubernetes/typed/rbac/v1alpha1/clusterrolebinding.go
index 86b3d79df..cdea18ca7 100644
--- a/kubernetes/typed/rbac/v1alpha1/clusterrolebinding.go
+++ b/kubernetes/typed/rbac/v1alpha1/clusterrolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
+	context "context"
+
+	apirbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1alpha1 "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	rbacv1alpha1client "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 )
 
 // ClusterRoleBindingsClusterGetter has a method to return a ClusterRoleBindingClusterInterface.
@@ -40,19 +37,20 @@ type ClusterRoleBindingsClusterGetter interface {
 }
 
 // ClusterRoleBindingClusterInterface can operate on ClusterRoleBindings across all clusters,
-// or scope down to one cluster and return a rbacv1alpha1client.ClusterRoleBindingInterface.
+// or scope down to one cluster and return a rbacv1alpha1.ClusterRoleBindingInterface.
 type ClusterRoleBindingClusterInterface interface {
-	Cluster(logicalcluster.Path) rbacv1alpha1client.ClusterRoleBindingInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.ClusterRoleBindingList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) rbacv1alpha1.ClusterRoleBindingInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apirbacv1alpha1.ClusterRoleBindingList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ClusterRoleBindingClusterExpansion
 }
 
 type clusterRoleBindingsClusterInterface struct {
-	clientCache kcpclient.Cache[*rbacv1alpha1client.RbacV1alpha1Client]
+	clientCache kcpclient.Cache[*rbacv1alpha1.RbacV1alpha1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *clusterRoleBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path) rbacv1alpha1client.ClusterRoleBindingInterface {
+func (c *clusterRoleBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path) rbacv1alpha1.ClusterRoleBindingInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *clusterRoleBindingsClusterInterface) Cluster(clusterPath logicalcluster
 }
 
 // List returns the entire collection of all ClusterRoleBindings across all clusters.
-func (c *clusterRoleBindingsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.ClusterRoleBindingList, error) {
+func (c *clusterRoleBindingsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apirbacv1alpha1.ClusterRoleBindingList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterRoleBindings().List(ctx, opts)
 }
 
 // Watch begins to watch all ClusterRoleBindings across all clusters.
-func (c *clusterRoleBindingsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *clusterRoleBindingsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterRoleBindings().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/rbac/v1alpha1/doc.go b/kubernetes/typed/rbac/v1alpha1/doc.go
new file mode 100644
index 000000000..08b80237c
--- /dev/null
+++ b/kubernetes/typed/rbac/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/kubernetes/typed/rbac/v1alpha1/fake/clusterrole.go b/kubernetes/typed/rbac/v1alpha1/fake/clusterrole.go
index 8b92738a6..33e5a1c7b 100644
--- a/kubernetes/typed/rbac/v1alpha1/fake/clusterrole.go
+++ b/kubernetes/typed/rbac/v1alpha1/fake/clusterrole.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsrbacv1alpha1 "k8s.io/client-go/applyconfigurations/rbac/v1alpha1"
-	rbacv1alpha1client "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
-	"k8s.io/client-go/testing"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/rbac/v1alpha1"
+	typedrbacv1alpha1 "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 
+	typedkcprbacv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var clusterRolesResource = schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1alpha1", Resource: "clusterroles"}
-var clusterRolesKind = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1alpha1", Kind: "ClusterRole"}
-
-type clusterRolesClusterClient struct {
-	*kcptesting.Fake
+// clusterRoleClusterClient implements ClusterRoleClusterInterface
+type clusterRoleClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*rbacv1alpha1.ClusterRole, *rbacv1alpha1.ClusterRoleList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *clusterRolesClusterClient) Cluster(clusterPath logicalcluster.Path) rbacv1alpha1client.ClusterRoleInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &clusterRolesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ClusterRoles that match those selectors across all clusters.
-func (c *clusterRolesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.ClusterRoleList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterRolesResource, clusterRolesKind, logicalcluster.Wildcard, opts), &rbacv1alpha1.ClusterRoleList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1alpha1.ClusterRoleList{ListMeta: obj.(*rbacv1alpha1.ClusterRoleList).ListMeta}
-	for _, item := range obj.(*rbacv1alpha1.ClusterRoleList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeClusterRoleClusterClient(fake *RbacV1alpha1ClusterClient) typedkcprbacv1alpha1.ClusterRoleClusterInterface {
+	return &clusterRoleClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*rbacv1alpha1.ClusterRole, *rbacv1alpha1.ClusterRoleList](
+			fake.Fake,
+			rbacv1alpha1.SchemeGroupVersion.WithResource("clusterroles"),
+			rbacv1alpha1.SchemeGroupVersion.WithKind("ClusterRole"),
+			func() *rbacv1alpha1.ClusterRole { return &rbacv1alpha1.ClusterRole{} },
+			func() *rbacv1alpha1.ClusterRoleList { return &rbacv1alpha1.ClusterRoleList{} },
+			func(dst, src *rbacv1alpha1.ClusterRoleList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1alpha1.ClusterRoleList) []*rbacv1alpha1.ClusterRole {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1alpha1.ClusterRoleList, items []*rbacv1alpha1.ClusterRole) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ClusterRoles across all clusters.
-func (c *clusterRolesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterRolesResource, logicalcluster.Wildcard, opts))
+func (c *clusterRoleClusterClient) Cluster(cluster logicalcluster.Path) typedrbacv1alpha1.ClusterRoleInterface {
+	return newFakeClusterRoleClient(c.Fake, cluster)
 }
 
-type clusterRolesClient struct {
-	*kcptesting.Fake
+// clusterRoleScopedClient implements ClusterRoleInterface
+type clusterRoleScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*rbacv1alpha1.ClusterRole, *rbacv1alpha1.ClusterRoleList, *v1alpha1.ClusterRoleApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *clusterRolesClient) Create(ctx context.Context, clusterRole *rbacv1alpha1.ClusterRole, opts metav1.CreateOptions) (*rbacv1alpha1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(clusterRolesResource, c.ClusterPath, clusterRole), &rbacv1alpha1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) Update(ctx context.Context, clusterRole *rbacv1alpha1.ClusterRole, opts metav1.UpdateOptions) (*rbacv1alpha1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(clusterRolesResource, c.ClusterPath, clusterRole), &rbacv1alpha1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) UpdateStatus(ctx context.Context, clusterRole *rbacv1alpha1.ClusterRole, opts metav1.UpdateOptions) (*rbacv1alpha1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(clusterRolesResource, c.ClusterPath, "status", clusterRole), &rbacv1alpha1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(clusterRolesResource, c.ClusterPath, name, opts), &rbacv1alpha1.ClusterRole{})
-	return err
-}
-
-func (c *clusterRolesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(clusterRolesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &rbacv1alpha1.ClusterRoleList{})
-	return err
-}
-
-func (c *clusterRolesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*rbacv1alpha1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(clusterRolesResource, c.ClusterPath, name), &rbacv1alpha1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.ClusterRole), err
-}
-
-// List takes label and field selectors, and returns the list of ClusterRoles that match those selectors.
-func (c *clusterRolesClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.ClusterRoleList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterRolesResource, clusterRolesKind, c.ClusterPath, opts), &rbacv1alpha1.ClusterRoleList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1alpha1.ClusterRoleList{ListMeta: obj.(*rbacv1alpha1.ClusterRoleList).ListMeta}
-	for _, item := range obj.(*rbacv1alpha1.ClusterRoleList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *clusterRolesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterRolesResource, c.ClusterPath, opts))
-}
-
-func (c *clusterRolesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*rbacv1alpha1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRolesResource, c.ClusterPath, name, pt, data, subresources...), &rbacv1alpha1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1alpha1.ClusterRoleApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1alpha1.ClusterRole, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRolesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &rbacv1alpha1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1alpha1.ClusterRoleApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1alpha1.ClusterRole, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRolesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &rbacv1alpha1.ClusterRole{})
-	if obj == nil {
-		return nil, err
+func newFakeClusterRoleClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedrbacv1alpha1.ClusterRoleInterface {
+	return &clusterRoleScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*rbacv1alpha1.ClusterRole, *rbacv1alpha1.ClusterRoleList, *v1alpha1.ClusterRoleApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			rbacv1alpha1.SchemeGroupVersion.WithResource("clusterroles"),
+			rbacv1alpha1.SchemeGroupVersion.WithKind("ClusterRole"),
+			func() *rbacv1alpha1.ClusterRole { return &rbacv1alpha1.ClusterRole{} },
+			func() *rbacv1alpha1.ClusterRoleList { return &rbacv1alpha1.ClusterRoleList{} },
+			func(dst, src *rbacv1alpha1.ClusterRoleList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1alpha1.ClusterRoleList) []*rbacv1alpha1.ClusterRole {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1alpha1.ClusterRoleList, items []*rbacv1alpha1.ClusterRole) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*rbacv1alpha1.ClusterRole), err
 }
diff --git a/kubernetes/typed/rbac/v1alpha1/fake/clusterrolebinding.go b/kubernetes/typed/rbac/v1alpha1/fake/clusterrolebinding.go
index 2b0329e75..7808dd7ca 100644
--- a/kubernetes/typed/rbac/v1alpha1/fake/clusterrolebinding.go
+++ b/kubernetes/typed/rbac/v1alpha1/fake/clusterrolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsrbacv1alpha1 "k8s.io/client-go/applyconfigurations/rbac/v1alpha1"
-	rbacv1alpha1client "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
-	"k8s.io/client-go/testing"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/rbac/v1alpha1"
+	typedrbacv1alpha1 "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 
+	typedkcprbacv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var clusterRoleBindingsResource = schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1alpha1", Resource: "clusterrolebindings"}
-var clusterRoleBindingsKind = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1alpha1", Kind: "ClusterRoleBinding"}
-
-type clusterRoleBindingsClusterClient struct {
-	*kcptesting.Fake
+// clusterRoleBindingClusterClient implements ClusterRoleBindingClusterInterface
+type clusterRoleBindingClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*rbacv1alpha1.ClusterRoleBinding, *rbacv1alpha1.ClusterRoleBindingList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *clusterRoleBindingsClusterClient) Cluster(clusterPath logicalcluster.Path) rbacv1alpha1client.ClusterRoleBindingInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &clusterRoleBindingsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ClusterRoleBindings that match those selectors across all clusters.
-func (c *clusterRoleBindingsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.ClusterRoleBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterRoleBindingsResource, clusterRoleBindingsKind, logicalcluster.Wildcard, opts), &rbacv1alpha1.ClusterRoleBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1alpha1.ClusterRoleBindingList{ListMeta: obj.(*rbacv1alpha1.ClusterRoleBindingList).ListMeta}
-	for _, item := range obj.(*rbacv1alpha1.ClusterRoleBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeClusterRoleBindingClusterClient(fake *RbacV1alpha1ClusterClient) typedkcprbacv1alpha1.ClusterRoleBindingClusterInterface {
+	return &clusterRoleBindingClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*rbacv1alpha1.ClusterRoleBinding, *rbacv1alpha1.ClusterRoleBindingList](
+			fake.Fake,
+			rbacv1alpha1.SchemeGroupVersion.WithResource("clusterrolebindings"),
+			rbacv1alpha1.SchemeGroupVersion.WithKind("ClusterRoleBinding"),
+			func() *rbacv1alpha1.ClusterRoleBinding { return &rbacv1alpha1.ClusterRoleBinding{} },
+			func() *rbacv1alpha1.ClusterRoleBindingList { return &rbacv1alpha1.ClusterRoleBindingList{} },
+			func(dst, src *rbacv1alpha1.ClusterRoleBindingList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1alpha1.ClusterRoleBindingList) []*rbacv1alpha1.ClusterRoleBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1alpha1.ClusterRoleBindingList, items []*rbacv1alpha1.ClusterRoleBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ClusterRoleBindings across all clusters.
-func (c *clusterRoleBindingsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterRoleBindingsResource, logicalcluster.Wildcard, opts))
+func (c *clusterRoleBindingClusterClient) Cluster(cluster logicalcluster.Path) typedrbacv1alpha1.ClusterRoleBindingInterface {
+	return newFakeClusterRoleBindingClient(c.Fake, cluster)
 }
 
-type clusterRoleBindingsClient struct {
-	*kcptesting.Fake
+// clusterRoleBindingScopedClient implements ClusterRoleBindingInterface
+type clusterRoleBindingScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*rbacv1alpha1.ClusterRoleBinding, *rbacv1alpha1.ClusterRoleBindingList, *v1alpha1.ClusterRoleBindingApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *clusterRoleBindingsClient) Create(ctx context.Context, clusterRoleBinding *rbacv1alpha1.ClusterRoleBinding, opts metav1.CreateOptions) (*rbacv1alpha1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(clusterRoleBindingsResource, c.ClusterPath, clusterRoleBinding), &rbacv1alpha1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) Update(ctx context.Context, clusterRoleBinding *rbacv1alpha1.ClusterRoleBinding, opts metav1.UpdateOptions) (*rbacv1alpha1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(clusterRoleBindingsResource, c.ClusterPath, clusterRoleBinding), &rbacv1alpha1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) UpdateStatus(ctx context.Context, clusterRoleBinding *rbacv1alpha1.ClusterRoleBinding, opts metav1.UpdateOptions) (*rbacv1alpha1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(clusterRoleBindingsResource, c.ClusterPath, "status", clusterRoleBinding), &rbacv1alpha1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(clusterRoleBindingsResource, c.ClusterPath, name, opts), &rbacv1alpha1.ClusterRoleBinding{})
-	return err
-}
-
-func (c *clusterRoleBindingsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(clusterRoleBindingsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &rbacv1alpha1.ClusterRoleBindingList{})
-	return err
-}
-
-func (c *clusterRoleBindingsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*rbacv1alpha1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(clusterRoleBindingsResource, c.ClusterPath, name), &rbacv1alpha1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.ClusterRoleBinding), err
-}
-
-// List takes label and field selectors, and returns the list of ClusterRoleBindings that match those selectors.
-func (c *clusterRoleBindingsClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.ClusterRoleBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterRoleBindingsResource, clusterRoleBindingsKind, c.ClusterPath, opts), &rbacv1alpha1.ClusterRoleBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1alpha1.ClusterRoleBindingList{ListMeta: obj.(*rbacv1alpha1.ClusterRoleBindingList).ListMeta}
-	for _, item := range obj.(*rbacv1alpha1.ClusterRoleBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *clusterRoleBindingsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterRoleBindingsResource, c.ClusterPath, opts))
-}
-
-func (c *clusterRoleBindingsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*rbacv1alpha1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRoleBindingsResource, c.ClusterPath, name, pt, data, subresources...), &rbacv1alpha1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1alpha1.ClusterRoleBindingApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1alpha1.ClusterRoleBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRoleBindingsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &rbacv1alpha1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1alpha1.ClusterRoleBindingApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1alpha1.ClusterRoleBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRoleBindingsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &rbacv1alpha1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
+func newFakeClusterRoleBindingClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedrbacv1alpha1.ClusterRoleBindingInterface {
+	return &clusterRoleBindingScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*rbacv1alpha1.ClusterRoleBinding, *rbacv1alpha1.ClusterRoleBindingList, *v1alpha1.ClusterRoleBindingApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			rbacv1alpha1.SchemeGroupVersion.WithResource("clusterrolebindings"),
+			rbacv1alpha1.SchemeGroupVersion.WithKind("ClusterRoleBinding"),
+			func() *rbacv1alpha1.ClusterRoleBinding { return &rbacv1alpha1.ClusterRoleBinding{} },
+			func() *rbacv1alpha1.ClusterRoleBindingList { return &rbacv1alpha1.ClusterRoleBindingList{} },
+			func(dst, src *rbacv1alpha1.ClusterRoleBindingList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1alpha1.ClusterRoleBindingList) []*rbacv1alpha1.ClusterRoleBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1alpha1.ClusterRoleBindingList, items []*rbacv1alpha1.ClusterRoleBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*rbacv1alpha1.ClusterRoleBinding), err
 }
diff --git a/kubernetes/typed/rbac/v1alpha1/fake/doc.go b/kubernetes/typed/rbac/v1alpha1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/rbac/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/rbac/v1alpha1/fake/rbac_client.go b/kubernetes/typed/rbac/v1alpha1/fake/rbac_client.go
index e7bd51c5d..afcf0ce51 100644
--- a/kubernetes/typed/rbac/v1alpha1/fake/rbac_client.go
+++ b/kubernetes/typed/rbac/v1alpha1/fake/rbac_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1alpha1 "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcprbacv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1alpha1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcprbacv1alpha1.RbacV1alpha1ClusterInterface = (*RbacV1alpha1ClusterClient)(nil)
@@ -44,46 +40,46 @@ func (c *RbacV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) rba
 	return &RbacV1alpha1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *RbacV1alpha1ClusterClient) Roles() kcprbacv1alpha1.RoleClusterInterface {
-	return &rolesClusterClient{Fake: c.Fake}
+func (c *RbacV1alpha1ClusterClient) ClusterRoles() kcprbacv1alpha1.ClusterRoleClusterInterface {
+	return newFakeClusterRoleClusterClient(c)
 }
 
-func (c *RbacV1alpha1ClusterClient) RoleBindings() kcprbacv1alpha1.RoleBindingClusterInterface {
-	return &roleBindingsClusterClient{Fake: c.Fake}
+func (c *RbacV1alpha1ClusterClient) ClusterRoleBindings() kcprbacv1alpha1.ClusterRoleBindingClusterInterface {
+	return newFakeClusterRoleBindingClusterClient(c)
 }
 
-func (c *RbacV1alpha1ClusterClient) ClusterRoles() kcprbacv1alpha1.ClusterRoleClusterInterface {
-	return &clusterRolesClusterClient{Fake: c.Fake}
+func (c *RbacV1alpha1ClusterClient) Roles() kcprbacv1alpha1.RoleClusterInterface {
+	return newFakeRoleClusterClient(c)
 }
 
-func (c *RbacV1alpha1ClusterClient) ClusterRoleBindings() kcprbacv1alpha1.ClusterRoleBindingClusterInterface {
-	return &clusterRoleBindingsClusterClient{Fake: c.Fake}
+func (c *RbacV1alpha1ClusterClient) RoleBindings() kcprbacv1alpha1.RoleBindingClusterInterface {
+	return newFakeRoleBindingClusterClient(c)
 }
 
-var _ rbacv1alpha1.RbacV1alpha1Interface = (*RbacV1alpha1Client)(nil)
-
 type RbacV1alpha1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *RbacV1alpha1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *RbacV1alpha1Client) ClusterRoles() rbacv1alpha1.ClusterRoleInterface {
+	return newFakeClusterRoleClient(c.Fake, c.ClusterPath)
 }
 
-func (c *RbacV1alpha1Client) Roles(namespace string) rbacv1alpha1.RoleInterface {
-	return &rolesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *RbacV1alpha1Client) ClusterRoleBindings() rbacv1alpha1.ClusterRoleBindingInterface {
+	return newFakeClusterRoleBindingClient(c.Fake, c.ClusterPath)
 }
 
-func (c *RbacV1alpha1Client) RoleBindings(namespace string) rbacv1alpha1.RoleBindingInterface {
-	return &roleBindingsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *RbacV1alpha1Client) Roles(namespace string) rbacv1alpha1.RoleInterface {
+	return newFakeRoleClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *RbacV1alpha1Client) ClusterRoles() rbacv1alpha1.ClusterRoleInterface {
-	return &clusterRolesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *RbacV1alpha1Client) RoleBindings(namespace string) rbacv1alpha1.RoleBindingInterface {
+	return newFakeRoleBindingClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *RbacV1alpha1Client) ClusterRoleBindings() rbacv1alpha1.ClusterRoleBindingInterface {
-	return &clusterRoleBindingsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *RbacV1alpha1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/rbac/v1alpha1/fake/role.go b/kubernetes/typed/rbac/v1alpha1/fake/role.go
index 050b002f2..2e38c0c21 100644
--- a/kubernetes/typed/rbac/v1alpha1/fake/role.go
+++ b/kubernetes/typed/rbac/v1alpha1/fake/role.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,82 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsrbacv1alpha1 "k8s.io/client-go/applyconfigurations/rbac/v1alpha1"
-	rbacv1alpha1client "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
-	"k8s.io/client-go/testing"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/rbac/v1alpha1"
+	typedrbacv1alpha1 "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 
-	kcprbacv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1alpha1"
+	typedkcprbacv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var rolesResource = schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1alpha1", Resource: "roles"}
-var rolesKind = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1alpha1", Kind: "Role"}
-
-type rolesClusterClient struct {
-	*kcptesting.Fake
+// roleClusterClient implements RoleClusterInterface
+type roleClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*rbacv1alpha1.Role, *rbacv1alpha1.RoleList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *rolesClusterClient) Cluster(clusterPath logicalcluster.Path) kcprbacv1alpha1.RolesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &rolesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Roles that match those selectors across all clusters.
-func (c *rolesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.RoleList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(rolesResource, rolesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &rbacv1alpha1.RoleList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeRoleClusterClient(fake *RbacV1alpha1ClusterClient) typedkcprbacv1alpha1.RoleClusterInterface {
+	return &roleClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*rbacv1alpha1.Role, *rbacv1alpha1.RoleList](
+			fake.Fake,
+			rbacv1alpha1.SchemeGroupVersion.WithResource("roles"),
+			rbacv1alpha1.SchemeGroupVersion.WithKind("Role"),
+			func() *rbacv1alpha1.Role { return &rbacv1alpha1.Role{} },
+			func() *rbacv1alpha1.RoleList { return &rbacv1alpha1.RoleList{} },
+			func(dst, src *rbacv1alpha1.RoleList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1alpha1.RoleList) []*rbacv1alpha1.Role { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *rbacv1alpha1.RoleList, items []*rbacv1alpha1.Role) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &rbacv1alpha1.RoleList{ListMeta: obj.(*rbacv1alpha1.RoleList).ListMeta}
-	for _, item := range obj.(*rbacv1alpha1.RoleList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Roles across all clusters.
-func (c *rolesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(rolesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *roleClusterClient) Cluster(cluster logicalcluster.Path) typedkcprbacv1alpha1.RolesNamespacer {
+	return &roleNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type rolesNamespacer struct {
+type roleNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *rolesNamespacer) Namespace(namespace string) rbacv1alpha1client.RoleInterface {
-	return &rolesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *roleNamespacer) Namespace(namespace string) typedrbacv1alpha1.RoleInterface {
+	return newFakeRoleClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type rolesClient struct {
-	*kcptesting.Fake
+// roleScopedClient implements RoleInterface
+type roleScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*rbacv1alpha1.Role, *rbacv1alpha1.RoleList, *v1alpha1.RoleApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *rolesClient) Create(ctx context.Context, role *rbacv1alpha1.Role, opts metav1.CreateOptions) (*rbacv1alpha1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(rolesResource, c.ClusterPath, c.Namespace, role), &rbacv1alpha1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.Role), err
-}
-
-func (c *rolesClient) Update(ctx context.Context, role *rbacv1alpha1.Role, opts metav1.UpdateOptions) (*rbacv1alpha1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(rolesResource, c.ClusterPath, c.Namespace, role), &rbacv1alpha1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.Role), err
-}
-
-func (c *rolesClient) UpdateStatus(ctx context.Context, role *rbacv1alpha1.Role, opts metav1.UpdateOptions) (*rbacv1alpha1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(rolesResource, c.ClusterPath, "status", c.Namespace, role), &rbacv1alpha1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.Role), err
-}
-
-func (c *rolesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(rolesResource, c.ClusterPath, c.Namespace, name, opts), &rbacv1alpha1.Role{})
-	return err
 }
 
-func (c *rolesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(rolesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &rbacv1alpha1.RoleList{})
-	return err
-}
-
-func (c *rolesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*rbacv1alpha1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(rolesResource, c.ClusterPath, c.Namespace, name), &rbacv1alpha1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.Role), err
-}
-
-// List takes label and field selectors, and returns the list of Roles that match those selectors.
-func (c *rolesClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.RoleList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(rolesResource, rolesKind, c.ClusterPath, c.Namespace, opts), &rbacv1alpha1.RoleList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1alpha1.RoleList{ListMeta: obj.(*rbacv1alpha1.RoleList).ListMeta}
-	for _, item := range obj.(*rbacv1alpha1.RoleList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *rolesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(rolesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *rolesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*rbacv1alpha1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(rolesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &rbacv1alpha1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.Role), err
-}
-
-func (c *rolesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1alpha1.RoleApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1alpha1.Role, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(rolesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &rbacv1alpha1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.Role), err
-}
-
-func (c *rolesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1alpha1.RoleApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1alpha1.Role, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(rolesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &rbacv1alpha1.Role{})
-	if obj == nil {
-		return nil, err
+func newFakeRoleClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedrbacv1alpha1.RoleInterface {
+	return &roleScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*rbacv1alpha1.Role, *rbacv1alpha1.RoleList, *v1alpha1.RoleApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			rbacv1alpha1.SchemeGroupVersion.WithResource("roles"),
+			rbacv1alpha1.SchemeGroupVersion.WithKind("Role"),
+			func() *rbacv1alpha1.Role { return &rbacv1alpha1.Role{} },
+			func() *rbacv1alpha1.RoleList { return &rbacv1alpha1.RoleList{} },
+			func(dst, src *rbacv1alpha1.RoleList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1alpha1.RoleList) []*rbacv1alpha1.Role { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *rbacv1alpha1.RoleList, items []*rbacv1alpha1.Role) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*rbacv1alpha1.Role), err
 }
diff --git a/kubernetes/typed/rbac/v1alpha1/fake/rolebinding.go b/kubernetes/typed/rbac/v1alpha1/fake/rolebinding.go
index 196d1ec7f..3fe8527cd 100644
--- a/kubernetes/typed/rbac/v1alpha1/fake/rolebinding.go
+++ b/kubernetes/typed/rbac/v1alpha1/fake/rolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsrbacv1alpha1 "k8s.io/client-go/applyconfigurations/rbac/v1alpha1"
-	rbacv1alpha1client "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
-	"k8s.io/client-go/testing"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/rbac/v1alpha1"
+	typedrbacv1alpha1 "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 
-	kcprbacv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1alpha1"
+	typedkcprbacv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var roleBindingsResource = schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1alpha1", Resource: "rolebindings"}
-var roleBindingsKind = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1alpha1", Kind: "RoleBinding"}
-
-type roleBindingsClusterClient struct {
-	*kcptesting.Fake
+// roleBindingClusterClient implements RoleBindingClusterInterface
+type roleBindingClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*rbacv1alpha1.RoleBinding, *rbacv1alpha1.RoleBindingList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *roleBindingsClusterClient) Cluster(clusterPath logicalcluster.Path) kcprbacv1alpha1.RoleBindingsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &roleBindingsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of RoleBindings that match those selectors across all clusters.
-func (c *roleBindingsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.RoleBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(roleBindingsResource, roleBindingsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &rbacv1alpha1.RoleBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeRoleBindingClusterClient(fake *RbacV1alpha1ClusterClient) typedkcprbacv1alpha1.RoleBindingClusterInterface {
+	return &roleBindingClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*rbacv1alpha1.RoleBinding, *rbacv1alpha1.RoleBindingList](
+			fake.Fake,
+			rbacv1alpha1.SchemeGroupVersion.WithResource("rolebindings"),
+			rbacv1alpha1.SchemeGroupVersion.WithKind("RoleBinding"),
+			func() *rbacv1alpha1.RoleBinding { return &rbacv1alpha1.RoleBinding{} },
+			func() *rbacv1alpha1.RoleBindingList { return &rbacv1alpha1.RoleBindingList{} },
+			func(dst, src *rbacv1alpha1.RoleBindingList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1alpha1.RoleBindingList) []*rbacv1alpha1.RoleBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1alpha1.RoleBindingList, items []*rbacv1alpha1.RoleBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &rbacv1alpha1.RoleBindingList{ListMeta: obj.(*rbacv1alpha1.RoleBindingList).ListMeta}
-	for _, item := range obj.(*rbacv1alpha1.RoleBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested RoleBindings across all clusters.
-func (c *roleBindingsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(roleBindingsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *roleBindingClusterClient) Cluster(cluster logicalcluster.Path) typedkcprbacv1alpha1.RoleBindingsNamespacer {
+	return &roleBindingNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type roleBindingsNamespacer struct {
+type roleBindingNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *roleBindingsNamespacer) Namespace(namespace string) rbacv1alpha1client.RoleBindingInterface {
-	return &roleBindingsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *roleBindingNamespacer) Namespace(namespace string) typedrbacv1alpha1.RoleBindingInterface {
+	return newFakeRoleBindingClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type roleBindingsClient struct {
-	*kcptesting.Fake
+// roleBindingScopedClient implements RoleBindingInterface
+type roleBindingScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*rbacv1alpha1.RoleBinding, *rbacv1alpha1.RoleBindingList, *v1alpha1.RoleBindingApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *roleBindingsClient) Create(ctx context.Context, roleBinding *rbacv1alpha1.RoleBinding, opts metav1.CreateOptions) (*rbacv1alpha1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(roleBindingsResource, c.ClusterPath, c.Namespace, roleBinding), &rbacv1alpha1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) Update(ctx context.Context, roleBinding *rbacv1alpha1.RoleBinding, opts metav1.UpdateOptions) (*rbacv1alpha1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(roleBindingsResource, c.ClusterPath, c.Namespace, roleBinding), &rbacv1alpha1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) UpdateStatus(ctx context.Context, roleBinding *rbacv1alpha1.RoleBinding, opts metav1.UpdateOptions) (*rbacv1alpha1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(roleBindingsResource, c.ClusterPath, "status", c.Namespace, roleBinding), &rbacv1alpha1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(roleBindingsResource, c.ClusterPath, c.Namespace, name, opts), &rbacv1alpha1.RoleBinding{})
-	return err
 }
 
-func (c *roleBindingsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(roleBindingsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &rbacv1alpha1.RoleBindingList{})
-	return err
-}
-
-func (c *roleBindingsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*rbacv1alpha1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(roleBindingsResource, c.ClusterPath, c.Namespace, name), &rbacv1alpha1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.RoleBinding), err
-}
-
-// List takes label and field selectors, and returns the list of RoleBindings that match those selectors.
-func (c *roleBindingsClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.RoleBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(roleBindingsResource, roleBindingsKind, c.ClusterPath, c.Namespace, opts), &rbacv1alpha1.RoleBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1alpha1.RoleBindingList{ListMeta: obj.(*rbacv1alpha1.RoleBindingList).ListMeta}
-	for _, item := range obj.(*rbacv1alpha1.RoleBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *roleBindingsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(roleBindingsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *roleBindingsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*rbacv1alpha1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(roleBindingsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &rbacv1alpha1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1alpha1.RoleBindingApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1alpha1.RoleBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(roleBindingsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &rbacv1alpha1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1alpha1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1alpha1.RoleBindingApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1alpha1.RoleBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(roleBindingsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &rbacv1alpha1.RoleBinding{})
-	if obj == nil {
-		return nil, err
+func newFakeRoleBindingClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedrbacv1alpha1.RoleBindingInterface {
+	return &roleBindingScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*rbacv1alpha1.RoleBinding, *rbacv1alpha1.RoleBindingList, *v1alpha1.RoleBindingApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			rbacv1alpha1.SchemeGroupVersion.WithResource("rolebindings"),
+			rbacv1alpha1.SchemeGroupVersion.WithKind("RoleBinding"),
+			func() *rbacv1alpha1.RoleBinding { return &rbacv1alpha1.RoleBinding{} },
+			func() *rbacv1alpha1.RoleBindingList { return &rbacv1alpha1.RoleBindingList{} },
+			func(dst, src *rbacv1alpha1.RoleBindingList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1alpha1.RoleBindingList) []*rbacv1alpha1.RoleBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1alpha1.RoleBindingList, items []*rbacv1alpha1.RoleBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*rbacv1alpha1.RoleBinding), err
 }
diff --git a/kubernetes/typed/rbac/v1alpha1/generated_expansion.go b/kubernetes/typed/rbac/v1alpha1/generated_expansion.go
new file mode 100644
index 000000000..6705c7cbd
--- /dev/null
+++ b/kubernetes/typed/rbac/v1alpha1/generated_expansion.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type ClusterRoleClusterExpansion interface{}
+
+type ClusterRoleBindingClusterExpansion interface{}
+
+type RoleClusterExpansion interface{}
+
+type RoleBindingClusterExpansion interface{}
diff --git a/kubernetes/typed/rbac/v1alpha1/rbac_client.go b/kubernetes/typed/rbac/v1alpha1/rbac_client.go
index 1a5d587c5..bad5295ac 100644
--- a/kubernetes/typed/rbac/v1alpha1/rbac_client.go
+++ b/kubernetes/typed/rbac/v1alpha1/rbac_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,32 +14,35 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apirbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
+	rbacv1alpha1 "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1alpha1 "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
-	"k8s.io/client-go/rest"
 )
 
 type RbacV1alpha1ClusterInterface interface {
 	RbacV1alpha1ClusterScoper
-	RolesClusterGetter
-	RoleBindingsClusterGetter
 	ClusterRolesClusterGetter
 	ClusterRoleBindingsClusterGetter
+	RolesClusterGetter
+	RoleBindingsClusterGetter
 }
 
 type RbacV1alpha1ClusterScoper interface {
 	Cluster(logicalcluster.Path) rbacv1alpha1.RbacV1alpha1Interface
 }
 
+// RbacV1alpha1ClusterClient is used to interact with features provided by the rbac.authorization.k8s.io group.
 type RbacV1alpha1ClusterClient struct {
 	clientCache kcpclient.Cache[*rbacv1alpha1.RbacV1alpha1Client]
 }
@@ -54,14 +54,6 @@ func (c *RbacV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) rba
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *RbacV1alpha1ClusterClient) Roles() RoleClusterInterface {
-	return &rolesClusterInterface{clientCache: c.clientCache}
-}
-
-func (c *RbacV1alpha1ClusterClient) RoleBindings() RoleBindingClusterInterface {
-	return &roleBindingsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *RbacV1alpha1ClusterClient) ClusterRoles() ClusterRoleClusterInterface {
 	return &clusterRolesClusterInterface{clientCache: c.clientCache}
 }
@@ -70,15 +62,25 @@ func (c *RbacV1alpha1ClusterClient) ClusterRoleBindings() ClusterRoleBindingClus
 	return &clusterRoleBindingsClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *RbacV1alpha1ClusterClient) Roles() RoleClusterInterface {
+	return &rolesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *RbacV1alpha1ClusterClient) RoleBindings() RoleBindingClusterInterface {
+	return &roleBindingsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new RbacV1alpha1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*RbacV1alpha1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new RbacV1alpha1ClusterClient for the given config and http client.
@@ -90,6 +92,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*RbacV1alpha1Cluster
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &RbacV1alpha1ClusterClient{clientCache: cache}, nil
 }
 
@@ -102,3 +105,14 @@ func NewForConfigOrDie(c *rest.Config) *RbacV1alpha1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apirbacv1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/rbac/v1alpha1/role.go b/kubernetes/typed/rbac/v1alpha1/role.go
index 22ceeb7f0..8ea989086 100644
--- a/kubernetes/typed/rbac/v1alpha1/role.go
+++ b/kubernetes/typed/rbac/v1alpha1/role.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
+	context "context"
+
+	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedrbacv1alpha1 "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	rbacv1alpha1client "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 )
 
 // RolesClusterGetter has a method to return a RoleClusterInterface.
@@ -43,12 +40,13 @@ type RolesClusterGetter interface {
 // or scope down to one cluster and return a RolesNamespacer.
 type RoleClusterInterface interface {
 	Cluster(logicalcluster.Path) RolesNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.RoleList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*rbacv1alpha1.RoleList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	RoleClusterExpansion
 }
 
 type rolesClusterInterface struct {
-	clientCache kcpclient.Cache[*rbacv1alpha1client.RbacV1alpha1Client]
+	clientCache kcpclient.Cache[*typedrbacv1alpha1.RbacV1alpha1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *rolesClusterInterface) Cluster(clusterPath logicalcluster.Path) RolesNa
 }
 
 // List returns the entire collection of all Roles across all clusters.
-func (c *rolesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.RoleList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Roles(metav1.NamespaceAll).List(ctx, opts)
+func (c *rolesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*rbacv1alpha1.RoleList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Roles(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all Roles across all clusters.
-func (c *rolesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Roles(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *rolesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Roles(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// RolesNamespacer can scope to objects within a namespace, returning a rbacv1alpha1client.RoleInterface.
+// RolesNamespacer can scope to objects within a namespace, returning a typedrbacv1alpha1.RoleInterface.
 type RolesNamespacer interface {
-	Namespace(string) rbacv1alpha1client.RoleInterface
+	Namespace(string) typedrbacv1alpha1.RoleInterface
 }
 
 type rolesNamespacer struct {
-	clientCache kcpclient.Cache[*rbacv1alpha1client.RbacV1alpha1Client]
+	clientCache kcpclient.Cache[*typedrbacv1alpha1.RbacV1alpha1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *rolesNamespacer) Namespace(namespace string) rbacv1alpha1client.RoleInterface {
+func (n *rolesNamespacer) Namespace(namespace string) typedrbacv1alpha1.RoleInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Roles(namespace)
 }
diff --git a/kubernetes/typed/rbac/v1alpha1/rolebinding.go b/kubernetes/typed/rbac/v1alpha1/rolebinding.go
index 4953e6226..3fd129e13 100644
--- a/kubernetes/typed/rbac/v1alpha1/rolebinding.go
+++ b/kubernetes/typed/rbac/v1alpha1/rolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
+	context "context"
+
+	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedrbacv1alpha1 "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	rbacv1alpha1client "k8s.io/client-go/kubernetes/typed/rbac/v1alpha1"
 )
 
 // RoleBindingsClusterGetter has a method to return a RoleBindingClusterInterface.
@@ -43,12 +40,13 @@ type RoleBindingsClusterGetter interface {
 // or scope down to one cluster and return a RoleBindingsNamespacer.
 type RoleBindingClusterInterface interface {
 	Cluster(logicalcluster.Path) RoleBindingsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.RoleBindingList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*rbacv1alpha1.RoleBindingList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	RoleBindingClusterExpansion
 }
 
 type roleBindingsClusterInterface struct {
-	clientCache kcpclient.Cache[*rbacv1alpha1client.RbacV1alpha1Client]
+	clientCache kcpclient.Cache[*typedrbacv1alpha1.RbacV1alpha1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *roleBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path)
 }
 
 // List returns the entire collection of all RoleBindings across all clusters.
-func (c *roleBindingsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1alpha1.RoleBindingList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RoleBindings(metav1.NamespaceAll).List(ctx, opts)
+func (c *roleBindingsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*rbacv1alpha1.RoleBindingList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RoleBindings(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all RoleBindings across all clusters.
-func (c *roleBindingsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RoleBindings(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *roleBindingsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RoleBindings(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// RoleBindingsNamespacer can scope to objects within a namespace, returning a rbacv1alpha1client.RoleBindingInterface.
+// RoleBindingsNamespacer can scope to objects within a namespace, returning a typedrbacv1alpha1.RoleBindingInterface.
 type RoleBindingsNamespacer interface {
-	Namespace(string) rbacv1alpha1client.RoleBindingInterface
+	Namespace(string) typedrbacv1alpha1.RoleBindingInterface
 }
 
 type roleBindingsNamespacer struct {
-	clientCache kcpclient.Cache[*rbacv1alpha1client.RbacV1alpha1Client]
+	clientCache kcpclient.Cache[*typedrbacv1alpha1.RbacV1alpha1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *roleBindingsNamespacer) Namespace(namespace string) rbacv1alpha1client.RoleBindingInterface {
+func (n *roleBindingsNamespacer) Namespace(namespace string) typedrbacv1alpha1.RoleBindingInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).RoleBindings(namespace)
 }
diff --git a/kubernetes/typed/rbac/v1beta1/clusterrole.go b/kubernetes/typed/rbac/v1beta1/clusterrole.go
index 2c09eaa3a..92f6a60b0 100644
--- a/kubernetes/typed/rbac/v1beta1/clusterrole.go
+++ b/kubernetes/typed/rbac/v1beta1/clusterrole.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apirbacv1beta1 "k8s.io/api/rbac/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1beta1 "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	rbacv1beta1client "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
 )
 
 // ClusterRolesClusterGetter has a method to return a ClusterRoleClusterInterface.
@@ -40,19 +37,20 @@ type ClusterRolesClusterGetter interface {
 }
 
 // ClusterRoleClusterInterface can operate on ClusterRoles across all clusters,
-// or scope down to one cluster and return a rbacv1beta1client.ClusterRoleInterface.
+// or scope down to one cluster and return a rbacv1beta1.ClusterRoleInterface.
 type ClusterRoleClusterInterface interface {
-	Cluster(logicalcluster.Path) rbacv1beta1client.ClusterRoleInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.ClusterRoleList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) rbacv1beta1.ClusterRoleInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apirbacv1beta1.ClusterRoleList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ClusterRoleClusterExpansion
 }
 
 type clusterRolesClusterInterface struct {
-	clientCache kcpclient.Cache[*rbacv1beta1client.RbacV1beta1Client]
+	clientCache kcpclient.Cache[*rbacv1beta1.RbacV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *clusterRolesClusterInterface) Cluster(clusterPath logicalcluster.Path) rbacv1beta1client.ClusterRoleInterface {
+func (c *clusterRolesClusterInterface) Cluster(clusterPath logicalcluster.Path) rbacv1beta1.ClusterRoleInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *clusterRolesClusterInterface) Cluster(clusterPath logicalcluster.Path)
 }
 
 // List returns the entire collection of all ClusterRoles across all clusters.
-func (c *clusterRolesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.ClusterRoleList, error) {
+func (c *clusterRolesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apirbacv1beta1.ClusterRoleList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterRoles().List(ctx, opts)
 }
 
 // Watch begins to watch all ClusterRoles across all clusters.
-func (c *clusterRolesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *clusterRolesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterRoles().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/rbac/v1beta1/clusterrolebinding.go b/kubernetes/typed/rbac/v1beta1/clusterrolebinding.go
index f1ec6f173..a90887059 100644
--- a/kubernetes/typed/rbac/v1beta1/clusterrolebinding.go
+++ b/kubernetes/typed/rbac/v1beta1/clusterrolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apirbacv1beta1 "k8s.io/api/rbac/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rbacv1beta1 "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	rbacv1beta1client "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
 )
 
 // ClusterRoleBindingsClusterGetter has a method to return a ClusterRoleBindingClusterInterface.
@@ -40,19 +37,20 @@ type ClusterRoleBindingsClusterGetter interface {
 }
 
 // ClusterRoleBindingClusterInterface can operate on ClusterRoleBindings across all clusters,
-// or scope down to one cluster and return a rbacv1beta1client.ClusterRoleBindingInterface.
+// or scope down to one cluster and return a rbacv1beta1.ClusterRoleBindingInterface.
 type ClusterRoleBindingClusterInterface interface {
-	Cluster(logicalcluster.Path) rbacv1beta1client.ClusterRoleBindingInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.ClusterRoleBindingList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) rbacv1beta1.ClusterRoleBindingInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apirbacv1beta1.ClusterRoleBindingList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ClusterRoleBindingClusterExpansion
 }
 
 type clusterRoleBindingsClusterInterface struct {
-	clientCache kcpclient.Cache[*rbacv1beta1client.RbacV1beta1Client]
+	clientCache kcpclient.Cache[*rbacv1beta1.RbacV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *clusterRoleBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path) rbacv1beta1client.ClusterRoleBindingInterface {
+func (c *clusterRoleBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path) rbacv1beta1.ClusterRoleBindingInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *clusterRoleBindingsClusterInterface) Cluster(clusterPath logicalcluster
 }
 
 // List returns the entire collection of all ClusterRoleBindings across all clusters.
-func (c *clusterRoleBindingsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.ClusterRoleBindingList, error) {
+func (c *clusterRoleBindingsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apirbacv1beta1.ClusterRoleBindingList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterRoleBindings().List(ctx, opts)
 }
 
 // Watch begins to watch all ClusterRoleBindings across all clusters.
-func (c *clusterRoleBindingsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *clusterRoleBindingsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ClusterRoleBindings().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/rbac/v1beta1/doc.go b/kubernetes/typed/rbac/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/rbac/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/rbac/v1beta1/fake/clusterrole.go b/kubernetes/typed/rbac/v1beta1/fake/clusterrole.go
index 93c25fedb..af7e5daa8 100644
--- a/kubernetes/typed/rbac/v1beta1/fake/clusterrole.go
+++ b/kubernetes/typed/rbac/v1beta1/fake/clusterrole.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsrbacv1beta1 "k8s.io/client-go/applyconfigurations/rbac/v1beta1"
-	rbacv1beta1client "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/rbac/v1beta1"
+	typedrbacv1beta1 "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
 
+	typedkcprbacv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var clusterRolesResource = schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1beta1", Resource: "clusterroles"}
-var clusterRolesKind = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1beta1", Kind: "ClusterRole"}
-
-type clusterRolesClusterClient struct {
-	*kcptesting.Fake
+// clusterRoleClusterClient implements ClusterRoleClusterInterface
+type clusterRoleClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*rbacv1beta1.ClusterRole, *rbacv1beta1.ClusterRoleList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *clusterRolesClusterClient) Cluster(clusterPath logicalcluster.Path) rbacv1beta1client.ClusterRoleInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &clusterRolesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ClusterRoles that match those selectors across all clusters.
-func (c *clusterRolesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.ClusterRoleList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterRolesResource, clusterRolesKind, logicalcluster.Wildcard, opts), &rbacv1beta1.ClusterRoleList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1beta1.ClusterRoleList{ListMeta: obj.(*rbacv1beta1.ClusterRoleList).ListMeta}
-	for _, item := range obj.(*rbacv1beta1.ClusterRoleList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeClusterRoleClusterClient(fake *RbacV1beta1ClusterClient) typedkcprbacv1beta1.ClusterRoleClusterInterface {
+	return &clusterRoleClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*rbacv1beta1.ClusterRole, *rbacv1beta1.ClusterRoleList](
+			fake.Fake,
+			rbacv1beta1.SchemeGroupVersion.WithResource("clusterroles"),
+			rbacv1beta1.SchemeGroupVersion.WithKind("ClusterRole"),
+			func() *rbacv1beta1.ClusterRole { return &rbacv1beta1.ClusterRole{} },
+			func() *rbacv1beta1.ClusterRoleList { return &rbacv1beta1.ClusterRoleList{} },
+			func(dst, src *rbacv1beta1.ClusterRoleList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1beta1.ClusterRoleList) []*rbacv1beta1.ClusterRole {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1beta1.ClusterRoleList, items []*rbacv1beta1.ClusterRole) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ClusterRoles across all clusters.
-func (c *clusterRolesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterRolesResource, logicalcluster.Wildcard, opts))
+func (c *clusterRoleClusterClient) Cluster(cluster logicalcluster.Path) typedrbacv1beta1.ClusterRoleInterface {
+	return newFakeClusterRoleClient(c.Fake, cluster)
 }
 
-type clusterRolesClient struct {
-	*kcptesting.Fake
+// clusterRoleScopedClient implements ClusterRoleInterface
+type clusterRoleScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*rbacv1beta1.ClusterRole, *rbacv1beta1.ClusterRoleList, *v1beta1.ClusterRoleApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *clusterRolesClient) Create(ctx context.Context, clusterRole *rbacv1beta1.ClusterRole, opts metav1.CreateOptions) (*rbacv1beta1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(clusterRolesResource, c.ClusterPath, clusterRole), &rbacv1beta1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) Update(ctx context.Context, clusterRole *rbacv1beta1.ClusterRole, opts metav1.UpdateOptions) (*rbacv1beta1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(clusterRolesResource, c.ClusterPath, clusterRole), &rbacv1beta1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) UpdateStatus(ctx context.Context, clusterRole *rbacv1beta1.ClusterRole, opts metav1.UpdateOptions) (*rbacv1beta1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(clusterRolesResource, c.ClusterPath, "status", clusterRole), &rbacv1beta1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(clusterRolesResource, c.ClusterPath, name, opts), &rbacv1beta1.ClusterRole{})
-	return err
-}
-
-func (c *clusterRolesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(clusterRolesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &rbacv1beta1.ClusterRoleList{})
-	return err
-}
-
-func (c *clusterRolesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*rbacv1beta1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(clusterRolesResource, c.ClusterPath, name), &rbacv1beta1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.ClusterRole), err
-}
-
-// List takes label and field selectors, and returns the list of ClusterRoles that match those selectors.
-func (c *clusterRolesClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.ClusterRoleList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterRolesResource, clusterRolesKind, c.ClusterPath, opts), &rbacv1beta1.ClusterRoleList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1beta1.ClusterRoleList{ListMeta: obj.(*rbacv1beta1.ClusterRoleList).ListMeta}
-	for _, item := range obj.(*rbacv1beta1.ClusterRoleList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *clusterRolesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterRolesResource, c.ClusterPath, opts))
-}
-
-func (c *clusterRolesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*rbacv1beta1.ClusterRole, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRolesResource, c.ClusterPath, name, pt, data, subresources...), &rbacv1beta1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1beta1.ClusterRoleApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1beta1.ClusterRole, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRolesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &rbacv1beta1.ClusterRole{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.ClusterRole), err
-}
-
-func (c *clusterRolesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1beta1.ClusterRoleApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1beta1.ClusterRole, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRolesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &rbacv1beta1.ClusterRole{})
-	if obj == nil {
-		return nil, err
+func newFakeClusterRoleClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedrbacv1beta1.ClusterRoleInterface {
+	return &clusterRoleScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*rbacv1beta1.ClusterRole, *rbacv1beta1.ClusterRoleList, *v1beta1.ClusterRoleApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			rbacv1beta1.SchemeGroupVersion.WithResource("clusterroles"),
+			rbacv1beta1.SchemeGroupVersion.WithKind("ClusterRole"),
+			func() *rbacv1beta1.ClusterRole { return &rbacv1beta1.ClusterRole{} },
+			func() *rbacv1beta1.ClusterRoleList { return &rbacv1beta1.ClusterRoleList{} },
+			func(dst, src *rbacv1beta1.ClusterRoleList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1beta1.ClusterRoleList) []*rbacv1beta1.ClusterRole {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1beta1.ClusterRoleList, items []*rbacv1beta1.ClusterRole) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*rbacv1beta1.ClusterRole), err
 }
diff --git a/kubernetes/typed/rbac/v1beta1/fake/clusterrolebinding.go b/kubernetes/typed/rbac/v1beta1/fake/clusterrolebinding.go
index 8040adf68..91db08e16 100644
--- a/kubernetes/typed/rbac/v1beta1/fake/clusterrolebinding.go
+++ b/kubernetes/typed/rbac/v1beta1/fake/clusterrolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsrbacv1beta1 "k8s.io/client-go/applyconfigurations/rbac/v1beta1"
-	rbacv1beta1client "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/rbac/v1beta1"
+	typedrbacv1beta1 "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
 
+	typedkcprbacv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var clusterRoleBindingsResource = schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1beta1", Resource: "clusterrolebindings"}
-var clusterRoleBindingsKind = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1beta1", Kind: "ClusterRoleBinding"}
-
-type clusterRoleBindingsClusterClient struct {
-	*kcptesting.Fake
+// clusterRoleBindingClusterClient implements ClusterRoleBindingClusterInterface
+type clusterRoleBindingClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*rbacv1beta1.ClusterRoleBinding, *rbacv1beta1.ClusterRoleBindingList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *clusterRoleBindingsClusterClient) Cluster(clusterPath logicalcluster.Path) rbacv1beta1client.ClusterRoleBindingInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &clusterRoleBindingsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ClusterRoleBindings that match those selectors across all clusters.
-func (c *clusterRoleBindingsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.ClusterRoleBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterRoleBindingsResource, clusterRoleBindingsKind, logicalcluster.Wildcard, opts), &rbacv1beta1.ClusterRoleBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1beta1.ClusterRoleBindingList{ListMeta: obj.(*rbacv1beta1.ClusterRoleBindingList).ListMeta}
-	for _, item := range obj.(*rbacv1beta1.ClusterRoleBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeClusterRoleBindingClusterClient(fake *RbacV1beta1ClusterClient) typedkcprbacv1beta1.ClusterRoleBindingClusterInterface {
+	return &clusterRoleBindingClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*rbacv1beta1.ClusterRoleBinding, *rbacv1beta1.ClusterRoleBindingList](
+			fake.Fake,
+			rbacv1beta1.SchemeGroupVersion.WithResource("clusterrolebindings"),
+			rbacv1beta1.SchemeGroupVersion.WithKind("ClusterRoleBinding"),
+			func() *rbacv1beta1.ClusterRoleBinding { return &rbacv1beta1.ClusterRoleBinding{} },
+			func() *rbacv1beta1.ClusterRoleBindingList { return &rbacv1beta1.ClusterRoleBindingList{} },
+			func(dst, src *rbacv1beta1.ClusterRoleBindingList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1beta1.ClusterRoleBindingList) []*rbacv1beta1.ClusterRoleBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1beta1.ClusterRoleBindingList, items []*rbacv1beta1.ClusterRoleBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested ClusterRoleBindings across all clusters.
-func (c *clusterRoleBindingsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterRoleBindingsResource, logicalcluster.Wildcard, opts))
+func (c *clusterRoleBindingClusterClient) Cluster(cluster logicalcluster.Path) typedrbacv1beta1.ClusterRoleBindingInterface {
+	return newFakeClusterRoleBindingClient(c.Fake, cluster)
 }
 
-type clusterRoleBindingsClient struct {
-	*kcptesting.Fake
+// clusterRoleBindingScopedClient implements ClusterRoleBindingInterface
+type clusterRoleBindingScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*rbacv1beta1.ClusterRoleBinding, *rbacv1beta1.ClusterRoleBindingList, *v1beta1.ClusterRoleBindingApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *clusterRoleBindingsClient) Create(ctx context.Context, clusterRoleBinding *rbacv1beta1.ClusterRoleBinding, opts metav1.CreateOptions) (*rbacv1beta1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(clusterRoleBindingsResource, c.ClusterPath, clusterRoleBinding), &rbacv1beta1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) Update(ctx context.Context, clusterRoleBinding *rbacv1beta1.ClusterRoleBinding, opts metav1.UpdateOptions) (*rbacv1beta1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(clusterRoleBindingsResource, c.ClusterPath, clusterRoleBinding), &rbacv1beta1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) UpdateStatus(ctx context.Context, clusterRoleBinding *rbacv1beta1.ClusterRoleBinding, opts metav1.UpdateOptions) (*rbacv1beta1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(clusterRoleBindingsResource, c.ClusterPath, "status", clusterRoleBinding), &rbacv1beta1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(clusterRoleBindingsResource, c.ClusterPath, name, opts), &rbacv1beta1.ClusterRoleBinding{})
-	return err
-}
-
-func (c *clusterRoleBindingsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(clusterRoleBindingsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &rbacv1beta1.ClusterRoleBindingList{})
-	return err
-}
-
-func (c *clusterRoleBindingsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*rbacv1beta1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(clusterRoleBindingsResource, c.ClusterPath, name), &rbacv1beta1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.ClusterRoleBinding), err
-}
-
-// List takes label and field selectors, and returns the list of ClusterRoleBindings that match those selectors.
-func (c *clusterRoleBindingsClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.ClusterRoleBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(clusterRoleBindingsResource, clusterRoleBindingsKind, c.ClusterPath, opts), &rbacv1beta1.ClusterRoleBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1beta1.ClusterRoleBindingList{ListMeta: obj.(*rbacv1beta1.ClusterRoleBindingList).ListMeta}
-	for _, item := range obj.(*rbacv1beta1.ClusterRoleBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *clusterRoleBindingsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(clusterRoleBindingsResource, c.ClusterPath, opts))
-}
-
-func (c *clusterRoleBindingsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*rbacv1beta1.ClusterRoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRoleBindingsResource, c.ClusterPath, name, pt, data, subresources...), &rbacv1beta1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1beta1.ClusterRoleBindingApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1beta1.ClusterRoleBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRoleBindingsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &rbacv1beta1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.ClusterRoleBinding), err
-}
-
-func (c *clusterRoleBindingsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1beta1.ClusterRoleBindingApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1beta1.ClusterRoleBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(clusterRoleBindingsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &rbacv1beta1.ClusterRoleBinding{})
-	if obj == nil {
-		return nil, err
+func newFakeClusterRoleBindingClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedrbacv1beta1.ClusterRoleBindingInterface {
+	return &clusterRoleBindingScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*rbacv1beta1.ClusterRoleBinding, *rbacv1beta1.ClusterRoleBindingList, *v1beta1.ClusterRoleBindingApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			rbacv1beta1.SchemeGroupVersion.WithResource("clusterrolebindings"),
+			rbacv1beta1.SchemeGroupVersion.WithKind("ClusterRoleBinding"),
+			func() *rbacv1beta1.ClusterRoleBinding { return &rbacv1beta1.ClusterRoleBinding{} },
+			func() *rbacv1beta1.ClusterRoleBindingList { return &rbacv1beta1.ClusterRoleBindingList{} },
+			func(dst, src *rbacv1beta1.ClusterRoleBindingList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1beta1.ClusterRoleBindingList) []*rbacv1beta1.ClusterRoleBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1beta1.ClusterRoleBindingList, items []*rbacv1beta1.ClusterRoleBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*rbacv1beta1.ClusterRoleBinding), err
 }
diff --git a/kubernetes/typed/rbac/v1beta1/fake/doc.go b/kubernetes/typed/rbac/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/rbac/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/rbac/v1beta1/fake/rbac_client.go b/kubernetes/typed/rbac/v1beta1/fake/rbac_client.go
index ab7f96169..ffc4f22f1 100644
--- a/kubernetes/typed/rbac/v1beta1/fake/rbac_client.go
+++ b/kubernetes/typed/rbac/v1beta1/fake/rbac_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1beta1 "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcprbacv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcprbacv1beta1.RbacV1beta1ClusterInterface = (*RbacV1beta1ClusterClient)(nil)
@@ -44,46 +40,46 @@ func (c *RbacV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) rbac
 	return &RbacV1beta1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *RbacV1beta1ClusterClient) Roles() kcprbacv1beta1.RoleClusterInterface {
-	return &rolesClusterClient{Fake: c.Fake}
+func (c *RbacV1beta1ClusterClient) ClusterRoles() kcprbacv1beta1.ClusterRoleClusterInterface {
+	return newFakeClusterRoleClusterClient(c)
 }
 
-func (c *RbacV1beta1ClusterClient) RoleBindings() kcprbacv1beta1.RoleBindingClusterInterface {
-	return &roleBindingsClusterClient{Fake: c.Fake}
+func (c *RbacV1beta1ClusterClient) ClusterRoleBindings() kcprbacv1beta1.ClusterRoleBindingClusterInterface {
+	return newFakeClusterRoleBindingClusterClient(c)
 }
 
-func (c *RbacV1beta1ClusterClient) ClusterRoles() kcprbacv1beta1.ClusterRoleClusterInterface {
-	return &clusterRolesClusterClient{Fake: c.Fake}
+func (c *RbacV1beta1ClusterClient) Roles() kcprbacv1beta1.RoleClusterInterface {
+	return newFakeRoleClusterClient(c)
 }
 
-func (c *RbacV1beta1ClusterClient) ClusterRoleBindings() kcprbacv1beta1.ClusterRoleBindingClusterInterface {
-	return &clusterRoleBindingsClusterClient{Fake: c.Fake}
+func (c *RbacV1beta1ClusterClient) RoleBindings() kcprbacv1beta1.RoleBindingClusterInterface {
+	return newFakeRoleBindingClusterClient(c)
 }
 
-var _ rbacv1beta1.RbacV1beta1Interface = (*RbacV1beta1Client)(nil)
-
 type RbacV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *RbacV1beta1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *RbacV1beta1Client) ClusterRoles() rbacv1beta1.ClusterRoleInterface {
+	return newFakeClusterRoleClient(c.Fake, c.ClusterPath)
 }
 
-func (c *RbacV1beta1Client) Roles(namespace string) rbacv1beta1.RoleInterface {
-	return &rolesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *RbacV1beta1Client) ClusterRoleBindings() rbacv1beta1.ClusterRoleBindingInterface {
+	return newFakeClusterRoleBindingClient(c.Fake, c.ClusterPath)
 }
 
-func (c *RbacV1beta1Client) RoleBindings(namespace string) rbacv1beta1.RoleBindingInterface {
-	return &roleBindingsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *RbacV1beta1Client) Roles(namespace string) rbacv1beta1.RoleInterface {
+	return newFakeRoleClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *RbacV1beta1Client) ClusterRoles() rbacv1beta1.ClusterRoleInterface {
-	return &clusterRolesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *RbacV1beta1Client) RoleBindings(namespace string) rbacv1beta1.RoleBindingInterface {
+	return newFakeRoleBindingClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *RbacV1beta1Client) ClusterRoleBindings() rbacv1beta1.ClusterRoleBindingInterface {
-	return &clusterRoleBindingsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *RbacV1beta1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/rbac/v1beta1/fake/role.go b/kubernetes/typed/rbac/v1beta1/fake/role.go
index 5d529f358..f7a31f007 100644
--- a/kubernetes/typed/rbac/v1beta1/fake/role.go
+++ b/kubernetes/typed/rbac/v1beta1/fake/role.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,82 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsrbacv1beta1 "k8s.io/client-go/applyconfigurations/rbac/v1beta1"
-	rbacv1beta1client "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/rbac/v1beta1"
+	typedrbacv1beta1 "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
 
-	kcprbacv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1beta1"
+	typedkcprbacv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var rolesResource = schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1beta1", Resource: "roles"}
-var rolesKind = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1beta1", Kind: "Role"}
-
-type rolesClusterClient struct {
-	*kcptesting.Fake
+// roleClusterClient implements RoleClusterInterface
+type roleClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*rbacv1beta1.Role, *rbacv1beta1.RoleList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *rolesClusterClient) Cluster(clusterPath logicalcluster.Path) kcprbacv1beta1.RolesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &rolesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of Roles that match those selectors across all clusters.
-func (c *rolesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.RoleList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(rolesResource, rolesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &rbacv1beta1.RoleList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeRoleClusterClient(fake *RbacV1beta1ClusterClient) typedkcprbacv1beta1.RoleClusterInterface {
+	return &roleClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*rbacv1beta1.Role, *rbacv1beta1.RoleList](
+			fake.Fake,
+			rbacv1beta1.SchemeGroupVersion.WithResource("roles"),
+			rbacv1beta1.SchemeGroupVersion.WithKind("Role"),
+			func() *rbacv1beta1.Role { return &rbacv1beta1.Role{} },
+			func() *rbacv1beta1.RoleList { return &rbacv1beta1.RoleList{} },
+			func(dst, src *rbacv1beta1.RoleList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1beta1.RoleList) []*rbacv1beta1.Role { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *rbacv1beta1.RoleList, items []*rbacv1beta1.Role) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &rbacv1beta1.RoleList{ListMeta: obj.(*rbacv1beta1.RoleList).ListMeta}
-	for _, item := range obj.(*rbacv1beta1.RoleList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested Roles across all clusters.
-func (c *rolesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(rolesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *roleClusterClient) Cluster(cluster logicalcluster.Path) typedkcprbacv1beta1.RolesNamespacer {
+	return &roleNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type rolesNamespacer struct {
+type roleNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *rolesNamespacer) Namespace(namespace string) rbacv1beta1client.RoleInterface {
-	return &rolesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *roleNamespacer) Namespace(namespace string) typedrbacv1beta1.RoleInterface {
+	return newFakeRoleClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type rolesClient struct {
-	*kcptesting.Fake
+// roleScopedClient implements RoleInterface
+type roleScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*rbacv1beta1.Role, *rbacv1beta1.RoleList, *v1beta1.RoleApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *rolesClient) Create(ctx context.Context, role *rbacv1beta1.Role, opts metav1.CreateOptions) (*rbacv1beta1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(rolesResource, c.ClusterPath, c.Namespace, role), &rbacv1beta1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.Role), err
-}
-
-func (c *rolesClient) Update(ctx context.Context, role *rbacv1beta1.Role, opts metav1.UpdateOptions) (*rbacv1beta1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(rolesResource, c.ClusterPath, c.Namespace, role), &rbacv1beta1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.Role), err
-}
-
-func (c *rolesClient) UpdateStatus(ctx context.Context, role *rbacv1beta1.Role, opts metav1.UpdateOptions) (*rbacv1beta1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(rolesResource, c.ClusterPath, "status", c.Namespace, role), &rbacv1beta1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.Role), err
-}
-
-func (c *rolesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(rolesResource, c.ClusterPath, c.Namespace, name, opts), &rbacv1beta1.Role{})
-	return err
 }
 
-func (c *rolesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(rolesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &rbacv1beta1.RoleList{})
-	return err
-}
-
-func (c *rolesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*rbacv1beta1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(rolesResource, c.ClusterPath, c.Namespace, name), &rbacv1beta1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.Role), err
-}
-
-// List takes label and field selectors, and returns the list of Roles that match those selectors.
-func (c *rolesClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.RoleList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(rolesResource, rolesKind, c.ClusterPath, c.Namespace, opts), &rbacv1beta1.RoleList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1beta1.RoleList{ListMeta: obj.(*rbacv1beta1.RoleList).ListMeta}
-	for _, item := range obj.(*rbacv1beta1.RoleList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *rolesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(rolesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *rolesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*rbacv1beta1.Role, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(rolesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &rbacv1beta1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.Role), err
-}
-
-func (c *rolesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1beta1.RoleApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1beta1.Role, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(rolesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &rbacv1beta1.Role{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.Role), err
-}
-
-func (c *rolesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1beta1.RoleApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1beta1.Role, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(rolesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &rbacv1beta1.Role{})
-	if obj == nil {
-		return nil, err
+func newFakeRoleClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedrbacv1beta1.RoleInterface {
+	return &roleScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*rbacv1beta1.Role, *rbacv1beta1.RoleList, *v1beta1.RoleApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			rbacv1beta1.SchemeGroupVersion.WithResource("roles"),
+			rbacv1beta1.SchemeGroupVersion.WithKind("Role"),
+			func() *rbacv1beta1.Role { return &rbacv1beta1.Role{} },
+			func() *rbacv1beta1.RoleList { return &rbacv1beta1.RoleList{} },
+			func(dst, src *rbacv1beta1.RoleList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1beta1.RoleList) []*rbacv1beta1.Role { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *rbacv1beta1.RoleList, items []*rbacv1beta1.Role) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*rbacv1beta1.Role), err
 }
diff --git a/kubernetes/typed/rbac/v1beta1/fake/rolebinding.go b/kubernetes/typed/rbac/v1beta1/fake/rolebinding.go
index 07eaf8448..46aabd616 100644
--- a/kubernetes/typed/rbac/v1beta1/fake/rolebinding.go
+++ b/kubernetes/typed/rbac/v1beta1/fake/rolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsrbacv1beta1 "k8s.io/client-go/applyconfigurations/rbac/v1beta1"
-	rbacv1beta1client "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/rbac/v1beta1"
+	typedrbacv1beta1 "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
 
-	kcprbacv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1beta1"
+	typedkcprbacv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/rbac/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var roleBindingsResource = schema.GroupVersionResource{Group: "rbac.authorization.k8s.io", Version: "v1beta1", Resource: "rolebindings"}
-var roleBindingsKind = schema.GroupVersionKind{Group: "rbac.authorization.k8s.io", Version: "v1beta1", Kind: "RoleBinding"}
-
-type roleBindingsClusterClient struct {
-	*kcptesting.Fake
+// roleBindingClusterClient implements RoleBindingClusterInterface
+type roleBindingClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*rbacv1beta1.RoleBinding, *rbacv1beta1.RoleBindingList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *roleBindingsClusterClient) Cluster(clusterPath logicalcluster.Path) kcprbacv1beta1.RoleBindingsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &roleBindingsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of RoleBindings that match those selectors across all clusters.
-func (c *roleBindingsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.RoleBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(roleBindingsResource, roleBindingsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &rbacv1beta1.RoleBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeRoleBindingClusterClient(fake *RbacV1beta1ClusterClient) typedkcprbacv1beta1.RoleBindingClusterInterface {
+	return &roleBindingClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*rbacv1beta1.RoleBinding, *rbacv1beta1.RoleBindingList](
+			fake.Fake,
+			rbacv1beta1.SchemeGroupVersion.WithResource("rolebindings"),
+			rbacv1beta1.SchemeGroupVersion.WithKind("RoleBinding"),
+			func() *rbacv1beta1.RoleBinding { return &rbacv1beta1.RoleBinding{} },
+			func() *rbacv1beta1.RoleBindingList { return &rbacv1beta1.RoleBindingList{} },
+			func(dst, src *rbacv1beta1.RoleBindingList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1beta1.RoleBindingList) []*rbacv1beta1.RoleBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1beta1.RoleBindingList, items []*rbacv1beta1.RoleBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &rbacv1beta1.RoleBindingList{ListMeta: obj.(*rbacv1beta1.RoleBindingList).ListMeta}
-	for _, item := range obj.(*rbacv1beta1.RoleBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested RoleBindings across all clusters.
-func (c *roleBindingsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(roleBindingsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *roleBindingClusterClient) Cluster(cluster logicalcluster.Path) typedkcprbacv1beta1.RoleBindingsNamespacer {
+	return &roleBindingNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type roleBindingsNamespacer struct {
+type roleBindingNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *roleBindingsNamespacer) Namespace(namespace string) rbacv1beta1client.RoleBindingInterface {
-	return &roleBindingsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *roleBindingNamespacer) Namespace(namespace string) typedrbacv1beta1.RoleBindingInterface {
+	return newFakeRoleBindingClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type roleBindingsClient struct {
-	*kcptesting.Fake
+// roleBindingScopedClient implements RoleBindingInterface
+type roleBindingScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*rbacv1beta1.RoleBinding, *rbacv1beta1.RoleBindingList, *v1beta1.RoleBindingApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *roleBindingsClient) Create(ctx context.Context, roleBinding *rbacv1beta1.RoleBinding, opts metav1.CreateOptions) (*rbacv1beta1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(roleBindingsResource, c.ClusterPath, c.Namespace, roleBinding), &rbacv1beta1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) Update(ctx context.Context, roleBinding *rbacv1beta1.RoleBinding, opts metav1.UpdateOptions) (*rbacv1beta1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(roleBindingsResource, c.ClusterPath, c.Namespace, roleBinding), &rbacv1beta1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) UpdateStatus(ctx context.Context, roleBinding *rbacv1beta1.RoleBinding, opts metav1.UpdateOptions) (*rbacv1beta1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(roleBindingsResource, c.ClusterPath, "status", c.Namespace, roleBinding), &rbacv1beta1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(roleBindingsResource, c.ClusterPath, c.Namespace, name, opts), &rbacv1beta1.RoleBinding{})
-	return err
 }
 
-func (c *roleBindingsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(roleBindingsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &rbacv1beta1.RoleBindingList{})
-	return err
-}
-
-func (c *roleBindingsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*rbacv1beta1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(roleBindingsResource, c.ClusterPath, c.Namespace, name), &rbacv1beta1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.RoleBinding), err
-}
-
-// List takes label and field selectors, and returns the list of RoleBindings that match those selectors.
-func (c *roleBindingsClient) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.RoleBindingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(roleBindingsResource, roleBindingsKind, c.ClusterPath, c.Namespace, opts), &rbacv1beta1.RoleBindingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &rbacv1beta1.RoleBindingList{ListMeta: obj.(*rbacv1beta1.RoleBindingList).ListMeta}
-	for _, item := range obj.(*rbacv1beta1.RoleBindingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *roleBindingsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(roleBindingsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *roleBindingsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*rbacv1beta1.RoleBinding, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(roleBindingsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &rbacv1beta1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1beta1.RoleBindingApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1beta1.RoleBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(roleBindingsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &rbacv1beta1.RoleBinding{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*rbacv1beta1.RoleBinding), err
-}
-
-func (c *roleBindingsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsrbacv1beta1.RoleBindingApplyConfiguration, opts metav1.ApplyOptions) (*rbacv1beta1.RoleBinding, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(roleBindingsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &rbacv1beta1.RoleBinding{})
-	if obj == nil {
-		return nil, err
+func newFakeRoleBindingClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedrbacv1beta1.RoleBindingInterface {
+	return &roleBindingScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*rbacv1beta1.RoleBinding, *rbacv1beta1.RoleBindingList, *v1beta1.RoleBindingApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			rbacv1beta1.SchemeGroupVersion.WithResource("rolebindings"),
+			rbacv1beta1.SchemeGroupVersion.WithKind("RoleBinding"),
+			func() *rbacv1beta1.RoleBinding { return &rbacv1beta1.RoleBinding{} },
+			func() *rbacv1beta1.RoleBindingList { return &rbacv1beta1.RoleBindingList{} },
+			func(dst, src *rbacv1beta1.RoleBindingList) { dst.ListMeta = src.ListMeta },
+			func(list *rbacv1beta1.RoleBindingList) []*rbacv1beta1.RoleBinding {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *rbacv1beta1.RoleBindingList, items []*rbacv1beta1.RoleBinding) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*rbacv1beta1.RoleBinding), err
 }
diff --git a/kubernetes/typed/rbac/v1beta1/generated_expansion.go b/kubernetes/typed/rbac/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..6993dc2f3
--- /dev/null
+++ b/kubernetes/typed/rbac/v1beta1/generated_expansion.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type ClusterRoleClusterExpansion interface{}
+
+type ClusterRoleBindingClusterExpansion interface{}
+
+type RoleClusterExpansion interface{}
+
+type RoleBindingClusterExpansion interface{}
diff --git a/kubernetes/typed/rbac/v1beta1/rbac_client.go b/kubernetes/typed/rbac/v1beta1/rbac_client.go
index 6a11ab445..258d6fe0b 100644
--- a/kubernetes/typed/rbac/v1beta1/rbac_client.go
+++ b/kubernetes/typed/rbac/v1beta1/rbac_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,32 +14,35 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apirbacv1beta1 "k8s.io/api/rbac/v1beta1"
+	rbacv1beta1 "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1beta1 "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type RbacV1beta1ClusterInterface interface {
 	RbacV1beta1ClusterScoper
-	RolesClusterGetter
-	RoleBindingsClusterGetter
 	ClusterRolesClusterGetter
 	ClusterRoleBindingsClusterGetter
+	RolesClusterGetter
+	RoleBindingsClusterGetter
 }
 
 type RbacV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) rbacv1beta1.RbacV1beta1Interface
 }
 
+// RbacV1beta1ClusterClient is used to interact with features provided by the rbac.authorization.k8s.io group.
 type RbacV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*rbacv1beta1.RbacV1beta1Client]
 }
@@ -54,14 +54,6 @@ func (c *RbacV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) rbac
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *RbacV1beta1ClusterClient) Roles() RoleClusterInterface {
-	return &rolesClusterInterface{clientCache: c.clientCache}
-}
-
-func (c *RbacV1beta1ClusterClient) RoleBindings() RoleBindingClusterInterface {
-	return &roleBindingsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *RbacV1beta1ClusterClient) ClusterRoles() ClusterRoleClusterInterface {
 	return &clusterRolesClusterInterface{clientCache: c.clientCache}
 }
@@ -70,15 +62,25 @@ func (c *RbacV1beta1ClusterClient) ClusterRoleBindings() ClusterRoleBindingClust
 	return &clusterRoleBindingsClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *RbacV1beta1ClusterClient) Roles() RoleClusterInterface {
+	return &rolesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *RbacV1beta1ClusterClient) RoleBindings() RoleBindingClusterInterface {
+	return &roleBindingsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new RbacV1beta1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*RbacV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new RbacV1beta1ClusterClient for the given config and http client.
@@ -90,6 +92,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*RbacV1beta1ClusterC
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &RbacV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -102,3 +105,14 @@ func NewForConfigOrDie(c *rest.Config) *RbacV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apirbacv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/rbac/v1beta1/role.go b/kubernetes/typed/rbac/v1beta1/role.go
index 186b64546..642a24727 100644
--- a/kubernetes/typed/rbac/v1beta1/role.go
+++ b/kubernetes/typed/rbac/v1beta1/role.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedrbacv1beta1 "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	rbacv1beta1client "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
 )
 
 // RolesClusterGetter has a method to return a RoleClusterInterface.
@@ -43,12 +40,13 @@ type RolesClusterGetter interface {
 // or scope down to one cluster and return a RolesNamespacer.
 type RoleClusterInterface interface {
 	Cluster(logicalcluster.Path) RolesNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.RoleList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*rbacv1beta1.RoleList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	RoleClusterExpansion
 }
 
 type rolesClusterInterface struct {
-	clientCache kcpclient.Cache[*rbacv1beta1client.RbacV1beta1Client]
+	clientCache kcpclient.Cache[*typedrbacv1beta1.RbacV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *rolesClusterInterface) Cluster(clusterPath logicalcluster.Path) RolesNa
 }
 
 // List returns the entire collection of all Roles across all clusters.
-func (c *rolesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.RoleList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Roles(metav1.NamespaceAll).List(ctx, opts)
+func (c *rolesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*rbacv1beta1.RoleList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Roles(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all Roles across all clusters.
-func (c *rolesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Roles(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *rolesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).Roles(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// RolesNamespacer can scope to objects within a namespace, returning a rbacv1beta1client.RoleInterface.
+// RolesNamespacer can scope to objects within a namespace, returning a typedrbacv1beta1.RoleInterface.
 type RolesNamespacer interface {
-	Namespace(string) rbacv1beta1client.RoleInterface
+	Namespace(string) typedrbacv1beta1.RoleInterface
 }
 
 type rolesNamespacer struct {
-	clientCache kcpclient.Cache[*rbacv1beta1client.RbacV1beta1Client]
+	clientCache kcpclient.Cache[*typedrbacv1beta1.RbacV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *rolesNamespacer) Namespace(namespace string) rbacv1beta1client.RoleInterface {
+func (n *rolesNamespacer) Namespace(namespace string) typedrbacv1beta1.RoleInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).Roles(namespace)
 }
diff --git a/kubernetes/typed/rbac/v1beta1/rolebinding.go b/kubernetes/typed/rbac/v1beta1/rolebinding.go
index 03cb11095..8d3e3085f 100644
--- a/kubernetes/typed/rbac/v1beta1/rolebinding.go
+++ b/kubernetes/typed/rbac/v1beta1/rolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedrbacv1beta1 "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	rbacv1beta1client "k8s.io/client-go/kubernetes/typed/rbac/v1beta1"
 )
 
 // RoleBindingsClusterGetter has a method to return a RoleBindingClusterInterface.
@@ -43,12 +40,13 @@ type RoleBindingsClusterGetter interface {
 // or scope down to one cluster and return a RoleBindingsNamespacer.
 type RoleBindingClusterInterface interface {
 	Cluster(logicalcluster.Path) RoleBindingsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.RoleBindingList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*rbacv1beta1.RoleBindingList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	RoleBindingClusterExpansion
 }
 
 type roleBindingsClusterInterface struct {
-	clientCache kcpclient.Cache[*rbacv1beta1client.RbacV1beta1Client]
+	clientCache kcpclient.Cache[*typedrbacv1beta1.RbacV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *roleBindingsClusterInterface) Cluster(clusterPath logicalcluster.Path)
 }
 
 // List returns the entire collection of all RoleBindings across all clusters.
-func (c *roleBindingsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*rbacv1beta1.RoleBindingList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RoleBindings(metav1.NamespaceAll).List(ctx, opts)
+func (c *roleBindingsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*rbacv1beta1.RoleBindingList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RoleBindings(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all RoleBindings across all clusters.
-func (c *roleBindingsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RoleBindings(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *roleBindingsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).RoleBindings(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// RoleBindingsNamespacer can scope to objects within a namespace, returning a rbacv1beta1client.RoleBindingInterface.
+// RoleBindingsNamespacer can scope to objects within a namespace, returning a typedrbacv1beta1.RoleBindingInterface.
 type RoleBindingsNamespacer interface {
-	Namespace(string) rbacv1beta1client.RoleBindingInterface
+	Namespace(string) typedrbacv1beta1.RoleBindingInterface
 }
 
 type roleBindingsNamespacer struct {
-	clientCache kcpclient.Cache[*rbacv1beta1client.RbacV1beta1Client]
+	clientCache kcpclient.Cache[*typedrbacv1beta1.RbacV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *roleBindingsNamespacer) Namespace(namespace string) rbacv1beta1client.RoleBindingInterface {
+func (n *roleBindingsNamespacer) Namespace(namespace string) typedrbacv1beta1.RoleBindingInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).RoleBindings(namespace)
 }
diff --git a/kubernetes/typed/resource/v1alpha1/fake/podscheduling.go b/kubernetes/typed/resource/v1alpha1/fake/podscheduling.go
deleted file mode 100644
index 51491b52c..000000000
--- a/kubernetes/typed/resource/v1alpha1/fake/podscheduling.go
+++ /dev/null
@@ -1,213 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsresourcev1alpha1 "k8s.io/client-go/applyconfigurations/resource/v1alpha1"
-	resourcev1alpha1client "k8s.io/client-go/kubernetes/typed/resource/v1alpha1"
-	"k8s.io/client-go/testing"
-
-	kcpresourcev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha1"
-	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
-)
-
-var podSchedulingsResource = schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1alpha1", Resource: "podschedulings"}
-var podSchedulingsKind = schema.GroupVersionKind{Group: "resource.k8s.io", Version: "v1alpha1", Kind: "PodScheduling"}
-
-type podSchedulingsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *podSchedulingsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpresourcev1alpha1.PodSchedulingsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &podSchedulingsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PodSchedulings that match those selectors across all clusters.
-func (c *podSchedulingsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.PodSchedulingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(podSchedulingsResource, podSchedulingsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &resourcev1alpha1.PodSchedulingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &resourcev1alpha1.PodSchedulingList{ListMeta: obj.(*resourcev1alpha1.PodSchedulingList).ListMeta}
-	for _, item := range obj.(*resourcev1alpha1.PodSchedulingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested PodSchedulings across all clusters.
-func (c *podSchedulingsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(podSchedulingsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
-}
-
-type podSchedulingsNamespacer struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-}
-
-func (n *podSchedulingsNamespacer) Namespace(namespace string) resourcev1alpha1client.PodSchedulingInterface {
-	return &podSchedulingsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
-}
-
-type podSchedulingsClient struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *podSchedulingsClient) Create(ctx context.Context, podScheduling *resourcev1alpha1.PodScheduling, opts metav1.CreateOptions) (*resourcev1alpha1.PodScheduling, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(podSchedulingsResource, c.ClusterPath, c.Namespace, podScheduling), &resourcev1alpha1.PodScheduling{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.PodScheduling), err
-}
-
-func (c *podSchedulingsClient) Update(ctx context.Context, podScheduling *resourcev1alpha1.PodScheduling, opts metav1.UpdateOptions) (*resourcev1alpha1.PodScheduling, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(podSchedulingsResource, c.ClusterPath, c.Namespace, podScheduling), &resourcev1alpha1.PodScheduling{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.PodScheduling), err
-}
-
-func (c *podSchedulingsClient) UpdateStatus(ctx context.Context, podScheduling *resourcev1alpha1.PodScheduling, opts metav1.UpdateOptions) (*resourcev1alpha1.PodScheduling, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(podSchedulingsResource, c.ClusterPath, "status", c.Namespace, podScheduling), &resourcev1alpha1.PodScheduling{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.PodScheduling), err
-}
-
-func (c *podSchedulingsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(podSchedulingsResource, c.ClusterPath, c.Namespace, name, opts), &resourcev1alpha1.PodScheduling{})
-	return err
-}
-
-func (c *podSchedulingsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(podSchedulingsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &resourcev1alpha1.PodSchedulingList{})
-	return err
-}
-
-func (c *podSchedulingsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*resourcev1alpha1.PodScheduling, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(podSchedulingsResource, c.ClusterPath, c.Namespace, name), &resourcev1alpha1.PodScheduling{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.PodScheduling), err
-}
-
-// List takes label and field selectors, and returns the list of PodSchedulings that match those selectors.
-func (c *podSchedulingsClient) List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.PodSchedulingList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(podSchedulingsResource, podSchedulingsKind, c.ClusterPath, c.Namespace, opts), &resourcev1alpha1.PodSchedulingList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &resourcev1alpha1.PodSchedulingList{ListMeta: obj.(*resourcev1alpha1.PodSchedulingList).ListMeta}
-	for _, item := range obj.(*resourcev1alpha1.PodSchedulingList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *podSchedulingsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(podSchedulingsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *podSchedulingsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*resourcev1alpha1.PodScheduling, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podSchedulingsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &resourcev1alpha1.PodScheduling{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.PodScheduling), err
-}
-
-func (c *podSchedulingsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsresourcev1alpha1.PodSchedulingApplyConfiguration, opts metav1.ApplyOptions) (*resourcev1alpha1.PodScheduling, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podSchedulingsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &resourcev1alpha1.PodScheduling{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.PodScheduling), err
-}
-
-func (c *podSchedulingsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsresourcev1alpha1.PodSchedulingApplyConfiguration, opts metav1.ApplyOptions) (*resourcev1alpha1.PodScheduling, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(podSchedulingsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &resourcev1alpha1.PodScheduling{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.PodScheduling), err
-}
diff --git a/kubernetes/typed/resource/v1alpha1/fake/resource_client.go b/kubernetes/typed/resource/v1alpha1/fake/resource_client.go
deleted file mode 100644
index 167f64bdf..000000000
--- a/kubernetes/typed/resource/v1alpha1/fake/resource_client.go
+++ /dev/null
@@ -1,89 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package fake
-
-import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/client-go/kubernetes/typed/resource/v1alpha1"
-	"k8s.io/client-go/rest"
-
-	kcpresourcev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha1"
-	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
-)
-
-var _ kcpresourcev1alpha1.ResourceV1alpha1ClusterInterface = (*ResourceV1alpha1ClusterClient)(nil)
-
-type ResourceV1alpha1ClusterClient struct {
-	*kcptesting.Fake
-}
-
-func (c *ResourceV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) resourcev1alpha1.ResourceV1alpha1Interface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-	return &ResourceV1alpha1Client{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-func (c *ResourceV1alpha1ClusterClient) ResourceClaims() kcpresourcev1alpha1.ResourceClaimClusterInterface {
-	return &resourceClaimsClusterClient{Fake: c.Fake}
-}
-
-func (c *ResourceV1alpha1ClusterClient) PodSchedulings() kcpresourcev1alpha1.PodSchedulingClusterInterface {
-	return &podSchedulingsClusterClient{Fake: c.Fake}
-}
-
-func (c *ResourceV1alpha1ClusterClient) ResourceClasses() kcpresourcev1alpha1.ResourceClassClusterInterface {
-	return &resourceClassesClusterClient{Fake: c.Fake}
-}
-
-func (c *ResourceV1alpha1ClusterClient) ResourceClaimTemplates() kcpresourcev1alpha1.ResourceClaimTemplateClusterInterface {
-	return &resourceClaimTemplatesClusterClient{Fake: c.Fake}
-}
-
-var _ resourcev1alpha1.ResourceV1alpha1Interface = (*ResourceV1alpha1Client)(nil)
-
-type ResourceV1alpha1Client struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-}
-
-func (c *ResourceV1alpha1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
-}
-
-func (c *ResourceV1alpha1Client) ResourceClaims(namespace string) resourcev1alpha1.ResourceClaimInterface {
-	return &resourceClaimsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
-
-func (c *ResourceV1alpha1Client) PodSchedulings(namespace string) resourcev1alpha1.PodSchedulingInterface {
-	return &podSchedulingsClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
-
-func (c *ResourceV1alpha1Client) ResourceClasses() resourcev1alpha1.ResourceClassInterface {
-	return &resourceClassesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
-
-func (c *ResourceV1alpha1Client) ResourceClaimTemplates(namespace string) resourcev1alpha1.ResourceClaimTemplateInterface {
-	return &resourceClaimTemplatesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
-}
diff --git a/kubernetes/typed/resource/v1alpha1/fake/resourceclaim.go b/kubernetes/typed/resource/v1alpha1/fake/resourceclaim.go
deleted file mode 100644
index b7a901bd9..000000000
--- a/kubernetes/typed/resource/v1alpha1/fake/resourceclaim.go
+++ /dev/null
@@ -1,213 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsresourcev1alpha1 "k8s.io/client-go/applyconfigurations/resource/v1alpha1"
-	resourcev1alpha1client "k8s.io/client-go/kubernetes/typed/resource/v1alpha1"
-	"k8s.io/client-go/testing"
-
-	kcpresourcev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha1"
-	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
-)
-
-var resourceClaimsResource = schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1alpha1", Resource: "resourceclaims"}
-var resourceClaimsKind = schema.GroupVersionKind{Group: "resource.k8s.io", Version: "v1alpha1", Kind: "ResourceClaim"}
-
-type resourceClaimsClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *resourceClaimsClusterClient) Cluster(clusterPath logicalcluster.Path) kcpresourcev1alpha1.ResourceClaimsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &resourceClaimsNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ResourceClaims that match those selectors across all clusters.
-func (c *resourceClaimsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.ResourceClaimList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(resourceClaimsResource, resourceClaimsKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &resourcev1alpha1.ResourceClaimList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &resourcev1alpha1.ResourceClaimList{ListMeta: obj.(*resourcev1alpha1.ResourceClaimList).ListMeta}
-	for _, item := range obj.(*resourcev1alpha1.ResourceClaimList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested ResourceClaims across all clusters.
-func (c *resourceClaimsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(resourceClaimsResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
-}
-
-type resourceClaimsNamespacer struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-}
-
-func (n *resourceClaimsNamespacer) Namespace(namespace string) resourcev1alpha1client.ResourceClaimInterface {
-	return &resourceClaimsClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
-}
-
-type resourceClaimsClient struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *resourceClaimsClient) Create(ctx context.Context, resourceClaim *resourcev1alpha1.ResourceClaim, opts metav1.CreateOptions) (*resourcev1alpha1.ResourceClaim, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(resourceClaimsResource, c.ClusterPath, c.Namespace, resourceClaim), &resourcev1alpha1.ResourceClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaim), err
-}
-
-func (c *resourceClaimsClient) Update(ctx context.Context, resourceClaim *resourcev1alpha1.ResourceClaim, opts metav1.UpdateOptions) (*resourcev1alpha1.ResourceClaim, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(resourceClaimsResource, c.ClusterPath, c.Namespace, resourceClaim), &resourcev1alpha1.ResourceClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaim), err
-}
-
-func (c *resourceClaimsClient) UpdateStatus(ctx context.Context, resourceClaim *resourcev1alpha1.ResourceClaim, opts metav1.UpdateOptions) (*resourcev1alpha1.ResourceClaim, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(resourceClaimsResource, c.ClusterPath, "status", c.Namespace, resourceClaim), &resourcev1alpha1.ResourceClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaim), err
-}
-
-func (c *resourceClaimsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(resourceClaimsResource, c.ClusterPath, c.Namespace, name, opts), &resourcev1alpha1.ResourceClaim{})
-	return err
-}
-
-func (c *resourceClaimsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(resourceClaimsResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &resourcev1alpha1.ResourceClaimList{})
-	return err
-}
-
-func (c *resourceClaimsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*resourcev1alpha1.ResourceClaim, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(resourceClaimsResource, c.ClusterPath, c.Namespace, name), &resourcev1alpha1.ResourceClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaim), err
-}
-
-// List takes label and field selectors, and returns the list of ResourceClaims that match those selectors.
-func (c *resourceClaimsClient) List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.ResourceClaimList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(resourceClaimsResource, resourceClaimsKind, c.ClusterPath, c.Namespace, opts), &resourcev1alpha1.ResourceClaimList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &resourcev1alpha1.ResourceClaimList{ListMeta: obj.(*resourcev1alpha1.ResourceClaimList).ListMeta}
-	for _, item := range obj.(*resourcev1alpha1.ResourceClaimList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *resourceClaimsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(resourceClaimsResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *resourceClaimsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*resourcev1alpha1.ResourceClaim, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(resourceClaimsResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &resourcev1alpha1.ResourceClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaim), err
-}
-
-func (c *resourceClaimsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsresourcev1alpha1.ResourceClaimApplyConfiguration, opts metav1.ApplyOptions) (*resourcev1alpha1.ResourceClaim, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(resourceClaimsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &resourcev1alpha1.ResourceClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaim), err
-}
-
-func (c *resourceClaimsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsresourcev1alpha1.ResourceClaimApplyConfiguration, opts metav1.ApplyOptions) (*resourcev1alpha1.ResourceClaim, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(resourceClaimsResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &resourcev1alpha1.ResourceClaim{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaim), err
-}
diff --git a/kubernetes/typed/resource/v1alpha1/fake/resourceclaimtemplate.go b/kubernetes/typed/resource/v1alpha1/fake/resourceclaimtemplate.go
deleted file mode 100644
index 35102f5f7..000000000
--- a/kubernetes/typed/resource/v1alpha1/fake/resourceclaimtemplate.go
+++ /dev/null
@@ -1,213 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsresourcev1alpha1 "k8s.io/client-go/applyconfigurations/resource/v1alpha1"
-	resourcev1alpha1client "k8s.io/client-go/kubernetes/typed/resource/v1alpha1"
-	"k8s.io/client-go/testing"
-
-	kcpresourcev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha1"
-	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
-)
-
-var resourceClaimTemplatesResource = schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1alpha1", Resource: "resourceclaimtemplates"}
-var resourceClaimTemplatesKind = schema.GroupVersionKind{Group: "resource.k8s.io", Version: "v1alpha1", Kind: "ResourceClaimTemplate"}
-
-type resourceClaimTemplatesClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *resourceClaimTemplatesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpresourcev1alpha1.ResourceClaimTemplatesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &resourceClaimTemplatesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ResourceClaimTemplates that match those selectors across all clusters.
-func (c *resourceClaimTemplatesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.ResourceClaimTemplateList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(resourceClaimTemplatesResource, resourceClaimTemplatesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &resourcev1alpha1.ResourceClaimTemplateList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &resourcev1alpha1.ResourceClaimTemplateList{ListMeta: obj.(*resourcev1alpha1.ResourceClaimTemplateList).ListMeta}
-	for _, item := range obj.(*resourcev1alpha1.ResourceClaimTemplateList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested ResourceClaimTemplates across all clusters.
-func (c *resourceClaimTemplatesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(resourceClaimTemplatesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
-}
-
-type resourceClaimTemplatesNamespacer struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-}
-
-func (n *resourceClaimTemplatesNamespacer) Namespace(namespace string) resourcev1alpha1client.ResourceClaimTemplateInterface {
-	return &resourceClaimTemplatesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
-}
-
-type resourceClaimTemplatesClient struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *resourceClaimTemplatesClient) Create(ctx context.Context, resourceClaimTemplate *resourcev1alpha1.ResourceClaimTemplate, opts metav1.CreateOptions) (*resourcev1alpha1.ResourceClaimTemplate, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(resourceClaimTemplatesResource, c.ClusterPath, c.Namespace, resourceClaimTemplate), &resourcev1alpha1.ResourceClaimTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaimTemplate), err
-}
-
-func (c *resourceClaimTemplatesClient) Update(ctx context.Context, resourceClaimTemplate *resourcev1alpha1.ResourceClaimTemplate, opts metav1.UpdateOptions) (*resourcev1alpha1.ResourceClaimTemplate, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(resourceClaimTemplatesResource, c.ClusterPath, c.Namespace, resourceClaimTemplate), &resourcev1alpha1.ResourceClaimTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaimTemplate), err
-}
-
-func (c *resourceClaimTemplatesClient) UpdateStatus(ctx context.Context, resourceClaimTemplate *resourcev1alpha1.ResourceClaimTemplate, opts metav1.UpdateOptions) (*resourcev1alpha1.ResourceClaimTemplate, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(resourceClaimTemplatesResource, c.ClusterPath, "status", c.Namespace, resourceClaimTemplate), &resourcev1alpha1.ResourceClaimTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaimTemplate), err
-}
-
-func (c *resourceClaimTemplatesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(resourceClaimTemplatesResource, c.ClusterPath, c.Namespace, name, opts), &resourcev1alpha1.ResourceClaimTemplate{})
-	return err
-}
-
-func (c *resourceClaimTemplatesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(resourceClaimTemplatesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &resourcev1alpha1.ResourceClaimTemplateList{})
-	return err
-}
-
-func (c *resourceClaimTemplatesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*resourcev1alpha1.ResourceClaimTemplate, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(resourceClaimTemplatesResource, c.ClusterPath, c.Namespace, name), &resourcev1alpha1.ResourceClaimTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaimTemplate), err
-}
-
-// List takes label and field selectors, and returns the list of ResourceClaimTemplates that match those selectors.
-func (c *resourceClaimTemplatesClient) List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.ResourceClaimTemplateList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(resourceClaimTemplatesResource, resourceClaimTemplatesKind, c.ClusterPath, c.Namespace, opts), &resourcev1alpha1.ResourceClaimTemplateList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &resourcev1alpha1.ResourceClaimTemplateList{ListMeta: obj.(*resourcev1alpha1.ResourceClaimTemplateList).ListMeta}
-	for _, item := range obj.(*resourcev1alpha1.ResourceClaimTemplateList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *resourceClaimTemplatesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(resourceClaimTemplatesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *resourceClaimTemplatesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*resourcev1alpha1.ResourceClaimTemplate, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(resourceClaimTemplatesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &resourcev1alpha1.ResourceClaimTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaimTemplate), err
-}
-
-func (c *resourceClaimTemplatesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsresourcev1alpha1.ResourceClaimTemplateApplyConfiguration, opts metav1.ApplyOptions) (*resourcev1alpha1.ResourceClaimTemplate, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(resourceClaimTemplatesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &resourcev1alpha1.ResourceClaimTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaimTemplate), err
-}
-
-func (c *resourceClaimTemplatesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsresourcev1alpha1.ResourceClaimTemplateApplyConfiguration, opts metav1.ApplyOptions) (*resourcev1alpha1.ResourceClaimTemplate, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(resourceClaimTemplatesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &resourcev1alpha1.ResourceClaimTemplate{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClaimTemplate), err
-}
diff --git a/kubernetes/typed/resource/v1alpha1/fake/resourceclass.go b/kubernetes/typed/resource/v1alpha1/fake/resourceclass.go
deleted file mode 100644
index ddaebe854..000000000
--- a/kubernetes/typed/resource/v1alpha1/fake/resourceclass.go
+++ /dev/null
@@ -1,202 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsresourcev1alpha1 "k8s.io/client-go/applyconfigurations/resource/v1alpha1"
-	resourcev1alpha1client "k8s.io/client-go/kubernetes/typed/resource/v1alpha1"
-	"k8s.io/client-go/testing"
-
-	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
-)
-
-var resourceClassesResource = schema.GroupVersionResource{Group: "resource.k8s.io", Version: "v1alpha1", Resource: "resourceclasses"}
-var resourceClassesKind = schema.GroupVersionKind{Group: "resource.k8s.io", Version: "v1alpha1", Kind: "ResourceClass"}
-
-type resourceClassesClusterClient struct {
-	*kcptesting.Fake
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *resourceClassesClusterClient) Cluster(clusterPath logicalcluster.Path) resourcev1alpha1client.ResourceClassInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &resourceClassesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of ResourceClasses that match those selectors across all clusters.
-func (c *resourceClassesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.ResourceClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(resourceClassesResource, resourceClassesKind, logicalcluster.Wildcard, opts), &resourcev1alpha1.ResourceClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &resourcev1alpha1.ResourceClassList{ListMeta: obj.(*resourcev1alpha1.ResourceClassList).ListMeta}
-	for _, item := range obj.(*resourcev1alpha1.ResourceClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested ResourceClasses across all clusters.
-func (c *resourceClassesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(resourceClassesResource, logicalcluster.Wildcard, opts))
-}
-
-type resourceClassesClient struct {
-	*kcptesting.Fake
-	ClusterPath logicalcluster.Path
-}
-
-func (c *resourceClassesClient) Create(ctx context.Context, resourceClass *resourcev1alpha1.ResourceClass, opts metav1.CreateOptions) (*resourcev1alpha1.ResourceClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(resourceClassesResource, c.ClusterPath, resourceClass), &resourcev1alpha1.ResourceClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClass), err
-}
-
-func (c *resourceClassesClient) Update(ctx context.Context, resourceClass *resourcev1alpha1.ResourceClass, opts metav1.UpdateOptions) (*resourcev1alpha1.ResourceClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(resourceClassesResource, c.ClusterPath, resourceClass), &resourcev1alpha1.ResourceClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClass), err
-}
-
-func (c *resourceClassesClient) UpdateStatus(ctx context.Context, resourceClass *resourcev1alpha1.ResourceClass, opts metav1.UpdateOptions) (*resourcev1alpha1.ResourceClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(resourceClassesResource, c.ClusterPath, "status", resourceClass), &resourcev1alpha1.ResourceClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClass), err
-}
-
-func (c *resourceClassesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(resourceClassesResource, c.ClusterPath, name, opts), &resourcev1alpha1.ResourceClass{})
-	return err
-}
-
-func (c *resourceClassesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(resourceClassesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &resourcev1alpha1.ResourceClassList{})
-	return err
-}
-
-func (c *resourceClassesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*resourcev1alpha1.ResourceClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(resourceClassesResource, c.ClusterPath, name), &resourcev1alpha1.ResourceClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClass), err
-}
-
-// List takes label and field selectors, and returns the list of ResourceClasses that match those selectors.
-func (c *resourceClassesClient) List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.ResourceClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(resourceClassesResource, resourceClassesKind, c.ClusterPath, opts), &resourcev1alpha1.ResourceClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &resourcev1alpha1.ResourceClassList{ListMeta: obj.(*resourcev1alpha1.ResourceClassList).ListMeta}
-	for _, item := range obj.(*resourcev1alpha1.ResourceClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *resourceClassesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(resourceClassesResource, c.ClusterPath, opts))
-}
-
-func (c *resourceClassesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*resourcev1alpha1.ResourceClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(resourceClassesResource, c.ClusterPath, name, pt, data, subresources...), &resourcev1alpha1.ResourceClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClass), err
-}
-
-func (c *resourceClassesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsresourcev1alpha1.ResourceClassApplyConfiguration, opts metav1.ApplyOptions) (*resourcev1alpha1.ResourceClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(resourceClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &resourcev1alpha1.ResourceClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClass), err
-}
-
-func (c *resourceClassesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsresourcev1alpha1.ResourceClassApplyConfiguration, opts metav1.ApplyOptions) (*resourcev1alpha1.ResourceClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(resourceClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &resourcev1alpha1.ResourceClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*resourcev1alpha1.ResourceClass), err
-}
diff --git a/kubernetes/typed/resource/v1alpha1/podscheduling.go b/kubernetes/typed/resource/v1alpha1/podscheduling.go
deleted file mode 100644
index f6179eed3..000000000
--- a/kubernetes/typed/resource/v1alpha1/podscheduling.go
+++ /dev/null
@@ -1,85 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	resourcev1alpha1client "k8s.io/client-go/kubernetes/typed/resource/v1alpha1"
-)
-
-// PodSchedulingsClusterGetter has a method to return a PodSchedulingClusterInterface.
-// A group's cluster client should implement this interface.
-type PodSchedulingsClusterGetter interface {
-	PodSchedulings() PodSchedulingClusterInterface
-}
-
-// PodSchedulingClusterInterface can operate on PodSchedulings across all clusters,
-// or scope down to one cluster and return a PodSchedulingsNamespacer.
-type PodSchedulingClusterInterface interface {
-	Cluster(logicalcluster.Path) PodSchedulingsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.PodSchedulingList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
-}
-
-type podSchedulingsClusterInterface struct {
-	clientCache kcpclient.Cache[*resourcev1alpha1client.ResourceV1alpha1Client]
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *podSchedulingsClusterInterface) Cluster(clusterPath logicalcluster.Path) PodSchedulingsNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &podSchedulingsNamespacer{clientCache: c.clientCache, clusterPath: clusterPath}
-}
-
-// List returns the entire collection of all PodSchedulings across all clusters.
-func (c *podSchedulingsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.PodSchedulingList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PodSchedulings(metav1.NamespaceAll).List(ctx, opts)
-}
-
-// Watch begins to watch all PodSchedulings across all clusters.
-func (c *podSchedulingsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PodSchedulings(metav1.NamespaceAll).Watch(ctx, opts)
-}
-
-// PodSchedulingsNamespacer can scope to objects within a namespace, returning a resourcev1alpha1client.PodSchedulingInterface.
-type PodSchedulingsNamespacer interface {
-	Namespace(string) resourcev1alpha1client.PodSchedulingInterface
-}
-
-type podSchedulingsNamespacer struct {
-	clientCache kcpclient.Cache[*resourcev1alpha1client.ResourceV1alpha1Client]
-	clusterPath logicalcluster.Path
-}
-
-func (n *podSchedulingsNamespacer) Namespace(namespace string) resourcev1alpha1client.PodSchedulingInterface {
-	return n.clientCache.ClusterOrDie(n.clusterPath).PodSchedulings(namespace)
-}
diff --git a/kubernetes/typed/resource/v1alpha1/resource_client.go b/kubernetes/typed/resource/v1alpha1/resource_client.go
deleted file mode 100644
index 89626ad5f..000000000
--- a/kubernetes/typed/resource/v1alpha1/resource_client.go
+++ /dev/null
@@ -1,104 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"net/http"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/client-go/kubernetes/typed/resource/v1alpha1"
-	"k8s.io/client-go/rest"
-)
-
-type ResourceV1alpha1ClusterInterface interface {
-	ResourceV1alpha1ClusterScoper
-	ResourceClaimsClusterGetter
-	PodSchedulingsClusterGetter
-	ResourceClassesClusterGetter
-	ResourceClaimTemplatesClusterGetter
-}
-
-type ResourceV1alpha1ClusterScoper interface {
-	Cluster(logicalcluster.Path) resourcev1alpha1.ResourceV1alpha1Interface
-}
-
-type ResourceV1alpha1ClusterClient struct {
-	clientCache kcpclient.Cache[*resourcev1alpha1.ResourceV1alpha1Client]
-}
-
-func (c *ResourceV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) resourcev1alpha1.ResourceV1alpha1Interface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-	return c.clientCache.ClusterOrDie(clusterPath)
-}
-
-func (c *ResourceV1alpha1ClusterClient) ResourceClaims() ResourceClaimClusterInterface {
-	return &resourceClaimsClusterInterface{clientCache: c.clientCache}
-}
-
-func (c *ResourceV1alpha1ClusterClient) PodSchedulings() PodSchedulingClusterInterface {
-	return &podSchedulingsClusterInterface{clientCache: c.clientCache}
-}
-
-func (c *ResourceV1alpha1ClusterClient) ResourceClasses() ResourceClassClusterInterface {
-	return &resourceClassesClusterInterface{clientCache: c.clientCache}
-}
-
-func (c *ResourceV1alpha1ClusterClient) ResourceClaimTemplates() ResourceClaimTemplateClusterInterface {
-	return &resourceClaimTemplatesClusterInterface{clientCache: c.clientCache}
-}
-
-// NewForConfig creates a new ResourceV1alpha1ClusterClient for the given config.
-// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
-// where httpClient was generated with rest.HTTPClientFor(c).
-func NewForConfig(c *rest.Config) (*ResourceV1alpha1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
-	if err != nil {
-		return nil, err
-	}
-	return NewForConfigAndClient(c, client)
-}
-
-// NewForConfigAndClient creates a new ResourceV1alpha1ClusterClient for the given config and http client.
-// Note the http client provided takes precedence over the configured transport values.
-func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ResourceV1alpha1ClusterClient, error) {
-	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*resourcev1alpha1.ResourceV1alpha1Client]{
-		NewForConfigAndClient: resourcev1alpha1.NewForConfigAndClient,
-	})
-	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
-		return nil, err
-	}
-	return &ResourceV1alpha1ClusterClient{clientCache: cache}, nil
-}
-
-// NewForConfigOrDie creates a new ResourceV1alpha1ClusterClient for the given config and
-// panics if there is an error in the config.
-func NewForConfigOrDie(c *rest.Config) *ResourceV1alpha1ClusterClient {
-	client, err := NewForConfig(c)
-	if err != nil {
-		panic(err)
-	}
-	return client
-}
diff --git a/kubernetes/typed/resource/v1alpha1/resourceclass.go b/kubernetes/typed/resource/v1alpha1/resourceclass.go
deleted file mode 100644
index 0324f19f1..000000000
--- a/kubernetes/typed/resource/v1alpha1/resourceclass.go
+++ /dev/null
@@ -1,71 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	resourcev1alpha1client "k8s.io/client-go/kubernetes/typed/resource/v1alpha1"
-)
-
-// ResourceClassesClusterGetter has a method to return a ResourceClassClusterInterface.
-// A group's cluster client should implement this interface.
-type ResourceClassesClusterGetter interface {
-	ResourceClasses() ResourceClassClusterInterface
-}
-
-// ResourceClassClusterInterface can operate on ResourceClasses across all clusters,
-// or scope down to one cluster and return a resourcev1alpha1client.ResourceClassInterface.
-type ResourceClassClusterInterface interface {
-	Cluster(logicalcluster.Path) resourcev1alpha1client.ResourceClassInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.ResourceClassList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
-}
-
-type resourceClassesClusterInterface struct {
-	clientCache kcpclient.Cache[*resourcev1alpha1client.ResourceV1alpha1Client]
-}
-
-// Cluster scopes the client down to a particular cluster.
-func (c *resourceClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) resourcev1alpha1client.ResourceClassInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return c.clientCache.ClusterOrDie(clusterPath).ResourceClasses()
-}
-
-// List returns the entire collection of all ResourceClasses across all clusters.
-func (c *resourceClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.ResourceClassList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClasses().List(ctx, opts)
-}
-
-// Watch begins to watch all ResourceClasses across all clusters.
-func (c *resourceClassesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClasses().Watch(ctx, opts)
-}
diff --git a/kubernetes/typed/resource/v1alpha3/deviceclass.go b/kubernetes/typed/resource/v1alpha3/deviceclass.go
new file mode 100644
index 000000000..339e379cf
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/deviceclass.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+
+	apiresourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// DeviceClassesClusterGetter has a method to return a DeviceClassClusterInterface.
+// A group's cluster client should implement this interface.
+type DeviceClassesClusterGetter interface {
+	DeviceClasses() DeviceClassClusterInterface
+}
+
+// DeviceClassClusterInterface can operate on DeviceClasses across all clusters,
+// or scope down to one cluster and return a resourcev1alpha3.DeviceClassInterface.
+type DeviceClassClusterInterface interface {
+	Cluster(logicalcluster.Path) resourcev1alpha3.DeviceClassInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1alpha3.DeviceClassList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	DeviceClassClusterExpansion
+}
+
+type deviceClassesClusterInterface struct {
+	clientCache kcpclient.Cache[*resourcev1alpha3.ResourceV1alpha3Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *deviceClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) resourcev1alpha3.DeviceClassInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).DeviceClasses()
+}
+
+// List returns the entire collection of all DeviceClasses across all clusters.
+func (c *deviceClassesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1alpha3.DeviceClassList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DeviceClasses().List(ctx, opts)
+}
+
+// Watch begins to watch all DeviceClasses across all clusters.
+func (c *deviceClassesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DeviceClasses().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/resource/v1alpha3/devicetaintrule.go b/kubernetes/typed/resource/v1alpha3/devicetaintrule.go
new file mode 100644
index 000000000..f5b18638a
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/devicetaintrule.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+
+	apiresourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// DeviceTaintRulesClusterGetter has a method to return a DeviceTaintRuleClusterInterface.
+// A group's cluster client should implement this interface.
+type DeviceTaintRulesClusterGetter interface {
+	DeviceTaintRules() DeviceTaintRuleClusterInterface
+}
+
+// DeviceTaintRuleClusterInterface can operate on DeviceTaintRules across all clusters,
+// or scope down to one cluster and return a resourcev1alpha3.DeviceTaintRuleInterface.
+type DeviceTaintRuleClusterInterface interface {
+	Cluster(logicalcluster.Path) resourcev1alpha3.DeviceTaintRuleInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1alpha3.DeviceTaintRuleList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	DeviceTaintRuleClusterExpansion
+}
+
+type deviceTaintRulesClusterInterface struct {
+	clientCache kcpclient.Cache[*resourcev1alpha3.ResourceV1alpha3Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *deviceTaintRulesClusterInterface) Cluster(clusterPath logicalcluster.Path) resourcev1alpha3.DeviceTaintRuleInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).DeviceTaintRules()
+}
+
+// List returns the entire collection of all DeviceTaintRules across all clusters.
+func (c *deviceTaintRulesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1alpha3.DeviceTaintRuleList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DeviceTaintRules().List(ctx, opts)
+}
+
+// Watch begins to watch all DeviceTaintRules across all clusters.
+func (c *deviceTaintRulesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DeviceTaintRules().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/resource/v1alpha3/doc.go b/kubernetes/typed/resource/v1alpha3/doc.go
new file mode 100644
index 000000000..2170a4a57
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha3
diff --git a/kubernetes/typed/resource/v1alpha3/fake/deviceclass.go b/kubernetes/typed/resource/v1alpha3/fake/deviceclass.go
new file mode 100644
index 000000000..ab0c771cf
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/fake/deviceclass.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1alpha3 "k8s.io/client-go/applyconfigurations/resource/v1alpha3"
+	typedresourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
+
+	typedkcpresourcev1alpha3 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha3"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// deviceClassClusterClient implements DeviceClassClusterInterface
+type deviceClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1alpha3.DeviceClass, *resourcev1alpha3.DeviceClassList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeDeviceClassClusterClient(fake *ResourceV1alpha3ClusterClient) typedkcpresourcev1alpha3.DeviceClassClusterInterface {
+	return &deviceClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1alpha3.DeviceClass, *resourcev1alpha3.DeviceClassList](
+			fake.Fake,
+			resourcev1alpha3.SchemeGroupVersion.WithResource("deviceclasses"),
+			resourcev1alpha3.SchemeGroupVersion.WithKind("DeviceClass"),
+			func() *resourcev1alpha3.DeviceClass { return &resourcev1alpha3.DeviceClass{} },
+			func() *resourcev1alpha3.DeviceClassList { return &resourcev1alpha3.DeviceClassList{} },
+			func(dst, src *resourcev1alpha3.DeviceClassList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1alpha3.DeviceClassList) []*resourcev1alpha3.DeviceClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1alpha3.DeviceClassList, items []*resourcev1alpha3.DeviceClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *deviceClassClusterClient) Cluster(cluster logicalcluster.Path) typedresourcev1alpha3.DeviceClassInterface {
+	return newFakeDeviceClassClient(c.Fake, cluster)
+}
+
+// deviceClassScopedClient implements DeviceClassInterface
+type deviceClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1alpha3.DeviceClass, *resourcev1alpha3.DeviceClassList, *v1alpha3.DeviceClassApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeDeviceClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedresourcev1alpha3.DeviceClassInterface {
+	return &deviceClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1alpha3.DeviceClass, *resourcev1alpha3.DeviceClassList, *v1alpha3.DeviceClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			resourcev1alpha3.SchemeGroupVersion.WithResource("deviceclasses"),
+			resourcev1alpha3.SchemeGroupVersion.WithKind("DeviceClass"),
+			func() *resourcev1alpha3.DeviceClass { return &resourcev1alpha3.DeviceClass{} },
+			func() *resourcev1alpha3.DeviceClassList { return &resourcev1alpha3.DeviceClassList{} },
+			func(dst, src *resourcev1alpha3.DeviceClassList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1alpha3.DeviceClassList) []*resourcev1alpha3.DeviceClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1alpha3.DeviceClassList, items []*resourcev1alpha3.DeviceClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1alpha3/fake/devicetaintrule.go b/kubernetes/typed/resource/v1alpha3/fake/devicetaintrule.go
new file mode 100644
index 000000000..05ef9c7f1
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/fake/devicetaintrule.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1alpha3 "k8s.io/client-go/applyconfigurations/resource/v1alpha3"
+	typedresourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
+
+	typedkcpresourcev1alpha3 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha3"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// deviceTaintRuleClusterClient implements DeviceTaintRuleClusterInterface
+type deviceTaintRuleClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1alpha3.DeviceTaintRule, *resourcev1alpha3.DeviceTaintRuleList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeDeviceTaintRuleClusterClient(fake *ResourceV1alpha3ClusterClient) typedkcpresourcev1alpha3.DeviceTaintRuleClusterInterface {
+	return &deviceTaintRuleClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1alpha3.DeviceTaintRule, *resourcev1alpha3.DeviceTaintRuleList](
+			fake.Fake,
+			resourcev1alpha3.SchemeGroupVersion.WithResource("devicetaintrules"),
+			resourcev1alpha3.SchemeGroupVersion.WithKind("DeviceTaintRule"),
+			func() *resourcev1alpha3.DeviceTaintRule { return &resourcev1alpha3.DeviceTaintRule{} },
+			func() *resourcev1alpha3.DeviceTaintRuleList { return &resourcev1alpha3.DeviceTaintRuleList{} },
+			func(dst, src *resourcev1alpha3.DeviceTaintRuleList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1alpha3.DeviceTaintRuleList) []*resourcev1alpha3.DeviceTaintRule {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1alpha3.DeviceTaintRuleList, items []*resourcev1alpha3.DeviceTaintRule) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *deviceTaintRuleClusterClient) Cluster(cluster logicalcluster.Path) typedresourcev1alpha3.DeviceTaintRuleInterface {
+	return newFakeDeviceTaintRuleClient(c.Fake, cluster)
+}
+
+// deviceTaintRuleScopedClient implements DeviceTaintRuleInterface
+type deviceTaintRuleScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1alpha3.DeviceTaintRule, *resourcev1alpha3.DeviceTaintRuleList, *v1alpha3.DeviceTaintRuleApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeDeviceTaintRuleClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedresourcev1alpha3.DeviceTaintRuleInterface {
+	return &deviceTaintRuleScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1alpha3.DeviceTaintRule, *resourcev1alpha3.DeviceTaintRuleList, *v1alpha3.DeviceTaintRuleApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			resourcev1alpha3.SchemeGroupVersion.WithResource("devicetaintrules"),
+			resourcev1alpha3.SchemeGroupVersion.WithKind("DeviceTaintRule"),
+			func() *resourcev1alpha3.DeviceTaintRule { return &resourcev1alpha3.DeviceTaintRule{} },
+			func() *resourcev1alpha3.DeviceTaintRuleList { return &resourcev1alpha3.DeviceTaintRuleList{} },
+			func(dst, src *resourcev1alpha3.DeviceTaintRuleList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1alpha3.DeviceTaintRuleList) []*resourcev1alpha3.DeviceTaintRule {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1alpha3.DeviceTaintRuleList, items []*resourcev1alpha3.DeviceTaintRule) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1alpha3/fake/doc.go b/kubernetes/typed/resource/v1alpha3/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/resource/v1alpha3/fake/resource_client.go b/kubernetes/typed/resource/v1alpha3/fake/resource_client.go
new file mode 100644
index 000000000..bef95d076
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/fake/resource_client.go
@@ -0,0 +1,93 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
+	rest "k8s.io/client-go/rest"
+
+	kcpresourcev1alpha3 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha3"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+var _ kcpresourcev1alpha3.ResourceV1alpha3ClusterInterface = (*ResourceV1alpha3ClusterClient)(nil)
+
+type ResourceV1alpha3ClusterClient struct {
+	*kcptesting.Fake
+}
+
+func (c *ResourceV1alpha3ClusterClient) Cluster(clusterPath logicalcluster.Path) resourcev1alpha3.ResourceV1alpha3Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return &ResourceV1alpha3Client{Fake: c.Fake, ClusterPath: clusterPath}
+}
+
+func (c *ResourceV1alpha3ClusterClient) DeviceClasses() kcpresourcev1alpha3.DeviceClassClusterInterface {
+	return newFakeDeviceClassClusterClient(c)
+}
+
+func (c *ResourceV1alpha3ClusterClient) DeviceTaintRules() kcpresourcev1alpha3.DeviceTaintRuleClusterInterface {
+	return newFakeDeviceTaintRuleClusterClient(c)
+}
+
+func (c *ResourceV1alpha3ClusterClient) ResourceClaims() kcpresourcev1alpha3.ResourceClaimClusterInterface {
+	return newFakeResourceClaimClusterClient(c)
+}
+
+func (c *ResourceV1alpha3ClusterClient) ResourceClaimTemplates() kcpresourcev1alpha3.ResourceClaimTemplateClusterInterface {
+	return newFakeResourceClaimTemplateClusterClient(c)
+}
+
+func (c *ResourceV1alpha3ClusterClient) ResourceSlices() kcpresourcev1alpha3.ResourceSliceClusterInterface {
+	return newFakeResourceSliceClusterClient(c)
+}
+
+type ResourceV1alpha3Client struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (c *ResourceV1alpha3Client) DeviceClasses() resourcev1alpha3.DeviceClassInterface {
+	return newFakeDeviceClassClient(c.Fake, c.ClusterPath)
+}
+
+func (c *ResourceV1alpha3Client) DeviceTaintRules() resourcev1alpha3.DeviceTaintRuleInterface {
+	return newFakeDeviceTaintRuleClient(c.Fake, c.ClusterPath)
+}
+
+func (c *ResourceV1alpha3Client) ResourceClaims(namespace string) resourcev1alpha3.ResourceClaimInterface {
+	return newFakeResourceClaimClient(c.Fake, namespace, c.ClusterPath)
+}
+
+func (c *ResourceV1alpha3Client) ResourceClaimTemplates(namespace string) resourcev1alpha3.ResourceClaimTemplateInterface {
+	return newFakeResourceClaimTemplateClient(c.Fake, namespace, c.ClusterPath)
+}
+
+func (c *ResourceV1alpha3Client) ResourceSlices() resourcev1alpha3.ResourceSliceInterface {
+	return newFakeResourceSliceClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ResourceV1alpha3Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/kubernetes/typed/resource/v1alpha3/fake/resourceclaim.go b/kubernetes/typed/resource/v1alpha3/fake/resourceclaim.go
new file mode 100644
index 000000000..5f6895e1e
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/fake/resourceclaim.go
@@ -0,0 +1,99 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1alpha3 "k8s.io/client-go/applyconfigurations/resource/v1alpha3"
+	typedresourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
+
+	typedkcpresourcev1alpha3 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha3"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// resourceClaimClusterClient implements ResourceClaimClusterInterface
+type resourceClaimClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1alpha3.ResourceClaim, *resourcev1alpha3.ResourceClaimList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeResourceClaimClusterClient(fake *ResourceV1alpha3ClusterClient) typedkcpresourcev1alpha3.ResourceClaimClusterInterface {
+	return &resourceClaimClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1alpha3.ResourceClaim, *resourcev1alpha3.ResourceClaimList](
+			fake.Fake,
+			resourcev1alpha3.SchemeGroupVersion.WithResource("resourceclaims"),
+			resourcev1alpha3.SchemeGroupVersion.WithKind("ResourceClaim"),
+			func() *resourcev1alpha3.ResourceClaim { return &resourcev1alpha3.ResourceClaim{} },
+			func() *resourcev1alpha3.ResourceClaimList { return &resourcev1alpha3.ResourceClaimList{} },
+			func(dst, src *resourcev1alpha3.ResourceClaimList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1alpha3.ResourceClaimList) []*resourcev1alpha3.ResourceClaim {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1alpha3.ResourceClaimList, items []*resourcev1alpha3.ResourceClaim) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *resourceClaimClusterClient) Cluster(cluster logicalcluster.Path) typedkcpresourcev1alpha3.ResourceClaimsNamespacer {
+	return &resourceClaimNamespacer{Fake: c.Fake, ClusterPath: cluster}
+}
+
+type resourceClaimNamespacer struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (n *resourceClaimNamespacer) Namespace(namespace string) typedresourcev1alpha3.ResourceClaimInterface {
+	return newFakeResourceClaimClient(n.Fake, namespace, n.ClusterPath)
+}
+
+// resourceClaimScopedClient implements ResourceClaimInterface
+type resourceClaimScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1alpha3.ResourceClaim, *resourcev1alpha3.ResourceClaimList, *v1alpha3.ResourceClaimApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeResourceClaimClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedresourcev1alpha3.ResourceClaimInterface {
+	return &resourceClaimScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1alpha3.ResourceClaim, *resourcev1alpha3.ResourceClaimList, *v1alpha3.ResourceClaimApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			resourcev1alpha3.SchemeGroupVersion.WithResource("resourceclaims"),
+			resourcev1alpha3.SchemeGroupVersion.WithKind("ResourceClaim"),
+			func() *resourcev1alpha3.ResourceClaim { return &resourcev1alpha3.ResourceClaim{} },
+			func() *resourcev1alpha3.ResourceClaimList { return &resourcev1alpha3.ResourceClaimList{} },
+			func(dst, src *resourcev1alpha3.ResourceClaimList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1alpha3.ResourceClaimList) []*resourcev1alpha3.ResourceClaim {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1alpha3.ResourceClaimList, items []*resourcev1alpha3.ResourceClaim) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1alpha3/fake/resourceclaimtemplate.go b/kubernetes/typed/resource/v1alpha3/fake/resourceclaimtemplate.go
new file mode 100644
index 000000000..ecfc36732
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/fake/resourceclaimtemplate.go
@@ -0,0 +1,103 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1alpha3 "k8s.io/client-go/applyconfigurations/resource/v1alpha3"
+	typedresourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
+
+	typedkcpresourcev1alpha3 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha3"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// resourceClaimTemplateClusterClient implements ResourceClaimTemplateClusterInterface
+type resourceClaimTemplateClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1alpha3.ResourceClaimTemplate, *resourcev1alpha3.ResourceClaimTemplateList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeResourceClaimTemplateClusterClient(fake *ResourceV1alpha3ClusterClient) typedkcpresourcev1alpha3.ResourceClaimTemplateClusterInterface {
+	return &resourceClaimTemplateClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1alpha3.ResourceClaimTemplate, *resourcev1alpha3.ResourceClaimTemplateList](
+			fake.Fake,
+			resourcev1alpha3.SchemeGroupVersion.WithResource("resourceclaimtemplates"),
+			resourcev1alpha3.SchemeGroupVersion.WithKind("ResourceClaimTemplate"),
+			func() *resourcev1alpha3.ResourceClaimTemplate { return &resourcev1alpha3.ResourceClaimTemplate{} },
+			func() *resourcev1alpha3.ResourceClaimTemplateList {
+				return &resourcev1alpha3.ResourceClaimTemplateList{}
+			},
+			func(dst, src *resourcev1alpha3.ResourceClaimTemplateList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1alpha3.ResourceClaimTemplateList) []*resourcev1alpha3.ResourceClaimTemplate {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1alpha3.ResourceClaimTemplateList, items []*resourcev1alpha3.ResourceClaimTemplate) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *resourceClaimTemplateClusterClient) Cluster(cluster logicalcluster.Path) typedkcpresourcev1alpha3.ResourceClaimTemplatesNamespacer {
+	return &resourceClaimTemplateNamespacer{Fake: c.Fake, ClusterPath: cluster}
+}
+
+type resourceClaimTemplateNamespacer struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (n *resourceClaimTemplateNamespacer) Namespace(namespace string) typedresourcev1alpha3.ResourceClaimTemplateInterface {
+	return newFakeResourceClaimTemplateClient(n.Fake, namespace, n.ClusterPath)
+}
+
+// resourceClaimTemplateScopedClient implements ResourceClaimTemplateInterface
+type resourceClaimTemplateScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1alpha3.ResourceClaimTemplate, *resourcev1alpha3.ResourceClaimTemplateList, *v1alpha3.ResourceClaimTemplateApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeResourceClaimTemplateClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedresourcev1alpha3.ResourceClaimTemplateInterface {
+	return &resourceClaimTemplateScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1alpha3.ResourceClaimTemplate, *resourcev1alpha3.ResourceClaimTemplateList, *v1alpha3.ResourceClaimTemplateApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			resourcev1alpha3.SchemeGroupVersion.WithResource("resourceclaimtemplates"),
+			resourcev1alpha3.SchemeGroupVersion.WithKind("ResourceClaimTemplate"),
+			func() *resourcev1alpha3.ResourceClaimTemplate { return &resourcev1alpha3.ResourceClaimTemplate{} },
+			func() *resourcev1alpha3.ResourceClaimTemplateList {
+				return &resourcev1alpha3.ResourceClaimTemplateList{}
+			},
+			func(dst, src *resourcev1alpha3.ResourceClaimTemplateList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1alpha3.ResourceClaimTemplateList) []*resourcev1alpha3.ResourceClaimTemplate {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1alpha3.ResourceClaimTemplateList, items []*resourcev1alpha3.ResourceClaimTemplate) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1alpha3/fake/resourceslice.go b/kubernetes/typed/resource/v1alpha3/fake/resourceslice.go
new file mode 100644
index 000000000..b89fc3f4a
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/fake/resourceslice.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1alpha3 "k8s.io/client-go/applyconfigurations/resource/v1alpha3"
+	typedresourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
+
+	typedkcpresourcev1alpha3 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1alpha3"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// resourceSliceClusterClient implements ResourceSliceClusterInterface
+type resourceSliceClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1alpha3.ResourceSlice, *resourcev1alpha3.ResourceSliceList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeResourceSliceClusterClient(fake *ResourceV1alpha3ClusterClient) typedkcpresourcev1alpha3.ResourceSliceClusterInterface {
+	return &resourceSliceClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1alpha3.ResourceSlice, *resourcev1alpha3.ResourceSliceList](
+			fake.Fake,
+			resourcev1alpha3.SchemeGroupVersion.WithResource("resourceslices"),
+			resourcev1alpha3.SchemeGroupVersion.WithKind("ResourceSlice"),
+			func() *resourcev1alpha3.ResourceSlice { return &resourcev1alpha3.ResourceSlice{} },
+			func() *resourcev1alpha3.ResourceSliceList { return &resourcev1alpha3.ResourceSliceList{} },
+			func(dst, src *resourcev1alpha3.ResourceSliceList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1alpha3.ResourceSliceList) []*resourcev1alpha3.ResourceSlice {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1alpha3.ResourceSliceList, items []*resourcev1alpha3.ResourceSlice) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *resourceSliceClusterClient) Cluster(cluster logicalcluster.Path) typedresourcev1alpha3.ResourceSliceInterface {
+	return newFakeResourceSliceClient(c.Fake, cluster)
+}
+
+// resourceSliceScopedClient implements ResourceSliceInterface
+type resourceSliceScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1alpha3.ResourceSlice, *resourcev1alpha3.ResourceSliceList, *v1alpha3.ResourceSliceApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeResourceSliceClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedresourcev1alpha3.ResourceSliceInterface {
+	return &resourceSliceScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1alpha3.ResourceSlice, *resourcev1alpha3.ResourceSliceList, *v1alpha3.ResourceSliceApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			resourcev1alpha3.SchemeGroupVersion.WithResource("resourceslices"),
+			resourcev1alpha3.SchemeGroupVersion.WithKind("ResourceSlice"),
+			func() *resourcev1alpha3.ResourceSlice { return &resourcev1alpha3.ResourceSlice{} },
+			func() *resourcev1alpha3.ResourceSliceList { return &resourcev1alpha3.ResourceSliceList{} },
+			func(dst, src *resourcev1alpha3.ResourceSliceList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1alpha3.ResourceSliceList) []*resourcev1alpha3.ResourceSlice {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1alpha3.ResourceSliceList, items []*resourcev1alpha3.ResourceSlice) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1alpha3/generated_expansion.go b/kubernetes/typed/resource/v1alpha3/generated_expansion.go
new file mode 100644
index 000000000..0d6d54a2f
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/generated_expansion.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+type DeviceClassClusterExpansion interface{}
+
+type DeviceTaintRuleClusterExpansion interface{}
+
+type ResourceClaimClusterExpansion interface{}
+
+type ResourceClaimTemplateClusterExpansion interface{}
+
+type ResourceSliceClusterExpansion interface{}
diff --git a/kubernetes/typed/resource/v1alpha3/resource_client.go b/kubernetes/typed/resource/v1alpha3/resource_client.go
new file mode 100644
index 000000000..57af3a5ff
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/resource_client.go
@@ -0,0 +1,123 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	http "net/http"
+
+	apiresourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	resourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
+	rest "k8s.io/client-go/rest"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+type ResourceV1alpha3ClusterInterface interface {
+	ResourceV1alpha3ClusterScoper
+	DeviceClassesClusterGetter
+	DeviceTaintRulesClusterGetter
+	ResourceClaimsClusterGetter
+	ResourceClaimTemplatesClusterGetter
+	ResourceSlicesClusterGetter
+}
+
+type ResourceV1alpha3ClusterScoper interface {
+	Cluster(logicalcluster.Path) resourcev1alpha3.ResourceV1alpha3Interface
+}
+
+// ResourceV1alpha3ClusterClient is used to interact with features provided by the resource.k8s.io group.
+type ResourceV1alpha3ClusterClient struct {
+	clientCache kcpclient.Cache[*resourcev1alpha3.ResourceV1alpha3Client]
+}
+
+func (c *ResourceV1alpha3ClusterClient) Cluster(clusterPath logicalcluster.Path) resourcev1alpha3.ResourceV1alpha3Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return c.clientCache.ClusterOrDie(clusterPath)
+}
+
+func (c *ResourceV1alpha3ClusterClient) DeviceClasses() DeviceClassClusterInterface {
+	return &deviceClassesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *ResourceV1alpha3ClusterClient) DeviceTaintRules() DeviceTaintRuleClusterInterface {
+	return &deviceTaintRulesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *ResourceV1alpha3ClusterClient) ResourceClaims() ResourceClaimClusterInterface {
+	return &resourceClaimsClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *ResourceV1alpha3ClusterClient) ResourceClaimTemplates() ResourceClaimTemplateClusterInterface {
+	return &resourceClaimTemplatesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *ResourceV1alpha3ClusterClient) ResourceSlices() ResourceSliceClusterInterface {
+	return &resourceSlicesClusterInterface{clientCache: c.clientCache}
+}
+
+// NewForConfig creates a new ResourceV1alpha3ClusterClient for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ResourceV1alpha3ClusterClient, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ResourceV1alpha3ClusterClient for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ResourceV1alpha3ClusterClient, error) {
+	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*resourcev1alpha3.ResourceV1alpha3Client]{
+		NewForConfigAndClient: resourcev1alpha3.NewForConfigAndClient,
+	})
+	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
+		return nil, err
+	}
+
+	return &ResourceV1alpha3ClusterClient{clientCache: cache}, nil
+}
+
+// NewForConfigOrDie creates a new ResourceV1alpha3ClusterClient for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ResourceV1alpha3ClusterClient {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiresourcev1alpha3.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/resource/v1alpha1/resourceclaim.go b/kubernetes/typed/resource/v1alpha3/resourceclaim.go
similarity index 65%
rename from kubernetes/typed/resource/v1alpha1/resourceclaim.go
rename to kubernetes/typed/resource/v1alpha3/resourceclaim.go
index 1403ea132..3be00cf53 100644
--- a/kubernetes/typed/resource/v1alpha1/resourceclaim.go
+++ b/kubernetes/typed/resource/v1alpha3/resourceclaim.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
-package v1alpha1
+package v1alpha3
 
 import (
-	"context"
+	context "context"
+
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedresourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	resourcev1alpha1client "k8s.io/client-go/kubernetes/typed/resource/v1alpha1"
 )
 
 // ResourceClaimsClusterGetter has a method to return a ResourceClaimClusterInterface.
@@ -43,12 +40,13 @@ type ResourceClaimsClusterGetter interface {
 // or scope down to one cluster and return a ResourceClaimsNamespacer.
 type ResourceClaimClusterInterface interface {
 	Cluster(logicalcluster.Path) ResourceClaimsNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.ResourceClaimList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*resourcev1alpha3.ResourceClaimList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ResourceClaimClusterExpansion
 }
 
 type resourceClaimsClusterInterface struct {
-	clientCache kcpclient.Cache[*resourcev1alpha1client.ResourceV1alpha1Client]
+	clientCache kcpclient.Cache[*typedresourcev1alpha3.ResourceV1alpha3Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *resourceClaimsClusterInterface) Cluster(clusterPath logicalcluster.Path
 }
 
 // List returns the entire collection of all ResourceClaims across all clusters.
-func (c *resourceClaimsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.ResourceClaimList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaims(metav1.NamespaceAll).List(ctx, opts)
+func (c *resourceClaimsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*resourcev1alpha3.ResourceClaimList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaims(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all ResourceClaims across all clusters.
-func (c *resourceClaimsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaims(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *resourceClaimsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaims(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ResourceClaimsNamespacer can scope to objects within a namespace, returning a resourcev1alpha1client.ResourceClaimInterface.
+// ResourceClaimsNamespacer can scope to objects within a namespace, returning a typedresourcev1alpha3.ResourceClaimInterface.
 type ResourceClaimsNamespacer interface {
-	Namespace(string) resourcev1alpha1client.ResourceClaimInterface
+	Namespace(string) typedresourcev1alpha3.ResourceClaimInterface
 }
 
 type resourceClaimsNamespacer struct {
-	clientCache kcpclient.Cache[*resourcev1alpha1client.ResourceV1alpha1Client]
+	clientCache kcpclient.Cache[*typedresourcev1alpha3.ResourceV1alpha3Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *resourceClaimsNamespacer) Namespace(namespace string) resourcev1alpha1client.ResourceClaimInterface {
+func (n *resourceClaimsNamespacer) Namespace(namespace string) typedresourcev1alpha3.ResourceClaimInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).ResourceClaims(namespace)
 }
diff --git a/kubernetes/typed/resource/v1alpha1/resourceclaimtemplate.go b/kubernetes/typed/resource/v1alpha3/resourceclaimtemplate.go
similarity index 67%
rename from kubernetes/typed/resource/v1alpha1/resourceclaimtemplate.go
rename to kubernetes/typed/resource/v1alpha3/resourceclaimtemplate.go
index 873a4ec82..307dea8f3 100644
--- a/kubernetes/typed/resource/v1alpha1/resourceclaimtemplate.go
+++ b/kubernetes/typed/resource/v1alpha3/resourceclaimtemplate.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
-package v1alpha1
+package v1alpha3
 
 import (
-	"context"
+	context "context"
+
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedresourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	resourcev1alpha1client "k8s.io/client-go/kubernetes/typed/resource/v1alpha1"
 )
 
 // ResourceClaimTemplatesClusterGetter has a method to return a ResourceClaimTemplateClusterInterface.
@@ -43,12 +40,13 @@ type ResourceClaimTemplatesClusterGetter interface {
 // or scope down to one cluster and return a ResourceClaimTemplatesNamespacer.
 type ResourceClaimTemplateClusterInterface interface {
 	Cluster(logicalcluster.Path) ResourceClaimTemplatesNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.ResourceClaimTemplateList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*resourcev1alpha3.ResourceClaimTemplateList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ResourceClaimTemplateClusterExpansion
 }
 
 type resourceClaimTemplatesClusterInterface struct {
-	clientCache kcpclient.Cache[*resourcev1alpha1client.ResourceV1alpha1Client]
+	clientCache kcpclient.Cache[*typedresourcev1alpha3.ResourceV1alpha3Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *resourceClaimTemplatesClusterInterface) Cluster(clusterPath logicalclus
 }
 
 // List returns the entire collection of all ResourceClaimTemplates across all clusters.
-func (c *resourceClaimTemplatesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*resourcev1alpha1.ResourceClaimTemplateList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaimTemplates(metav1.NamespaceAll).List(ctx, opts)
+func (c *resourceClaimTemplatesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*resourcev1alpha3.ResourceClaimTemplateList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaimTemplates(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all ResourceClaimTemplates across all clusters.
-func (c *resourceClaimTemplatesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaimTemplates(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *resourceClaimTemplatesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaimTemplates(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// ResourceClaimTemplatesNamespacer can scope to objects within a namespace, returning a resourcev1alpha1client.ResourceClaimTemplateInterface.
+// ResourceClaimTemplatesNamespacer can scope to objects within a namespace, returning a typedresourcev1alpha3.ResourceClaimTemplateInterface.
 type ResourceClaimTemplatesNamespacer interface {
-	Namespace(string) resourcev1alpha1client.ResourceClaimTemplateInterface
+	Namespace(string) typedresourcev1alpha3.ResourceClaimTemplateInterface
 }
 
 type resourceClaimTemplatesNamespacer struct {
-	clientCache kcpclient.Cache[*resourcev1alpha1client.ResourceV1alpha1Client]
+	clientCache kcpclient.Cache[*typedresourcev1alpha3.ResourceV1alpha3Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *resourceClaimTemplatesNamespacer) Namespace(namespace string) resourcev1alpha1client.ResourceClaimTemplateInterface {
+func (n *resourceClaimTemplatesNamespacer) Namespace(namespace string) typedresourcev1alpha3.ResourceClaimTemplateInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).ResourceClaimTemplates(namespace)
 }
diff --git a/kubernetes/typed/resource/v1alpha3/resourceslice.go b/kubernetes/typed/resource/v1alpha3/resourceslice.go
new file mode 100644
index 000000000..7d9cb6e28
--- /dev/null
+++ b/kubernetes/typed/resource/v1alpha3/resourceslice.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	context "context"
+
+	apiresourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1alpha3 "k8s.io/client-go/kubernetes/typed/resource/v1alpha3"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceSlicesClusterGetter has a method to return a ResourceSliceClusterInterface.
+// A group's cluster client should implement this interface.
+type ResourceSlicesClusterGetter interface {
+	ResourceSlices() ResourceSliceClusterInterface
+}
+
+// ResourceSliceClusterInterface can operate on ResourceSlices across all clusters,
+// or scope down to one cluster and return a resourcev1alpha3.ResourceSliceInterface.
+type ResourceSliceClusterInterface interface {
+	Cluster(logicalcluster.Path) resourcev1alpha3.ResourceSliceInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1alpha3.ResourceSliceList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ResourceSliceClusterExpansion
+}
+
+type resourceSlicesClusterInterface struct {
+	clientCache kcpclient.Cache[*resourcev1alpha3.ResourceV1alpha3Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *resourceSlicesClusterInterface) Cluster(clusterPath logicalcluster.Path) resourcev1alpha3.ResourceSliceInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).ResourceSlices()
+}
+
+// List returns the entire collection of all ResourceSlices across all clusters.
+func (c *resourceSlicesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1alpha3.ResourceSliceList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceSlices().List(ctx, opts)
+}
+
+// Watch begins to watch all ResourceSlices across all clusters.
+func (c *resourceSlicesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceSlices().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/resource/v1beta1/deviceclass.go b/kubernetes/typed/resource/v1beta1/deviceclass.go
new file mode 100644
index 000000000..a3dd85509
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/deviceclass.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	apiresourcev1beta1 "k8s.io/api/resource/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1beta1 "k8s.io/client-go/kubernetes/typed/resource/v1beta1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// DeviceClassesClusterGetter has a method to return a DeviceClassClusterInterface.
+// A group's cluster client should implement this interface.
+type DeviceClassesClusterGetter interface {
+	DeviceClasses() DeviceClassClusterInterface
+}
+
+// DeviceClassClusterInterface can operate on DeviceClasses across all clusters,
+// or scope down to one cluster and return a resourcev1beta1.DeviceClassInterface.
+type DeviceClassClusterInterface interface {
+	Cluster(logicalcluster.Path) resourcev1beta1.DeviceClassInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1beta1.DeviceClassList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	DeviceClassClusterExpansion
+}
+
+type deviceClassesClusterInterface struct {
+	clientCache kcpclient.Cache[*resourcev1beta1.ResourceV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *deviceClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) resourcev1beta1.DeviceClassInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).DeviceClasses()
+}
+
+// List returns the entire collection of all DeviceClasses across all clusters.
+func (c *deviceClassesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1beta1.DeviceClassList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DeviceClasses().List(ctx, opts)
+}
+
+// Watch begins to watch all DeviceClasses across all clusters.
+func (c *deviceClassesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DeviceClasses().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/resource/v1beta1/doc.go b/kubernetes/typed/resource/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/resource/v1beta1/fake/deviceclass.go b/kubernetes/typed/resource/v1beta1/fake/deviceclass.go
new file mode 100644
index 000000000..042785d2e
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/fake/deviceclass.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	v1beta1 "k8s.io/client-go/applyconfigurations/resource/v1beta1"
+	typedresourcev1beta1 "k8s.io/client-go/kubernetes/typed/resource/v1beta1"
+
+	typedkcpresourcev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// deviceClassClusterClient implements DeviceClassClusterInterface
+type deviceClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1beta1.DeviceClass, *resourcev1beta1.DeviceClassList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeDeviceClassClusterClient(fake *ResourceV1beta1ClusterClient) typedkcpresourcev1beta1.DeviceClassClusterInterface {
+	return &deviceClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1beta1.DeviceClass, *resourcev1beta1.DeviceClassList](
+			fake.Fake,
+			resourcev1beta1.SchemeGroupVersion.WithResource("deviceclasses"),
+			resourcev1beta1.SchemeGroupVersion.WithKind("DeviceClass"),
+			func() *resourcev1beta1.DeviceClass { return &resourcev1beta1.DeviceClass{} },
+			func() *resourcev1beta1.DeviceClassList { return &resourcev1beta1.DeviceClassList{} },
+			func(dst, src *resourcev1beta1.DeviceClassList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta1.DeviceClassList) []*resourcev1beta1.DeviceClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta1.DeviceClassList, items []*resourcev1beta1.DeviceClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *deviceClassClusterClient) Cluster(cluster logicalcluster.Path) typedresourcev1beta1.DeviceClassInterface {
+	return newFakeDeviceClassClient(c.Fake, cluster)
+}
+
+// deviceClassScopedClient implements DeviceClassInterface
+type deviceClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1beta1.DeviceClass, *resourcev1beta1.DeviceClassList, *v1beta1.DeviceClassApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeDeviceClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedresourcev1beta1.DeviceClassInterface {
+	return &deviceClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1beta1.DeviceClass, *resourcev1beta1.DeviceClassList, *v1beta1.DeviceClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			resourcev1beta1.SchemeGroupVersion.WithResource("deviceclasses"),
+			resourcev1beta1.SchemeGroupVersion.WithKind("DeviceClass"),
+			func() *resourcev1beta1.DeviceClass { return &resourcev1beta1.DeviceClass{} },
+			func() *resourcev1beta1.DeviceClassList { return &resourcev1beta1.DeviceClassList{} },
+			func(dst, src *resourcev1beta1.DeviceClassList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta1.DeviceClassList) []*resourcev1beta1.DeviceClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta1.DeviceClassList, items []*resourcev1beta1.DeviceClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1beta1/fake/doc.go b/kubernetes/typed/resource/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/resource/v1beta1/fake/resource_client.go b/kubernetes/typed/resource/v1beta1/fake/resource_client.go
new file mode 100644
index 000000000..f3bb2c823
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/fake/resource_client.go
@@ -0,0 +1,85 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1beta1 "k8s.io/client-go/kubernetes/typed/resource/v1beta1"
+	rest "k8s.io/client-go/rest"
+
+	kcpresourcev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta1"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+var _ kcpresourcev1beta1.ResourceV1beta1ClusterInterface = (*ResourceV1beta1ClusterClient)(nil)
+
+type ResourceV1beta1ClusterClient struct {
+	*kcptesting.Fake
+}
+
+func (c *ResourceV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) resourcev1beta1.ResourceV1beta1Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return &ResourceV1beta1Client{Fake: c.Fake, ClusterPath: clusterPath}
+}
+
+func (c *ResourceV1beta1ClusterClient) DeviceClasses() kcpresourcev1beta1.DeviceClassClusterInterface {
+	return newFakeDeviceClassClusterClient(c)
+}
+
+func (c *ResourceV1beta1ClusterClient) ResourceClaims() kcpresourcev1beta1.ResourceClaimClusterInterface {
+	return newFakeResourceClaimClusterClient(c)
+}
+
+func (c *ResourceV1beta1ClusterClient) ResourceClaimTemplates() kcpresourcev1beta1.ResourceClaimTemplateClusterInterface {
+	return newFakeResourceClaimTemplateClusterClient(c)
+}
+
+func (c *ResourceV1beta1ClusterClient) ResourceSlices() kcpresourcev1beta1.ResourceSliceClusterInterface {
+	return newFakeResourceSliceClusterClient(c)
+}
+
+type ResourceV1beta1Client struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (c *ResourceV1beta1Client) DeviceClasses() resourcev1beta1.DeviceClassInterface {
+	return newFakeDeviceClassClient(c.Fake, c.ClusterPath)
+}
+
+func (c *ResourceV1beta1Client) ResourceClaims(namespace string) resourcev1beta1.ResourceClaimInterface {
+	return newFakeResourceClaimClient(c.Fake, namespace, c.ClusterPath)
+}
+
+func (c *ResourceV1beta1Client) ResourceClaimTemplates(namespace string) resourcev1beta1.ResourceClaimTemplateInterface {
+	return newFakeResourceClaimTemplateClient(c.Fake, namespace, c.ClusterPath)
+}
+
+func (c *ResourceV1beta1Client) ResourceSlices() resourcev1beta1.ResourceSliceInterface {
+	return newFakeResourceSliceClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ResourceV1beta1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/kubernetes/typed/resource/v1beta1/fake/resourceclaim.go b/kubernetes/typed/resource/v1beta1/fake/resourceclaim.go
new file mode 100644
index 000000000..a7971779d
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/fake/resourceclaim.go
@@ -0,0 +1,99 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	v1beta1 "k8s.io/client-go/applyconfigurations/resource/v1beta1"
+	typedresourcev1beta1 "k8s.io/client-go/kubernetes/typed/resource/v1beta1"
+
+	typedkcpresourcev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// resourceClaimClusterClient implements ResourceClaimClusterInterface
+type resourceClaimClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1beta1.ResourceClaim, *resourcev1beta1.ResourceClaimList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeResourceClaimClusterClient(fake *ResourceV1beta1ClusterClient) typedkcpresourcev1beta1.ResourceClaimClusterInterface {
+	return &resourceClaimClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1beta1.ResourceClaim, *resourcev1beta1.ResourceClaimList](
+			fake.Fake,
+			resourcev1beta1.SchemeGroupVersion.WithResource("resourceclaims"),
+			resourcev1beta1.SchemeGroupVersion.WithKind("ResourceClaim"),
+			func() *resourcev1beta1.ResourceClaim { return &resourcev1beta1.ResourceClaim{} },
+			func() *resourcev1beta1.ResourceClaimList { return &resourcev1beta1.ResourceClaimList{} },
+			func(dst, src *resourcev1beta1.ResourceClaimList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta1.ResourceClaimList) []*resourcev1beta1.ResourceClaim {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta1.ResourceClaimList, items []*resourcev1beta1.ResourceClaim) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *resourceClaimClusterClient) Cluster(cluster logicalcluster.Path) typedkcpresourcev1beta1.ResourceClaimsNamespacer {
+	return &resourceClaimNamespacer{Fake: c.Fake, ClusterPath: cluster}
+}
+
+type resourceClaimNamespacer struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (n *resourceClaimNamespacer) Namespace(namespace string) typedresourcev1beta1.ResourceClaimInterface {
+	return newFakeResourceClaimClient(n.Fake, namespace, n.ClusterPath)
+}
+
+// resourceClaimScopedClient implements ResourceClaimInterface
+type resourceClaimScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1beta1.ResourceClaim, *resourcev1beta1.ResourceClaimList, *v1beta1.ResourceClaimApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeResourceClaimClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedresourcev1beta1.ResourceClaimInterface {
+	return &resourceClaimScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1beta1.ResourceClaim, *resourcev1beta1.ResourceClaimList, *v1beta1.ResourceClaimApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			resourcev1beta1.SchemeGroupVersion.WithResource("resourceclaims"),
+			resourcev1beta1.SchemeGroupVersion.WithKind("ResourceClaim"),
+			func() *resourcev1beta1.ResourceClaim { return &resourcev1beta1.ResourceClaim{} },
+			func() *resourcev1beta1.ResourceClaimList { return &resourcev1beta1.ResourceClaimList{} },
+			func(dst, src *resourcev1beta1.ResourceClaimList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta1.ResourceClaimList) []*resourcev1beta1.ResourceClaim {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta1.ResourceClaimList, items []*resourcev1beta1.ResourceClaim) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1beta1/fake/resourceclaimtemplate.go b/kubernetes/typed/resource/v1beta1/fake/resourceclaimtemplate.go
new file mode 100644
index 000000000..48696d8c1
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/fake/resourceclaimtemplate.go
@@ -0,0 +1,99 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	v1beta1 "k8s.io/client-go/applyconfigurations/resource/v1beta1"
+	typedresourcev1beta1 "k8s.io/client-go/kubernetes/typed/resource/v1beta1"
+
+	typedkcpresourcev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// resourceClaimTemplateClusterClient implements ResourceClaimTemplateClusterInterface
+type resourceClaimTemplateClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1beta1.ResourceClaimTemplate, *resourcev1beta1.ResourceClaimTemplateList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeResourceClaimTemplateClusterClient(fake *ResourceV1beta1ClusterClient) typedkcpresourcev1beta1.ResourceClaimTemplateClusterInterface {
+	return &resourceClaimTemplateClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1beta1.ResourceClaimTemplate, *resourcev1beta1.ResourceClaimTemplateList](
+			fake.Fake,
+			resourcev1beta1.SchemeGroupVersion.WithResource("resourceclaimtemplates"),
+			resourcev1beta1.SchemeGroupVersion.WithKind("ResourceClaimTemplate"),
+			func() *resourcev1beta1.ResourceClaimTemplate { return &resourcev1beta1.ResourceClaimTemplate{} },
+			func() *resourcev1beta1.ResourceClaimTemplateList { return &resourcev1beta1.ResourceClaimTemplateList{} },
+			func(dst, src *resourcev1beta1.ResourceClaimTemplateList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta1.ResourceClaimTemplateList) []*resourcev1beta1.ResourceClaimTemplate {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta1.ResourceClaimTemplateList, items []*resourcev1beta1.ResourceClaimTemplate) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *resourceClaimTemplateClusterClient) Cluster(cluster logicalcluster.Path) typedkcpresourcev1beta1.ResourceClaimTemplatesNamespacer {
+	return &resourceClaimTemplateNamespacer{Fake: c.Fake, ClusterPath: cluster}
+}
+
+type resourceClaimTemplateNamespacer struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (n *resourceClaimTemplateNamespacer) Namespace(namespace string) typedresourcev1beta1.ResourceClaimTemplateInterface {
+	return newFakeResourceClaimTemplateClient(n.Fake, namespace, n.ClusterPath)
+}
+
+// resourceClaimTemplateScopedClient implements ResourceClaimTemplateInterface
+type resourceClaimTemplateScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1beta1.ResourceClaimTemplate, *resourcev1beta1.ResourceClaimTemplateList, *v1beta1.ResourceClaimTemplateApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeResourceClaimTemplateClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedresourcev1beta1.ResourceClaimTemplateInterface {
+	return &resourceClaimTemplateScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1beta1.ResourceClaimTemplate, *resourcev1beta1.ResourceClaimTemplateList, *v1beta1.ResourceClaimTemplateApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			resourcev1beta1.SchemeGroupVersion.WithResource("resourceclaimtemplates"),
+			resourcev1beta1.SchemeGroupVersion.WithKind("ResourceClaimTemplate"),
+			func() *resourcev1beta1.ResourceClaimTemplate { return &resourcev1beta1.ResourceClaimTemplate{} },
+			func() *resourcev1beta1.ResourceClaimTemplateList { return &resourcev1beta1.ResourceClaimTemplateList{} },
+			func(dst, src *resourcev1beta1.ResourceClaimTemplateList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta1.ResourceClaimTemplateList) []*resourcev1beta1.ResourceClaimTemplate {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta1.ResourceClaimTemplateList, items []*resourcev1beta1.ResourceClaimTemplate) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1beta1/fake/resourceslice.go b/kubernetes/typed/resource/v1beta1/fake/resourceslice.go
new file mode 100644
index 000000000..e2cef39fb
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/fake/resourceslice.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	v1beta1 "k8s.io/client-go/applyconfigurations/resource/v1beta1"
+	typedresourcev1beta1 "k8s.io/client-go/kubernetes/typed/resource/v1beta1"
+
+	typedkcpresourcev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// resourceSliceClusterClient implements ResourceSliceClusterInterface
+type resourceSliceClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1beta1.ResourceSlice, *resourcev1beta1.ResourceSliceList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeResourceSliceClusterClient(fake *ResourceV1beta1ClusterClient) typedkcpresourcev1beta1.ResourceSliceClusterInterface {
+	return &resourceSliceClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1beta1.ResourceSlice, *resourcev1beta1.ResourceSliceList](
+			fake.Fake,
+			resourcev1beta1.SchemeGroupVersion.WithResource("resourceslices"),
+			resourcev1beta1.SchemeGroupVersion.WithKind("ResourceSlice"),
+			func() *resourcev1beta1.ResourceSlice { return &resourcev1beta1.ResourceSlice{} },
+			func() *resourcev1beta1.ResourceSliceList { return &resourcev1beta1.ResourceSliceList{} },
+			func(dst, src *resourcev1beta1.ResourceSliceList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta1.ResourceSliceList) []*resourcev1beta1.ResourceSlice {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta1.ResourceSliceList, items []*resourcev1beta1.ResourceSlice) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *resourceSliceClusterClient) Cluster(cluster logicalcluster.Path) typedresourcev1beta1.ResourceSliceInterface {
+	return newFakeResourceSliceClient(c.Fake, cluster)
+}
+
+// resourceSliceScopedClient implements ResourceSliceInterface
+type resourceSliceScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1beta1.ResourceSlice, *resourcev1beta1.ResourceSliceList, *v1beta1.ResourceSliceApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeResourceSliceClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedresourcev1beta1.ResourceSliceInterface {
+	return &resourceSliceScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1beta1.ResourceSlice, *resourcev1beta1.ResourceSliceList, *v1beta1.ResourceSliceApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			resourcev1beta1.SchemeGroupVersion.WithResource("resourceslices"),
+			resourcev1beta1.SchemeGroupVersion.WithKind("ResourceSlice"),
+			func() *resourcev1beta1.ResourceSlice { return &resourcev1beta1.ResourceSlice{} },
+			func() *resourcev1beta1.ResourceSliceList { return &resourcev1beta1.ResourceSliceList{} },
+			func(dst, src *resourcev1beta1.ResourceSliceList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta1.ResourceSliceList) []*resourcev1beta1.ResourceSlice {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta1.ResourceSliceList, items []*resourcev1beta1.ResourceSlice) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1beta1/generated_expansion.go b/kubernetes/typed/resource/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..6c77c2efb
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/generated_expansion.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type DeviceClassClusterExpansion interface{}
+
+type ResourceClaimClusterExpansion interface{}
+
+type ResourceClaimTemplateClusterExpansion interface{}
+
+type ResourceSliceClusterExpansion interface{}
diff --git a/kubernetes/typed/resource/v1beta1/resource_client.go b/kubernetes/typed/resource/v1beta1/resource_client.go
new file mode 100644
index 000000000..122a18ce8
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/resource_client.go
@@ -0,0 +1,118 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	http "net/http"
+
+	apiresourcev1beta1 "k8s.io/api/resource/v1beta1"
+	resourcev1beta1 "k8s.io/client-go/kubernetes/typed/resource/v1beta1"
+	rest "k8s.io/client-go/rest"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+type ResourceV1beta1ClusterInterface interface {
+	ResourceV1beta1ClusterScoper
+	DeviceClassesClusterGetter
+	ResourceClaimsClusterGetter
+	ResourceClaimTemplatesClusterGetter
+	ResourceSlicesClusterGetter
+}
+
+type ResourceV1beta1ClusterScoper interface {
+	Cluster(logicalcluster.Path) resourcev1beta1.ResourceV1beta1Interface
+}
+
+// ResourceV1beta1ClusterClient is used to interact with features provided by the resource.k8s.io group.
+type ResourceV1beta1ClusterClient struct {
+	clientCache kcpclient.Cache[*resourcev1beta1.ResourceV1beta1Client]
+}
+
+func (c *ResourceV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) resourcev1beta1.ResourceV1beta1Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return c.clientCache.ClusterOrDie(clusterPath)
+}
+
+func (c *ResourceV1beta1ClusterClient) DeviceClasses() DeviceClassClusterInterface {
+	return &deviceClassesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *ResourceV1beta1ClusterClient) ResourceClaims() ResourceClaimClusterInterface {
+	return &resourceClaimsClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *ResourceV1beta1ClusterClient) ResourceClaimTemplates() ResourceClaimTemplateClusterInterface {
+	return &resourceClaimTemplatesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *ResourceV1beta1ClusterClient) ResourceSlices() ResourceSliceClusterInterface {
+	return &resourceSlicesClusterInterface{clientCache: c.clientCache}
+}
+
+// NewForConfig creates a new ResourceV1beta1ClusterClient for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ResourceV1beta1ClusterClient, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ResourceV1beta1ClusterClient for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ResourceV1beta1ClusterClient, error) {
+	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*resourcev1beta1.ResourceV1beta1Client]{
+		NewForConfigAndClient: resourcev1beta1.NewForConfigAndClient,
+	})
+	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
+		return nil, err
+	}
+
+	return &ResourceV1beta1ClusterClient{clientCache: cache}, nil
+}
+
+// NewForConfigOrDie creates a new ResourceV1beta1ClusterClient for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ResourceV1beta1ClusterClient {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiresourcev1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/resource/v1beta1/resourceclaim.go b/kubernetes/typed/resource/v1beta1/resourceclaim.go
new file mode 100644
index 000000000..0cb8a6418
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/resourceclaim.go
@@ -0,0 +1,83 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedresourcev1beta1 "k8s.io/client-go/kubernetes/typed/resource/v1beta1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimsClusterGetter has a method to return a ResourceClaimClusterInterface.
+// A group's cluster client should implement this interface.
+type ResourceClaimsClusterGetter interface {
+	ResourceClaims() ResourceClaimClusterInterface
+}
+
+// ResourceClaimClusterInterface can operate on ResourceClaims across all clusters,
+// or scope down to one cluster and return a ResourceClaimsNamespacer.
+type ResourceClaimClusterInterface interface {
+	Cluster(logicalcluster.Path) ResourceClaimsNamespacer
+	List(ctx context.Context, opts v1.ListOptions) (*resourcev1beta1.ResourceClaimList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ResourceClaimClusterExpansion
+}
+
+type resourceClaimsClusterInterface struct {
+	clientCache kcpclient.Cache[*typedresourcev1beta1.ResourceV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *resourceClaimsClusterInterface) Cluster(clusterPath logicalcluster.Path) ResourceClaimsNamespacer {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return &resourceClaimsNamespacer{clientCache: c.clientCache, clusterPath: clusterPath}
+}
+
+// List returns the entire collection of all ResourceClaims across all clusters.
+func (c *resourceClaimsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*resourcev1beta1.ResourceClaimList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaims(v1.NamespaceAll).List(ctx, opts)
+}
+
+// Watch begins to watch all ResourceClaims across all clusters.
+func (c *resourceClaimsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaims(v1.NamespaceAll).Watch(ctx, opts)
+}
+
+// ResourceClaimsNamespacer can scope to objects within a namespace, returning a typedresourcev1beta1.ResourceClaimInterface.
+type ResourceClaimsNamespacer interface {
+	Namespace(string) typedresourcev1beta1.ResourceClaimInterface
+}
+
+type resourceClaimsNamespacer struct {
+	clientCache kcpclient.Cache[*typedresourcev1beta1.ResourceV1beta1Client]
+	clusterPath logicalcluster.Path
+}
+
+func (n *resourceClaimsNamespacer) Namespace(namespace string) typedresourcev1beta1.ResourceClaimInterface {
+	return n.clientCache.ClusterOrDie(n.clusterPath).ResourceClaims(namespace)
+}
diff --git a/kubernetes/typed/resource/v1beta1/resourceclaimtemplate.go b/kubernetes/typed/resource/v1beta1/resourceclaimtemplate.go
new file mode 100644
index 000000000..52cd1e10b
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/resourceclaimtemplate.go
@@ -0,0 +1,83 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedresourcev1beta1 "k8s.io/client-go/kubernetes/typed/resource/v1beta1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimTemplatesClusterGetter has a method to return a ResourceClaimTemplateClusterInterface.
+// A group's cluster client should implement this interface.
+type ResourceClaimTemplatesClusterGetter interface {
+	ResourceClaimTemplates() ResourceClaimTemplateClusterInterface
+}
+
+// ResourceClaimTemplateClusterInterface can operate on ResourceClaimTemplates across all clusters,
+// or scope down to one cluster and return a ResourceClaimTemplatesNamespacer.
+type ResourceClaimTemplateClusterInterface interface {
+	Cluster(logicalcluster.Path) ResourceClaimTemplatesNamespacer
+	List(ctx context.Context, opts v1.ListOptions) (*resourcev1beta1.ResourceClaimTemplateList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ResourceClaimTemplateClusterExpansion
+}
+
+type resourceClaimTemplatesClusterInterface struct {
+	clientCache kcpclient.Cache[*typedresourcev1beta1.ResourceV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *resourceClaimTemplatesClusterInterface) Cluster(clusterPath logicalcluster.Path) ResourceClaimTemplatesNamespacer {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return &resourceClaimTemplatesNamespacer{clientCache: c.clientCache, clusterPath: clusterPath}
+}
+
+// List returns the entire collection of all ResourceClaimTemplates across all clusters.
+func (c *resourceClaimTemplatesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*resourcev1beta1.ResourceClaimTemplateList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaimTemplates(v1.NamespaceAll).List(ctx, opts)
+}
+
+// Watch begins to watch all ResourceClaimTemplates across all clusters.
+func (c *resourceClaimTemplatesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaimTemplates(v1.NamespaceAll).Watch(ctx, opts)
+}
+
+// ResourceClaimTemplatesNamespacer can scope to objects within a namespace, returning a typedresourcev1beta1.ResourceClaimTemplateInterface.
+type ResourceClaimTemplatesNamespacer interface {
+	Namespace(string) typedresourcev1beta1.ResourceClaimTemplateInterface
+}
+
+type resourceClaimTemplatesNamespacer struct {
+	clientCache kcpclient.Cache[*typedresourcev1beta1.ResourceV1beta1Client]
+	clusterPath logicalcluster.Path
+}
+
+func (n *resourceClaimTemplatesNamespacer) Namespace(namespace string) typedresourcev1beta1.ResourceClaimTemplateInterface {
+	return n.clientCache.ClusterOrDie(n.clusterPath).ResourceClaimTemplates(namespace)
+}
diff --git a/kubernetes/typed/resource/v1beta1/resourceslice.go b/kubernetes/typed/resource/v1beta1/resourceslice.go
new file mode 100644
index 000000000..71d69e246
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta1/resourceslice.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	apiresourcev1beta1 "k8s.io/api/resource/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1beta1 "k8s.io/client-go/kubernetes/typed/resource/v1beta1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceSlicesClusterGetter has a method to return a ResourceSliceClusterInterface.
+// A group's cluster client should implement this interface.
+type ResourceSlicesClusterGetter interface {
+	ResourceSlices() ResourceSliceClusterInterface
+}
+
+// ResourceSliceClusterInterface can operate on ResourceSlices across all clusters,
+// or scope down to one cluster and return a resourcev1beta1.ResourceSliceInterface.
+type ResourceSliceClusterInterface interface {
+	Cluster(logicalcluster.Path) resourcev1beta1.ResourceSliceInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1beta1.ResourceSliceList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ResourceSliceClusterExpansion
+}
+
+type resourceSlicesClusterInterface struct {
+	clientCache kcpclient.Cache[*resourcev1beta1.ResourceV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *resourceSlicesClusterInterface) Cluster(clusterPath logicalcluster.Path) resourcev1beta1.ResourceSliceInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).ResourceSlices()
+}
+
+// List returns the entire collection of all ResourceSlices across all clusters.
+func (c *resourceSlicesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1beta1.ResourceSliceList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceSlices().List(ctx, opts)
+}
+
+// Watch begins to watch all ResourceSlices across all clusters.
+func (c *resourceSlicesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceSlices().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/resource/v1beta2/deviceclass.go b/kubernetes/typed/resource/v1beta2/deviceclass.go
new file mode 100644
index 000000000..28f0fbaa4
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/deviceclass.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	context "context"
+
+	apiresourcev1beta2 "k8s.io/api/resource/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// DeviceClassesClusterGetter has a method to return a DeviceClassClusterInterface.
+// A group's cluster client should implement this interface.
+type DeviceClassesClusterGetter interface {
+	DeviceClasses() DeviceClassClusterInterface
+}
+
+// DeviceClassClusterInterface can operate on DeviceClasses across all clusters,
+// or scope down to one cluster and return a resourcev1beta2.DeviceClassInterface.
+type DeviceClassClusterInterface interface {
+	Cluster(logicalcluster.Path) resourcev1beta2.DeviceClassInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1beta2.DeviceClassList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	DeviceClassClusterExpansion
+}
+
+type deviceClassesClusterInterface struct {
+	clientCache kcpclient.Cache[*resourcev1beta2.ResourceV1beta2Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *deviceClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) resourcev1beta2.DeviceClassInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).DeviceClasses()
+}
+
+// List returns the entire collection of all DeviceClasses across all clusters.
+func (c *deviceClassesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1beta2.DeviceClassList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DeviceClasses().List(ctx, opts)
+}
+
+// Watch begins to watch all DeviceClasses across all clusters.
+func (c *deviceClassesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).DeviceClasses().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/resource/v1beta2/doc.go b/kubernetes/typed/resource/v1beta2/doc.go
new file mode 100644
index 000000000..3f0720c40
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta2
diff --git a/kubernetes/typed/resource/v1beta2/fake/deviceclass.go b/kubernetes/typed/resource/v1beta2/fake/deviceclass.go
new file mode 100644
index 000000000..a15dcf88f
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/fake/deviceclass.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+	v1beta2 "k8s.io/client-go/applyconfigurations/resource/v1beta2"
+	typedresourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2"
+
+	typedkcpresourcev1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// deviceClassClusterClient implements DeviceClassClusterInterface
+type deviceClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1beta2.DeviceClass, *resourcev1beta2.DeviceClassList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeDeviceClassClusterClient(fake *ResourceV1beta2ClusterClient) typedkcpresourcev1beta2.DeviceClassClusterInterface {
+	return &deviceClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1beta2.DeviceClass, *resourcev1beta2.DeviceClassList](
+			fake.Fake,
+			resourcev1beta2.SchemeGroupVersion.WithResource("deviceclasses"),
+			resourcev1beta2.SchemeGroupVersion.WithKind("DeviceClass"),
+			func() *resourcev1beta2.DeviceClass { return &resourcev1beta2.DeviceClass{} },
+			func() *resourcev1beta2.DeviceClassList { return &resourcev1beta2.DeviceClassList{} },
+			func(dst, src *resourcev1beta2.DeviceClassList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta2.DeviceClassList) []*resourcev1beta2.DeviceClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta2.DeviceClassList, items []*resourcev1beta2.DeviceClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *deviceClassClusterClient) Cluster(cluster logicalcluster.Path) typedresourcev1beta2.DeviceClassInterface {
+	return newFakeDeviceClassClient(c.Fake, cluster)
+}
+
+// deviceClassScopedClient implements DeviceClassInterface
+type deviceClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1beta2.DeviceClass, *resourcev1beta2.DeviceClassList, *v1beta2.DeviceClassApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeDeviceClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedresourcev1beta2.DeviceClassInterface {
+	return &deviceClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1beta2.DeviceClass, *resourcev1beta2.DeviceClassList, *v1beta2.DeviceClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			resourcev1beta2.SchemeGroupVersion.WithResource("deviceclasses"),
+			resourcev1beta2.SchemeGroupVersion.WithKind("DeviceClass"),
+			func() *resourcev1beta2.DeviceClass { return &resourcev1beta2.DeviceClass{} },
+			func() *resourcev1beta2.DeviceClassList { return &resourcev1beta2.DeviceClassList{} },
+			func(dst, src *resourcev1beta2.DeviceClassList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta2.DeviceClassList) []*resourcev1beta2.DeviceClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta2.DeviceClassList, items []*resourcev1beta2.DeviceClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1beta2/fake/doc.go b/kubernetes/typed/resource/v1beta2/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/resource/v1beta2/fake/resource_client.go b/kubernetes/typed/resource/v1beta2/fake/resource_client.go
new file mode 100644
index 000000000..4d2491b4c
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/fake/resource_client.go
@@ -0,0 +1,85 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2"
+	rest "k8s.io/client-go/rest"
+
+	kcpresourcev1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta2"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+var _ kcpresourcev1beta2.ResourceV1beta2ClusterInterface = (*ResourceV1beta2ClusterClient)(nil)
+
+type ResourceV1beta2ClusterClient struct {
+	*kcptesting.Fake
+}
+
+func (c *ResourceV1beta2ClusterClient) Cluster(clusterPath logicalcluster.Path) resourcev1beta2.ResourceV1beta2Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return &ResourceV1beta2Client{Fake: c.Fake, ClusterPath: clusterPath}
+}
+
+func (c *ResourceV1beta2ClusterClient) DeviceClasses() kcpresourcev1beta2.DeviceClassClusterInterface {
+	return newFakeDeviceClassClusterClient(c)
+}
+
+func (c *ResourceV1beta2ClusterClient) ResourceClaims() kcpresourcev1beta2.ResourceClaimClusterInterface {
+	return newFakeResourceClaimClusterClient(c)
+}
+
+func (c *ResourceV1beta2ClusterClient) ResourceClaimTemplates() kcpresourcev1beta2.ResourceClaimTemplateClusterInterface {
+	return newFakeResourceClaimTemplateClusterClient(c)
+}
+
+func (c *ResourceV1beta2ClusterClient) ResourceSlices() kcpresourcev1beta2.ResourceSliceClusterInterface {
+	return newFakeResourceSliceClusterClient(c)
+}
+
+type ResourceV1beta2Client struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (c *ResourceV1beta2Client) DeviceClasses() resourcev1beta2.DeviceClassInterface {
+	return newFakeDeviceClassClient(c.Fake, c.ClusterPath)
+}
+
+func (c *ResourceV1beta2Client) ResourceClaims(namespace string) resourcev1beta2.ResourceClaimInterface {
+	return newFakeResourceClaimClient(c.Fake, namespace, c.ClusterPath)
+}
+
+func (c *ResourceV1beta2Client) ResourceClaimTemplates(namespace string) resourcev1beta2.ResourceClaimTemplateInterface {
+	return newFakeResourceClaimTemplateClient(c.Fake, namespace, c.ClusterPath)
+}
+
+func (c *ResourceV1beta2Client) ResourceSlices() resourcev1beta2.ResourceSliceInterface {
+	return newFakeResourceSliceClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *ResourceV1beta2Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/kubernetes/typed/resource/v1beta2/fake/resourceclaim.go b/kubernetes/typed/resource/v1beta2/fake/resourceclaim.go
new file mode 100644
index 000000000..d2fd5488c
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/fake/resourceclaim.go
@@ -0,0 +1,99 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+	v1beta2 "k8s.io/client-go/applyconfigurations/resource/v1beta2"
+	typedresourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2"
+
+	typedkcpresourcev1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// resourceClaimClusterClient implements ResourceClaimClusterInterface
+type resourceClaimClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1beta2.ResourceClaim, *resourcev1beta2.ResourceClaimList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeResourceClaimClusterClient(fake *ResourceV1beta2ClusterClient) typedkcpresourcev1beta2.ResourceClaimClusterInterface {
+	return &resourceClaimClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1beta2.ResourceClaim, *resourcev1beta2.ResourceClaimList](
+			fake.Fake,
+			resourcev1beta2.SchemeGroupVersion.WithResource("resourceclaims"),
+			resourcev1beta2.SchemeGroupVersion.WithKind("ResourceClaim"),
+			func() *resourcev1beta2.ResourceClaim { return &resourcev1beta2.ResourceClaim{} },
+			func() *resourcev1beta2.ResourceClaimList { return &resourcev1beta2.ResourceClaimList{} },
+			func(dst, src *resourcev1beta2.ResourceClaimList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta2.ResourceClaimList) []*resourcev1beta2.ResourceClaim {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta2.ResourceClaimList, items []*resourcev1beta2.ResourceClaim) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *resourceClaimClusterClient) Cluster(cluster logicalcluster.Path) typedkcpresourcev1beta2.ResourceClaimsNamespacer {
+	return &resourceClaimNamespacer{Fake: c.Fake, ClusterPath: cluster}
+}
+
+type resourceClaimNamespacer struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (n *resourceClaimNamespacer) Namespace(namespace string) typedresourcev1beta2.ResourceClaimInterface {
+	return newFakeResourceClaimClient(n.Fake, namespace, n.ClusterPath)
+}
+
+// resourceClaimScopedClient implements ResourceClaimInterface
+type resourceClaimScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1beta2.ResourceClaim, *resourcev1beta2.ResourceClaimList, *v1beta2.ResourceClaimApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeResourceClaimClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedresourcev1beta2.ResourceClaimInterface {
+	return &resourceClaimScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1beta2.ResourceClaim, *resourcev1beta2.ResourceClaimList, *v1beta2.ResourceClaimApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			resourcev1beta2.SchemeGroupVersion.WithResource("resourceclaims"),
+			resourcev1beta2.SchemeGroupVersion.WithKind("ResourceClaim"),
+			func() *resourcev1beta2.ResourceClaim { return &resourcev1beta2.ResourceClaim{} },
+			func() *resourcev1beta2.ResourceClaimList { return &resourcev1beta2.ResourceClaimList{} },
+			func(dst, src *resourcev1beta2.ResourceClaimList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta2.ResourceClaimList) []*resourcev1beta2.ResourceClaim {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta2.ResourceClaimList, items []*resourcev1beta2.ResourceClaim) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1beta2/fake/resourceclaimtemplate.go b/kubernetes/typed/resource/v1beta2/fake/resourceclaimtemplate.go
new file mode 100644
index 000000000..815d5a335
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/fake/resourceclaimtemplate.go
@@ -0,0 +1,99 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+	v1beta2 "k8s.io/client-go/applyconfigurations/resource/v1beta2"
+	typedresourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2"
+
+	typedkcpresourcev1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// resourceClaimTemplateClusterClient implements ResourceClaimTemplateClusterInterface
+type resourceClaimTemplateClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1beta2.ResourceClaimTemplate, *resourcev1beta2.ResourceClaimTemplateList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeResourceClaimTemplateClusterClient(fake *ResourceV1beta2ClusterClient) typedkcpresourcev1beta2.ResourceClaimTemplateClusterInterface {
+	return &resourceClaimTemplateClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1beta2.ResourceClaimTemplate, *resourcev1beta2.ResourceClaimTemplateList](
+			fake.Fake,
+			resourcev1beta2.SchemeGroupVersion.WithResource("resourceclaimtemplates"),
+			resourcev1beta2.SchemeGroupVersion.WithKind("ResourceClaimTemplate"),
+			func() *resourcev1beta2.ResourceClaimTemplate { return &resourcev1beta2.ResourceClaimTemplate{} },
+			func() *resourcev1beta2.ResourceClaimTemplateList { return &resourcev1beta2.ResourceClaimTemplateList{} },
+			func(dst, src *resourcev1beta2.ResourceClaimTemplateList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta2.ResourceClaimTemplateList) []*resourcev1beta2.ResourceClaimTemplate {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta2.ResourceClaimTemplateList, items []*resourcev1beta2.ResourceClaimTemplate) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *resourceClaimTemplateClusterClient) Cluster(cluster logicalcluster.Path) typedkcpresourcev1beta2.ResourceClaimTemplatesNamespacer {
+	return &resourceClaimTemplateNamespacer{Fake: c.Fake, ClusterPath: cluster}
+}
+
+type resourceClaimTemplateNamespacer struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (n *resourceClaimTemplateNamespacer) Namespace(namespace string) typedresourcev1beta2.ResourceClaimTemplateInterface {
+	return newFakeResourceClaimTemplateClient(n.Fake, namespace, n.ClusterPath)
+}
+
+// resourceClaimTemplateScopedClient implements ResourceClaimTemplateInterface
+type resourceClaimTemplateScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1beta2.ResourceClaimTemplate, *resourcev1beta2.ResourceClaimTemplateList, *v1beta2.ResourceClaimTemplateApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeResourceClaimTemplateClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedresourcev1beta2.ResourceClaimTemplateInterface {
+	return &resourceClaimTemplateScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1beta2.ResourceClaimTemplate, *resourcev1beta2.ResourceClaimTemplateList, *v1beta2.ResourceClaimTemplateApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			resourcev1beta2.SchemeGroupVersion.WithResource("resourceclaimtemplates"),
+			resourcev1beta2.SchemeGroupVersion.WithKind("ResourceClaimTemplate"),
+			func() *resourcev1beta2.ResourceClaimTemplate { return &resourcev1beta2.ResourceClaimTemplate{} },
+			func() *resourcev1beta2.ResourceClaimTemplateList { return &resourcev1beta2.ResourceClaimTemplateList{} },
+			func(dst, src *resourcev1beta2.ResourceClaimTemplateList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta2.ResourceClaimTemplateList) []*resourcev1beta2.ResourceClaimTemplate {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta2.ResourceClaimTemplateList, items []*resourcev1beta2.ResourceClaimTemplate) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1beta2/fake/resourceslice.go b/kubernetes/typed/resource/v1beta2/fake/resourceslice.go
new file mode 100644
index 000000000..ad92a053b
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/fake/resourceslice.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+	v1beta2 "k8s.io/client-go/applyconfigurations/resource/v1beta2"
+	typedresourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2"
+
+	typedkcpresourcev1beta2 "github.com/kcp-dev/client-go/kubernetes/typed/resource/v1beta2"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// resourceSliceClusterClient implements ResourceSliceClusterInterface
+type resourceSliceClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*resourcev1beta2.ResourceSlice, *resourcev1beta2.ResourceSliceList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeResourceSliceClusterClient(fake *ResourceV1beta2ClusterClient) typedkcpresourcev1beta2.ResourceSliceClusterInterface {
+	return &resourceSliceClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*resourcev1beta2.ResourceSlice, *resourcev1beta2.ResourceSliceList](
+			fake.Fake,
+			resourcev1beta2.SchemeGroupVersion.WithResource("resourceslices"),
+			resourcev1beta2.SchemeGroupVersion.WithKind("ResourceSlice"),
+			func() *resourcev1beta2.ResourceSlice { return &resourcev1beta2.ResourceSlice{} },
+			func() *resourcev1beta2.ResourceSliceList { return &resourcev1beta2.ResourceSliceList{} },
+			func(dst, src *resourcev1beta2.ResourceSliceList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta2.ResourceSliceList) []*resourcev1beta2.ResourceSlice {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta2.ResourceSliceList, items []*resourcev1beta2.ResourceSlice) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *resourceSliceClusterClient) Cluster(cluster logicalcluster.Path) typedresourcev1beta2.ResourceSliceInterface {
+	return newFakeResourceSliceClient(c.Fake, cluster)
+}
+
+// resourceSliceScopedClient implements ResourceSliceInterface
+type resourceSliceScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*resourcev1beta2.ResourceSlice, *resourcev1beta2.ResourceSliceList, *v1beta2.ResourceSliceApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeResourceSliceClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedresourcev1beta2.ResourceSliceInterface {
+	return &resourceSliceScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*resourcev1beta2.ResourceSlice, *resourcev1beta2.ResourceSliceList, *v1beta2.ResourceSliceApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			resourcev1beta2.SchemeGroupVersion.WithResource("resourceslices"),
+			resourcev1beta2.SchemeGroupVersion.WithKind("ResourceSlice"),
+			func() *resourcev1beta2.ResourceSlice { return &resourcev1beta2.ResourceSlice{} },
+			func() *resourcev1beta2.ResourceSliceList { return &resourcev1beta2.ResourceSliceList{} },
+			func(dst, src *resourcev1beta2.ResourceSliceList) { dst.ListMeta = src.ListMeta },
+			func(list *resourcev1beta2.ResourceSliceList) []*resourcev1beta2.ResourceSlice {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *resourcev1beta2.ResourceSliceList, items []*resourcev1beta2.ResourceSlice) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/resource/v1beta2/generated_expansion.go b/kubernetes/typed/resource/v1beta2/generated_expansion.go
new file mode 100644
index 000000000..7dc1b719a
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/generated_expansion.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta2
+
+type DeviceClassClusterExpansion interface{}
+
+type ResourceClaimClusterExpansion interface{}
+
+type ResourceClaimTemplateClusterExpansion interface{}
+
+type ResourceSliceClusterExpansion interface{}
diff --git a/kubernetes/typed/resource/v1beta2/resource_client.go b/kubernetes/typed/resource/v1beta2/resource_client.go
new file mode 100644
index 000000000..867b06962
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/resource_client.go
@@ -0,0 +1,118 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	http "net/http"
+
+	apiresourcev1beta2 "k8s.io/api/resource/v1beta2"
+	resourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2"
+	rest "k8s.io/client-go/rest"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+type ResourceV1beta2ClusterInterface interface {
+	ResourceV1beta2ClusterScoper
+	DeviceClassesClusterGetter
+	ResourceClaimsClusterGetter
+	ResourceClaimTemplatesClusterGetter
+	ResourceSlicesClusterGetter
+}
+
+type ResourceV1beta2ClusterScoper interface {
+	Cluster(logicalcluster.Path) resourcev1beta2.ResourceV1beta2Interface
+}
+
+// ResourceV1beta2ClusterClient is used to interact with features provided by the resource.k8s.io group.
+type ResourceV1beta2ClusterClient struct {
+	clientCache kcpclient.Cache[*resourcev1beta2.ResourceV1beta2Client]
+}
+
+func (c *ResourceV1beta2ClusterClient) Cluster(clusterPath logicalcluster.Path) resourcev1beta2.ResourceV1beta2Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return c.clientCache.ClusterOrDie(clusterPath)
+}
+
+func (c *ResourceV1beta2ClusterClient) DeviceClasses() DeviceClassClusterInterface {
+	return &deviceClassesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *ResourceV1beta2ClusterClient) ResourceClaims() ResourceClaimClusterInterface {
+	return &resourceClaimsClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *ResourceV1beta2ClusterClient) ResourceClaimTemplates() ResourceClaimTemplateClusterInterface {
+	return &resourceClaimTemplatesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *ResourceV1beta2ClusterClient) ResourceSlices() ResourceSliceClusterInterface {
+	return &resourceSlicesClusterInterface{clientCache: c.clientCache}
+}
+
+// NewForConfig creates a new ResourceV1beta2ClusterClient for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ResourceV1beta2ClusterClient, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ResourceV1beta2ClusterClient for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ResourceV1beta2ClusterClient, error) {
+	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*resourcev1beta2.ResourceV1beta2Client]{
+		NewForConfigAndClient: resourcev1beta2.NewForConfigAndClient,
+	})
+	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
+		return nil, err
+	}
+
+	return &ResourceV1beta2ClusterClient{clientCache: cache}, nil
+}
+
+// NewForConfigOrDie creates a new ResourceV1beta2ClusterClient for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ResourceV1beta2ClusterClient {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apiresourcev1beta2.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/resource/v1beta2/resourceclaim.go b/kubernetes/typed/resource/v1beta2/resourceclaim.go
new file mode 100644
index 000000000..527f0794c
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/resourceclaim.go
@@ -0,0 +1,83 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	context "context"
+
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedresourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimsClusterGetter has a method to return a ResourceClaimClusterInterface.
+// A group's cluster client should implement this interface.
+type ResourceClaimsClusterGetter interface {
+	ResourceClaims() ResourceClaimClusterInterface
+}
+
+// ResourceClaimClusterInterface can operate on ResourceClaims across all clusters,
+// or scope down to one cluster and return a ResourceClaimsNamespacer.
+type ResourceClaimClusterInterface interface {
+	Cluster(logicalcluster.Path) ResourceClaimsNamespacer
+	List(ctx context.Context, opts v1.ListOptions) (*resourcev1beta2.ResourceClaimList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ResourceClaimClusterExpansion
+}
+
+type resourceClaimsClusterInterface struct {
+	clientCache kcpclient.Cache[*typedresourcev1beta2.ResourceV1beta2Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *resourceClaimsClusterInterface) Cluster(clusterPath logicalcluster.Path) ResourceClaimsNamespacer {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return &resourceClaimsNamespacer{clientCache: c.clientCache, clusterPath: clusterPath}
+}
+
+// List returns the entire collection of all ResourceClaims across all clusters.
+func (c *resourceClaimsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*resourcev1beta2.ResourceClaimList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaims(v1.NamespaceAll).List(ctx, opts)
+}
+
+// Watch begins to watch all ResourceClaims across all clusters.
+func (c *resourceClaimsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaims(v1.NamespaceAll).Watch(ctx, opts)
+}
+
+// ResourceClaimsNamespacer can scope to objects within a namespace, returning a typedresourcev1beta2.ResourceClaimInterface.
+type ResourceClaimsNamespacer interface {
+	Namespace(string) typedresourcev1beta2.ResourceClaimInterface
+}
+
+type resourceClaimsNamespacer struct {
+	clientCache kcpclient.Cache[*typedresourcev1beta2.ResourceV1beta2Client]
+	clusterPath logicalcluster.Path
+}
+
+func (n *resourceClaimsNamespacer) Namespace(namespace string) typedresourcev1beta2.ResourceClaimInterface {
+	return n.clientCache.ClusterOrDie(n.clusterPath).ResourceClaims(namespace)
+}
diff --git a/kubernetes/typed/resource/v1beta2/resourceclaimtemplate.go b/kubernetes/typed/resource/v1beta2/resourceclaimtemplate.go
new file mode 100644
index 000000000..391ed802a
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/resourceclaimtemplate.go
@@ -0,0 +1,83 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	context "context"
+
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedresourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimTemplatesClusterGetter has a method to return a ResourceClaimTemplateClusterInterface.
+// A group's cluster client should implement this interface.
+type ResourceClaimTemplatesClusterGetter interface {
+	ResourceClaimTemplates() ResourceClaimTemplateClusterInterface
+}
+
+// ResourceClaimTemplateClusterInterface can operate on ResourceClaimTemplates across all clusters,
+// or scope down to one cluster and return a ResourceClaimTemplatesNamespacer.
+type ResourceClaimTemplateClusterInterface interface {
+	Cluster(logicalcluster.Path) ResourceClaimTemplatesNamespacer
+	List(ctx context.Context, opts v1.ListOptions) (*resourcev1beta2.ResourceClaimTemplateList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ResourceClaimTemplateClusterExpansion
+}
+
+type resourceClaimTemplatesClusterInterface struct {
+	clientCache kcpclient.Cache[*typedresourcev1beta2.ResourceV1beta2Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *resourceClaimTemplatesClusterInterface) Cluster(clusterPath logicalcluster.Path) ResourceClaimTemplatesNamespacer {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return &resourceClaimTemplatesNamespacer{clientCache: c.clientCache, clusterPath: clusterPath}
+}
+
+// List returns the entire collection of all ResourceClaimTemplates across all clusters.
+func (c *resourceClaimTemplatesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*resourcev1beta2.ResourceClaimTemplateList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaimTemplates(v1.NamespaceAll).List(ctx, opts)
+}
+
+// Watch begins to watch all ResourceClaimTemplates across all clusters.
+func (c *resourceClaimTemplatesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceClaimTemplates(v1.NamespaceAll).Watch(ctx, opts)
+}
+
+// ResourceClaimTemplatesNamespacer can scope to objects within a namespace, returning a typedresourcev1beta2.ResourceClaimTemplateInterface.
+type ResourceClaimTemplatesNamespacer interface {
+	Namespace(string) typedresourcev1beta2.ResourceClaimTemplateInterface
+}
+
+type resourceClaimTemplatesNamespacer struct {
+	clientCache kcpclient.Cache[*typedresourcev1beta2.ResourceV1beta2Client]
+	clusterPath logicalcluster.Path
+}
+
+func (n *resourceClaimTemplatesNamespacer) Namespace(namespace string) typedresourcev1beta2.ResourceClaimTemplateInterface {
+	return n.clientCache.ClusterOrDie(n.clusterPath).ResourceClaimTemplates(namespace)
+}
diff --git a/kubernetes/typed/resource/v1beta2/resourceslice.go b/kubernetes/typed/resource/v1beta2/resourceslice.go
new file mode 100644
index 000000000..6ceb4867b
--- /dev/null
+++ b/kubernetes/typed/resource/v1beta2/resourceslice.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	context "context"
+
+	apiresourcev1beta2 "k8s.io/api/resource/v1beta2"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	resourcev1beta2 "k8s.io/client-go/kubernetes/typed/resource/v1beta2"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceSlicesClusterGetter has a method to return a ResourceSliceClusterInterface.
+// A group's cluster client should implement this interface.
+type ResourceSlicesClusterGetter interface {
+	ResourceSlices() ResourceSliceClusterInterface
+}
+
+// ResourceSliceClusterInterface can operate on ResourceSlices across all clusters,
+// or scope down to one cluster and return a resourcev1beta2.ResourceSliceInterface.
+type ResourceSliceClusterInterface interface {
+	Cluster(logicalcluster.Path) resourcev1beta2.ResourceSliceInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1beta2.ResourceSliceList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	ResourceSliceClusterExpansion
+}
+
+type resourceSlicesClusterInterface struct {
+	clientCache kcpclient.Cache[*resourcev1beta2.ResourceV1beta2Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *resourceSlicesClusterInterface) Cluster(clusterPath logicalcluster.Path) resourcev1beta2.ResourceSliceInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).ResourceSlices()
+}
+
+// List returns the entire collection of all ResourceSlices across all clusters.
+func (c *resourceSlicesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apiresourcev1beta2.ResourceSliceList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceSlices().List(ctx, opts)
+}
+
+// Watch begins to watch all ResourceSlices across all clusters.
+func (c *resourceSlicesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).ResourceSlices().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/scheduling/v1/doc.go b/kubernetes/typed/scheduling/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/scheduling/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/scheduling/v1/fake/doc.go b/kubernetes/typed/scheduling/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/scheduling/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/scheduling/v1/fake/priorityclass.go b/kubernetes/typed/scheduling/v1/fake/priorityclass.go
index 4ad4636d5..e20e8ae17 100644
--- a/kubernetes/typed/scheduling/v1/fake/priorityclass.go
+++ b/kubernetes/typed/scheduling/v1/fake/priorityclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	schedulingv1 "k8s.io/api/scheduling/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsschedulingv1 "k8s.io/client-go/applyconfigurations/scheduling/v1"
-	schedulingv1client "k8s.io/client-go/kubernetes/typed/scheduling/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/scheduling/v1"
+	typedschedulingv1 "k8s.io/client-go/kubernetes/typed/scheduling/v1"
 
+	typedkcpschedulingv1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var priorityClassesResource = schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1", Resource: "priorityclasses"}
-var priorityClassesKind = schema.GroupVersionKind{Group: "scheduling.k8s.io", Version: "v1", Kind: "PriorityClass"}
-
-type priorityClassesClusterClient struct {
-	*kcptesting.Fake
+// priorityClassClusterClient implements PriorityClassClusterInterface
+type priorityClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*schedulingv1.PriorityClass, *schedulingv1.PriorityClassList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *priorityClassesClusterClient) Cluster(clusterPath logicalcluster.Path) schedulingv1client.PriorityClassInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &priorityClassesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PriorityClasses that match those selectors across all clusters.
-func (c *priorityClassesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*schedulingv1.PriorityClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityClassesResource, priorityClassesKind, logicalcluster.Wildcard, opts), &schedulingv1.PriorityClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &schedulingv1.PriorityClassList{ListMeta: obj.(*schedulingv1.PriorityClassList).ListMeta}
-	for _, item := range obj.(*schedulingv1.PriorityClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakePriorityClassClusterClient(fake *SchedulingV1ClusterClient) typedkcpschedulingv1.PriorityClassClusterInterface {
+	return &priorityClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*schedulingv1.PriorityClass, *schedulingv1.PriorityClassList](
+			fake.Fake,
+			schedulingv1.SchemeGroupVersion.WithResource("priorityclasses"),
+			schedulingv1.SchemeGroupVersion.WithKind("PriorityClass"),
+			func() *schedulingv1.PriorityClass { return &schedulingv1.PriorityClass{} },
+			func() *schedulingv1.PriorityClassList { return &schedulingv1.PriorityClassList{} },
+			func(dst, src *schedulingv1.PriorityClassList) { dst.ListMeta = src.ListMeta },
+			func(list *schedulingv1.PriorityClassList) []*schedulingv1.PriorityClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *schedulingv1.PriorityClassList, items []*schedulingv1.PriorityClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested PriorityClasses across all clusters.
-func (c *priorityClassesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityClassesResource, logicalcluster.Wildcard, opts))
+func (c *priorityClassClusterClient) Cluster(cluster logicalcluster.Path) typedschedulingv1.PriorityClassInterface {
+	return newFakePriorityClassClient(c.Fake, cluster)
 }
 
-type priorityClassesClient struct {
-	*kcptesting.Fake
+// priorityClassScopedClient implements PriorityClassInterface
+type priorityClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*schedulingv1.PriorityClass, *schedulingv1.PriorityClassList, *v1.PriorityClassApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *priorityClassesClient) Create(ctx context.Context, priorityClass *schedulingv1.PriorityClass, opts metav1.CreateOptions) (*schedulingv1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(priorityClassesResource, c.ClusterPath, priorityClass), &schedulingv1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) Update(ctx context.Context, priorityClass *schedulingv1.PriorityClass, opts metav1.UpdateOptions) (*schedulingv1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(priorityClassesResource, c.ClusterPath, priorityClass), &schedulingv1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) UpdateStatus(ctx context.Context, priorityClass *schedulingv1.PriorityClass, opts metav1.UpdateOptions) (*schedulingv1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(priorityClassesResource, c.ClusterPath, "status", priorityClass), &schedulingv1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(priorityClassesResource, c.ClusterPath, name, opts), &schedulingv1.PriorityClass{})
-	return err
-}
-
-func (c *priorityClassesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(priorityClassesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &schedulingv1.PriorityClassList{})
-	return err
-}
-
-func (c *priorityClassesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*schedulingv1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(priorityClassesResource, c.ClusterPath, name), &schedulingv1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1.PriorityClass), err
-}
-
-// List takes label and field selectors, and returns the list of PriorityClasses that match those selectors.
-func (c *priorityClassesClient) List(ctx context.Context, opts metav1.ListOptions) (*schedulingv1.PriorityClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityClassesResource, priorityClassesKind, c.ClusterPath, opts), &schedulingv1.PriorityClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &schedulingv1.PriorityClassList{ListMeta: obj.(*schedulingv1.PriorityClassList).ListMeta}
-	for _, item := range obj.(*schedulingv1.PriorityClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *priorityClassesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityClassesResource, c.ClusterPath, opts))
-}
-
-func (c *priorityClassesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*schedulingv1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityClassesResource, c.ClusterPath, name, pt, data, subresources...), &schedulingv1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsschedulingv1.PriorityClassApplyConfiguration, opts metav1.ApplyOptions) (*schedulingv1.PriorityClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &schedulingv1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsschedulingv1.PriorityClassApplyConfiguration, opts metav1.ApplyOptions) (*schedulingv1.PriorityClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &schedulingv1.PriorityClass{})
-	if obj == nil {
-		return nil, err
+func newFakePriorityClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedschedulingv1.PriorityClassInterface {
+	return &priorityClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*schedulingv1.PriorityClass, *schedulingv1.PriorityClassList, *v1.PriorityClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			schedulingv1.SchemeGroupVersion.WithResource("priorityclasses"),
+			schedulingv1.SchemeGroupVersion.WithKind("PriorityClass"),
+			func() *schedulingv1.PriorityClass { return &schedulingv1.PriorityClass{} },
+			func() *schedulingv1.PriorityClassList { return &schedulingv1.PriorityClassList{} },
+			func(dst, src *schedulingv1.PriorityClassList) { dst.ListMeta = src.ListMeta },
+			func(list *schedulingv1.PriorityClassList) []*schedulingv1.PriorityClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *schedulingv1.PriorityClassList, items []*schedulingv1.PriorityClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*schedulingv1.PriorityClass), err
 }
diff --git a/kubernetes/typed/scheduling/v1/fake/scheduling_client.go b/kubernetes/typed/scheduling/v1/fake/scheduling_client.go
index 42905e464..f49ef2a2d 100644
--- a/kubernetes/typed/scheduling/v1/fake/scheduling_client.go
+++ b/kubernetes/typed/scheduling/v1/fake/scheduling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	schedulingv1 "k8s.io/client-go/kubernetes/typed/scheduling/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpschedulingv1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpschedulingv1.SchedulingV1ClusterInterface = (*SchedulingV1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *SchedulingV1ClusterClient) Cluster(clusterPath logicalcluster.Path) sch
 }
 
 func (c *SchedulingV1ClusterClient) PriorityClasses() kcpschedulingv1.PriorityClassClusterInterface {
-	return &priorityClassesClusterClient{Fake: c.Fake}
+	return newFakePriorityClassClusterClient(c)
 }
 
-var _ schedulingv1.SchedulingV1Interface = (*SchedulingV1Client)(nil)
-
 type SchedulingV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *SchedulingV1Client) PriorityClasses() schedulingv1.PriorityClassInterface {
+	return newFakePriorityClassClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *SchedulingV1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *SchedulingV1Client) PriorityClasses() schedulingv1.PriorityClassInterface {
-	return &priorityClassesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
diff --git a/kubernetes/typed/scheduling/v1/generated_expansion.go b/kubernetes/typed/scheduling/v1/generated_expansion.go
new file mode 100644
index 000000000..c8f2aa9db
--- /dev/null
+++ b/kubernetes/typed/scheduling/v1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type PriorityClassClusterExpansion interface{}
diff --git a/kubernetes/typed/scheduling/v1/priorityclass.go b/kubernetes/typed/scheduling/v1/priorityclass.go
index f8911512c..0348c3c3f 100644
--- a/kubernetes/typed/scheduling/v1/priorityclass.go
+++ b/kubernetes/typed/scheduling/v1/priorityclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apischedulingv1 "k8s.io/api/scheduling/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	schedulingv1 "k8s.io/client-go/kubernetes/typed/scheduling/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	schedulingv1 "k8s.io/api/scheduling/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	schedulingv1client "k8s.io/client-go/kubernetes/typed/scheduling/v1"
 )
 
 // PriorityClassesClusterGetter has a method to return a PriorityClassClusterInterface.
@@ -40,19 +37,20 @@ type PriorityClassesClusterGetter interface {
 }
 
 // PriorityClassClusterInterface can operate on PriorityClasses across all clusters,
-// or scope down to one cluster and return a schedulingv1client.PriorityClassInterface.
+// or scope down to one cluster and return a schedulingv1.PriorityClassInterface.
 type PriorityClassClusterInterface interface {
-	Cluster(logicalcluster.Path) schedulingv1client.PriorityClassInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*schedulingv1.PriorityClassList, error)
+	Cluster(logicalcluster.Path) schedulingv1.PriorityClassInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apischedulingv1.PriorityClassList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	PriorityClassClusterExpansion
 }
 
 type priorityClassesClusterInterface struct {
-	clientCache kcpclient.Cache[*schedulingv1client.SchedulingV1Client]
+	clientCache kcpclient.Cache[*schedulingv1.SchedulingV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *priorityClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) schedulingv1client.PriorityClassInterface {
+func (c *priorityClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) schedulingv1.PriorityClassInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *priorityClassesClusterInterface) Cluster(clusterPath logicalcluster.Pat
 }
 
 // List returns the entire collection of all PriorityClasses across all clusters.
-func (c *priorityClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*schedulingv1.PriorityClassList, error) {
+func (c *priorityClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apischedulingv1.PriorityClassList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PriorityClasses().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/scheduling/v1/scheduling_client.go b/kubernetes/typed/scheduling/v1/scheduling_client.go
index 5d859b373..abca07ba7 100644
--- a/kubernetes/typed/scheduling/v1/scheduling_client.go
+++ b/kubernetes/typed/scheduling/v1/scheduling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apischedulingv1 "k8s.io/api/scheduling/v1"
+	schedulingv1 "k8s.io/client-go/kubernetes/typed/scheduling/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	schedulingv1 "k8s.io/client-go/kubernetes/typed/scheduling/v1"
-	"k8s.io/client-go/rest"
 )
 
 type SchedulingV1ClusterInterface interface {
@@ -40,6 +39,7 @@ type SchedulingV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) schedulingv1.SchedulingV1Interface
 }
 
+// SchedulingV1ClusterClient is used to interact with features provided by the scheduling.k8s.io group.
 type SchedulingV1ClusterClient struct {
 	clientCache kcpclient.Cache[*schedulingv1.SchedulingV1Client]
 }
@@ -59,11 +59,13 @@ func (c *SchedulingV1ClusterClient) PriorityClasses() PriorityClassClusterInterf
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*SchedulingV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new SchedulingV1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*SchedulingV1Cluster
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &SchedulingV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *SchedulingV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apischedulingv1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/scheduling/v1alpha1/doc.go b/kubernetes/typed/scheduling/v1alpha1/doc.go
new file mode 100644
index 000000000..08b80237c
--- /dev/null
+++ b/kubernetes/typed/scheduling/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/kubernetes/typed/scheduling/v1alpha1/fake/doc.go b/kubernetes/typed/scheduling/v1alpha1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/scheduling/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/scheduling/v1alpha1/fake/priorityclass.go b/kubernetes/typed/scheduling/v1alpha1/fake/priorityclass.go
index 6f99f2c55..0292e20d4 100644
--- a/kubernetes/typed/scheduling/v1alpha1/fake/priorityclass.go
+++ b/kubernetes/typed/scheduling/v1alpha1/fake/priorityclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	schedulingv1alpha1 "k8s.io/api/scheduling/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsschedulingv1alpha1 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha1"
-	schedulingv1alpha1client "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha1"
-	"k8s.io/client-go/testing"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/scheduling/v1alpha1"
+	typedschedulingv1alpha1 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha1"
 
+	typedkcpschedulingv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var priorityClassesResource = schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1alpha1", Resource: "priorityclasses"}
-var priorityClassesKind = schema.GroupVersionKind{Group: "scheduling.k8s.io", Version: "v1alpha1", Kind: "PriorityClass"}
-
-type priorityClassesClusterClient struct {
-	*kcptesting.Fake
+// priorityClassClusterClient implements PriorityClassClusterInterface
+type priorityClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*schedulingv1alpha1.PriorityClass, *schedulingv1alpha1.PriorityClassList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *priorityClassesClusterClient) Cluster(clusterPath logicalcluster.Path) schedulingv1alpha1client.PriorityClassInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &priorityClassesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PriorityClasses that match those selectors across all clusters.
-func (c *priorityClassesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*schedulingv1alpha1.PriorityClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityClassesResource, priorityClassesKind, logicalcluster.Wildcard, opts), &schedulingv1alpha1.PriorityClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &schedulingv1alpha1.PriorityClassList{ListMeta: obj.(*schedulingv1alpha1.PriorityClassList).ListMeta}
-	for _, item := range obj.(*schedulingv1alpha1.PriorityClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakePriorityClassClusterClient(fake *SchedulingV1alpha1ClusterClient) typedkcpschedulingv1alpha1.PriorityClassClusterInterface {
+	return &priorityClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*schedulingv1alpha1.PriorityClass, *schedulingv1alpha1.PriorityClassList](
+			fake.Fake,
+			schedulingv1alpha1.SchemeGroupVersion.WithResource("priorityclasses"),
+			schedulingv1alpha1.SchemeGroupVersion.WithKind("PriorityClass"),
+			func() *schedulingv1alpha1.PriorityClass { return &schedulingv1alpha1.PriorityClass{} },
+			func() *schedulingv1alpha1.PriorityClassList { return &schedulingv1alpha1.PriorityClassList{} },
+			func(dst, src *schedulingv1alpha1.PriorityClassList) { dst.ListMeta = src.ListMeta },
+			func(list *schedulingv1alpha1.PriorityClassList) []*schedulingv1alpha1.PriorityClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *schedulingv1alpha1.PriorityClassList, items []*schedulingv1alpha1.PriorityClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested PriorityClasses across all clusters.
-func (c *priorityClassesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityClassesResource, logicalcluster.Wildcard, opts))
+func (c *priorityClassClusterClient) Cluster(cluster logicalcluster.Path) typedschedulingv1alpha1.PriorityClassInterface {
+	return newFakePriorityClassClient(c.Fake, cluster)
 }
 
-type priorityClassesClient struct {
-	*kcptesting.Fake
+// priorityClassScopedClient implements PriorityClassInterface
+type priorityClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*schedulingv1alpha1.PriorityClass, *schedulingv1alpha1.PriorityClassList, *v1alpha1.PriorityClassApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *priorityClassesClient) Create(ctx context.Context, priorityClass *schedulingv1alpha1.PriorityClass, opts metav1.CreateOptions) (*schedulingv1alpha1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(priorityClassesResource, c.ClusterPath, priorityClass), &schedulingv1alpha1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1alpha1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) Update(ctx context.Context, priorityClass *schedulingv1alpha1.PriorityClass, opts metav1.UpdateOptions) (*schedulingv1alpha1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(priorityClassesResource, c.ClusterPath, priorityClass), &schedulingv1alpha1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1alpha1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) UpdateStatus(ctx context.Context, priorityClass *schedulingv1alpha1.PriorityClass, opts metav1.UpdateOptions) (*schedulingv1alpha1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(priorityClassesResource, c.ClusterPath, "status", priorityClass), &schedulingv1alpha1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1alpha1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(priorityClassesResource, c.ClusterPath, name, opts), &schedulingv1alpha1.PriorityClass{})
-	return err
-}
-
-func (c *priorityClassesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(priorityClassesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &schedulingv1alpha1.PriorityClassList{})
-	return err
-}
-
-func (c *priorityClassesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*schedulingv1alpha1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(priorityClassesResource, c.ClusterPath, name), &schedulingv1alpha1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1alpha1.PriorityClass), err
-}
-
-// List takes label and field selectors, and returns the list of PriorityClasses that match those selectors.
-func (c *priorityClassesClient) List(ctx context.Context, opts metav1.ListOptions) (*schedulingv1alpha1.PriorityClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityClassesResource, priorityClassesKind, c.ClusterPath, opts), &schedulingv1alpha1.PriorityClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &schedulingv1alpha1.PriorityClassList{ListMeta: obj.(*schedulingv1alpha1.PriorityClassList).ListMeta}
-	for _, item := range obj.(*schedulingv1alpha1.PriorityClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *priorityClassesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityClassesResource, c.ClusterPath, opts))
-}
-
-func (c *priorityClassesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*schedulingv1alpha1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityClassesResource, c.ClusterPath, name, pt, data, subresources...), &schedulingv1alpha1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1alpha1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsschedulingv1alpha1.PriorityClassApplyConfiguration, opts metav1.ApplyOptions) (*schedulingv1alpha1.PriorityClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &schedulingv1alpha1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1alpha1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsschedulingv1alpha1.PriorityClassApplyConfiguration, opts metav1.ApplyOptions) (*schedulingv1alpha1.PriorityClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &schedulingv1alpha1.PriorityClass{})
-	if obj == nil {
-		return nil, err
+func newFakePriorityClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedschedulingv1alpha1.PriorityClassInterface {
+	return &priorityClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*schedulingv1alpha1.PriorityClass, *schedulingv1alpha1.PriorityClassList, *v1alpha1.PriorityClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			schedulingv1alpha1.SchemeGroupVersion.WithResource("priorityclasses"),
+			schedulingv1alpha1.SchemeGroupVersion.WithKind("PriorityClass"),
+			func() *schedulingv1alpha1.PriorityClass { return &schedulingv1alpha1.PriorityClass{} },
+			func() *schedulingv1alpha1.PriorityClassList { return &schedulingv1alpha1.PriorityClassList{} },
+			func(dst, src *schedulingv1alpha1.PriorityClassList) { dst.ListMeta = src.ListMeta },
+			func(list *schedulingv1alpha1.PriorityClassList) []*schedulingv1alpha1.PriorityClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *schedulingv1alpha1.PriorityClassList, items []*schedulingv1alpha1.PriorityClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*schedulingv1alpha1.PriorityClass), err
 }
diff --git a/kubernetes/typed/scheduling/v1alpha1/fake/scheduling_client.go b/kubernetes/typed/scheduling/v1alpha1/fake/scheduling_client.go
index 6bdfaf640..c905c911a 100644
--- a/kubernetes/typed/scheduling/v1alpha1/fake/scheduling_client.go
+++ b/kubernetes/typed/scheduling/v1alpha1/fake/scheduling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	schedulingv1alpha1 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpschedulingv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1alpha1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpschedulingv1alpha1.SchedulingV1alpha1ClusterInterface = (*SchedulingV1alpha1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *SchedulingV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Pat
 }
 
 func (c *SchedulingV1alpha1ClusterClient) PriorityClasses() kcpschedulingv1alpha1.PriorityClassClusterInterface {
-	return &priorityClassesClusterClient{Fake: c.Fake}
+	return newFakePriorityClassClusterClient(c)
 }
 
-var _ schedulingv1alpha1.SchedulingV1alpha1Interface = (*SchedulingV1alpha1Client)(nil)
-
 type SchedulingV1alpha1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *SchedulingV1alpha1Client) PriorityClasses() schedulingv1alpha1.PriorityClassInterface {
+	return newFakePriorityClassClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *SchedulingV1alpha1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *SchedulingV1alpha1Client) PriorityClasses() schedulingv1alpha1.PriorityClassInterface {
-	return &priorityClassesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
diff --git a/kubernetes/typed/scheduling/v1alpha1/generated_expansion.go b/kubernetes/typed/scheduling/v1alpha1/generated_expansion.go
new file mode 100644
index 000000000..3c3dadfc4
--- /dev/null
+++ b/kubernetes/typed/scheduling/v1alpha1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type PriorityClassClusterExpansion interface{}
diff --git a/kubernetes/typed/scheduling/v1alpha1/priorityclass.go b/kubernetes/typed/scheduling/v1alpha1/priorityclass.go
index 57db199aa..c789f8f4c 100644
--- a/kubernetes/typed/scheduling/v1alpha1/priorityclass.go
+++ b/kubernetes/typed/scheduling/v1alpha1/priorityclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
+	context "context"
+
+	apischedulingv1alpha1 "k8s.io/api/scheduling/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	schedulingv1alpha1 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	schedulingv1alpha1 "k8s.io/api/scheduling/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	schedulingv1alpha1client "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha1"
 )
 
 // PriorityClassesClusterGetter has a method to return a PriorityClassClusterInterface.
@@ -40,19 +37,20 @@ type PriorityClassesClusterGetter interface {
 }
 
 // PriorityClassClusterInterface can operate on PriorityClasses across all clusters,
-// or scope down to one cluster and return a schedulingv1alpha1client.PriorityClassInterface.
+// or scope down to one cluster and return a schedulingv1alpha1.PriorityClassInterface.
 type PriorityClassClusterInterface interface {
-	Cluster(logicalcluster.Path) schedulingv1alpha1client.PriorityClassInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*schedulingv1alpha1.PriorityClassList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) schedulingv1alpha1.PriorityClassInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apischedulingv1alpha1.PriorityClassList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	PriorityClassClusterExpansion
 }
 
 type priorityClassesClusterInterface struct {
-	clientCache kcpclient.Cache[*schedulingv1alpha1client.SchedulingV1alpha1Client]
+	clientCache kcpclient.Cache[*schedulingv1alpha1.SchedulingV1alpha1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *priorityClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) schedulingv1alpha1client.PriorityClassInterface {
+func (c *priorityClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) schedulingv1alpha1.PriorityClassInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *priorityClassesClusterInterface) Cluster(clusterPath logicalcluster.Pat
 }
 
 // List returns the entire collection of all PriorityClasses across all clusters.
-func (c *priorityClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*schedulingv1alpha1.PriorityClassList, error) {
+func (c *priorityClassesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apischedulingv1alpha1.PriorityClassList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PriorityClasses().List(ctx, opts)
 }
 
 // Watch begins to watch all PriorityClasses across all clusters.
-func (c *priorityClassesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *priorityClassesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PriorityClasses().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/scheduling/v1alpha1/scheduling_client.go b/kubernetes/typed/scheduling/v1alpha1/scheduling_client.go
index b80fad075..f04e3b356 100644
--- a/kubernetes/typed/scheduling/v1alpha1/scheduling_client.go
+++ b/kubernetes/typed/scheduling/v1alpha1/scheduling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apischedulingv1alpha1 "k8s.io/api/scheduling/v1alpha1"
+	schedulingv1alpha1 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	schedulingv1alpha1 "k8s.io/client-go/kubernetes/typed/scheduling/v1alpha1"
-	"k8s.io/client-go/rest"
 )
 
 type SchedulingV1alpha1ClusterInterface interface {
@@ -40,6 +39,7 @@ type SchedulingV1alpha1ClusterScoper interface {
 	Cluster(logicalcluster.Path) schedulingv1alpha1.SchedulingV1alpha1Interface
 }
 
+// SchedulingV1alpha1ClusterClient is used to interact with features provided by the scheduling.k8s.io group.
 type SchedulingV1alpha1ClusterClient struct {
 	clientCache kcpclient.Cache[*schedulingv1alpha1.SchedulingV1alpha1Client]
 }
@@ -59,11 +59,13 @@ func (c *SchedulingV1alpha1ClusterClient) PriorityClasses() PriorityClassCluster
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*SchedulingV1alpha1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new SchedulingV1alpha1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*SchedulingV1alpha1C
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &SchedulingV1alpha1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *SchedulingV1alpha1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apischedulingv1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/scheduling/v1beta1/doc.go b/kubernetes/typed/scheduling/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/scheduling/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/scheduling/v1beta1/fake/doc.go b/kubernetes/typed/scheduling/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/scheduling/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/scheduling/v1beta1/fake/priorityclass.go b/kubernetes/typed/scheduling/v1beta1/fake/priorityclass.go
index 487babde9..e4632a674 100644
--- a/kubernetes/typed/scheduling/v1beta1/fake/priorityclass.go
+++ b/kubernetes/typed/scheduling/v1beta1/fake/priorityclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsschedulingv1beta1 "k8s.io/client-go/applyconfigurations/scheduling/v1beta1"
-	schedulingv1beta1client "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/scheduling/v1beta1"
+	typedschedulingv1beta1 "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1"
 
+	typedkcpschedulingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var priorityClassesResource = schema.GroupVersionResource{Group: "scheduling.k8s.io", Version: "v1beta1", Resource: "priorityclasses"}
-var priorityClassesKind = schema.GroupVersionKind{Group: "scheduling.k8s.io", Version: "v1beta1", Kind: "PriorityClass"}
-
-type priorityClassesClusterClient struct {
-	*kcptesting.Fake
+// priorityClassClusterClient implements PriorityClassClusterInterface
+type priorityClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*schedulingv1beta1.PriorityClass, *schedulingv1beta1.PriorityClassList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *priorityClassesClusterClient) Cluster(clusterPath logicalcluster.Path) schedulingv1beta1client.PriorityClassInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &priorityClassesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of PriorityClasses that match those selectors across all clusters.
-func (c *priorityClassesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*schedulingv1beta1.PriorityClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityClassesResource, priorityClassesKind, logicalcluster.Wildcard, opts), &schedulingv1beta1.PriorityClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &schedulingv1beta1.PriorityClassList{ListMeta: obj.(*schedulingv1beta1.PriorityClassList).ListMeta}
-	for _, item := range obj.(*schedulingv1beta1.PriorityClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakePriorityClassClusterClient(fake *SchedulingV1beta1ClusterClient) typedkcpschedulingv1beta1.PriorityClassClusterInterface {
+	return &priorityClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*schedulingv1beta1.PriorityClass, *schedulingv1beta1.PriorityClassList](
+			fake.Fake,
+			schedulingv1beta1.SchemeGroupVersion.WithResource("priorityclasses"),
+			schedulingv1beta1.SchemeGroupVersion.WithKind("PriorityClass"),
+			func() *schedulingv1beta1.PriorityClass { return &schedulingv1beta1.PriorityClass{} },
+			func() *schedulingv1beta1.PriorityClassList { return &schedulingv1beta1.PriorityClassList{} },
+			func(dst, src *schedulingv1beta1.PriorityClassList) { dst.ListMeta = src.ListMeta },
+			func(list *schedulingv1beta1.PriorityClassList) []*schedulingv1beta1.PriorityClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *schedulingv1beta1.PriorityClassList, items []*schedulingv1beta1.PriorityClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested PriorityClasses across all clusters.
-func (c *priorityClassesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityClassesResource, logicalcluster.Wildcard, opts))
+func (c *priorityClassClusterClient) Cluster(cluster logicalcluster.Path) typedschedulingv1beta1.PriorityClassInterface {
+	return newFakePriorityClassClient(c.Fake, cluster)
 }
 
-type priorityClassesClient struct {
-	*kcptesting.Fake
+// priorityClassScopedClient implements PriorityClassInterface
+type priorityClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*schedulingv1beta1.PriorityClass, *schedulingv1beta1.PriorityClassList, *v1beta1.PriorityClassApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *priorityClassesClient) Create(ctx context.Context, priorityClass *schedulingv1beta1.PriorityClass, opts metav1.CreateOptions) (*schedulingv1beta1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(priorityClassesResource, c.ClusterPath, priorityClass), &schedulingv1beta1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1beta1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) Update(ctx context.Context, priorityClass *schedulingv1beta1.PriorityClass, opts metav1.UpdateOptions) (*schedulingv1beta1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(priorityClassesResource, c.ClusterPath, priorityClass), &schedulingv1beta1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1beta1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) UpdateStatus(ctx context.Context, priorityClass *schedulingv1beta1.PriorityClass, opts metav1.UpdateOptions) (*schedulingv1beta1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(priorityClassesResource, c.ClusterPath, "status", priorityClass), &schedulingv1beta1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1beta1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(priorityClassesResource, c.ClusterPath, name, opts), &schedulingv1beta1.PriorityClass{})
-	return err
-}
-
-func (c *priorityClassesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(priorityClassesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &schedulingv1beta1.PriorityClassList{})
-	return err
-}
-
-func (c *priorityClassesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*schedulingv1beta1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(priorityClassesResource, c.ClusterPath, name), &schedulingv1beta1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1beta1.PriorityClass), err
-}
-
-// List takes label and field selectors, and returns the list of PriorityClasses that match those selectors.
-func (c *priorityClassesClient) List(ctx context.Context, opts metav1.ListOptions) (*schedulingv1beta1.PriorityClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(priorityClassesResource, priorityClassesKind, c.ClusterPath, opts), &schedulingv1beta1.PriorityClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &schedulingv1beta1.PriorityClassList{ListMeta: obj.(*schedulingv1beta1.PriorityClassList).ListMeta}
-	for _, item := range obj.(*schedulingv1beta1.PriorityClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *priorityClassesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(priorityClassesResource, c.ClusterPath, opts))
-}
-
-func (c *priorityClassesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*schedulingv1beta1.PriorityClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityClassesResource, c.ClusterPath, name, pt, data, subresources...), &schedulingv1beta1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1beta1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsschedulingv1beta1.PriorityClassApplyConfiguration, opts metav1.ApplyOptions) (*schedulingv1beta1.PriorityClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &schedulingv1beta1.PriorityClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*schedulingv1beta1.PriorityClass), err
-}
-
-func (c *priorityClassesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsschedulingv1beta1.PriorityClassApplyConfiguration, opts metav1.ApplyOptions) (*schedulingv1beta1.PriorityClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(priorityClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &schedulingv1beta1.PriorityClass{})
-	if obj == nil {
-		return nil, err
+func newFakePriorityClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedschedulingv1beta1.PriorityClassInterface {
+	return &priorityClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*schedulingv1beta1.PriorityClass, *schedulingv1beta1.PriorityClassList, *v1beta1.PriorityClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			schedulingv1beta1.SchemeGroupVersion.WithResource("priorityclasses"),
+			schedulingv1beta1.SchemeGroupVersion.WithKind("PriorityClass"),
+			func() *schedulingv1beta1.PriorityClass { return &schedulingv1beta1.PriorityClass{} },
+			func() *schedulingv1beta1.PriorityClassList { return &schedulingv1beta1.PriorityClassList{} },
+			func(dst, src *schedulingv1beta1.PriorityClassList) { dst.ListMeta = src.ListMeta },
+			func(list *schedulingv1beta1.PriorityClassList) []*schedulingv1beta1.PriorityClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *schedulingv1beta1.PriorityClassList, items []*schedulingv1beta1.PriorityClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*schedulingv1beta1.PriorityClass), err
 }
diff --git a/kubernetes/typed/scheduling/v1beta1/fake/scheduling_client.go b/kubernetes/typed/scheduling/v1beta1/fake/scheduling_client.go
index 3b6905718..d9e3af561 100644
--- a/kubernetes/typed/scheduling/v1beta1/fake/scheduling_client.go
+++ b/kubernetes/typed/scheduling/v1beta1/fake/scheduling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	schedulingv1beta1 "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpschedulingv1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/scheduling/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpschedulingv1beta1.SchedulingV1beta1ClusterInterface = (*SchedulingV1beta1ClusterClient)(nil)
@@ -45,21 +41,21 @@ func (c *SchedulingV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path
 }
 
 func (c *SchedulingV1beta1ClusterClient) PriorityClasses() kcpschedulingv1beta1.PriorityClassClusterInterface {
-	return &priorityClassesClusterClient{Fake: c.Fake}
+	return newFakePriorityClassClusterClient(c)
 }
 
-var _ schedulingv1beta1.SchedulingV1beta1Interface = (*SchedulingV1beta1Client)(nil)
-
 type SchedulingV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
+func (c *SchedulingV1beta1Client) PriorityClasses() schedulingv1beta1.PriorityClassInterface {
+	return newFakePriorityClassClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
 func (c *SchedulingV1beta1Client) RESTClient() rest.Interface {
 	var ret *rest.RESTClient
 	return ret
 }
-
-func (c *SchedulingV1beta1Client) PriorityClasses() schedulingv1beta1.PriorityClassInterface {
-	return &priorityClassesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
-}
diff --git a/kubernetes/typed/scheduling/v1beta1/generated_expansion.go b/kubernetes/typed/scheduling/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..da307a5ee
--- /dev/null
+++ b/kubernetes/typed/scheduling/v1beta1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type PriorityClassClusterExpansion interface{}
diff --git a/kubernetes/typed/scheduling/v1beta1/priorityclass.go b/kubernetes/typed/scheduling/v1beta1/priorityclass.go
index 3f66451c0..508373565 100644
--- a/kubernetes/typed/scheduling/v1beta1/priorityclass.go
+++ b/kubernetes/typed/scheduling/v1beta1/priorityclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apischedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	schedulingv1beta1 "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	schedulingv1beta1client "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1"
 )
 
 // PriorityClassesClusterGetter has a method to return a PriorityClassClusterInterface.
@@ -40,19 +37,20 @@ type PriorityClassesClusterGetter interface {
 }
 
 // PriorityClassClusterInterface can operate on PriorityClasses across all clusters,
-// or scope down to one cluster and return a schedulingv1beta1client.PriorityClassInterface.
+// or scope down to one cluster and return a schedulingv1beta1.PriorityClassInterface.
 type PriorityClassClusterInterface interface {
-	Cluster(logicalcluster.Path) schedulingv1beta1client.PriorityClassInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*schedulingv1beta1.PriorityClassList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) schedulingv1beta1.PriorityClassInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apischedulingv1beta1.PriorityClassList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	PriorityClassClusterExpansion
 }
 
 type priorityClassesClusterInterface struct {
-	clientCache kcpclient.Cache[*schedulingv1beta1client.SchedulingV1beta1Client]
+	clientCache kcpclient.Cache[*schedulingv1beta1.SchedulingV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *priorityClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) schedulingv1beta1client.PriorityClassInterface {
+func (c *priorityClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) schedulingv1beta1.PriorityClassInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *priorityClassesClusterInterface) Cluster(clusterPath logicalcluster.Pat
 }
 
 // List returns the entire collection of all PriorityClasses across all clusters.
-func (c *priorityClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*schedulingv1beta1.PriorityClassList, error) {
+func (c *priorityClassesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apischedulingv1beta1.PriorityClassList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PriorityClasses().List(ctx, opts)
 }
 
 // Watch begins to watch all PriorityClasses across all clusters.
-func (c *priorityClassesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *priorityClassesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).PriorityClasses().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/scheduling/v1beta1/scheduling_client.go b/kubernetes/typed/scheduling/v1beta1/scheduling_client.go
index 0715c1a5e..cd62cccfe 100644
--- a/kubernetes/typed/scheduling/v1beta1/scheduling_client.go
+++ b/kubernetes/typed/scheduling/v1beta1/scheduling_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apischedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
+	schedulingv1beta1 "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	schedulingv1beta1 "k8s.io/client-go/kubernetes/typed/scheduling/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type SchedulingV1beta1ClusterInterface interface {
@@ -40,6 +39,7 @@ type SchedulingV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) schedulingv1beta1.SchedulingV1beta1Interface
 }
 
+// SchedulingV1beta1ClusterClient is used to interact with features provided by the scheduling.k8s.io group.
 type SchedulingV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*schedulingv1beta1.SchedulingV1beta1Client]
 }
@@ -59,11 +59,13 @@ func (c *SchedulingV1beta1ClusterClient) PriorityClasses() PriorityClassClusterI
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*SchedulingV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new SchedulingV1beta1ClusterClient for the given config and http client.
@@ -75,6 +77,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*SchedulingV1beta1Cl
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &SchedulingV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -87,3 +90,14 @@ func NewForConfigOrDie(c *rest.Config) *SchedulingV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apischedulingv1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/storage/v1/csidriver.go b/kubernetes/typed/storage/v1/csidriver.go
index 7efbafbad..400e99e72 100644
--- a/kubernetes/typed/storage/v1/csidriver.go
+++ b/kubernetes/typed/storage/v1/csidriver.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apistoragev1 "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	storagev1client "k8s.io/client-go/kubernetes/typed/storage/v1"
 )
 
 // CSIDriversClusterGetter has a method to return a CSIDriverClusterInterface.
@@ -40,19 +37,20 @@ type CSIDriversClusterGetter interface {
 }
 
 // CSIDriverClusterInterface can operate on CSIDrivers across all clusters,
-// or scope down to one cluster and return a storagev1client.CSIDriverInterface.
+// or scope down to one cluster and return a storagev1.CSIDriverInterface.
 type CSIDriverClusterInterface interface {
-	Cluster(logicalcluster.Path) storagev1client.CSIDriverInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*storagev1.CSIDriverList, error)
+	Cluster(logicalcluster.Path) storagev1.CSIDriverInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apistoragev1.CSIDriverList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	CSIDriverClusterExpansion
 }
 
 type cSIDriversClusterInterface struct {
-	clientCache kcpclient.Cache[*storagev1client.StorageV1Client]
+	clientCache kcpclient.Cache[*storagev1.StorageV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *cSIDriversClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1client.CSIDriverInterface {
+func (c *cSIDriversClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1.CSIDriverInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *cSIDriversClusterInterface) Cluster(clusterPath logicalcluster.Path) st
 }
 
 // List returns the entire collection of all CSIDrivers across all clusters.
-func (c *cSIDriversClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.CSIDriverList, error) {
+func (c *cSIDriversClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apistoragev1.CSIDriverList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSIDrivers().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/storage/v1/csinode.go b/kubernetes/typed/storage/v1/csinode.go
index 14bf7c528..0640fd0a6 100644
--- a/kubernetes/typed/storage/v1/csinode.go
+++ b/kubernetes/typed/storage/v1/csinode.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apistoragev1 "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	storagev1client "k8s.io/client-go/kubernetes/typed/storage/v1"
 )
 
 // CSINodesClusterGetter has a method to return a CSINodeClusterInterface.
@@ -40,19 +37,20 @@ type CSINodesClusterGetter interface {
 }
 
 // CSINodeClusterInterface can operate on CSINodes across all clusters,
-// or scope down to one cluster and return a storagev1client.CSINodeInterface.
+// or scope down to one cluster and return a storagev1.CSINodeInterface.
 type CSINodeClusterInterface interface {
-	Cluster(logicalcluster.Path) storagev1client.CSINodeInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*storagev1.CSINodeList, error)
+	Cluster(logicalcluster.Path) storagev1.CSINodeInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apistoragev1.CSINodeList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	CSINodeClusterExpansion
 }
 
 type cSINodesClusterInterface struct {
-	clientCache kcpclient.Cache[*storagev1client.StorageV1Client]
+	clientCache kcpclient.Cache[*storagev1.StorageV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *cSINodesClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1client.CSINodeInterface {
+func (c *cSINodesClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1.CSINodeInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *cSINodesClusterInterface) Cluster(clusterPath logicalcluster.Path) stor
 }
 
 // List returns the entire collection of all CSINodes across all clusters.
-func (c *cSINodesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.CSINodeList, error) {
+func (c *cSINodesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apistoragev1.CSINodeList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSINodes().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/storage/v1/csistoragecapacity.go b/kubernetes/typed/storage/v1/csistoragecapacity.go
index fe3401780..c866327eb 100644
--- a/kubernetes/typed/storage/v1/csistoragecapacity.go
+++ b/kubernetes/typed/storage/v1/csistoragecapacity.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
-
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
+	context "context"
 
 	storagev1 "k8s.io/api/storage/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	storagev1client "k8s.io/client-go/kubernetes/typed/storage/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedstoragev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // CSIStorageCapacitiesClusterGetter has a method to return a CSIStorageCapacityClusterInterface.
@@ -45,10 +42,11 @@ type CSIStorageCapacityClusterInterface interface {
 	Cluster(logicalcluster.Path) CSIStorageCapacitiesNamespacer
 	List(ctx context.Context, opts metav1.ListOptions) (*storagev1.CSIStorageCapacityList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	CSIStorageCapacityClusterExpansion
 }
 
 type cSIStorageCapacitiesClusterInterface struct {
-	clientCache kcpclient.Cache[*storagev1client.StorageV1Client]
+	clientCache kcpclient.Cache[*typedstoragev1.StorageV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -70,16 +68,16 @@ func (c *cSIStorageCapacitiesClusterInterface) Watch(ctx context.Context, opts m
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSIStorageCapacities(metav1.NamespaceAll).Watch(ctx, opts)
 }
 
-// CSIStorageCapacitiesNamespacer can scope to objects within a namespace, returning a storagev1client.CSIStorageCapacityInterface.
+// CSIStorageCapacitiesNamespacer can scope to objects within a namespace, returning a typedstoragev1.CSIStorageCapacityInterface.
 type CSIStorageCapacitiesNamespacer interface {
-	Namespace(string) storagev1client.CSIStorageCapacityInterface
+	Namespace(string) typedstoragev1.CSIStorageCapacityInterface
 }
 
 type cSIStorageCapacitiesNamespacer struct {
-	clientCache kcpclient.Cache[*storagev1client.StorageV1Client]
+	clientCache kcpclient.Cache[*typedstoragev1.StorageV1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *cSIStorageCapacitiesNamespacer) Namespace(namespace string) storagev1client.CSIStorageCapacityInterface {
+func (n *cSIStorageCapacitiesNamespacer) Namespace(namespace string) typedstoragev1.CSIStorageCapacityInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).CSIStorageCapacities(namespace)
 }
diff --git a/kubernetes/typed/storage/v1/doc.go b/kubernetes/typed/storage/v1/doc.go
new file mode 100644
index 000000000..d2f3412ab
--- /dev/null
+++ b/kubernetes/typed/storage/v1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1
diff --git a/kubernetes/typed/storage/v1/fake/csidriver.go b/kubernetes/typed/storage/v1/fake/csidriver.go
index 227d5fe60..20da26458 100644
--- a/kubernetes/typed/storage/v1/fake/csidriver.go
+++ b/kubernetes/typed/storage/v1/fake/csidriver.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsstoragev1 "k8s.io/client-go/applyconfigurations/storage/v1"
-	storagev1client "k8s.io/client-go/kubernetes/typed/storage/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/storage/v1"
+	typedstoragev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
 
+	typedkcpstoragev1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var cSIDriversResource = schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1", Resource: "csidrivers"}
-var cSIDriversKind = schema.GroupVersionKind{Group: "storage.k8s.io", Version: "v1", Kind: "CSIDriver"}
-
-type cSIDriversClusterClient struct {
-	*kcptesting.Fake
+// cSIDriverClusterClient implements CSIDriverClusterInterface
+type cSIDriverClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1.CSIDriver, *storagev1.CSIDriverList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *cSIDriversClusterClient) Cluster(clusterPath logicalcluster.Path) storagev1client.CSIDriverInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &cSIDriversClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of CSIDrivers that match those selectors across all clusters.
-func (c *cSIDriversClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.CSIDriverList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(cSIDriversResource, cSIDriversKind, logicalcluster.Wildcard, opts), &storagev1.CSIDriverList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1.CSIDriverList{ListMeta: obj.(*storagev1.CSIDriverList).ListMeta}
-	for _, item := range obj.(*storagev1.CSIDriverList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeCSIDriverClusterClient(fake *StorageV1ClusterClient) typedkcpstoragev1.CSIDriverClusterInterface {
+	return &cSIDriverClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1.CSIDriver, *storagev1.CSIDriverList](
+			fake.Fake,
+			storagev1.SchemeGroupVersion.WithResource("csidrivers"),
+			storagev1.SchemeGroupVersion.WithKind("CSIDriver"),
+			func() *storagev1.CSIDriver { return &storagev1.CSIDriver{} },
+			func() *storagev1.CSIDriverList { return &storagev1.CSIDriverList{} },
+			func(dst, src *storagev1.CSIDriverList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1.CSIDriverList) []*storagev1.CSIDriver {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1.CSIDriverList, items []*storagev1.CSIDriver) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested CSIDrivers across all clusters.
-func (c *cSIDriversClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(cSIDriversResource, logicalcluster.Wildcard, opts))
+func (c *cSIDriverClusterClient) Cluster(cluster logicalcluster.Path) typedstoragev1.CSIDriverInterface {
+	return newFakeCSIDriverClient(c.Fake, cluster)
 }
 
-type cSIDriversClient struct {
-	*kcptesting.Fake
+// cSIDriverScopedClient implements CSIDriverInterface
+type cSIDriverScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1.CSIDriver, *storagev1.CSIDriverList, *v1.CSIDriverApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *cSIDriversClient) Create(ctx context.Context, cSIDriver *storagev1.CSIDriver, opts metav1.CreateOptions) (*storagev1.CSIDriver, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(cSIDriversResource, c.ClusterPath, cSIDriver), &storagev1.CSIDriver{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSIDriver), err
-}
-
-func (c *cSIDriversClient) Update(ctx context.Context, cSIDriver *storagev1.CSIDriver, opts metav1.UpdateOptions) (*storagev1.CSIDriver, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(cSIDriversResource, c.ClusterPath, cSIDriver), &storagev1.CSIDriver{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSIDriver), err
-}
-
-func (c *cSIDriversClient) UpdateStatus(ctx context.Context, cSIDriver *storagev1.CSIDriver, opts metav1.UpdateOptions) (*storagev1.CSIDriver, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(cSIDriversResource, c.ClusterPath, "status", cSIDriver), &storagev1.CSIDriver{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSIDriver), err
-}
-
-func (c *cSIDriversClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(cSIDriversResource, c.ClusterPath, name, opts), &storagev1.CSIDriver{})
-	return err
-}
-
-func (c *cSIDriversClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(cSIDriversResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &storagev1.CSIDriverList{})
-	return err
-}
-
-func (c *cSIDriversClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*storagev1.CSIDriver, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(cSIDriversResource, c.ClusterPath, name), &storagev1.CSIDriver{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSIDriver), err
-}
-
-// List takes label and field selectors, and returns the list of CSIDrivers that match those selectors.
-func (c *cSIDriversClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.CSIDriverList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(cSIDriversResource, cSIDriversKind, c.ClusterPath, opts), &storagev1.CSIDriverList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1.CSIDriverList{ListMeta: obj.(*storagev1.CSIDriverList).ListMeta}
-	for _, item := range obj.(*storagev1.CSIDriverList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *cSIDriversClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(cSIDriversResource, c.ClusterPath, opts))
-}
-
-func (c *cSIDriversClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*storagev1.CSIDriver, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(cSIDriversResource, c.ClusterPath, name, pt, data, subresources...), &storagev1.CSIDriver{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSIDriver), err
-}
-
-func (c *cSIDriversClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1.CSIDriverApplyConfiguration, opts metav1.ApplyOptions) (*storagev1.CSIDriver, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(cSIDriversResource, c.ClusterPath, *name, types.ApplyPatchType, data), &storagev1.CSIDriver{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSIDriver), err
-}
-
-func (c *cSIDriversClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1.CSIDriverApplyConfiguration, opts metav1.ApplyOptions) (*storagev1.CSIDriver, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(cSIDriversResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &storagev1.CSIDriver{})
-	if obj == nil {
-		return nil, err
+func newFakeCSIDriverClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedstoragev1.CSIDriverInterface {
+	return &cSIDriverScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1.CSIDriver, *storagev1.CSIDriverList, *v1.CSIDriverApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			storagev1.SchemeGroupVersion.WithResource("csidrivers"),
+			storagev1.SchemeGroupVersion.WithKind("CSIDriver"),
+			func() *storagev1.CSIDriver { return &storagev1.CSIDriver{} },
+			func() *storagev1.CSIDriverList { return &storagev1.CSIDriverList{} },
+			func(dst, src *storagev1.CSIDriverList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1.CSIDriverList) []*storagev1.CSIDriver {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1.CSIDriverList, items []*storagev1.CSIDriver) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*storagev1.CSIDriver), err
 }
diff --git a/kubernetes/typed/storage/v1/fake/csinode.go b/kubernetes/typed/storage/v1/fake/csinode.go
index 6c7e7928b..42202a9f5 100644
--- a/kubernetes/typed/storage/v1/fake/csinode.go
+++ b/kubernetes/typed/storage/v1/fake/csinode.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,73 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsstoragev1 "k8s.io/client-go/applyconfigurations/storage/v1"
-	storagev1client "k8s.io/client-go/kubernetes/typed/storage/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/storage/v1"
+	typedstoragev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
 
+	typedkcpstoragev1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var cSINodesResource = schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1", Resource: "csinodes"}
-var cSINodesKind = schema.GroupVersionKind{Group: "storage.k8s.io", Version: "v1", Kind: "CSINode"}
-
-type cSINodesClusterClient struct {
-	*kcptesting.Fake
+// cSINodeClusterClient implements CSINodeClusterInterface
+type cSINodeClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1.CSINode, *storagev1.CSINodeList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *cSINodesClusterClient) Cluster(clusterPath logicalcluster.Path) storagev1client.CSINodeInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &cSINodesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of CSINodes that match those selectors across all clusters.
-func (c *cSINodesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.CSINodeList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(cSINodesResource, cSINodesKind, logicalcluster.Wildcard, opts), &storagev1.CSINodeList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1.CSINodeList{ListMeta: obj.(*storagev1.CSINodeList).ListMeta}
-	for _, item := range obj.(*storagev1.CSINodeList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeCSINodeClusterClient(fake *StorageV1ClusterClient) typedkcpstoragev1.CSINodeClusterInterface {
+	return &cSINodeClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1.CSINode, *storagev1.CSINodeList](
+			fake.Fake,
+			storagev1.SchemeGroupVersion.WithResource("csinodes"),
+			storagev1.SchemeGroupVersion.WithKind("CSINode"),
+			func() *storagev1.CSINode { return &storagev1.CSINode{} },
+			func() *storagev1.CSINodeList { return &storagev1.CSINodeList{} },
+			func(dst, src *storagev1.CSINodeList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1.CSINodeList) []*storagev1.CSINode { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *storagev1.CSINodeList, items []*storagev1.CSINode) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested CSINodes across all clusters.
-func (c *cSINodesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(cSINodesResource, logicalcluster.Wildcard, opts))
+func (c *cSINodeClusterClient) Cluster(cluster logicalcluster.Path) typedstoragev1.CSINodeInterface {
+	return newFakeCSINodeClient(c.Fake, cluster)
 }
 
-type cSINodesClient struct {
-	*kcptesting.Fake
+// cSINodeScopedClient implements CSINodeInterface
+type cSINodeScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1.CSINode, *storagev1.CSINodeList, *v1.CSINodeApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *cSINodesClient) Create(ctx context.Context, cSINode *storagev1.CSINode, opts metav1.CreateOptions) (*storagev1.CSINode, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(cSINodesResource, c.ClusterPath, cSINode), &storagev1.CSINode{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSINode), err
-}
-
-func (c *cSINodesClient) Update(ctx context.Context, cSINode *storagev1.CSINode, opts metav1.UpdateOptions) (*storagev1.CSINode, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(cSINodesResource, c.ClusterPath, cSINode), &storagev1.CSINode{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSINode), err
-}
-
-func (c *cSINodesClient) UpdateStatus(ctx context.Context, cSINode *storagev1.CSINode, opts metav1.UpdateOptions) (*storagev1.CSINode, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(cSINodesResource, c.ClusterPath, "status", cSINode), &storagev1.CSINode{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSINode), err
-}
-
-func (c *cSINodesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(cSINodesResource, c.ClusterPath, name, opts), &storagev1.CSINode{})
-	return err
-}
-
-func (c *cSINodesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(cSINodesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &storagev1.CSINodeList{})
-	return err
-}
-
-func (c *cSINodesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*storagev1.CSINode, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(cSINodesResource, c.ClusterPath, name), &storagev1.CSINode{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSINode), err
-}
-
-// List takes label and field selectors, and returns the list of CSINodes that match those selectors.
-func (c *cSINodesClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.CSINodeList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(cSINodesResource, cSINodesKind, c.ClusterPath, opts), &storagev1.CSINodeList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1.CSINodeList{ListMeta: obj.(*storagev1.CSINodeList).ListMeta}
-	for _, item := range obj.(*storagev1.CSINodeList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *cSINodesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(cSINodesResource, c.ClusterPath, opts))
-}
-
-func (c *cSINodesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*storagev1.CSINode, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(cSINodesResource, c.ClusterPath, name, pt, data, subresources...), &storagev1.CSINode{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSINode), err
-}
-
-func (c *cSINodesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1.CSINodeApplyConfiguration, opts metav1.ApplyOptions) (*storagev1.CSINode, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(cSINodesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &storagev1.CSINode{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSINode), err
-}
-
-func (c *cSINodesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1.CSINodeApplyConfiguration, opts metav1.ApplyOptions) (*storagev1.CSINode, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(cSINodesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &storagev1.CSINode{})
-	if obj == nil {
-		return nil, err
+func newFakeCSINodeClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedstoragev1.CSINodeInterface {
+	return &cSINodeScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1.CSINode, *storagev1.CSINodeList, *v1.CSINodeApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			storagev1.SchemeGroupVersion.WithResource("csinodes"),
+			storagev1.SchemeGroupVersion.WithKind("CSINode"),
+			func() *storagev1.CSINode { return &storagev1.CSINode{} },
+			func() *storagev1.CSINodeList { return &storagev1.CSINodeList{} },
+			func(dst, src *storagev1.CSINodeList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1.CSINodeList) []*storagev1.CSINode { return kcpgentype.ToPointerSlice(list.Items) },
+			func(list *storagev1.CSINodeList, items []*storagev1.CSINode) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*storagev1.CSINode), err
 }
diff --git a/kubernetes/typed/storage/v1/fake/csistoragecapacity.go b/kubernetes/typed/storage/v1/fake/csistoragecapacity.go
index 17d6c8b74..9893ceae6 100644
--- a/kubernetes/typed/storage/v1/fake/csistoragecapacity.go
+++ b/kubernetes/typed/storage/v1/fake/csistoragecapacity.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsstoragev1 "k8s.io/client-go/applyconfigurations/storage/v1"
-	storagev1client "k8s.io/client-go/kubernetes/typed/storage/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/storage/v1"
+	typedstoragev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
 
-	kcpstoragev1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1"
+	typedkcpstoragev1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var cSIStorageCapacitiesResource = schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1", Resource: "csistoragecapacities"}
-var cSIStorageCapacitiesKind = schema.GroupVersionKind{Group: "storage.k8s.io", Version: "v1", Kind: "CSIStorageCapacity"}
-
-type cSIStorageCapacitiesClusterClient struct {
-	*kcptesting.Fake
+// cSIStorageCapacityClusterClient implements CSIStorageCapacityClusterInterface
+type cSIStorageCapacityClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1.CSIStorageCapacity, *storagev1.CSIStorageCapacityList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *cSIStorageCapacitiesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpstoragev1.CSIStorageCapacitiesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &cSIStorageCapacitiesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of CSIStorageCapacities that match those selectors across all clusters.
-func (c *cSIStorageCapacitiesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.CSIStorageCapacityList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(cSIStorageCapacitiesResource, cSIStorageCapacitiesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &storagev1.CSIStorageCapacityList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeCSIStorageCapacityClusterClient(fake *StorageV1ClusterClient) typedkcpstoragev1.CSIStorageCapacityClusterInterface {
+	return &cSIStorageCapacityClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1.CSIStorageCapacity, *storagev1.CSIStorageCapacityList](
+			fake.Fake,
+			storagev1.SchemeGroupVersion.WithResource("csistoragecapacities"),
+			storagev1.SchemeGroupVersion.WithKind("CSIStorageCapacity"),
+			func() *storagev1.CSIStorageCapacity { return &storagev1.CSIStorageCapacity{} },
+			func() *storagev1.CSIStorageCapacityList { return &storagev1.CSIStorageCapacityList{} },
+			func(dst, src *storagev1.CSIStorageCapacityList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1.CSIStorageCapacityList) []*storagev1.CSIStorageCapacity {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1.CSIStorageCapacityList, items []*storagev1.CSIStorageCapacity) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &storagev1.CSIStorageCapacityList{ListMeta: obj.(*storagev1.CSIStorageCapacityList).ListMeta}
-	for _, item := range obj.(*storagev1.CSIStorageCapacityList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested CSIStorageCapacities across all clusters.
-func (c *cSIStorageCapacitiesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(cSIStorageCapacitiesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *cSIStorageCapacityClusterClient) Cluster(cluster logicalcluster.Path) typedkcpstoragev1.CSIStorageCapacitiesNamespacer {
+	return &cSIStorageCapacityNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type cSIStorageCapacitiesNamespacer struct {
+type cSIStorageCapacityNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *cSIStorageCapacitiesNamespacer) Namespace(namespace string) storagev1client.CSIStorageCapacityInterface {
-	return &cSIStorageCapacitiesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *cSIStorageCapacityNamespacer) Namespace(namespace string) typedstoragev1.CSIStorageCapacityInterface {
+	return newFakeCSIStorageCapacityClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type cSIStorageCapacitiesClient struct {
-	*kcptesting.Fake
+// cSIStorageCapacityScopedClient implements CSIStorageCapacityInterface
+type cSIStorageCapacityScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1.CSIStorageCapacity, *storagev1.CSIStorageCapacityList, *v1.CSIStorageCapacityApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *cSIStorageCapacitiesClient) Create(ctx context.Context, cSIStorageCapacity *storagev1.CSIStorageCapacity, opts metav1.CreateOptions) (*storagev1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, cSIStorageCapacity), &storagev1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) Update(ctx context.Context, cSIStorageCapacity *storagev1.CSIStorageCapacity, opts metav1.UpdateOptions) (*storagev1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, cSIStorageCapacity), &storagev1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) UpdateStatus(ctx context.Context, cSIStorageCapacity *storagev1.CSIStorageCapacity, opts metav1.UpdateOptions) (*storagev1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(cSIStorageCapacitiesResource, c.ClusterPath, "status", c.Namespace, cSIStorageCapacity), &storagev1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, name, opts), &storagev1.CSIStorageCapacity{})
-	return err
 }
 
-func (c *cSIStorageCapacitiesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &storagev1.CSIStorageCapacityList{})
-	return err
-}
-
-func (c *cSIStorageCapacitiesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*storagev1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, name), &storagev1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSIStorageCapacity), err
-}
-
-// List takes label and field selectors, and returns the list of CSIStorageCapacities that match those selectors.
-func (c *cSIStorageCapacitiesClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.CSIStorageCapacityList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(cSIStorageCapacitiesResource, cSIStorageCapacitiesKind, c.ClusterPath, c.Namespace, opts), &storagev1.CSIStorageCapacityList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1.CSIStorageCapacityList{ListMeta: obj.(*storagev1.CSIStorageCapacityList).ListMeta}
-	for _, item := range obj.(*storagev1.CSIStorageCapacityList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *cSIStorageCapacitiesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *cSIStorageCapacitiesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*storagev1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &storagev1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1.CSIStorageCapacityApplyConfiguration, opts metav1.ApplyOptions) (*storagev1.CSIStorageCapacity, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &storagev1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1.CSIStorageCapacityApplyConfiguration, opts metav1.ApplyOptions) (*storagev1.CSIStorageCapacity, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &storagev1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
+func newFakeCSIStorageCapacityClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedstoragev1.CSIStorageCapacityInterface {
+	return &cSIStorageCapacityScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1.CSIStorageCapacity, *storagev1.CSIStorageCapacityList, *v1.CSIStorageCapacityApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			storagev1.SchemeGroupVersion.WithResource("csistoragecapacities"),
+			storagev1.SchemeGroupVersion.WithKind("CSIStorageCapacity"),
+			func() *storagev1.CSIStorageCapacity { return &storagev1.CSIStorageCapacity{} },
+			func() *storagev1.CSIStorageCapacityList { return &storagev1.CSIStorageCapacityList{} },
+			func(dst, src *storagev1.CSIStorageCapacityList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1.CSIStorageCapacityList) []*storagev1.CSIStorageCapacity {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1.CSIStorageCapacityList, items []*storagev1.CSIStorageCapacity) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*storagev1.CSIStorageCapacity), err
 }
diff --git a/kubernetes/typed/storage/v1/fake/doc.go b/kubernetes/typed/storage/v1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/storage/v1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/storage/v1/fake/storage_client.go b/kubernetes/typed/storage/v1/fake/storage_client.go
index 28f01ecda..a73e3cb02 100644
--- a/kubernetes/typed/storage/v1/fake/storage_client.go
+++ b/kubernetes/typed/storage/v1/fake/storage_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpstoragev1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpstoragev1.StorageV1ClusterInterface = (*StorageV1ClusterClient)(nil)
@@ -44,54 +40,54 @@ func (c *StorageV1ClusterClient) Cluster(clusterPath logicalcluster.Path) storag
 	return &StorageV1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *StorageV1ClusterClient) StorageClasses() kcpstoragev1.StorageClassClusterInterface {
-	return &storageClassesClusterClient{Fake: c.Fake}
-}
-
-func (c *StorageV1ClusterClient) VolumeAttachments() kcpstoragev1.VolumeAttachmentClusterInterface {
-	return &volumeAttachmentsClusterClient{Fake: c.Fake}
-}
-
 func (c *StorageV1ClusterClient) CSIDrivers() kcpstoragev1.CSIDriverClusterInterface {
-	return &cSIDriversClusterClient{Fake: c.Fake}
+	return newFakeCSIDriverClusterClient(c)
 }
 
 func (c *StorageV1ClusterClient) CSINodes() kcpstoragev1.CSINodeClusterInterface {
-	return &cSINodesClusterClient{Fake: c.Fake}
+	return newFakeCSINodeClusterClient(c)
 }
 
 func (c *StorageV1ClusterClient) CSIStorageCapacities() kcpstoragev1.CSIStorageCapacityClusterInterface {
-	return &cSIStorageCapacitiesClusterClient{Fake: c.Fake}
+	return newFakeCSIStorageCapacityClusterClient(c)
+}
+
+func (c *StorageV1ClusterClient) StorageClasses() kcpstoragev1.StorageClassClusterInterface {
+	return newFakeStorageClassClusterClient(c)
 }
 
-var _ storagev1.StorageV1Interface = (*StorageV1Client)(nil)
+func (c *StorageV1ClusterClient) VolumeAttachments() kcpstoragev1.VolumeAttachmentClusterInterface {
+	return newFakeVolumeAttachmentClusterClient(c)
+}
 
 type StorageV1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *StorageV1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *StorageV1Client) CSIDrivers() storagev1.CSIDriverInterface {
+	return newFakeCSIDriverClient(c.Fake, c.ClusterPath)
 }
 
-func (c *StorageV1Client) StorageClasses() storagev1.StorageClassInterface {
-	return &storageClassesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *StorageV1Client) CSINodes() storagev1.CSINodeInterface {
+	return newFakeCSINodeClient(c.Fake, c.ClusterPath)
 }
 
-func (c *StorageV1Client) VolumeAttachments() storagev1.VolumeAttachmentInterface {
-	return &volumeAttachmentsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *StorageV1Client) CSIStorageCapacities(namespace string) storagev1.CSIStorageCapacityInterface {
+	return newFakeCSIStorageCapacityClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *StorageV1Client) CSIDrivers() storagev1.CSIDriverInterface {
-	return &cSIDriversClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *StorageV1Client) StorageClasses() storagev1.StorageClassInterface {
+	return newFakeStorageClassClient(c.Fake, c.ClusterPath)
 }
 
-func (c *StorageV1Client) CSINodes() storagev1.CSINodeInterface {
-	return &cSINodesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *StorageV1Client) VolumeAttachments() storagev1.VolumeAttachmentInterface {
+	return newFakeVolumeAttachmentClient(c.Fake, c.ClusterPath)
 }
 
-func (c *StorageV1Client) CSIStorageCapacities(namespace string) storagev1.CSIStorageCapacityInterface {
-	return &cSIStorageCapacitiesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *StorageV1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/storage/v1/fake/storageclass.go b/kubernetes/typed/storage/v1/fake/storageclass.go
index 8ea8f861d..6267597f7 100644
--- a/kubernetes/typed/storage/v1/fake/storageclass.go
+++ b/kubernetes/typed/storage/v1/fake/storageclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsstoragev1 "k8s.io/client-go/applyconfigurations/storage/v1"
-	storagev1client "k8s.io/client-go/kubernetes/typed/storage/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/storage/v1"
+	typedstoragev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
 
+	typedkcpstoragev1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var storageClassesResource = schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1", Resource: "storageclasses"}
-var storageClassesKind = schema.GroupVersionKind{Group: "storage.k8s.io", Version: "v1", Kind: "StorageClass"}
-
-type storageClassesClusterClient struct {
-	*kcptesting.Fake
+// storageClassClusterClient implements StorageClassClusterInterface
+type storageClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1.StorageClass, *storagev1.StorageClassList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *storageClassesClusterClient) Cluster(clusterPath logicalcluster.Path) storagev1client.StorageClassInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &storageClassesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of StorageClasses that match those selectors across all clusters.
-func (c *storageClassesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.StorageClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(storageClassesResource, storageClassesKind, logicalcluster.Wildcard, opts), &storagev1.StorageClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1.StorageClassList{ListMeta: obj.(*storagev1.StorageClassList).ListMeta}
-	for _, item := range obj.(*storagev1.StorageClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeStorageClassClusterClient(fake *StorageV1ClusterClient) typedkcpstoragev1.StorageClassClusterInterface {
+	return &storageClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1.StorageClass, *storagev1.StorageClassList](
+			fake.Fake,
+			storagev1.SchemeGroupVersion.WithResource("storageclasses"),
+			storagev1.SchemeGroupVersion.WithKind("StorageClass"),
+			func() *storagev1.StorageClass { return &storagev1.StorageClass{} },
+			func() *storagev1.StorageClassList { return &storagev1.StorageClassList{} },
+			func(dst, src *storagev1.StorageClassList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1.StorageClassList) []*storagev1.StorageClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1.StorageClassList, items []*storagev1.StorageClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested StorageClasses across all clusters.
-func (c *storageClassesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(storageClassesResource, logicalcluster.Wildcard, opts))
+func (c *storageClassClusterClient) Cluster(cluster logicalcluster.Path) typedstoragev1.StorageClassInterface {
+	return newFakeStorageClassClient(c.Fake, cluster)
 }
 
-type storageClassesClient struct {
-	*kcptesting.Fake
+// storageClassScopedClient implements StorageClassInterface
+type storageClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1.StorageClass, *storagev1.StorageClassList, *v1.StorageClassApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *storageClassesClient) Create(ctx context.Context, storageClass *storagev1.StorageClass, opts metav1.CreateOptions) (*storagev1.StorageClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(storageClassesResource, c.ClusterPath, storageClass), &storagev1.StorageClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.StorageClass), err
-}
-
-func (c *storageClassesClient) Update(ctx context.Context, storageClass *storagev1.StorageClass, opts metav1.UpdateOptions) (*storagev1.StorageClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(storageClassesResource, c.ClusterPath, storageClass), &storagev1.StorageClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.StorageClass), err
-}
-
-func (c *storageClassesClient) UpdateStatus(ctx context.Context, storageClass *storagev1.StorageClass, opts metav1.UpdateOptions) (*storagev1.StorageClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(storageClassesResource, c.ClusterPath, "status", storageClass), &storagev1.StorageClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.StorageClass), err
-}
-
-func (c *storageClassesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(storageClassesResource, c.ClusterPath, name, opts), &storagev1.StorageClass{})
-	return err
-}
-
-func (c *storageClassesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(storageClassesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &storagev1.StorageClassList{})
-	return err
-}
-
-func (c *storageClassesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*storagev1.StorageClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(storageClassesResource, c.ClusterPath, name), &storagev1.StorageClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.StorageClass), err
-}
-
-// List takes label and field selectors, and returns the list of StorageClasses that match those selectors.
-func (c *storageClassesClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.StorageClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(storageClassesResource, storageClassesKind, c.ClusterPath, opts), &storagev1.StorageClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1.StorageClassList{ListMeta: obj.(*storagev1.StorageClassList).ListMeta}
-	for _, item := range obj.(*storagev1.StorageClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *storageClassesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(storageClassesResource, c.ClusterPath, opts))
-}
-
-func (c *storageClassesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*storagev1.StorageClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(storageClassesResource, c.ClusterPath, name, pt, data, subresources...), &storagev1.StorageClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.StorageClass), err
-}
-
-func (c *storageClassesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1.StorageClassApplyConfiguration, opts metav1.ApplyOptions) (*storagev1.StorageClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(storageClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &storagev1.StorageClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.StorageClass), err
-}
-
-func (c *storageClassesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1.StorageClassApplyConfiguration, opts metav1.ApplyOptions) (*storagev1.StorageClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(storageClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &storagev1.StorageClass{})
-	if obj == nil {
-		return nil, err
+func newFakeStorageClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedstoragev1.StorageClassInterface {
+	return &storageClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1.StorageClass, *storagev1.StorageClassList, *v1.StorageClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			storagev1.SchemeGroupVersion.WithResource("storageclasses"),
+			storagev1.SchemeGroupVersion.WithKind("StorageClass"),
+			func() *storagev1.StorageClass { return &storagev1.StorageClass{} },
+			func() *storagev1.StorageClassList { return &storagev1.StorageClassList{} },
+			func(dst, src *storagev1.StorageClassList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1.StorageClassList) []*storagev1.StorageClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1.StorageClassList, items []*storagev1.StorageClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*storagev1.StorageClass), err
 }
diff --git a/kubernetes/typed/storage/v1/fake/volumeattachment.go b/kubernetes/typed/storage/v1/fake/volumeattachment.go
index e5cfbd7da..d0b717e34 100644
--- a/kubernetes/typed/storage/v1/fake/volumeattachment.go
+++ b/kubernetes/typed/storage/v1/fake/volumeattachment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsstoragev1 "k8s.io/client-go/applyconfigurations/storage/v1"
-	storagev1client "k8s.io/client-go/kubernetes/typed/storage/v1"
-	"k8s.io/client-go/testing"
+	v1 "k8s.io/client-go/applyconfigurations/storage/v1"
+	typedstoragev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
 
+	typedkcpstoragev1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var volumeAttachmentsResource = schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1", Resource: "volumeattachments"}
-var volumeAttachmentsKind = schema.GroupVersionKind{Group: "storage.k8s.io", Version: "v1", Kind: "VolumeAttachment"}
-
-type volumeAttachmentsClusterClient struct {
-	*kcptesting.Fake
+// volumeAttachmentClusterClient implements VolumeAttachmentClusterInterface
+type volumeAttachmentClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1.VolumeAttachment, *storagev1.VolumeAttachmentList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *volumeAttachmentsClusterClient) Cluster(clusterPath logicalcluster.Path) storagev1client.VolumeAttachmentInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &volumeAttachmentsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of VolumeAttachments that match those selectors across all clusters.
-func (c *volumeAttachmentsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.VolumeAttachmentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(volumeAttachmentsResource, volumeAttachmentsKind, logicalcluster.Wildcard, opts), &storagev1.VolumeAttachmentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1.VolumeAttachmentList{ListMeta: obj.(*storagev1.VolumeAttachmentList).ListMeta}
-	for _, item := range obj.(*storagev1.VolumeAttachmentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeVolumeAttachmentClusterClient(fake *StorageV1ClusterClient) typedkcpstoragev1.VolumeAttachmentClusterInterface {
+	return &volumeAttachmentClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1.VolumeAttachment, *storagev1.VolumeAttachmentList](
+			fake.Fake,
+			storagev1.SchemeGroupVersion.WithResource("volumeattachments"),
+			storagev1.SchemeGroupVersion.WithKind("VolumeAttachment"),
+			func() *storagev1.VolumeAttachment { return &storagev1.VolumeAttachment{} },
+			func() *storagev1.VolumeAttachmentList { return &storagev1.VolumeAttachmentList{} },
+			func(dst, src *storagev1.VolumeAttachmentList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1.VolumeAttachmentList) []*storagev1.VolumeAttachment {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1.VolumeAttachmentList, items []*storagev1.VolumeAttachment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested VolumeAttachments across all clusters.
-func (c *volumeAttachmentsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(volumeAttachmentsResource, logicalcluster.Wildcard, opts))
+func (c *volumeAttachmentClusterClient) Cluster(cluster logicalcluster.Path) typedstoragev1.VolumeAttachmentInterface {
+	return newFakeVolumeAttachmentClient(c.Fake, cluster)
 }
 
-type volumeAttachmentsClient struct {
-	*kcptesting.Fake
+// volumeAttachmentScopedClient implements VolumeAttachmentInterface
+type volumeAttachmentScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1.VolumeAttachment, *storagev1.VolumeAttachmentList, *v1.VolumeAttachmentApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *volumeAttachmentsClient) Create(ctx context.Context, volumeAttachment *storagev1.VolumeAttachment, opts metav1.CreateOptions) (*storagev1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(volumeAttachmentsResource, c.ClusterPath, volumeAttachment), &storagev1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) Update(ctx context.Context, volumeAttachment *storagev1.VolumeAttachment, opts metav1.UpdateOptions) (*storagev1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(volumeAttachmentsResource, c.ClusterPath, volumeAttachment), &storagev1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) UpdateStatus(ctx context.Context, volumeAttachment *storagev1.VolumeAttachment, opts metav1.UpdateOptions) (*storagev1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(volumeAttachmentsResource, c.ClusterPath, "status", volumeAttachment), &storagev1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(volumeAttachmentsResource, c.ClusterPath, name, opts), &storagev1.VolumeAttachment{})
-	return err
-}
-
-func (c *volumeAttachmentsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(volumeAttachmentsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &storagev1.VolumeAttachmentList{})
-	return err
-}
-
-func (c *volumeAttachmentsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*storagev1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(volumeAttachmentsResource, c.ClusterPath, name), &storagev1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.VolumeAttachment), err
-}
-
-// List takes label and field selectors, and returns the list of VolumeAttachments that match those selectors.
-func (c *volumeAttachmentsClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.VolumeAttachmentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(volumeAttachmentsResource, volumeAttachmentsKind, c.ClusterPath, opts), &storagev1.VolumeAttachmentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1.VolumeAttachmentList{ListMeta: obj.(*storagev1.VolumeAttachmentList).ListMeta}
-	for _, item := range obj.(*storagev1.VolumeAttachmentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *volumeAttachmentsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(volumeAttachmentsResource, c.ClusterPath, opts))
-}
-
-func (c *volumeAttachmentsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*storagev1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(volumeAttachmentsResource, c.ClusterPath, name, pt, data, subresources...), &storagev1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1.VolumeAttachmentApplyConfiguration, opts metav1.ApplyOptions) (*storagev1.VolumeAttachment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(volumeAttachmentsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &storagev1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1.VolumeAttachmentApplyConfiguration, opts metav1.ApplyOptions) (*storagev1.VolumeAttachment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(volumeAttachmentsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &storagev1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
+func newFakeVolumeAttachmentClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedstoragev1.VolumeAttachmentInterface {
+	return &volumeAttachmentScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1.VolumeAttachment, *storagev1.VolumeAttachmentList, *v1.VolumeAttachmentApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			storagev1.SchemeGroupVersion.WithResource("volumeattachments"),
+			storagev1.SchemeGroupVersion.WithKind("VolumeAttachment"),
+			func() *storagev1.VolumeAttachment { return &storagev1.VolumeAttachment{} },
+			func() *storagev1.VolumeAttachmentList { return &storagev1.VolumeAttachmentList{} },
+			func(dst, src *storagev1.VolumeAttachmentList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1.VolumeAttachmentList) []*storagev1.VolumeAttachment {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1.VolumeAttachmentList, items []*storagev1.VolumeAttachment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*storagev1.VolumeAttachment), err
 }
diff --git a/kubernetes/typed/storage/v1/generated_expansion.go b/kubernetes/typed/storage/v1/generated_expansion.go
new file mode 100644
index 000000000..f1e6323da
--- /dev/null
+++ b/kubernetes/typed/storage/v1/generated_expansion.go
@@ -0,0 +1,29 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1
+
+type CSIDriverClusterExpansion interface{}
+
+type CSINodeClusterExpansion interface{}
+
+type CSIStorageCapacityClusterExpansion interface{}
+
+type StorageClassClusterExpansion interface{}
+
+type VolumeAttachmentClusterExpansion interface{}
diff --git a/kubernetes/typed/storage/v1/storage_client.go b/kubernetes/typed/storage/v1/storage_client.go
index 66721476b..26d07a0e0 100644
--- a/kubernetes/typed/storage/v1/storage_client.go
+++ b/kubernetes/typed/storage/v1/storage_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,33 +14,36 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apistoragev1 "k8s.io/api/storage/v1"
+	storagev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
-	"k8s.io/client-go/rest"
 )
 
 type StorageV1ClusterInterface interface {
 	StorageV1ClusterScoper
-	StorageClassesClusterGetter
-	VolumeAttachmentsClusterGetter
 	CSIDriversClusterGetter
 	CSINodesClusterGetter
 	CSIStorageCapacitiesClusterGetter
+	StorageClassesClusterGetter
+	VolumeAttachmentsClusterGetter
 }
 
 type StorageV1ClusterScoper interface {
 	Cluster(logicalcluster.Path) storagev1.StorageV1Interface
 }
 
+// StorageV1ClusterClient is used to interact with features provided by the storage.k8s.io group.
 type StorageV1ClusterClient struct {
 	clientCache kcpclient.Cache[*storagev1.StorageV1Client]
 }
@@ -55,14 +55,6 @@ func (c *StorageV1ClusterClient) Cluster(clusterPath logicalcluster.Path) storag
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *StorageV1ClusterClient) StorageClasses() StorageClassClusterInterface {
-	return &storageClassesClusterInterface{clientCache: c.clientCache}
-}
-
-func (c *StorageV1ClusterClient) VolumeAttachments() VolumeAttachmentClusterInterface {
-	return &volumeAttachmentsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *StorageV1ClusterClient) CSIDrivers() CSIDriverClusterInterface {
 	return &cSIDriversClusterInterface{clientCache: c.clientCache}
 }
@@ -75,15 +67,25 @@ func (c *StorageV1ClusterClient) CSIStorageCapacities() CSIStorageCapacityCluste
 	return &cSIStorageCapacitiesClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *StorageV1ClusterClient) StorageClasses() StorageClassClusterInterface {
+	return &storageClassesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *StorageV1ClusterClient) VolumeAttachments() VolumeAttachmentClusterInterface {
+	return &volumeAttachmentsClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new StorageV1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*StorageV1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new StorageV1ClusterClient for the given config and http client.
@@ -95,6 +97,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*StorageV1ClusterCli
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &StorageV1ClusterClient{clientCache: cache}, nil
 }
 
@@ -107,3 +110,14 @@ func NewForConfigOrDie(c *rest.Config) *StorageV1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apistoragev1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/storage/v1/storageclass.go b/kubernetes/typed/storage/v1/storageclass.go
index 23f5eb963..4b325d899 100644
--- a/kubernetes/typed/storage/v1/storageclass.go
+++ b/kubernetes/typed/storage/v1/storageclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apistoragev1 "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	storagev1client "k8s.io/client-go/kubernetes/typed/storage/v1"
 )
 
 // StorageClassesClusterGetter has a method to return a StorageClassClusterInterface.
@@ -40,19 +37,20 @@ type StorageClassesClusterGetter interface {
 }
 
 // StorageClassClusterInterface can operate on StorageClasses across all clusters,
-// or scope down to one cluster and return a storagev1client.StorageClassInterface.
+// or scope down to one cluster and return a storagev1.StorageClassInterface.
 type StorageClassClusterInterface interface {
-	Cluster(logicalcluster.Path) storagev1client.StorageClassInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*storagev1.StorageClassList, error)
+	Cluster(logicalcluster.Path) storagev1.StorageClassInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apistoragev1.StorageClassList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	StorageClassClusterExpansion
 }
 
 type storageClassesClusterInterface struct {
-	clientCache kcpclient.Cache[*storagev1client.StorageV1Client]
+	clientCache kcpclient.Cache[*storagev1.StorageV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *storageClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1client.StorageClassInterface {
+func (c *storageClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1.StorageClassInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *storageClassesClusterInterface) Cluster(clusterPath logicalcluster.Path
 }
 
 // List returns the entire collection of all StorageClasses across all clusters.
-func (c *storageClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.StorageClassList, error) {
+func (c *storageClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apistoragev1.StorageClassList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StorageClasses().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/storage/v1/volumeattachment.go b/kubernetes/typed/storage/v1/volumeattachment.go
index 744c93cce..bd079a0e4 100644
--- a/kubernetes/typed/storage/v1/volumeattachment.go
+++ b/kubernetes/typed/storage/v1/volumeattachment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	"context"
+	context "context"
+
+	apistoragev1 "k8s.io/api/storage/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1 "k8s.io/client-go/kubernetes/typed/storage/v1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1 "k8s.io/api/storage/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	storagev1client "k8s.io/client-go/kubernetes/typed/storage/v1"
 )
 
 // VolumeAttachmentsClusterGetter has a method to return a VolumeAttachmentClusterInterface.
@@ -40,19 +37,20 @@ type VolumeAttachmentsClusterGetter interface {
 }
 
 // VolumeAttachmentClusterInterface can operate on VolumeAttachments across all clusters,
-// or scope down to one cluster and return a storagev1client.VolumeAttachmentInterface.
+// or scope down to one cluster and return a storagev1.VolumeAttachmentInterface.
 type VolumeAttachmentClusterInterface interface {
-	Cluster(logicalcluster.Path) storagev1client.VolumeAttachmentInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*storagev1.VolumeAttachmentList, error)
+	Cluster(logicalcluster.Path) storagev1.VolumeAttachmentInterface
+	List(ctx context.Context, opts metav1.ListOptions) (*apistoragev1.VolumeAttachmentList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	VolumeAttachmentClusterExpansion
 }
 
 type volumeAttachmentsClusterInterface struct {
-	clientCache kcpclient.Cache[*storagev1client.StorageV1Client]
+	clientCache kcpclient.Cache[*storagev1.StorageV1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *volumeAttachmentsClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1client.VolumeAttachmentInterface {
+func (c *volumeAttachmentsClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1.VolumeAttachmentInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,7 +59,7 @@ func (c *volumeAttachmentsClusterInterface) Cluster(clusterPath logicalcluster.P
 }
 
 // List returns the entire collection of all VolumeAttachments across all clusters.
-func (c *volumeAttachmentsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*storagev1.VolumeAttachmentList, error) {
+func (c *volumeAttachmentsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*apistoragev1.VolumeAttachmentList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).VolumeAttachments().List(ctx, opts)
 }
 
diff --git a/kubernetes/typed/storage/v1alpha1/csistoragecapacity.go b/kubernetes/typed/storage/v1alpha1/csistoragecapacity.go
index fb85589ff..1539f0b7e 100644
--- a/kubernetes/typed/storage/v1alpha1/csistoragecapacity.go
+++ b/kubernetes/typed/storage/v1alpha1/csistoragecapacity.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
+	context "context"
+
+	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedstoragev1alpha1 "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	storagev1alpha1client "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
 )
 
 // CSIStorageCapacitiesClusterGetter has a method to return a CSIStorageCapacityClusterInterface.
@@ -43,12 +40,13 @@ type CSIStorageCapacitiesClusterGetter interface {
 // or scope down to one cluster and return a CSIStorageCapacitiesNamespacer.
 type CSIStorageCapacityClusterInterface interface {
 	Cluster(logicalcluster.Path) CSIStorageCapacitiesNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*storagev1alpha1.CSIStorageCapacityList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*storagev1alpha1.CSIStorageCapacityList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	CSIStorageCapacityClusterExpansion
 }
 
 type cSIStorageCapacitiesClusterInterface struct {
-	clientCache kcpclient.Cache[*storagev1alpha1client.StorageV1alpha1Client]
+	clientCache kcpclient.Cache[*typedstoragev1alpha1.StorageV1alpha1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *cSIStorageCapacitiesClusterInterface) Cluster(clusterPath logicalcluste
 }
 
 // List returns the entire collection of all CSIStorageCapacities across all clusters.
-func (c *cSIStorageCapacitiesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*storagev1alpha1.CSIStorageCapacityList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSIStorageCapacities(metav1.NamespaceAll).List(ctx, opts)
+func (c *cSIStorageCapacitiesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*storagev1alpha1.CSIStorageCapacityList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSIStorageCapacities(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all CSIStorageCapacities across all clusters.
-func (c *cSIStorageCapacitiesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSIStorageCapacities(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *cSIStorageCapacitiesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSIStorageCapacities(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// CSIStorageCapacitiesNamespacer can scope to objects within a namespace, returning a storagev1alpha1client.CSIStorageCapacityInterface.
+// CSIStorageCapacitiesNamespacer can scope to objects within a namespace, returning a typedstoragev1alpha1.CSIStorageCapacityInterface.
 type CSIStorageCapacitiesNamespacer interface {
-	Namespace(string) storagev1alpha1client.CSIStorageCapacityInterface
+	Namespace(string) typedstoragev1alpha1.CSIStorageCapacityInterface
 }
 
 type cSIStorageCapacitiesNamespacer struct {
-	clientCache kcpclient.Cache[*storagev1alpha1client.StorageV1alpha1Client]
+	clientCache kcpclient.Cache[*typedstoragev1alpha1.StorageV1alpha1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *cSIStorageCapacitiesNamespacer) Namespace(namespace string) storagev1alpha1client.CSIStorageCapacityInterface {
+func (n *cSIStorageCapacitiesNamespacer) Namespace(namespace string) typedstoragev1alpha1.CSIStorageCapacityInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).CSIStorageCapacities(namespace)
 }
diff --git a/kubernetes/typed/storage/v1alpha1/doc.go b/kubernetes/typed/storage/v1alpha1/doc.go
new file mode 100644
index 000000000..08b80237c
--- /dev/null
+++ b/kubernetes/typed/storage/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/kubernetes/typed/storage/v1alpha1/fake/csistoragecapacity.go b/kubernetes/typed/storage/v1alpha1/fake/csistoragecapacity.go
index 44e620926..a5aa8e0c5 100644
--- a/kubernetes/typed/storage/v1alpha1/fake/csistoragecapacity.go
+++ b/kubernetes/typed/storage/v1alpha1/fake/csistoragecapacity.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsstoragev1alpha1 "k8s.io/client-go/applyconfigurations/storage/v1alpha1"
-	storagev1alpha1client "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
-	"k8s.io/client-go/testing"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/storage/v1alpha1"
+	typedstoragev1alpha1 "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
 
-	kcpstoragev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1alpha1"
+	typedkcpstoragev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var cSIStorageCapacitiesResource = schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1alpha1", Resource: "csistoragecapacities"}
-var cSIStorageCapacitiesKind = schema.GroupVersionKind{Group: "storage.k8s.io", Version: "v1alpha1", Kind: "CSIStorageCapacity"}
-
-type cSIStorageCapacitiesClusterClient struct {
-	*kcptesting.Fake
+// cSIStorageCapacityClusterClient implements CSIStorageCapacityClusterInterface
+type cSIStorageCapacityClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1alpha1.CSIStorageCapacity, *storagev1alpha1.CSIStorageCapacityList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *cSIStorageCapacitiesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpstoragev1alpha1.CSIStorageCapacitiesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &cSIStorageCapacitiesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of CSIStorageCapacities that match those selectors across all clusters.
-func (c *cSIStorageCapacitiesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1alpha1.CSIStorageCapacityList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(cSIStorageCapacitiesResource, cSIStorageCapacitiesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &storagev1alpha1.CSIStorageCapacityList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeCSIStorageCapacityClusterClient(fake *StorageV1alpha1ClusterClient) typedkcpstoragev1alpha1.CSIStorageCapacityClusterInterface {
+	return &cSIStorageCapacityClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1alpha1.CSIStorageCapacity, *storagev1alpha1.CSIStorageCapacityList](
+			fake.Fake,
+			storagev1alpha1.SchemeGroupVersion.WithResource("csistoragecapacities"),
+			storagev1alpha1.SchemeGroupVersion.WithKind("CSIStorageCapacity"),
+			func() *storagev1alpha1.CSIStorageCapacity { return &storagev1alpha1.CSIStorageCapacity{} },
+			func() *storagev1alpha1.CSIStorageCapacityList { return &storagev1alpha1.CSIStorageCapacityList{} },
+			func(dst, src *storagev1alpha1.CSIStorageCapacityList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1alpha1.CSIStorageCapacityList) []*storagev1alpha1.CSIStorageCapacity {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1alpha1.CSIStorageCapacityList, items []*storagev1alpha1.CSIStorageCapacity) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &storagev1alpha1.CSIStorageCapacityList{ListMeta: obj.(*storagev1alpha1.CSIStorageCapacityList).ListMeta}
-	for _, item := range obj.(*storagev1alpha1.CSIStorageCapacityList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested CSIStorageCapacities across all clusters.
-func (c *cSIStorageCapacitiesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(cSIStorageCapacitiesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *cSIStorageCapacityClusterClient) Cluster(cluster logicalcluster.Path) typedkcpstoragev1alpha1.CSIStorageCapacitiesNamespacer {
+	return &cSIStorageCapacityNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type cSIStorageCapacitiesNamespacer struct {
+type cSIStorageCapacityNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *cSIStorageCapacitiesNamespacer) Namespace(namespace string) storagev1alpha1client.CSIStorageCapacityInterface {
-	return &cSIStorageCapacitiesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *cSIStorageCapacityNamespacer) Namespace(namespace string) typedstoragev1alpha1.CSIStorageCapacityInterface {
+	return newFakeCSIStorageCapacityClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type cSIStorageCapacitiesClient struct {
-	*kcptesting.Fake
+// cSIStorageCapacityScopedClient implements CSIStorageCapacityInterface
+type cSIStorageCapacityScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1alpha1.CSIStorageCapacity, *storagev1alpha1.CSIStorageCapacityList, *v1alpha1.CSIStorageCapacityApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *cSIStorageCapacitiesClient) Create(ctx context.Context, cSIStorageCapacity *storagev1alpha1.CSIStorageCapacity, opts metav1.CreateOptions) (*storagev1alpha1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, cSIStorageCapacity), &storagev1alpha1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1alpha1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) Update(ctx context.Context, cSIStorageCapacity *storagev1alpha1.CSIStorageCapacity, opts metav1.UpdateOptions) (*storagev1alpha1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, cSIStorageCapacity), &storagev1alpha1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1alpha1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) UpdateStatus(ctx context.Context, cSIStorageCapacity *storagev1alpha1.CSIStorageCapacity, opts metav1.UpdateOptions) (*storagev1alpha1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(cSIStorageCapacitiesResource, c.ClusterPath, "status", c.Namespace, cSIStorageCapacity), &storagev1alpha1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1alpha1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, name, opts), &storagev1alpha1.CSIStorageCapacity{})
-	return err
 }
 
-func (c *cSIStorageCapacitiesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &storagev1alpha1.CSIStorageCapacityList{})
-	return err
-}
-
-func (c *cSIStorageCapacitiesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*storagev1alpha1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, name), &storagev1alpha1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1alpha1.CSIStorageCapacity), err
-}
-
-// List takes label and field selectors, and returns the list of CSIStorageCapacities that match those selectors.
-func (c *cSIStorageCapacitiesClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1alpha1.CSIStorageCapacityList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(cSIStorageCapacitiesResource, cSIStorageCapacitiesKind, c.ClusterPath, c.Namespace, opts), &storagev1alpha1.CSIStorageCapacityList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1alpha1.CSIStorageCapacityList{ListMeta: obj.(*storagev1alpha1.CSIStorageCapacityList).ListMeta}
-	for _, item := range obj.(*storagev1alpha1.CSIStorageCapacityList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *cSIStorageCapacitiesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *cSIStorageCapacitiesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*storagev1alpha1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &storagev1alpha1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1alpha1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1alpha1.CSIStorageCapacityApplyConfiguration, opts metav1.ApplyOptions) (*storagev1alpha1.CSIStorageCapacity, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &storagev1alpha1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1alpha1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1alpha1.CSIStorageCapacityApplyConfiguration, opts metav1.ApplyOptions) (*storagev1alpha1.CSIStorageCapacity, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &storagev1alpha1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
+func newFakeCSIStorageCapacityClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedstoragev1alpha1.CSIStorageCapacityInterface {
+	return &cSIStorageCapacityScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1alpha1.CSIStorageCapacity, *storagev1alpha1.CSIStorageCapacityList, *v1alpha1.CSIStorageCapacityApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			storagev1alpha1.SchemeGroupVersion.WithResource("csistoragecapacities"),
+			storagev1alpha1.SchemeGroupVersion.WithKind("CSIStorageCapacity"),
+			func() *storagev1alpha1.CSIStorageCapacity { return &storagev1alpha1.CSIStorageCapacity{} },
+			func() *storagev1alpha1.CSIStorageCapacityList { return &storagev1alpha1.CSIStorageCapacityList{} },
+			func(dst, src *storagev1alpha1.CSIStorageCapacityList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1alpha1.CSIStorageCapacityList) []*storagev1alpha1.CSIStorageCapacity {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1alpha1.CSIStorageCapacityList, items []*storagev1alpha1.CSIStorageCapacity) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*storagev1alpha1.CSIStorageCapacity), err
 }
diff --git a/kubernetes/typed/storage/v1alpha1/fake/doc.go b/kubernetes/typed/storage/v1alpha1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/storage/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/storage/v1alpha1/fake/storage_client.go b/kubernetes/typed/storage/v1alpha1/fake/storage_client.go
index ac57d3056..61e6cd7d2 100644
--- a/kubernetes/typed/storage/v1alpha1/fake/storage_client.go
+++ b/kubernetes/typed/storage/v1alpha1/fake/storage_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1alpha1 "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpstoragev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1alpha1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpstoragev1alpha1.StorageV1alpha1ClusterInterface = (*StorageV1alpha1ClusterClient)(nil)
@@ -44,30 +40,38 @@ func (c *StorageV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path)
 	return &StorageV1alpha1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *StorageV1alpha1ClusterClient) VolumeAttachments() kcpstoragev1alpha1.VolumeAttachmentClusterInterface {
-	return &volumeAttachmentsClusterClient{Fake: c.Fake}
+func (c *StorageV1alpha1ClusterClient) CSIStorageCapacities() kcpstoragev1alpha1.CSIStorageCapacityClusterInterface {
+	return newFakeCSIStorageCapacityClusterClient(c)
 }
 
-func (c *StorageV1alpha1ClusterClient) CSIStorageCapacities() kcpstoragev1alpha1.CSIStorageCapacityClusterInterface {
-	return &cSIStorageCapacitiesClusterClient{Fake: c.Fake}
+func (c *StorageV1alpha1ClusterClient) VolumeAttachments() kcpstoragev1alpha1.VolumeAttachmentClusterInterface {
+	return newFakeVolumeAttachmentClusterClient(c)
 }
 
-var _ storagev1alpha1.StorageV1alpha1Interface = (*StorageV1alpha1Client)(nil)
+func (c *StorageV1alpha1ClusterClient) VolumeAttributesClasses() kcpstoragev1alpha1.VolumeAttributesClassClusterInterface {
+	return newFakeVolumeAttributesClassClusterClient(c)
+}
 
 type StorageV1alpha1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *StorageV1alpha1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *StorageV1alpha1Client) CSIStorageCapacities(namespace string) storagev1alpha1.CSIStorageCapacityInterface {
+	return newFakeCSIStorageCapacityClient(c.Fake, namespace, c.ClusterPath)
 }
 
 func (c *StorageV1alpha1Client) VolumeAttachments() storagev1alpha1.VolumeAttachmentInterface {
-	return &volumeAttachmentsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+	return newFakeVolumeAttachmentClient(c.Fake, c.ClusterPath)
 }
 
-func (c *StorageV1alpha1Client) CSIStorageCapacities(namespace string) storagev1alpha1.CSIStorageCapacityInterface {
-	return &cSIStorageCapacitiesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *StorageV1alpha1Client) VolumeAttributesClasses() storagev1alpha1.VolumeAttributesClassInterface {
+	return newFakeVolumeAttributesClassClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *StorageV1alpha1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/storage/v1alpha1/fake/volumeattachment.go b/kubernetes/typed/storage/v1alpha1/fake/volumeattachment.go
index 111a5122d..64b963aca 100644
--- a/kubernetes/typed/storage/v1alpha1/fake/volumeattachment.go
+++ b/kubernetes/typed/storage/v1alpha1/fake/volumeattachment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsstoragev1alpha1 "k8s.io/client-go/applyconfigurations/storage/v1alpha1"
-	storagev1alpha1client "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
-	"k8s.io/client-go/testing"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/storage/v1alpha1"
+	typedstoragev1alpha1 "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
 
+	typedkcpstoragev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var volumeAttachmentsResource = schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1alpha1", Resource: "volumeattachments"}
-var volumeAttachmentsKind = schema.GroupVersionKind{Group: "storage.k8s.io", Version: "v1alpha1", Kind: "VolumeAttachment"}
-
-type volumeAttachmentsClusterClient struct {
-	*kcptesting.Fake
+// volumeAttachmentClusterClient implements VolumeAttachmentClusterInterface
+type volumeAttachmentClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1alpha1.VolumeAttachment, *storagev1alpha1.VolumeAttachmentList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *volumeAttachmentsClusterClient) Cluster(clusterPath logicalcluster.Path) storagev1alpha1client.VolumeAttachmentInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &volumeAttachmentsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of VolumeAttachments that match those selectors across all clusters.
-func (c *volumeAttachmentsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1alpha1.VolumeAttachmentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(volumeAttachmentsResource, volumeAttachmentsKind, logicalcluster.Wildcard, opts), &storagev1alpha1.VolumeAttachmentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1alpha1.VolumeAttachmentList{ListMeta: obj.(*storagev1alpha1.VolumeAttachmentList).ListMeta}
-	for _, item := range obj.(*storagev1alpha1.VolumeAttachmentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeVolumeAttachmentClusterClient(fake *StorageV1alpha1ClusterClient) typedkcpstoragev1alpha1.VolumeAttachmentClusterInterface {
+	return &volumeAttachmentClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1alpha1.VolumeAttachment, *storagev1alpha1.VolumeAttachmentList](
+			fake.Fake,
+			storagev1alpha1.SchemeGroupVersion.WithResource("volumeattachments"),
+			storagev1alpha1.SchemeGroupVersion.WithKind("VolumeAttachment"),
+			func() *storagev1alpha1.VolumeAttachment { return &storagev1alpha1.VolumeAttachment{} },
+			func() *storagev1alpha1.VolumeAttachmentList { return &storagev1alpha1.VolumeAttachmentList{} },
+			func(dst, src *storagev1alpha1.VolumeAttachmentList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1alpha1.VolumeAttachmentList) []*storagev1alpha1.VolumeAttachment {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1alpha1.VolumeAttachmentList, items []*storagev1alpha1.VolumeAttachment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested VolumeAttachments across all clusters.
-func (c *volumeAttachmentsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(volumeAttachmentsResource, logicalcluster.Wildcard, opts))
+func (c *volumeAttachmentClusterClient) Cluster(cluster logicalcluster.Path) typedstoragev1alpha1.VolumeAttachmentInterface {
+	return newFakeVolumeAttachmentClient(c.Fake, cluster)
 }
 
-type volumeAttachmentsClient struct {
-	*kcptesting.Fake
+// volumeAttachmentScopedClient implements VolumeAttachmentInterface
+type volumeAttachmentScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1alpha1.VolumeAttachment, *storagev1alpha1.VolumeAttachmentList, *v1alpha1.VolumeAttachmentApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *volumeAttachmentsClient) Create(ctx context.Context, volumeAttachment *storagev1alpha1.VolumeAttachment, opts metav1.CreateOptions) (*storagev1alpha1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(volumeAttachmentsResource, c.ClusterPath, volumeAttachment), &storagev1alpha1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1alpha1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) Update(ctx context.Context, volumeAttachment *storagev1alpha1.VolumeAttachment, opts metav1.UpdateOptions) (*storagev1alpha1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(volumeAttachmentsResource, c.ClusterPath, volumeAttachment), &storagev1alpha1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1alpha1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) UpdateStatus(ctx context.Context, volumeAttachment *storagev1alpha1.VolumeAttachment, opts metav1.UpdateOptions) (*storagev1alpha1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(volumeAttachmentsResource, c.ClusterPath, "status", volumeAttachment), &storagev1alpha1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1alpha1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(volumeAttachmentsResource, c.ClusterPath, name, opts), &storagev1alpha1.VolumeAttachment{})
-	return err
-}
-
-func (c *volumeAttachmentsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(volumeAttachmentsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &storagev1alpha1.VolumeAttachmentList{})
-	return err
-}
-
-func (c *volumeAttachmentsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*storagev1alpha1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(volumeAttachmentsResource, c.ClusterPath, name), &storagev1alpha1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1alpha1.VolumeAttachment), err
-}
-
-// List takes label and field selectors, and returns the list of VolumeAttachments that match those selectors.
-func (c *volumeAttachmentsClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1alpha1.VolumeAttachmentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(volumeAttachmentsResource, volumeAttachmentsKind, c.ClusterPath, opts), &storagev1alpha1.VolumeAttachmentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1alpha1.VolumeAttachmentList{ListMeta: obj.(*storagev1alpha1.VolumeAttachmentList).ListMeta}
-	for _, item := range obj.(*storagev1alpha1.VolumeAttachmentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *volumeAttachmentsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(volumeAttachmentsResource, c.ClusterPath, opts))
-}
-
-func (c *volumeAttachmentsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*storagev1alpha1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(volumeAttachmentsResource, c.ClusterPath, name, pt, data, subresources...), &storagev1alpha1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1alpha1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1alpha1.VolumeAttachmentApplyConfiguration, opts metav1.ApplyOptions) (*storagev1alpha1.VolumeAttachment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(volumeAttachmentsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &storagev1alpha1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1alpha1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1alpha1.VolumeAttachmentApplyConfiguration, opts metav1.ApplyOptions) (*storagev1alpha1.VolumeAttachment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(volumeAttachmentsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &storagev1alpha1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
+func newFakeVolumeAttachmentClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedstoragev1alpha1.VolumeAttachmentInterface {
+	return &volumeAttachmentScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1alpha1.VolumeAttachment, *storagev1alpha1.VolumeAttachmentList, *v1alpha1.VolumeAttachmentApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			storagev1alpha1.SchemeGroupVersion.WithResource("volumeattachments"),
+			storagev1alpha1.SchemeGroupVersion.WithKind("VolumeAttachment"),
+			func() *storagev1alpha1.VolumeAttachment { return &storagev1alpha1.VolumeAttachment{} },
+			func() *storagev1alpha1.VolumeAttachmentList { return &storagev1alpha1.VolumeAttachmentList{} },
+			func(dst, src *storagev1alpha1.VolumeAttachmentList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1alpha1.VolumeAttachmentList) []*storagev1alpha1.VolumeAttachment {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1alpha1.VolumeAttachmentList, items []*storagev1alpha1.VolumeAttachment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*storagev1alpha1.VolumeAttachment), err
 }
diff --git a/kubernetes/typed/storage/v1alpha1/fake/volumeattributesclass.go b/kubernetes/typed/storage/v1alpha1/fake/volumeattributesclass.go
new file mode 100644
index 000000000..7648cc44a
--- /dev/null
+++ b/kubernetes/typed/storage/v1alpha1/fake/volumeattributesclass.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/storage/v1alpha1"
+	typedstoragev1alpha1 "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
+
+	typedkcpstoragev1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// volumeAttributesClassClusterClient implements VolumeAttributesClassClusterInterface
+type volumeAttributesClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1alpha1.VolumeAttributesClass, *storagev1alpha1.VolumeAttributesClassList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeVolumeAttributesClassClusterClient(fake *StorageV1alpha1ClusterClient) typedkcpstoragev1alpha1.VolumeAttributesClassClusterInterface {
+	return &volumeAttributesClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1alpha1.VolumeAttributesClass, *storagev1alpha1.VolumeAttributesClassList](
+			fake.Fake,
+			storagev1alpha1.SchemeGroupVersion.WithResource("volumeattributesclasses"),
+			storagev1alpha1.SchemeGroupVersion.WithKind("VolumeAttributesClass"),
+			func() *storagev1alpha1.VolumeAttributesClass { return &storagev1alpha1.VolumeAttributesClass{} },
+			func() *storagev1alpha1.VolumeAttributesClassList { return &storagev1alpha1.VolumeAttributesClassList{} },
+			func(dst, src *storagev1alpha1.VolumeAttributesClassList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1alpha1.VolumeAttributesClassList) []*storagev1alpha1.VolumeAttributesClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1alpha1.VolumeAttributesClassList, items []*storagev1alpha1.VolumeAttributesClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *volumeAttributesClassClusterClient) Cluster(cluster logicalcluster.Path) typedstoragev1alpha1.VolumeAttributesClassInterface {
+	return newFakeVolumeAttributesClassClient(c.Fake, cluster)
+}
+
+// volumeAttributesClassScopedClient implements VolumeAttributesClassInterface
+type volumeAttributesClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1alpha1.VolumeAttributesClass, *storagev1alpha1.VolumeAttributesClassList, *v1alpha1.VolumeAttributesClassApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeVolumeAttributesClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedstoragev1alpha1.VolumeAttributesClassInterface {
+	return &volumeAttributesClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1alpha1.VolumeAttributesClass, *storagev1alpha1.VolumeAttributesClassList, *v1alpha1.VolumeAttributesClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			storagev1alpha1.SchemeGroupVersion.WithResource("volumeattributesclasses"),
+			storagev1alpha1.SchemeGroupVersion.WithKind("VolumeAttributesClass"),
+			func() *storagev1alpha1.VolumeAttributesClass { return &storagev1alpha1.VolumeAttributesClass{} },
+			func() *storagev1alpha1.VolumeAttributesClassList { return &storagev1alpha1.VolumeAttributesClassList{} },
+			func(dst, src *storagev1alpha1.VolumeAttributesClassList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1alpha1.VolumeAttributesClassList) []*storagev1alpha1.VolumeAttributesClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1alpha1.VolumeAttributesClassList, items []*storagev1alpha1.VolumeAttributesClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/storage/v1alpha1/generated_expansion.go b/kubernetes/typed/storage/v1alpha1/generated_expansion.go
new file mode 100644
index 000000000..1573d1c17
--- /dev/null
+++ b/kubernetes/typed/storage/v1alpha1/generated_expansion.go
@@ -0,0 +1,25 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type CSIStorageCapacityClusterExpansion interface{}
+
+type VolumeAttachmentClusterExpansion interface{}
+
+type VolumeAttributesClassClusterExpansion interface{}
diff --git a/kubernetes/typed/storage/v1alpha1/storage_client.go b/kubernetes/typed/storage/v1alpha1/storage_client.go
index 034d48373..5cf0f64f8 100644
--- a/kubernetes/typed/storage/v1alpha1/storage_client.go
+++ b/kubernetes/typed/storage/v1alpha1/storage_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,30 +14,34 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apistoragev1alpha1 "k8s.io/api/storage/v1alpha1"
+	storagev1alpha1 "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1alpha1 "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
-	"k8s.io/client-go/rest"
 )
 
 type StorageV1alpha1ClusterInterface interface {
 	StorageV1alpha1ClusterScoper
-	VolumeAttachmentsClusterGetter
 	CSIStorageCapacitiesClusterGetter
+	VolumeAttachmentsClusterGetter
+	VolumeAttributesClassesClusterGetter
 }
 
 type StorageV1alpha1ClusterScoper interface {
 	Cluster(logicalcluster.Path) storagev1alpha1.StorageV1alpha1Interface
 }
 
+// StorageV1alpha1ClusterClient is used to interact with features provided by the storage.k8s.io group.
 type StorageV1alpha1ClusterClient struct {
 	clientCache kcpclient.Cache[*storagev1alpha1.StorageV1alpha1Client]
 }
@@ -52,23 +53,29 @@ func (c *StorageV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path)
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
+func (c *StorageV1alpha1ClusterClient) CSIStorageCapacities() CSIStorageCapacityClusterInterface {
+	return &cSIStorageCapacitiesClusterInterface{clientCache: c.clientCache}
+}
+
 func (c *StorageV1alpha1ClusterClient) VolumeAttachments() VolumeAttachmentClusterInterface {
 	return &volumeAttachmentsClusterInterface{clientCache: c.clientCache}
 }
 
-func (c *StorageV1alpha1ClusterClient) CSIStorageCapacities() CSIStorageCapacityClusterInterface {
-	return &cSIStorageCapacitiesClusterInterface{clientCache: c.clientCache}
+func (c *StorageV1alpha1ClusterClient) VolumeAttributesClasses() VolumeAttributesClassClusterInterface {
+	return &volumeAttributesClassesClusterInterface{clientCache: c.clientCache}
 }
 
 // NewForConfig creates a new StorageV1alpha1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*StorageV1alpha1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new StorageV1alpha1ClusterClient for the given config and http client.
@@ -80,6 +87,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*StorageV1alpha1Clus
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &StorageV1alpha1ClusterClient{clientCache: cache}, nil
 }
 
@@ -92,3 +100,14 @@ func NewForConfigOrDie(c *rest.Config) *StorageV1alpha1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apistoragev1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/storage/v1alpha1/volumeattachment.go b/kubernetes/typed/storage/v1alpha1/volumeattachment.go
index 42b5ed30a..818221810 100644
--- a/kubernetes/typed/storage/v1alpha1/volumeattachment.go
+++ b/kubernetes/typed/storage/v1alpha1/volumeattachment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	"context"
+	context "context"
+
+	apistoragev1alpha1 "k8s.io/api/storage/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1alpha1 "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	storagev1alpha1client "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
 )
 
 // VolumeAttachmentsClusterGetter has a method to return a VolumeAttachmentClusterInterface.
@@ -40,19 +37,20 @@ type VolumeAttachmentsClusterGetter interface {
 }
 
 // VolumeAttachmentClusterInterface can operate on VolumeAttachments across all clusters,
-// or scope down to one cluster and return a storagev1alpha1client.VolumeAttachmentInterface.
+// or scope down to one cluster and return a storagev1alpha1.VolumeAttachmentInterface.
 type VolumeAttachmentClusterInterface interface {
-	Cluster(logicalcluster.Path) storagev1alpha1client.VolumeAttachmentInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*storagev1alpha1.VolumeAttachmentList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) storagev1alpha1.VolumeAttachmentInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apistoragev1alpha1.VolumeAttachmentList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	VolumeAttachmentClusterExpansion
 }
 
 type volumeAttachmentsClusterInterface struct {
-	clientCache kcpclient.Cache[*storagev1alpha1client.StorageV1alpha1Client]
+	clientCache kcpclient.Cache[*storagev1alpha1.StorageV1alpha1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *volumeAttachmentsClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1alpha1client.VolumeAttachmentInterface {
+func (c *volumeAttachmentsClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1alpha1.VolumeAttachmentInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *volumeAttachmentsClusterInterface) Cluster(clusterPath logicalcluster.P
 }
 
 // List returns the entire collection of all VolumeAttachments across all clusters.
-func (c *volumeAttachmentsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*storagev1alpha1.VolumeAttachmentList, error) {
+func (c *volumeAttachmentsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apistoragev1alpha1.VolumeAttachmentList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).VolumeAttachments().List(ctx, opts)
 }
 
 // Watch begins to watch all VolumeAttachments across all clusters.
-func (c *volumeAttachmentsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *volumeAttachmentsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).VolumeAttachments().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/storage/v1alpha1/volumeattributesclass.go b/kubernetes/typed/storage/v1alpha1/volumeattributesclass.go
new file mode 100644
index 000000000..03eac0daf
--- /dev/null
+++ b/kubernetes/typed/storage/v1alpha1/volumeattributesclass.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	apistoragev1alpha1 "k8s.io/api/storage/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1alpha1 "k8s.io/client-go/kubernetes/typed/storage/v1alpha1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// VolumeAttributesClassesClusterGetter has a method to return a VolumeAttributesClassClusterInterface.
+// A group's cluster client should implement this interface.
+type VolumeAttributesClassesClusterGetter interface {
+	VolumeAttributesClasses() VolumeAttributesClassClusterInterface
+}
+
+// VolumeAttributesClassClusterInterface can operate on VolumeAttributesClasses across all clusters,
+// or scope down to one cluster and return a storagev1alpha1.VolumeAttributesClassInterface.
+type VolumeAttributesClassClusterInterface interface {
+	Cluster(logicalcluster.Path) storagev1alpha1.VolumeAttributesClassInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apistoragev1alpha1.VolumeAttributesClassList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	VolumeAttributesClassClusterExpansion
+}
+
+type volumeAttributesClassesClusterInterface struct {
+	clientCache kcpclient.Cache[*storagev1alpha1.StorageV1alpha1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *volumeAttributesClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1alpha1.VolumeAttributesClassInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).VolumeAttributesClasses()
+}
+
+// List returns the entire collection of all VolumeAttributesClasses across all clusters.
+func (c *volumeAttributesClassesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apistoragev1alpha1.VolumeAttributesClassList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).VolumeAttributesClasses().List(ctx, opts)
+}
+
+// Watch begins to watch all VolumeAttributesClasses across all clusters.
+func (c *volumeAttributesClassesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).VolumeAttributesClasses().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/storage/v1beta1/csidriver.go b/kubernetes/typed/storage/v1beta1/csidriver.go
index 775ca7465..655f9c788 100644
--- a/kubernetes/typed/storage/v1beta1/csidriver.go
+++ b/kubernetes/typed/storage/v1beta1/csidriver.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apistoragev1beta1 "k8s.io/api/storage/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	storagev1beta1client "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 )
 
 // CSIDriversClusterGetter has a method to return a CSIDriverClusterInterface.
@@ -40,19 +37,20 @@ type CSIDriversClusterGetter interface {
 }
 
 // CSIDriverClusterInterface can operate on CSIDrivers across all clusters,
-// or scope down to one cluster and return a storagev1beta1client.CSIDriverInterface.
+// or scope down to one cluster and return a storagev1beta1.CSIDriverInterface.
 type CSIDriverClusterInterface interface {
-	Cluster(logicalcluster.Path) storagev1beta1client.CSIDriverInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.CSIDriverList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) storagev1beta1.CSIDriverInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apistoragev1beta1.CSIDriverList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	CSIDriverClusterExpansion
 }
 
 type cSIDriversClusterInterface struct {
-	clientCache kcpclient.Cache[*storagev1beta1client.StorageV1beta1Client]
+	clientCache kcpclient.Cache[*storagev1beta1.StorageV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *cSIDriversClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1beta1client.CSIDriverInterface {
+func (c *cSIDriversClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1beta1.CSIDriverInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *cSIDriversClusterInterface) Cluster(clusterPath logicalcluster.Path) st
 }
 
 // List returns the entire collection of all CSIDrivers across all clusters.
-func (c *cSIDriversClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.CSIDriverList, error) {
+func (c *cSIDriversClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apistoragev1beta1.CSIDriverList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSIDrivers().List(ctx, opts)
 }
 
 // Watch begins to watch all CSIDrivers across all clusters.
-func (c *cSIDriversClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *cSIDriversClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSIDrivers().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/storage/v1beta1/csinode.go b/kubernetes/typed/storage/v1beta1/csinode.go
index 6203e84ef..f3e200733 100644
--- a/kubernetes/typed/storage/v1beta1/csinode.go
+++ b/kubernetes/typed/storage/v1beta1/csinode.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apistoragev1beta1 "k8s.io/api/storage/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	storagev1beta1client "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 )
 
 // CSINodesClusterGetter has a method to return a CSINodeClusterInterface.
@@ -40,19 +37,20 @@ type CSINodesClusterGetter interface {
 }
 
 // CSINodeClusterInterface can operate on CSINodes across all clusters,
-// or scope down to one cluster and return a storagev1beta1client.CSINodeInterface.
+// or scope down to one cluster and return a storagev1beta1.CSINodeInterface.
 type CSINodeClusterInterface interface {
-	Cluster(logicalcluster.Path) storagev1beta1client.CSINodeInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.CSINodeList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) storagev1beta1.CSINodeInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apistoragev1beta1.CSINodeList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	CSINodeClusterExpansion
 }
 
 type cSINodesClusterInterface struct {
-	clientCache kcpclient.Cache[*storagev1beta1client.StorageV1beta1Client]
+	clientCache kcpclient.Cache[*storagev1beta1.StorageV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *cSINodesClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1beta1client.CSINodeInterface {
+func (c *cSINodesClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1beta1.CSINodeInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *cSINodesClusterInterface) Cluster(clusterPath logicalcluster.Path) stor
 }
 
 // List returns the entire collection of all CSINodes across all clusters.
-func (c *cSINodesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.CSINodeList, error) {
+func (c *cSINodesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apistoragev1beta1.CSINodeList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSINodes().List(ctx, opts)
 }
 
 // Watch begins to watch all CSINodes across all clusters.
-func (c *cSINodesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *cSINodesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSINodes().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/storage/v1beta1/csistoragecapacity.go b/kubernetes/typed/storage/v1beta1/csistoragecapacity.go
index 3c99962c1..9284296fe 100644
--- a/kubernetes/typed/storage/v1beta1/csistoragecapacity.go
+++ b/kubernetes/typed/storage/v1beta1/csistoragecapacity.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	storagev1beta1 "k8s.io/api/storage/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	typedstoragev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	storagev1beta1client "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 )
 
 // CSIStorageCapacitiesClusterGetter has a method to return a CSIStorageCapacityClusterInterface.
@@ -43,12 +40,13 @@ type CSIStorageCapacitiesClusterGetter interface {
 // or scope down to one cluster and return a CSIStorageCapacitiesNamespacer.
 type CSIStorageCapacityClusterInterface interface {
 	Cluster(logicalcluster.Path) CSIStorageCapacitiesNamespacer
-	List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.CSIStorageCapacityList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	List(ctx context.Context, opts v1.ListOptions) (*storagev1beta1.CSIStorageCapacityList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	CSIStorageCapacityClusterExpansion
 }
 
 type cSIStorageCapacitiesClusterInterface struct {
-	clientCache kcpclient.Cache[*storagev1beta1client.StorageV1beta1Client]
+	clientCache kcpclient.Cache[*typedstoragev1beta1.StorageV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
@@ -61,25 +59,25 @@ func (c *cSIStorageCapacitiesClusterInterface) Cluster(clusterPath logicalcluste
 }
 
 // List returns the entire collection of all CSIStorageCapacities across all clusters.
-func (c *cSIStorageCapacitiesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.CSIStorageCapacityList, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSIStorageCapacities(metav1.NamespaceAll).List(ctx, opts)
+func (c *cSIStorageCapacitiesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*storagev1beta1.CSIStorageCapacityList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSIStorageCapacities(v1.NamespaceAll).List(ctx, opts)
 }
 
 // Watch begins to watch all CSIStorageCapacities across all clusters.
-func (c *cSIStorageCapacitiesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSIStorageCapacities(metav1.NamespaceAll).Watch(ctx, opts)
+func (c *cSIStorageCapacitiesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).CSIStorageCapacities(v1.NamespaceAll).Watch(ctx, opts)
 }
 
-// CSIStorageCapacitiesNamespacer can scope to objects within a namespace, returning a storagev1beta1client.CSIStorageCapacityInterface.
+// CSIStorageCapacitiesNamespacer can scope to objects within a namespace, returning a typedstoragev1beta1.CSIStorageCapacityInterface.
 type CSIStorageCapacitiesNamespacer interface {
-	Namespace(string) storagev1beta1client.CSIStorageCapacityInterface
+	Namespace(string) typedstoragev1beta1.CSIStorageCapacityInterface
 }
 
 type cSIStorageCapacitiesNamespacer struct {
-	clientCache kcpclient.Cache[*storagev1beta1client.StorageV1beta1Client]
+	clientCache kcpclient.Cache[*typedstoragev1beta1.StorageV1beta1Client]
 	clusterPath logicalcluster.Path
 }
 
-func (n *cSIStorageCapacitiesNamespacer) Namespace(namespace string) storagev1beta1client.CSIStorageCapacityInterface {
+func (n *cSIStorageCapacitiesNamespacer) Namespace(namespace string) typedstoragev1beta1.CSIStorageCapacityInterface {
 	return n.clientCache.ClusterOrDie(n.clusterPath).CSIStorageCapacities(namespace)
 }
diff --git a/kubernetes/typed/storage/v1beta1/doc.go b/kubernetes/typed/storage/v1beta1/doc.go
new file mode 100644
index 000000000..541e9d258
--- /dev/null
+++ b/kubernetes/typed/storage/v1beta1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1
diff --git a/kubernetes/typed/storage/v1beta1/fake/csidriver.go b/kubernetes/typed/storage/v1beta1/fake/csidriver.go
index ab31ad626..d4b6e2316 100644
--- a/kubernetes/typed/storage/v1beta1/fake/csidriver.go
+++ b/kubernetes/typed/storage/v1beta1/fake/csidriver.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsstoragev1beta1 "k8s.io/client-go/applyconfigurations/storage/v1beta1"
-	storagev1beta1client "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/storage/v1beta1"
+	typedstoragev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 
+	typedkcpstoragev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var cSIDriversResource = schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1beta1", Resource: "csidrivers"}
-var cSIDriversKind = schema.GroupVersionKind{Group: "storage.k8s.io", Version: "v1beta1", Kind: "CSIDriver"}
-
-type cSIDriversClusterClient struct {
-	*kcptesting.Fake
+// cSIDriverClusterClient implements CSIDriverClusterInterface
+type cSIDriverClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1beta1.CSIDriver, *storagev1beta1.CSIDriverList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *cSIDriversClusterClient) Cluster(clusterPath logicalcluster.Path) storagev1beta1client.CSIDriverInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &cSIDriversClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of CSIDrivers that match those selectors across all clusters.
-func (c *cSIDriversClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.CSIDriverList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(cSIDriversResource, cSIDriversKind, logicalcluster.Wildcard, opts), &storagev1beta1.CSIDriverList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1beta1.CSIDriverList{ListMeta: obj.(*storagev1beta1.CSIDriverList).ListMeta}
-	for _, item := range obj.(*storagev1beta1.CSIDriverList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeCSIDriverClusterClient(fake *StorageV1beta1ClusterClient) typedkcpstoragev1beta1.CSIDriverClusterInterface {
+	return &cSIDriverClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1beta1.CSIDriver, *storagev1beta1.CSIDriverList](
+			fake.Fake,
+			storagev1beta1.SchemeGroupVersion.WithResource("csidrivers"),
+			storagev1beta1.SchemeGroupVersion.WithKind("CSIDriver"),
+			func() *storagev1beta1.CSIDriver { return &storagev1beta1.CSIDriver{} },
+			func() *storagev1beta1.CSIDriverList { return &storagev1beta1.CSIDriverList{} },
+			func(dst, src *storagev1beta1.CSIDriverList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1beta1.CSIDriverList) []*storagev1beta1.CSIDriver {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1beta1.CSIDriverList, items []*storagev1beta1.CSIDriver) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested CSIDrivers across all clusters.
-func (c *cSIDriversClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(cSIDriversResource, logicalcluster.Wildcard, opts))
+func (c *cSIDriverClusterClient) Cluster(cluster logicalcluster.Path) typedstoragev1beta1.CSIDriverInterface {
+	return newFakeCSIDriverClient(c.Fake, cluster)
 }
 
-type cSIDriversClient struct {
-	*kcptesting.Fake
+// cSIDriverScopedClient implements CSIDriverInterface
+type cSIDriverScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1beta1.CSIDriver, *storagev1beta1.CSIDriverList, *v1beta1.CSIDriverApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *cSIDriversClient) Create(ctx context.Context, cSIDriver *storagev1beta1.CSIDriver, opts metav1.CreateOptions) (*storagev1beta1.CSIDriver, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(cSIDriversResource, c.ClusterPath, cSIDriver), &storagev1beta1.CSIDriver{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSIDriver), err
-}
-
-func (c *cSIDriversClient) Update(ctx context.Context, cSIDriver *storagev1beta1.CSIDriver, opts metav1.UpdateOptions) (*storagev1beta1.CSIDriver, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(cSIDriversResource, c.ClusterPath, cSIDriver), &storagev1beta1.CSIDriver{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSIDriver), err
-}
-
-func (c *cSIDriversClient) UpdateStatus(ctx context.Context, cSIDriver *storagev1beta1.CSIDriver, opts metav1.UpdateOptions) (*storagev1beta1.CSIDriver, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(cSIDriversResource, c.ClusterPath, "status", cSIDriver), &storagev1beta1.CSIDriver{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSIDriver), err
-}
-
-func (c *cSIDriversClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(cSIDriversResource, c.ClusterPath, name, opts), &storagev1beta1.CSIDriver{})
-	return err
-}
-
-func (c *cSIDriversClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(cSIDriversResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &storagev1beta1.CSIDriverList{})
-	return err
-}
-
-func (c *cSIDriversClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*storagev1beta1.CSIDriver, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(cSIDriversResource, c.ClusterPath, name), &storagev1beta1.CSIDriver{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSIDriver), err
-}
-
-// List takes label and field selectors, and returns the list of CSIDrivers that match those selectors.
-func (c *cSIDriversClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.CSIDriverList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(cSIDriversResource, cSIDriversKind, c.ClusterPath, opts), &storagev1beta1.CSIDriverList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1beta1.CSIDriverList{ListMeta: obj.(*storagev1beta1.CSIDriverList).ListMeta}
-	for _, item := range obj.(*storagev1beta1.CSIDriverList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *cSIDriversClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(cSIDriversResource, c.ClusterPath, opts))
-}
-
-func (c *cSIDriversClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*storagev1beta1.CSIDriver, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(cSIDriversResource, c.ClusterPath, name, pt, data, subresources...), &storagev1beta1.CSIDriver{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSIDriver), err
-}
-
-func (c *cSIDriversClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1beta1.CSIDriverApplyConfiguration, opts metav1.ApplyOptions) (*storagev1beta1.CSIDriver, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(cSIDriversResource, c.ClusterPath, *name, types.ApplyPatchType, data), &storagev1beta1.CSIDriver{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSIDriver), err
-}
-
-func (c *cSIDriversClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1beta1.CSIDriverApplyConfiguration, opts metav1.ApplyOptions) (*storagev1beta1.CSIDriver, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(cSIDriversResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &storagev1beta1.CSIDriver{})
-	if obj == nil {
-		return nil, err
+func newFakeCSIDriverClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedstoragev1beta1.CSIDriverInterface {
+	return &cSIDriverScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1beta1.CSIDriver, *storagev1beta1.CSIDriverList, *v1beta1.CSIDriverApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			storagev1beta1.SchemeGroupVersion.WithResource("csidrivers"),
+			storagev1beta1.SchemeGroupVersion.WithKind("CSIDriver"),
+			func() *storagev1beta1.CSIDriver { return &storagev1beta1.CSIDriver{} },
+			func() *storagev1beta1.CSIDriverList { return &storagev1beta1.CSIDriverList{} },
+			func(dst, src *storagev1beta1.CSIDriverList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1beta1.CSIDriverList) []*storagev1beta1.CSIDriver {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1beta1.CSIDriverList, items []*storagev1beta1.CSIDriver) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*storagev1beta1.CSIDriver), err
 }
diff --git a/kubernetes/typed/storage/v1beta1/fake/csinode.go b/kubernetes/typed/storage/v1beta1/fake/csinode.go
index eb64b7078..f0dd5e9b4 100644
--- a/kubernetes/typed/storage/v1beta1/fake/csinode.go
+++ b/kubernetes/typed/storage/v1beta1/fake/csinode.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsstoragev1beta1 "k8s.io/client-go/applyconfigurations/storage/v1beta1"
-	storagev1beta1client "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/storage/v1beta1"
+	typedstoragev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 
+	typedkcpstoragev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var cSINodesResource = schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1beta1", Resource: "csinodes"}
-var cSINodesKind = schema.GroupVersionKind{Group: "storage.k8s.io", Version: "v1beta1", Kind: "CSINode"}
-
-type cSINodesClusterClient struct {
-	*kcptesting.Fake
+// cSINodeClusterClient implements CSINodeClusterInterface
+type cSINodeClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1beta1.CSINode, *storagev1beta1.CSINodeList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *cSINodesClusterClient) Cluster(clusterPath logicalcluster.Path) storagev1beta1client.CSINodeInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &cSINodesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of CSINodes that match those selectors across all clusters.
-func (c *cSINodesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.CSINodeList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(cSINodesResource, cSINodesKind, logicalcluster.Wildcard, opts), &storagev1beta1.CSINodeList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1beta1.CSINodeList{ListMeta: obj.(*storagev1beta1.CSINodeList).ListMeta}
-	for _, item := range obj.(*storagev1beta1.CSINodeList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeCSINodeClusterClient(fake *StorageV1beta1ClusterClient) typedkcpstoragev1beta1.CSINodeClusterInterface {
+	return &cSINodeClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1beta1.CSINode, *storagev1beta1.CSINodeList](
+			fake.Fake,
+			storagev1beta1.SchemeGroupVersion.WithResource("csinodes"),
+			storagev1beta1.SchemeGroupVersion.WithKind("CSINode"),
+			func() *storagev1beta1.CSINode { return &storagev1beta1.CSINode{} },
+			func() *storagev1beta1.CSINodeList { return &storagev1beta1.CSINodeList{} },
+			func(dst, src *storagev1beta1.CSINodeList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1beta1.CSINodeList) []*storagev1beta1.CSINode {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1beta1.CSINodeList, items []*storagev1beta1.CSINode) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested CSINodes across all clusters.
-func (c *cSINodesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(cSINodesResource, logicalcluster.Wildcard, opts))
+func (c *cSINodeClusterClient) Cluster(cluster logicalcluster.Path) typedstoragev1beta1.CSINodeInterface {
+	return newFakeCSINodeClient(c.Fake, cluster)
 }
 
-type cSINodesClient struct {
-	*kcptesting.Fake
+// cSINodeScopedClient implements CSINodeInterface
+type cSINodeScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1beta1.CSINode, *storagev1beta1.CSINodeList, *v1beta1.CSINodeApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *cSINodesClient) Create(ctx context.Context, cSINode *storagev1beta1.CSINode, opts metav1.CreateOptions) (*storagev1beta1.CSINode, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(cSINodesResource, c.ClusterPath, cSINode), &storagev1beta1.CSINode{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSINode), err
-}
-
-func (c *cSINodesClient) Update(ctx context.Context, cSINode *storagev1beta1.CSINode, opts metav1.UpdateOptions) (*storagev1beta1.CSINode, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(cSINodesResource, c.ClusterPath, cSINode), &storagev1beta1.CSINode{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSINode), err
-}
-
-func (c *cSINodesClient) UpdateStatus(ctx context.Context, cSINode *storagev1beta1.CSINode, opts metav1.UpdateOptions) (*storagev1beta1.CSINode, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(cSINodesResource, c.ClusterPath, "status", cSINode), &storagev1beta1.CSINode{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSINode), err
-}
-
-func (c *cSINodesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(cSINodesResource, c.ClusterPath, name, opts), &storagev1beta1.CSINode{})
-	return err
-}
-
-func (c *cSINodesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(cSINodesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &storagev1beta1.CSINodeList{})
-	return err
-}
-
-func (c *cSINodesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*storagev1beta1.CSINode, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(cSINodesResource, c.ClusterPath, name), &storagev1beta1.CSINode{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSINode), err
-}
-
-// List takes label and field selectors, and returns the list of CSINodes that match those selectors.
-func (c *cSINodesClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.CSINodeList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(cSINodesResource, cSINodesKind, c.ClusterPath, opts), &storagev1beta1.CSINodeList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1beta1.CSINodeList{ListMeta: obj.(*storagev1beta1.CSINodeList).ListMeta}
-	for _, item := range obj.(*storagev1beta1.CSINodeList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *cSINodesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(cSINodesResource, c.ClusterPath, opts))
-}
-
-func (c *cSINodesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*storagev1beta1.CSINode, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(cSINodesResource, c.ClusterPath, name, pt, data, subresources...), &storagev1beta1.CSINode{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSINode), err
-}
-
-func (c *cSINodesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1beta1.CSINodeApplyConfiguration, opts metav1.ApplyOptions) (*storagev1beta1.CSINode, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(cSINodesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &storagev1beta1.CSINode{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSINode), err
-}
-
-func (c *cSINodesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1beta1.CSINodeApplyConfiguration, opts metav1.ApplyOptions) (*storagev1beta1.CSINode, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(cSINodesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &storagev1beta1.CSINode{})
-	if obj == nil {
-		return nil, err
+func newFakeCSINodeClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedstoragev1beta1.CSINodeInterface {
+	return &cSINodeScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1beta1.CSINode, *storagev1beta1.CSINodeList, *v1beta1.CSINodeApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			storagev1beta1.SchemeGroupVersion.WithResource("csinodes"),
+			storagev1beta1.SchemeGroupVersion.WithKind("CSINode"),
+			func() *storagev1beta1.CSINode { return &storagev1beta1.CSINode{} },
+			func() *storagev1beta1.CSINodeList { return &storagev1beta1.CSINodeList{} },
+			func(dst, src *storagev1beta1.CSINodeList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1beta1.CSINodeList) []*storagev1beta1.CSINode {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1beta1.CSINodeList, items []*storagev1beta1.CSINode) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*storagev1beta1.CSINode), err
 }
diff --git a/kubernetes/typed/storage/v1beta1/fake/csistoragecapacity.go b/kubernetes/typed/storage/v1beta1/fake/csistoragecapacity.go
index 18bf00729..4b8a6e303 100644
--- a/kubernetes/typed/storage/v1beta1/fake/csistoragecapacity.go
+++ b/kubernetes/typed/storage/v1beta1/fake/csistoragecapacity.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,197 +14,86 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsstoragev1beta1 "k8s.io/client-go/applyconfigurations/storage/v1beta1"
-	storagev1beta1client "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/storage/v1beta1"
+	typedstoragev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 
-	kcpstoragev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1beta1"
+	typedkcpstoragev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var cSIStorageCapacitiesResource = schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1beta1", Resource: "csistoragecapacities"}
-var cSIStorageCapacitiesKind = schema.GroupVersionKind{Group: "storage.k8s.io", Version: "v1beta1", Kind: "CSIStorageCapacity"}
-
-type cSIStorageCapacitiesClusterClient struct {
-	*kcptesting.Fake
+// cSIStorageCapacityClusterClient implements CSIStorageCapacityClusterInterface
+type cSIStorageCapacityClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1beta1.CSIStorageCapacity, *storagev1beta1.CSIStorageCapacityList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *cSIStorageCapacitiesClusterClient) Cluster(clusterPath logicalcluster.Path) kcpstoragev1beta1.CSIStorageCapacitiesNamespacer {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &cSIStorageCapacitiesNamespacer{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of CSIStorageCapacities that match those selectors across all clusters.
-func (c *cSIStorageCapacitiesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.CSIStorageCapacityList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(cSIStorageCapacitiesResource, cSIStorageCapacitiesKind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), &storagev1beta1.CSIStorageCapacityList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
+func newFakeCSIStorageCapacityClusterClient(fake *StorageV1beta1ClusterClient) typedkcpstoragev1beta1.CSIStorageCapacityClusterInterface {
+	return &cSIStorageCapacityClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1beta1.CSIStorageCapacity, *storagev1beta1.CSIStorageCapacityList](
+			fake.Fake,
+			storagev1beta1.SchemeGroupVersion.WithResource("csistoragecapacities"),
+			storagev1beta1.SchemeGroupVersion.WithKind("CSIStorageCapacity"),
+			func() *storagev1beta1.CSIStorageCapacity { return &storagev1beta1.CSIStorageCapacity{} },
+			func() *storagev1beta1.CSIStorageCapacityList { return &storagev1beta1.CSIStorageCapacityList{} },
+			func(dst, src *storagev1beta1.CSIStorageCapacityList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1beta1.CSIStorageCapacityList) []*storagev1beta1.CSIStorageCapacity {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1beta1.CSIStorageCapacityList, items []*storagev1beta1.CSIStorageCapacity) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	list := &storagev1beta1.CSIStorageCapacityList{ListMeta: obj.(*storagev1beta1.CSIStorageCapacityList).ListMeta}
-	for _, item := range obj.(*storagev1beta1.CSIStorageCapacityList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested CSIStorageCapacities across all clusters.
-func (c *cSIStorageCapacitiesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(cSIStorageCapacitiesResource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+func (c *cSIStorageCapacityClusterClient) Cluster(cluster logicalcluster.Path) typedkcpstoragev1beta1.CSIStorageCapacitiesNamespacer {
+	return &cSIStorageCapacityNamespacer{Fake: c.Fake, ClusterPath: cluster}
 }
 
-type cSIStorageCapacitiesNamespacer struct {
+type cSIStorageCapacityNamespacer struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (n *cSIStorageCapacitiesNamespacer) Namespace(namespace string) storagev1beta1client.CSIStorageCapacityInterface {
-	return &cSIStorageCapacitiesClient{Fake: n.Fake, ClusterPath: n.ClusterPath, Namespace: namespace}
+func (n *cSIStorageCapacityNamespacer) Namespace(namespace string) typedstoragev1beta1.CSIStorageCapacityInterface {
+	return newFakeCSIStorageCapacityClient(n.Fake, namespace, n.ClusterPath)
 }
 
-type cSIStorageCapacitiesClient struct {
-	*kcptesting.Fake
+// cSIStorageCapacityScopedClient implements CSIStorageCapacityInterface
+type cSIStorageCapacityScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1beta1.CSIStorageCapacity, *storagev1beta1.CSIStorageCapacityList, *v1beta1.CSIStorageCapacityApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
-	Namespace   string
-}
-
-func (c *cSIStorageCapacitiesClient) Create(ctx context.Context, cSIStorageCapacity *storagev1beta1.CSIStorageCapacity, opts metav1.CreateOptions) (*storagev1beta1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, cSIStorageCapacity), &storagev1beta1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) Update(ctx context.Context, cSIStorageCapacity *storagev1beta1.CSIStorageCapacity, opts metav1.UpdateOptions) (*storagev1beta1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, cSIStorageCapacity), &storagev1beta1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) UpdateStatus(ctx context.Context, cSIStorageCapacity *storagev1beta1.CSIStorageCapacity, opts metav1.UpdateOptions) (*storagev1beta1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewUpdateSubresourceAction(cSIStorageCapacitiesResource, c.ClusterPath, "status", c.Namespace, cSIStorageCapacity), &storagev1beta1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewDeleteActionWithOptions(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, name, opts), &storagev1beta1.CSIStorageCapacity{})
-	return err
 }
 
-func (c *cSIStorageCapacitiesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewDeleteCollectionAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, listOpts)
-
-	_, err := c.Fake.Invokes(action, &storagev1beta1.CSIStorageCapacityList{})
-	return err
-}
-
-func (c *cSIStorageCapacitiesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*storagev1beta1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, name), &storagev1beta1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSIStorageCapacity), err
-}
-
-// List takes label and field selectors, and returns the list of CSIStorageCapacities that match those selectors.
-func (c *cSIStorageCapacitiesClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.CSIStorageCapacityList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewListAction(cSIStorageCapacitiesResource, cSIStorageCapacitiesKind, c.ClusterPath, c.Namespace, opts), &storagev1beta1.CSIStorageCapacityList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1beta1.CSIStorageCapacityList{ListMeta: obj.(*storagev1beta1.CSIStorageCapacityList).ListMeta}
-	for _, item := range obj.(*storagev1beta1.CSIStorageCapacityList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *cSIStorageCapacitiesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, opts))
-}
-
-func (c *cSIStorageCapacitiesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*storagev1beta1.CSIStorageCapacity, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, name, pt, data, subresources...), &storagev1beta1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1beta1.CSIStorageCapacityApplyConfiguration, opts metav1.ApplyOptions) (*storagev1beta1.CSIStorageCapacity, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data), &storagev1beta1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.CSIStorageCapacity), err
-}
-
-func (c *cSIStorageCapacitiesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1beta1.CSIStorageCapacityApplyConfiguration, opts metav1.ApplyOptions) (*storagev1beta1.CSIStorageCapacity, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewPatchSubresourceAction(cSIStorageCapacitiesResource, c.ClusterPath, c.Namespace, *name, types.ApplyPatchType, data, "status"), &storagev1beta1.CSIStorageCapacity{})
-	if obj == nil {
-		return nil, err
+func newFakeCSIStorageCapacityClient(fake *kcptesting.Fake, namespace string, clusterPath logicalcluster.Path) typedstoragev1beta1.CSIStorageCapacityInterface {
+	return &cSIStorageCapacityScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1beta1.CSIStorageCapacity, *storagev1beta1.CSIStorageCapacityList, *v1beta1.CSIStorageCapacityApplyConfiguration](
+			fake,
+			clusterPath,
+			namespace,
+			storagev1beta1.SchemeGroupVersion.WithResource("csistoragecapacities"),
+			storagev1beta1.SchemeGroupVersion.WithKind("CSIStorageCapacity"),
+			func() *storagev1beta1.CSIStorageCapacity { return &storagev1beta1.CSIStorageCapacity{} },
+			func() *storagev1beta1.CSIStorageCapacityList { return &storagev1beta1.CSIStorageCapacityList{} },
+			func(dst, src *storagev1beta1.CSIStorageCapacityList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1beta1.CSIStorageCapacityList) []*storagev1beta1.CSIStorageCapacity {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1beta1.CSIStorageCapacityList, items []*storagev1beta1.CSIStorageCapacity) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*storagev1beta1.CSIStorageCapacity), err
 }
diff --git a/kubernetes/typed/storage/v1beta1/fake/doc.go b/kubernetes/typed/storage/v1beta1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/storage/v1beta1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/storage/v1beta1/fake/storage_client.go b/kubernetes/typed/storage/v1beta1/fake/storage_client.go
index 3f2283551..8726db660 100644
--- a/kubernetes/typed/storage/v1beta1/fake/storage_client.go
+++ b/kubernetes/typed/storage/v1beta1/fake/storage_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,18 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
-	"k8s.io/client-go/rest"
+	rest "k8s.io/client-go/rest"
 
 	kcpstoragev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1beta1"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ kcpstoragev1beta1.StorageV1beta1ClusterInterface = (*StorageV1beta1ClusterClient)(nil)
@@ -44,54 +40,62 @@ func (c *StorageV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) s
 	return &StorageV1beta1Client{Fake: c.Fake, ClusterPath: clusterPath}
 }
 
-func (c *StorageV1beta1ClusterClient) StorageClasses() kcpstoragev1beta1.StorageClassClusterInterface {
-	return &storageClassesClusterClient{Fake: c.Fake}
+func (c *StorageV1beta1ClusterClient) CSIDrivers() kcpstoragev1beta1.CSIDriverClusterInterface {
+	return newFakeCSIDriverClusterClient(c)
 }
 
-func (c *StorageV1beta1ClusterClient) VolumeAttachments() kcpstoragev1beta1.VolumeAttachmentClusterInterface {
-	return &volumeAttachmentsClusterClient{Fake: c.Fake}
+func (c *StorageV1beta1ClusterClient) CSINodes() kcpstoragev1beta1.CSINodeClusterInterface {
+	return newFakeCSINodeClusterClient(c)
 }
 
-func (c *StorageV1beta1ClusterClient) CSIDrivers() kcpstoragev1beta1.CSIDriverClusterInterface {
-	return &cSIDriversClusterClient{Fake: c.Fake}
+func (c *StorageV1beta1ClusterClient) CSIStorageCapacities() kcpstoragev1beta1.CSIStorageCapacityClusterInterface {
+	return newFakeCSIStorageCapacityClusterClient(c)
 }
 
-func (c *StorageV1beta1ClusterClient) CSINodes() kcpstoragev1beta1.CSINodeClusterInterface {
-	return &cSINodesClusterClient{Fake: c.Fake}
+func (c *StorageV1beta1ClusterClient) StorageClasses() kcpstoragev1beta1.StorageClassClusterInterface {
+	return newFakeStorageClassClusterClient(c)
 }
 
-func (c *StorageV1beta1ClusterClient) CSIStorageCapacities() kcpstoragev1beta1.CSIStorageCapacityClusterInterface {
-	return &cSIStorageCapacitiesClusterClient{Fake: c.Fake}
+func (c *StorageV1beta1ClusterClient) VolumeAttachments() kcpstoragev1beta1.VolumeAttachmentClusterInterface {
+	return newFakeVolumeAttachmentClusterClient(c)
 }
 
-var _ storagev1beta1.StorageV1beta1Interface = (*StorageV1beta1Client)(nil)
+func (c *StorageV1beta1ClusterClient) VolumeAttributesClasses() kcpstoragev1beta1.VolumeAttributesClassClusterInterface {
+	return newFakeVolumeAttributesClassClusterClient(c)
+}
 
 type StorageV1beta1Client struct {
 	*kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *StorageV1beta1Client) RESTClient() rest.Interface {
-	var ret *rest.RESTClient
-	return ret
+func (c *StorageV1beta1Client) CSIDrivers() storagev1beta1.CSIDriverInterface {
+	return newFakeCSIDriverClient(c.Fake, c.ClusterPath)
 }
 
-func (c *StorageV1beta1Client) StorageClasses() storagev1beta1.StorageClassInterface {
-	return &storageClassesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *StorageV1beta1Client) CSINodes() storagev1beta1.CSINodeInterface {
+	return newFakeCSINodeClient(c.Fake, c.ClusterPath)
 }
 
-func (c *StorageV1beta1Client) VolumeAttachments() storagev1beta1.VolumeAttachmentInterface {
-	return &volumeAttachmentsClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *StorageV1beta1Client) CSIStorageCapacities(namespace string) storagev1beta1.CSIStorageCapacityInterface {
+	return newFakeCSIStorageCapacityClient(c.Fake, namespace, c.ClusterPath)
 }
 
-func (c *StorageV1beta1Client) CSIDrivers() storagev1beta1.CSIDriverInterface {
-	return &cSIDriversClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *StorageV1beta1Client) StorageClasses() storagev1beta1.StorageClassInterface {
+	return newFakeStorageClassClient(c.Fake, c.ClusterPath)
 }
 
-func (c *StorageV1beta1Client) CSINodes() storagev1beta1.CSINodeInterface {
-	return &cSINodesClient{Fake: c.Fake, ClusterPath: c.ClusterPath}
+func (c *StorageV1beta1Client) VolumeAttachments() storagev1beta1.VolumeAttachmentInterface {
+	return newFakeVolumeAttachmentClient(c.Fake, c.ClusterPath)
 }
 
-func (c *StorageV1beta1Client) CSIStorageCapacities(namespace string) storagev1beta1.CSIStorageCapacityInterface {
-	return &cSIStorageCapacitiesClient{Fake: c.Fake, ClusterPath: c.ClusterPath, Namespace: namespace}
+func (c *StorageV1beta1Client) VolumeAttributesClasses() storagev1beta1.VolumeAttributesClassInterface {
+	return newFakeVolumeAttributesClassClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *StorageV1beta1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
 }
diff --git a/kubernetes/typed/storage/v1beta1/fake/storageclass.go b/kubernetes/typed/storage/v1beta1/fake/storageclass.go
index cd2fba655..b527fbf51 100644
--- a/kubernetes/typed/storage/v1beta1/fake/storageclass.go
+++ b/kubernetes/typed/storage/v1beta1/fake/storageclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsstoragev1beta1 "k8s.io/client-go/applyconfigurations/storage/v1beta1"
-	storagev1beta1client "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/storage/v1beta1"
+	typedstoragev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 
+	typedkcpstoragev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var storageClassesResource = schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1beta1", Resource: "storageclasses"}
-var storageClassesKind = schema.GroupVersionKind{Group: "storage.k8s.io", Version: "v1beta1", Kind: "StorageClass"}
-
-type storageClassesClusterClient struct {
-	*kcptesting.Fake
+// storageClassClusterClient implements StorageClassClusterInterface
+type storageClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1beta1.StorageClass, *storagev1beta1.StorageClassList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *storageClassesClusterClient) Cluster(clusterPath logicalcluster.Path) storagev1beta1client.StorageClassInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &storageClassesClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of StorageClasses that match those selectors across all clusters.
-func (c *storageClassesClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.StorageClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(storageClassesResource, storageClassesKind, logicalcluster.Wildcard, opts), &storagev1beta1.StorageClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1beta1.StorageClassList{ListMeta: obj.(*storagev1beta1.StorageClassList).ListMeta}
-	for _, item := range obj.(*storagev1beta1.StorageClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeStorageClassClusterClient(fake *StorageV1beta1ClusterClient) typedkcpstoragev1beta1.StorageClassClusterInterface {
+	return &storageClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1beta1.StorageClass, *storagev1beta1.StorageClassList](
+			fake.Fake,
+			storagev1beta1.SchemeGroupVersion.WithResource("storageclasses"),
+			storagev1beta1.SchemeGroupVersion.WithKind("StorageClass"),
+			func() *storagev1beta1.StorageClass { return &storagev1beta1.StorageClass{} },
+			func() *storagev1beta1.StorageClassList { return &storagev1beta1.StorageClassList{} },
+			func(dst, src *storagev1beta1.StorageClassList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1beta1.StorageClassList) []*storagev1beta1.StorageClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1beta1.StorageClassList, items []*storagev1beta1.StorageClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested StorageClasses across all clusters.
-func (c *storageClassesClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(storageClassesResource, logicalcluster.Wildcard, opts))
+func (c *storageClassClusterClient) Cluster(cluster logicalcluster.Path) typedstoragev1beta1.StorageClassInterface {
+	return newFakeStorageClassClient(c.Fake, cluster)
 }
 
-type storageClassesClient struct {
-	*kcptesting.Fake
+// storageClassScopedClient implements StorageClassInterface
+type storageClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1beta1.StorageClass, *storagev1beta1.StorageClassList, *v1beta1.StorageClassApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *storageClassesClient) Create(ctx context.Context, storageClass *storagev1beta1.StorageClass, opts metav1.CreateOptions) (*storagev1beta1.StorageClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(storageClassesResource, c.ClusterPath, storageClass), &storagev1beta1.StorageClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.StorageClass), err
-}
-
-func (c *storageClassesClient) Update(ctx context.Context, storageClass *storagev1beta1.StorageClass, opts metav1.UpdateOptions) (*storagev1beta1.StorageClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(storageClassesResource, c.ClusterPath, storageClass), &storagev1beta1.StorageClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.StorageClass), err
-}
-
-func (c *storageClassesClient) UpdateStatus(ctx context.Context, storageClass *storagev1beta1.StorageClass, opts metav1.UpdateOptions) (*storagev1beta1.StorageClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(storageClassesResource, c.ClusterPath, "status", storageClass), &storagev1beta1.StorageClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.StorageClass), err
-}
-
-func (c *storageClassesClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(storageClassesResource, c.ClusterPath, name, opts), &storagev1beta1.StorageClass{})
-	return err
-}
-
-func (c *storageClassesClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(storageClassesResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &storagev1beta1.StorageClassList{})
-	return err
-}
-
-func (c *storageClassesClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*storagev1beta1.StorageClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(storageClassesResource, c.ClusterPath, name), &storagev1beta1.StorageClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.StorageClass), err
-}
-
-// List takes label and field selectors, and returns the list of StorageClasses that match those selectors.
-func (c *storageClassesClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.StorageClassList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(storageClassesResource, storageClassesKind, c.ClusterPath, opts), &storagev1beta1.StorageClassList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1beta1.StorageClassList{ListMeta: obj.(*storagev1beta1.StorageClassList).ListMeta}
-	for _, item := range obj.(*storagev1beta1.StorageClassList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *storageClassesClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(storageClassesResource, c.ClusterPath, opts))
-}
-
-func (c *storageClassesClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*storagev1beta1.StorageClass, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(storageClassesResource, c.ClusterPath, name, pt, data, subresources...), &storagev1beta1.StorageClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.StorageClass), err
-}
-
-func (c *storageClassesClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1beta1.StorageClassApplyConfiguration, opts metav1.ApplyOptions) (*storagev1beta1.StorageClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(storageClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data), &storagev1beta1.StorageClass{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.StorageClass), err
-}
-
-func (c *storageClassesClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1beta1.StorageClassApplyConfiguration, opts metav1.ApplyOptions) (*storagev1beta1.StorageClass, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(storageClassesResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &storagev1beta1.StorageClass{})
-	if obj == nil {
-		return nil, err
+func newFakeStorageClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedstoragev1beta1.StorageClassInterface {
+	return &storageClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1beta1.StorageClass, *storagev1beta1.StorageClassList, *v1beta1.StorageClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			storagev1beta1.SchemeGroupVersion.WithResource("storageclasses"),
+			storagev1beta1.SchemeGroupVersion.WithKind("StorageClass"),
+			func() *storagev1beta1.StorageClass { return &storagev1beta1.StorageClass{} },
+			func() *storagev1beta1.StorageClassList { return &storagev1beta1.StorageClassList{} },
+			func(dst, src *storagev1beta1.StorageClassList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1beta1.StorageClassList) []*storagev1beta1.StorageClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1beta1.StorageClassList, items []*storagev1beta1.StorageClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*storagev1beta1.StorageClass), err
 }
diff --git a/kubernetes/typed/storage/v1beta1/fake/volumeattachment.go b/kubernetes/typed/storage/v1beta1/fake/volumeattachment.go
index 8e7c81714..370baa818 100644
--- a/kubernetes/typed/storage/v1beta1/fake/volumeattachment.go
+++ b/kubernetes/typed/storage/v1beta1/fake/volumeattachment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,186 +14,77 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package fake
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/watch"
-	applyconfigurationsstoragev1beta1 "k8s.io/client-go/applyconfigurations/storage/v1beta1"
-	storagev1beta1client "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
-	"k8s.io/client-go/testing"
+	v1beta1 "k8s.io/client-go/applyconfigurations/storage/v1beta1"
+	typedstoragev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 
+	typedkcpstoragev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-var volumeAttachmentsResource = schema.GroupVersionResource{Group: "storage.k8s.io", Version: "v1beta1", Resource: "volumeattachments"}
-var volumeAttachmentsKind = schema.GroupVersionKind{Group: "storage.k8s.io", Version: "v1beta1", Kind: "VolumeAttachment"}
-
-type volumeAttachmentsClusterClient struct {
-	*kcptesting.Fake
+// volumeAttachmentClusterClient implements VolumeAttachmentClusterInterface
+type volumeAttachmentClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1beta1.VolumeAttachment, *storagev1beta1.VolumeAttachmentList]
+	Fake *kcptesting.Fake
 }
 
-// Cluster scopes the client down to a particular cluster.
-func (c *volumeAttachmentsClusterClient) Cluster(clusterPath logicalcluster.Path) storagev1beta1client.VolumeAttachmentInterface {
-	if clusterPath == logicalcluster.Wildcard {
-		panic("A specific cluster must be provided when scoping, not the wildcard.")
-	}
-
-	return &volumeAttachmentsClient{Fake: c.Fake, ClusterPath: clusterPath}
-}
-
-// List takes label and field selectors, and returns the list of VolumeAttachments that match those selectors across all clusters.
-func (c *volumeAttachmentsClusterClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.VolumeAttachmentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(volumeAttachmentsResource, volumeAttachmentsKind, logicalcluster.Wildcard, opts), &storagev1beta1.VolumeAttachmentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1beta1.VolumeAttachmentList{ListMeta: obj.(*storagev1beta1.VolumeAttachmentList).ListMeta}
-	for _, item := range obj.(*storagev1beta1.VolumeAttachmentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
+func newFakeVolumeAttachmentClusterClient(fake *StorageV1beta1ClusterClient) typedkcpstoragev1beta1.VolumeAttachmentClusterInterface {
+	return &volumeAttachmentClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1beta1.VolumeAttachment, *storagev1beta1.VolumeAttachmentList](
+			fake.Fake,
+			storagev1beta1.SchemeGroupVersion.WithResource("volumeattachments"),
+			storagev1beta1.SchemeGroupVersion.WithKind("VolumeAttachment"),
+			func() *storagev1beta1.VolumeAttachment { return &storagev1beta1.VolumeAttachment{} },
+			func() *storagev1beta1.VolumeAttachmentList { return &storagev1beta1.VolumeAttachmentList{} },
+			func(dst, src *storagev1beta1.VolumeAttachmentList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1beta1.VolumeAttachmentList) []*storagev1beta1.VolumeAttachment {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1beta1.VolumeAttachmentList, items []*storagev1beta1.VolumeAttachment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
 	}
-	return list, err
 }
 
-// Watch returns a watch.Interface that watches the requested VolumeAttachments across all clusters.
-func (c *volumeAttachmentsClusterClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(volumeAttachmentsResource, logicalcluster.Wildcard, opts))
+func (c *volumeAttachmentClusterClient) Cluster(cluster logicalcluster.Path) typedstoragev1beta1.VolumeAttachmentInterface {
+	return newFakeVolumeAttachmentClient(c.Fake, cluster)
 }
 
-type volumeAttachmentsClient struct {
-	*kcptesting.Fake
+// volumeAttachmentScopedClient implements VolumeAttachmentInterface
+type volumeAttachmentScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1beta1.VolumeAttachment, *storagev1beta1.VolumeAttachmentList, *v1beta1.VolumeAttachmentApplyConfiguration]
+	Fake        *kcptesting.Fake
 	ClusterPath logicalcluster.Path
 }
 
-func (c *volumeAttachmentsClient) Create(ctx context.Context, volumeAttachment *storagev1beta1.VolumeAttachment, opts metav1.CreateOptions) (*storagev1beta1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootCreateAction(volumeAttachmentsResource, c.ClusterPath, volumeAttachment), &storagev1beta1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) Update(ctx context.Context, volumeAttachment *storagev1beta1.VolumeAttachment, opts metav1.UpdateOptions) (*storagev1beta1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateAction(volumeAttachmentsResource, c.ClusterPath, volumeAttachment), &storagev1beta1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) UpdateStatus(ctx context.Context, volumeAttachment *storagev1beta1.VolumeAttachment, opts metav1.UpdateOptions) (*storagev1beta1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootUpdateSubresourceAction(volumeAttachmentsResource, c.ClusterPath, "status", volumeAttachment), &storagev1beta1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
-	_, err := c.Fake.Invokes(kcptesting.NewRootDeleteActionWithOptions(volumeAttachmentsResource, c.ClusterPath, name, opts), &storagev1beta1.VolumeAttachment{})
-	return err
-}
-
-func (c *volumeAttachmentsClient) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
-	action := kcptesting.NewRootDeleteCollectionAction(volumeAttachmentsResource, c.ClusterPath, listOpts)
-
-	_, err := c.Fake.Invokes(action, &storagev1beta1.VolumeAttachmentList{})
-	return err
-}
-
-func (c *volumeAttachmentsClient) Get(ctx context.Context, name string, options metav1.GetOptions) (*storagev1beta1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootGetAction(volumeAttachmentsResource, c.ClusterPath, name), &storagev1beta1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.VolumeAttachment), err
-}
-
-// List takes label and field selectors, and returns the list of VolumeAttachments that match those selectors.
-func (c *volumeAttachmentsClient) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.VolumeAttachmentList, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootListAction(volumeAttachmentsResource, volumeAttachmentsKind, c.ClusterPath, opts), &storagev1beta1.VolumeAttachmentList{})
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &storagev1beta1.VolumeAttachmentList{ListMeta: obj.(*storagev1beta1.VolumeAttachmentList).ListMeta}
-	for _, item := range obj.(*storagev1beta1.VolumeAttachmentList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-func (c *volumeAttachmentsClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
-	return c.Fake.InvokesWatch(kcptesting.NewRootWatchAction(volumeAttachmentsResource, c.ClusterPath, opts))
-}
-
-func (c *volumeAttachmentsClient) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (*storagev1beta1.VolumeAttachment, error) {
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(volumeAttachmentsResource, c.ClusterPath, name, pt, data, subresources...), &storagev1beta1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) Apply(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1beta1.VolumeAttachmentApplyConfiguration, opts metav1.ApplyOptions) (*storagev1beta1.VolumeAttachment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(volumeAttachmentsResource, c.ClusterPath, *name, types.ApplyPatchType, data), &storagev1beta1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*storagev1beta1.VolumeAttachment), err
-}
-
-func (c *volumeAttachmentsClient) ApplyStatus(ctx context.Context, applyConfiguration *applyconfigurationsstoragev1beta1.VolumeAttachmentApplyConfiguration, opts metav1.ApplyOptions) (*storagev1beta1.VolumeAttachment, error) {
-	if applyConfiguration == nil {
-		return nil, fmt.Errorf("applyConfiguration provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(applyConfiguration)
-	if err != nil {
-		return nil, err
-	}
-	name := applyConfiguration.Name
-	if name == nil {
-		return nil, fmt.Errorf("applyConfiguration.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.Invokes(kcptesting.NewRootPatchSubresourceAction(volumeAttachmentsResource, c.ClusterPath, *name, types.ApplyPatchType, data, "status"), &storagev1beta1.VolumeAttachment{})
-	if obj == nil {
-		return nil, err
+func newFakeVolumeAttachmentClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedstoragev1beta1.VolumeAttachmentInterface {
+	return &volumeAttachmentScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1beta1.VolumeAttachment, *storagev1beta1.VolumeAttachmentList, *v1beta1.VolumeAttachmentApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			storagev1beta1.SchemeGroupVersion.WithResource("volumeattachments"),
+			storagev1beta1.SchemeGroupVersion.WithKind("VolumeAttachment"),
+			func() *storagev1beta1.VolumeAttachment { return &storagev1beta1.VolumeAttachment{} },
+			func() *storagev1beta1.VolumeAttachmentList { return &storagev1beta1.VolumeAttachmentList{} },
+			func(dst, src *storagev1beta1.VolumeAttachmentList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1beta1.VolumeAttachmentList) []*storagev1beta1.VolumeAttachment {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1beta1.VolumeAttachmentList, items []*storagev1beta1.VolumeAttachment) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
 	}
-	return obj.(*storagev1beta1.VolumeAttachment), err
 }
diff --git a/kubernetes/typed/storage/v1beta1/fake/volumeattributesclass.go b/kubernetes/typed/storage/v1beta1/fake/volumeattributesclass.go
new file mode 100644
index 000000000..eed5c0f60
--- /dev/null
+++ b/kubernetes/typed/storage/v1beta1/fake/volumeattributesclass.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	storagev1beta1 "k8s.io/api/storage/v1beta1"
+	v1beta1 "k8s.io/client-go/applyconfigurations/storage/v1beta1"
+	typedstoragev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
+
+	typedkcpstoragev1beta1 "github.com/kcp-dev/client-go/kubernetes/typed/storage/v1beta1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// volumeAttributesClassClusterClient implements VolumeAttributesClassClusterInterface
+type volumeAttributesClassClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagev1beta1.VolumeAttributesClass, *storagev1beta1.VolumeAttributesClassList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeVolumeAttributesClassClusterClient(fake *StorageV1beta1ClusterClient) typedkcpstoragev1beta1.VolumeAttributesClassClusterInterface {
+	return &volumeAttributesClassClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagev1beta1.VolumeAttributesClass, *storagev1beta1.VolumeAttributesClassList](
+			fake.Fake,
+			storagev1beta1.SchemeGroupVersion.WithResource("volumeattributesclasses"),
+			storagev1beta1.SchemeGroupVersion.WithKind("VolumeAttributesClass"),
+			func() *storagev1beta1.VolumeAttributesClass { return &storagev1beta1.VolumeAttributesClass{} },
+			func() *storagev1beta1.VolumeAttributesClassList { return &storagev1beta1.VolumeAttributesClassList{} },
+			func(dst, src *storagev1beta1.VolumeAttributesClassList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1beta1.VolumeAttributesClassList) []*storagev1beta1.VolumeAttributesClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1beta1.VolumeAttributesClassList, items []*storagev1beta1.VolumeAttributesClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *volumeAttributesClassClusterClient) Cluster(cluster logicalcluster.Path) typedstoragev1beta1.VolumeAttributesClassInterface {
+	return newFakeVolumeAttributesClassClient(c.Fake, cluster)
+}
+
+// volumeAttributesClassScopedClient implements VolumeAttributesClassInterface
+type volumeAttributesClassScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagev1beta1.VolumeAttributesClass, *storagev1beta1.VolumeAttributesClassList, *v1beta1.VolumeAttributesClassApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeVolumeAttributesClassClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedstoragev1beta1.VolumeAttributesClassInterface {
+	return &volumeAttributesClassScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagev1beta1.VolumeAttributesClass, *storagev1beta1.VolumeAttributesClassList, *v1beta1.VolumeAttributesClassApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			storagev1beta1.SchemeGroupVersion.WithResource("volumeattributesclasses"),
+			storagev1beta1.SchemeGroupVersion.WithKind("VolumeAttributesClass"),
+			func() *storagev1beta1.VolumeAttributesClass { return &storagev1beta1.VolumeAttributesClass{} },
+			func() *storagev1beta1.VolumeAttributesClassList { return &storagev1beta1.VolumeAttributesClassList{} },
+			func(dst, src *storagev1beta1.VolumeAttributesClassList) { dst.ListMeta = src.ListMeta },
+			func(list *storagev1beta1.VolumeAttributesClassList) []*storagev1beta1.VolumeAttributesClass {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagev1beta1.VolumeAttributesClassList, items []*storagev1beta1.VolumeAttributesClass) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/storage/v1beta1/generated_expansion.go b/kubernetes/typed/storage/v1beta1/generated_expansion.go
new file mode 100644
index 000000000..77a632cfd
--- /dev/null
+++ b/kubernetes/typed/storage/v1beta1/generated_expansion.go
@@ -0,0 +1,31 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type CSIDriverClusterExpansion interface{}
+
+type CSINodeClusterExpansion interface{}
+
+type CSIStorageCapacityClusterExpansion interface{}
+
+type StorageClassClusterExpansion interface{}
+
+type VolumeAttachmentClusterExpansion interface{}
+
+type VolumeAttributesClassClusterExpansion interface{}
diff --git a/kubernetes/typed/storage/v1beta1/storage_client.go b/kubernetes/typed/storage/v1beta1/storage_client.go
index 1eb93d14e..80b402051 100644
--- a/kubernetes/typed/storage/v1beta1/storage_client.go
+++ b/kubernetes/typed/storage/v1beta1/storage_client.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,33 +14,37 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"net/http"
+	http "net/http"
+
+	apistoragev1beta1 "k8s.io/api/storage/v1beta1"
+	storagev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
+	rest "k8s.io/client-go/rest"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
-	"k8s.io/client-go/rest"
 )
 
 type StorageV1beta1ClusterInterface interface {
 	StorageV1beta1ClusterScoper
-	StorageClassesClusterGetter
-	VolumeAttachmentsClusterGetter
 	CSIDriversClusterGetter
 	CSINodesClusterGetter
 	CSIStorageCapacitiesClusterGetter
+	StorageClassesClusterGetter
+	VolumeAttachmentsClusterGetter
+	VolumeAttributesClassesClusterGetter
 }
 
 type StorageV1beta1ClusterScoper interface {
 	Cluster(logicalcluster.Path) storagev1beta1.StorageV1beta1Interface
 }
 
+// StorageV1beta1ClusterClient is used to interact with features provided by the storage.k8s.io group.
 type StorageV1beta1ClusterClient struct {
 	clientCache kcpclient.Cache[*storagev1beta1.StorageV1beta1Client]
 }
@@ -55,14 +56,6 @@ func (c *StorageV1beta1ClusterClient) Cluster(clusterPath logicalcluster.Path) s
 	return c.clientCache.ClusterOrDie(clusterPath)
 }
 
-func (c *StorageV1beta1ClusterClient) StorageClasses() StorageClassClusterInterface {
-	return &storageClassesClusterInterface{clientCache: c.clientCache}
-}
-
-func (c *StorageV1beta1ClusterClient) VolumeAttachments() VolumeAttachmentClusterInterface {
-	return &volumeAttachmentsClusterInterface{clientCache: c.clientCache}
-}
-
 func (c *StorageV1beta1ClusterClient) CSIDrivers() CSIDriverClusterInterface {
 	return &cSIDriversClusterInterface{clientCache: c.clientCache}
 }
@@ -75,15 +68,29 @@ func (c *StorageV1beta1ClusterClient) CSIStorageCapacities() CSIStorageCapacityC
 	return &cSIStorageCapacitiesClusterInterface{clientCache: c.clientCache}
 }
 
+func (c *StorageV1beta1ClusterClient) StorageClasses() StorageClassClusterInterface {
+	return &storageClassesClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *StorageV1beta1ClusterClient) VolumeAttachments() VolumeAttachmentClusterInterface {
+	return &volumeAttachmentsClusterInterface{clientCache: c.clientCache}
+}
+
+func (c *StorageV1beta1ClusterClient) VolumeAttributesClasses() VolumeAttributesClassClusterInterface {
+	return &volumeAttributesClassesClusterInterface{clientCache: c.clientCache}
+}
+
 // NewForConfig creates a new StorageV1beta1ClusterClient for the given config.
 // NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
 // where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*StorageV1beta1ClusterClient, error) {
-	client, err := rest.HTTPClientFor(c)
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
 	if err != nil {
 		return nil, err
 	}
-	return NewForConfigAndClient(c, client)
+	return NewForConfigAndClient(&config, httpClient)
 }
 
 // NewForConfigAndClient creates a new StorageV1beta1ClusterClient for the given config and http client.
@@ -95,6 +102,7 @@ func NewForConfigAndClient(c *rest.Config, h *http.Client) (*StorageV1beta1Clust
 	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
 		return nil, err
 	}
+
 	return &StorageV1beta1ClusterClient{clientCache: cache}, nil
 }
 
@@ -107,3 +115,14 @@ func NewForConfigOrDie(c *rest.Config) *StorageV1beta1ClusterClient {
 	}
 	return client
 }
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apistoragev1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/storage/v1beta1/storageclass.go b/kubernetes/typed/storage/v1beta1/storageclass.go
index 903ca2c80..9b54eb4a2 100644
--- a/kubernetes/typed/storage/v1beta1/storageclass.go
+++ b/kubernetes/typed/storage/v1beta1/storageclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apistoragev1beta1 "k8s.io/api/storage/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	storagev1beta1client "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 )
 
 // StorageClassesClusterGetter has a method to return a StorageClassClusterInterface.
@@ -40,19 +37,20 @@ type StorageClassesClusterGetter interface {
 }
 
 // StorageClassClusterInterface can operate on StorageClasses across all clusters,
-// or scope down to one cluster and return a storagev1beta1client.StorageClassInterface.
+// or scope down to one cluster and return a storagev1beta1.StorageClassInterface.
 type StorageClassClusterInterface interface {
-	Cluster(logicalcluster.Path) storagev1beta1client.StorageClassInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.StorageClassList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) storagev1beta1.StorageClassInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apistoragev1beta1.StorageClassList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	StorageClassClusterExpansion
 }
 
 type storageClassesClusterInterface struct {
-	clientCache kcpclient.Cache[*storagev1beta1client.StorageV1beta1Client]
+	clientCache kcpclient.Cache[*storagev1beta1.StorageV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *storageClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1beta1client.StorageClassInterface {
+func (c *storageClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1beta1.StorageClassInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *storageClassesClusterInterface) Cluster(clusterPath logicalcluster.Path
 }
 
 // List returns the entire collection of all StorageClasses across all clusters.
-func (c *storageClassesClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.StorageClassList, error) {
+func (c *storageClassesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apistoragev1beta1.StorageClassList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StorageClasses().List(ctx, opts)
 }
 
 // Watch begins to watch all StorageClasses across all clusters.
-func (c *storageClassesClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *storageClassesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StorageClasses().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/storage/v1beta1/volumeattachment.go b/kubernetes/typed/storage/v1beta1/volumeattachment.go
index 4c96a511f..49da01075 100644
--- a/kubernetes/typed/storage/v1beta1/volumeattachment.go
+++ b/kubernetes/typed/storage/v1beta1/volumeattachment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,20 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-client-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	"context"
+	context "context"
+
+	apistoragev1beta1 "k8s.io/api/storage/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 
 	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
 	"github.com/kcp-dev/logicalcluster/v3"
-
-	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/watch"
-	storagev1beta1client "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
 )
 
 // VolumeAttachmentsClusterGetter has a method to return a VolumeAttachmentClusterInterface.
@@ -40,19 +37,20 @@ type VolumeAttachmentsClusterGetter interface {
 }
 
 // VolumeAttachmentClusterInterface can operate on VolumeAttachments across all clusters,
-// or scope down to one cluster and return a storagev1beta1client.VolumeAttachmentInterface.
+// or scope down to one cluster and return a storagev1beta1.VolumeAttachmentInterface.
 type VolumeAttachmentClusterInterface interface {
-	Cluster(logicalcluster.Path) storagev1beta1client.VolumeAttachmentInterface
-	List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.VolumeAttachmentList, error)
-	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
+	Cluster(logicalcluster.Path) storagev1beta1.VolumeAttachmentInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apistoragev1beta1.VolumeAttachmentList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	VolumeAttachmentClusterExpansion
 }
 
 type volumeAttachmentsClusterInterface struct {
-	clientCache kcpclient.Cache[*storagev1beta1client.StorageV1beta1Client]
+	clientCache kcpclient.Cache[*storagev1beta1.StorageV1beta1Client]
 }
 
 // Cluster scopes the client down to a particular cluster.
-func (c *volumeAttachmentsClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1beta1client.VolumeAttachmentInterface {
+func (c *volumeAttachmentsClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1beta1.VolumeAttachmentInterface {
 	if clusterPath == logicalcluster.Wildcard {
 		panic("A specific cluster must be provided when scoping, not the wildcard.")
 	}
@@ -61,11 +59,11 @@ func (c *volumeAttachmentsClusterInterface) Cluster(clusterPath logicalcluster.P
 }
 
 // List returns the entire collection of all VolumeAttachments across all clusters.
-func (c *volumeAttachmentsClusterInterface) List(ctx context.Context, opts metav1.ListOptions) (*storagev1beta1.VolumeAttachmentList, error) {
+func (c *volumeAttachmentsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apistoragev1beta1.VolumeAttachmentList, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).VolumeAttachments().List(ctx, opts)
 }
 
 // Watch begins to watch all VolumeAttachments across all clusters.
-func (c *volumeAttachmentsClusterInterface) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+func (c *volumeAttachmentsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
 	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).VolumeAttachments().Watch(ctx, opts)
 }
diff --git a/kubernetes/typed/storage/v1beta1/volumeattributesclass.go b/kubernetes/typed/storage/v1beta1/volumeattributesclass.go
new file mode 100644
index 000000000..ecef9b4be
--- /dev/null
+++ b/kubernetes/typed/storage/v1beta1/volumeattributesclass.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	context "context"
+
+	apistoragev1beta1 "k8s.io/api/storage/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagev1beta1 "k8s.io/client-go/kubernetes/typed/storage/v1beta1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// VolumeAttributesClassesClusterGetter has a method to return a VolumeAttributesClassClusterInterface.
+// A group's cluster client should implement this interface.
+type VolumeAttributesClassesClusterGetter interface {
+	VolumeAttributesClasses() VolumeAttributesClassClusterInterface
+}
+
+// VolumeAttributesClassClusterInterface can operate on VolumeAttributesClasses across all clusters,
+// or scope down to one cluster and return a storagev1beta1.VolumeAttributesClassInterface.
+type VolumeAttributesClassClusterInterface interface {
+	Cluster(logicalcluster.Path) storagev1beta1.VolumeAttributesClassInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apistoragev1beta1.VolumeAttributesClassList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	VolumeAttributesClassClusterExpansion
+}
+
+type volumeAttributesClassesClusterInterface struct {
+	clientCache kcpclient.Cache[*storagev1beta1.StorageV1beta1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *volumeAttributesClassesClusterInterface) Cluster(clusterPath logicalcluster.Path) storagev1beta1.VolumeAttributesClassInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).VolumeAttributesClasses()
+}
+
+// List returns the entire collection of all VolumeAttributesClasses across all clusters.
+func (c *volumeAttributesClassesClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apistoragev1beta1.VolumeAttributesClassList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).VolumeAttributesClasses().List(ctx, opts)
+}
+
+// Watch begins to watch all VolumeAttributesClasses across all clusters.
+func (c *volumeAttributesClassesClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).VolumeAttributesClasses().Watch(ctx, opts)
+}
diff --git a/kubernetes/typed/storagemigration/v1alpha1/doc.go b/kubernetes/typed/storagemigration/v1alpha1/doc.go
new file mode 100644
index 000000000..08b80237c
--- /dev/null
+++ b/kubernetes/typed/storagemigration/v1alpha1/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha1
diff --git a/kubernetes/typed/storagemigration/v1alpha1/fake/doc.go b/kubernetes/typed/storagemigration/v1alpha1/fake/doc.go
new file mode 100644
index 000000000..b4777acfa
--- /dev/null
+++ b/kubernetes/typed/storagemigration/v1alpha1/fake/doc.go
@@ -0,0 +1,20 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated cluster clients.
+package fake
diff --git a/kubernetes/typed/storagemigration/v1alpha1/fake/storagemigration_client.go b/kubernetes/typed/storagemigration/v1alpha1/fake/storagemigration_client.go
new file mode 100644
index 000000000..ec94f067d
--- /dev/null
+++ b/kubernetes/typed/storagemigration/v1alpha1/fake/storagemigration_client.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	storagemigrationv1alpha1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1alpha1"
+	rest "k8s.io/client-go/rest"
+
+	kcpstoragemigrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storagemigration/v1alpha1"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+var _ kcpstoragemigrationv1alpha1.StoragemigrationV1alpha1ClusterInterface = (*StoragemigrationV1alpha1ClusterClient)(nil)
+
+type StoragemigrationV1alpha1ClusterClient struct {
+	*kcptesting.Fake
+}
+
+func (c *StoragemigrationV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) storagemigrationv1alpha1.StoragemigrationV1alpha1Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return &StoragemigrationV1alpha1Client{Fake: c.Fake, ClusterPath: clusterPath}
+}
+
+func (c *StoragemigrationV1alpha1ClusterClient) StorageVersionMigrations() kcpstoragemigrationv1alpha1.StorageVersionMigrationClusterInterface {
+	return newFakeStorageVersionMigrationClusterClient(c)
+}
+
+type StoragemigrationV1alpha1Client struct {
+	*kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func (c *StoragemigrationV1alpha1Client) StorageVersionMigrations() storagemigrationv1alpha1.StorageVersionMigrationInterface {
+	return newFakeStorageVersionMigrationClient(c.Fake, c.ClusterPath)
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *StoragemigrationV1alpha1Client) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}
diff --git a/kubernetes/typed/storagemigration/v1alpha1/fake/storageversionmigration.go b/kubernetes/typed/storagemigration/v1alpha1/fake/storageversionmigration.go
new file mode 100644
index 000000000..2e268911c
--- /dev/null
+++ b/kubernetes/typed/storagemigration/v1alpha1/fake/storageversionmigration.go
@@ -0,0 +1,98 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	storagemigrationv1alpha1 "k8s.io/api/storagemigration/v1alpha1"
+	v1alpha1 "k8s.io/client-go/applyconfigurations/storagemigration/v1alpha1"
+	typedstoragemigrationv1alpha1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1alpha1"
+
+	typedkcpstoragemigrationv1alpha1 "github.com/kcp-dev/client-go/kubernetes/typed/storagemigration/v1alpha1"
+	kcpgentype "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/gentype"
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// storageVersionMigrationClusterClient implements StorageVersionMigrationClusterInterface
+type storageVersionMigrationClusterClient struct {
+	*kcpgentype.FakeClusterClientWithList[*storagemigrationv1alpha1.StorageVersionMigration, *storagemigrationv1alpha1.StorageVersionMigrationList]
+	Fake *kcptesting.Fake
+}
+
+func newFakeStorageVersionMigrationClusterClient(fake *StoragemigrationV1alpha1ClusterClient) typedkcpstoragemigrationv1alpha1.StorageVersionMigrationClusterInterface {
+	return &storageVersionMigrationClusterClient{
+		kcpgentype.NewFakeClusterClientWithList[*storagemigrationv1alpha1.StorageVersionMigration, *storagemigrationv1alpha1.StorageVersionMigrationList](
+			fake.Fake,
+			storagemigrationv1alpha1.SchemeGroupVersion.WithResource("storageversionmigrations"),
+			storagemigrationv1alpha1.SchemeGroupVersion.WithKind("StorageVersionMigration"),
+			func() *storagemigrationv1alpha1.StorageVersionMigration {
+				return &storagemigrationv1alpha1.StorageVersionMigration{}
+			},
+			func() *storagemigrationv1alpha1.StorageVersionMigrationList {
+				return &storagemigrationv1alpha1.StorageVersionMigrationList{}
+			},
+			func(dst, src *storagemigrationv1alpha1.StorageVersionMigrationList) { dst.ListMeta = src.ListMeta },
+			func(list *storagemigrationv1alpha1.StorageVersionMigrationList) []*storagemigrationv1alpha1.StorageVersionMigration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagemigrationv1alpha1.StorageVersionMigrationList, items []*storagemigrationv1alpha1.StorageVersionMigration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake.Fake,
+	}
+}
+
+func (c *storageVersionMigrationClusterClient) Cluster(cluster logicalcluster.Path) typedstoragemigrationv1alpha1.StorageVersionMigrationInterface {
+	return newFakeStorageVersionMigrationClient(c.Fake, cluster)
+}
+
+// storageVersionMigrationScopedClient implements StorageVersionMigrationInterface
+type storageVersionMigrationScopedClient struct {
+	*kcpgentype.FakeClientWithListAndApply[*storagemigrationv1alpha1.StorageVersionMigration, *storagemigrationv1alpha1.StorageVersionMigrationList, *v1alpha1.StorageVersionMigrationApplyConfiguration]
+	Fake        *kcptesting.Fake
+	ClusterPath logicalcluster.Path
+}
+
+func newFakeStorageVersionMigrationClient(fake *kcptesting.Fake, clusterPath logicalcluster.Path) typedstoragemigrationv1alpha1.StorageVersionMigrationInterface {
+	return &storageVersionMigrationScopedClient{
+		kcpgentype.NewFakeClientWithListAndApply[*storagemigrationv1alpha1.StorageVersionMigration, *storagemigrationv1alpha1.StorageVersionMigrationList, *v1alpha1.StorageVersionMigrationApplyConfiguration](
+			fake,
+			clusterPath,
+			"",
+			storagemigrationv1alpha1.SchemeGroupVersion.WithResource("storageversionmigrations"),
+			storagemigrationv1alpha1.SchemeGroupVersion.WithKind("StorageVersionMigration"),
+			func() *storagemigrationv1alpha1.StorageVersionMigration {
+				return &storagemigrationv1alpha1.StorageVersionMigration{}
+			},
+			func() *storagemigrationv1alpha1.StorageVersionMigrationList {
+				return &storagemigrationv1alpha1.StorageVersionMigrationList{}
+			},
+			func(dst, src *storagemigrationv1alpha1.StorageVersionMigrationList) { dst.ListMeta = src.ListMeta },
+			func(list *storagemigrationv1alpha1.StorageVersionMigrationList) []*storagemigrationv1alpha1.StorageVersionMigration {
+				return kcpgentype.ToPointerSlice(list.Items)
+			},
+			func(list *storagemigrationv1alpha1.StorageVersionMigrationList, items []*storagemigrationv1alpha1.StorageVersionMigration) {
+				list.Items = kcpgentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+		clusterPath,
+	}
+}
diff --git a/kubernetes/typed/storagemigration/v1alpha1/generated_expansion.go b/kubernetes/typed/storagemigration/v1alpha1/generated_expansion.go
new file mode 100644
index 000000000..1e6dc0d32
--- /dev/null
+++ b/kubernetes/typed/storagemigration/v1alpha1/generated_expansion.go
@@ -0,0 +1,21 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+type StorageVersionMigrationClusterExpansion interface{}
diff --git a/kubernetes/typed/storagemigration/v1alpha1/storagemigration_client.go b/kubernetes/typed/storagemigration/v1alpha1/storagemigration_client.go
new file mode 100644
index 000000000..e060430fa
--- /dev/null
+++ b/kubernetes/typed/storagemigration/v1alpha1/storagemigration_client.go
@@ -0,0 +1,103 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	http "net/http"
+
+	apistoragemigrationv1alpha1 "k8s.io/api/storagemigration/v1alpha1"
+	storagemigrationv1alpha1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1alpha1"
+	rest "k8s.io/client-go/rest"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	kcpscheme "github.com/kcp-dev/client-go/kubernetes/scheme"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+type StoragemigrationV1alpha1ClusterInterface interface {
+	StoragemigrationV1alpha1ClusterScoper
+	StorageVersionMigrationsClusterGetter
+}
+
+type StoragemigrationV1alpha1ClusterScoper interface {
+	Cluster(logicalcluster.Path) storagemigrationv1alpha1.StoragemigrationV1alpha1Interface
+}
+
+// StoragemigrationV1alpha1ClusterClient is used to interact with features provided by the storagemigration.k8s.io group.
+type StoragemigrationV1alpha1ClusterClient struct {
+	clientCache kcpclient.Cache[*storagemigrationv1alpha1.StoragemigrationV1alpha1Client]
+}
+
+func (c *StoragemigrationV1alpha1ClusterClient) Cluster(clusterPath logicalcluster.Path) storagemigrationv1alpha1.StoragemigrationV1alpha1Interface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+	return c.clientCache.ClusterOrDie(clusterPath)
+}
+
+func (c *StoragemigrationV1alpha1ClusterClient) StorageVersionMigrations() StorageVersionMigrationClusterInterface {
+	return &storageVersionMigrationsClusterInterface{clientCache: c.clientCache}
+}
+
+// NewForConfig creates a new StoragemigrationV1alpha1ClusterClient for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*StoragemigrationV1alpha1ClusterClient, error) {
+	config := *c
+	setConfigDefaults(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new StoragemigrationV1alpha1ClusterClient for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*StoragemigrationV1alpha1ClusterClient, error) {
+	cache := kcpclient.NewCache(c, h, &kcpclient.Constructor[*storagemigrationv1alpha1.StoragemigrationV1alpha1Client]{
+		NewForConfigAndClient: storagemigrationv1alpha1.NewForConfigAndClient,
+	})
+	if _, err := cache.Cluster(logicalcluster.Name("root").Path()); err != nil {
+		return nil, err
+	}
+
+	return &StoragemigrationV1alpha1ClusterClient{clientCache: cache}, nil
+}
+
+// NewForConfigOrDie creates a new StoragemigrationV1alpha1ClusterClient for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *StoragemigrationV1alpha1ClusterClient {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+func setConfigDefaults(config *rest.Config) {
+	gv := apistoragemigrationv1alpha1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = rest.CodecFactoryForGeneratedClient(kcpscheme.Scheme, kcpscheme.Codecs).WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+}
diff --git a/kubernetes/typed/storagemigration/v1alpha1/storageversionmigration.go b/kubernetes/typed/storagemigration/v1alpha1/storageversionmigration.go
new file mode 100644
index 000000000..8f22d72ba
--- /dev/null
+++ b/kubernetes/typed/storagemigration/v1alpha1/storageversionmigration.go
@@ -0,0 +1,69 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	apistoragemigrationv1alpha1 "k8s.io/api/storagemigration/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	watch "k8s.io/apimachinery/pkg/watch"
+	storagemigrationv1alpha1 "k8s.io/client-go/kubernetes/typed/storagemigration/v1alpha1"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// StorageVersionMigrationsClusterGetter has a method to return a StorageVersionMigrationClusterInterface.
+// A group's cluster client should implement this interface.
+type StorageVersionMigrationsClusterGetter interface {
+	StorageVersionMigrations() StorageVersionMigrationClusterInterface
+}
+
+// StorageVersionMigrationClusterInterface can operate on StorageVersionMigrations across all clusters,
+// or scope down to one cluster and return a storagemigrationv1alpha1.StorageVersionMigrationInterface.
+type StorageVersionMigrationClusterInterface interface {
+	Cluster(logicalcluster.Path) storagemigrationv1alpha1.StorageVersionMigrationInterface
+	List(ctx context.Context, opts v1.ListOptions) (*apistoragemigrationv1alpha1.StorageVersionMigrationList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	StorageVersionMigrationClusterExpansion
+}
+
+type storageVersionMigrationsClusterInterface struct {
+	clientCache kcpclient.Cache[*storagemigrationv1alpha1.StoragemigrationV1alpha1Client]
+}
+
+// Cluster scopes the client down to a particular cluster.
+func (c *storageVersionMigrationsClusterInterface) Cluster(clusterPath logicalcluster.Path) storagemigrationv1alpha1.StorageVersionMigrationInterface {
+	if clusterPath == logicalcluster.Wildcard {
+		panic("A specific cluster must be provided when scoping, not the wildcard.")
+	}
+
+	return c.clientCache.ClusterOrDie(clusterPath).StorageVersionMigrations()
+}
+
+// List returns the entire collection of all StorageVersionMigrations across all clusters.
+func (c *storageVersionMigrationsClusterInterface) List(ctx context.Context, opts v1.ListOptions) (*apistoragemigrationv1alpha1.StorageVersionMigrationList, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StorageVersionMigrations().List(ctx, opts)
+}
+
+// Watch begins to watch all StorageVersionMigrations across all clusters.
+func (c *storageVersionMigrationsClusterInterface) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.clientCache.ClusterOrDie(logicalcluster.Wildcard).StorageVersionMigrations().Watch(ctx, opts)
+}
diff --git a/hack/boilerplate/boilerplate.generatego.txt b/listers/admissionregistration/v1/expansion_generated.go
similarity index 84%
rename from hack/boilerplate/boilerplate.generatego.txt
rename to listers/admissionregistration/v1/expansion_generated.go
index 2d3aa5143..b6a0c6377 100644
--- a/hack/boilerplate/boilerplate.generatego.txt
+++ b/listers/admissionregistration/v1/expansion_generated.go
@@ -1,5 +1,5 @@
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,3 +14,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/admissionregistration/v1/mutatingwebhookconfiguration.go b/listers/admissionregistration/v1/mutatingwebhookconfiguration.go
index 7b7c82828..d8ae61dda 100644
--- a/listers/admissionregistration/v1/mutatingwebhookconfiguration.go
+++ b/listers/admissionregistration/v1/mutatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	admissionregistrationv1listers "k8s.io/client-go/listers/admissionregistration/v1"
+	listersadmissionregistrationv1 "k8s.io/client-go/listers/admissionregistration/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// MutatingWebhookConfigurationClusterLister can list MutatingWebhookConfigurations across all workspaces, or scope down to a MutatingWebhookConfigurationLister for one workspace.
+// MutatingWebhookConfigurationClusterLister helps list MutatingWebhookConfigurations across all workspaces,
+// or scope down to a MutatingWebhookConfigurationLister for one workspace.
 // All objects returned here must be treated as read-only.
 type MutatingWebhookConfigurationClusterLister interface {
 	// List lists all MutatingWebhookConfigurations in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*admissionregistrationv1.MutatingWebhookConfiguration, err error)
 	// Cluster returns a lister that can list and get MutatingWebhookConfigurations in one workspace.
-	Cluster(clusterName logicalcluster.Name) admissionregistrationv1listers.MutatingWebhookConfigurationLister
+	Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1.MutatingWebhookConfigurationLister
 	MutatingWebhookConfigurationClusterListerExpansion
 }
 
+// mutatingWebhookConfigurationClusterLister implements the MutatingWebhookConfigurationClusterLister interface.
 type mutatingWebhookConfigurationClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*admissionregistrationv1.MutatingWebhookConfiguration]
 }
 
+var _ MutatingWebhookConfigurationClusterLister = new(mutatingWebhookConfigurationClusterLister)
+
 // NewMutatingWebhookConfigurationClusterLister returns a new MutatingWebhookConfigurationClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewMutatingWebhookConfigurationClusterLister(indexer cache.Indexer) *mutatingWebhookConfigurationClusterLister {
-	return &mutatingWebhookConfigurationClusterLister{indexer: indexer}
-}
-
-// List lists all MutatingWebhookConfigurations in the indexer across all workspaces.
-func (s *mutatingWebhookConfigurationClusterLister) List(selector labels.Selector) (ret []*admissionregistrationv1.MutatingWebhookConfiguration, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*admissionregistrationv1.MutatingWebhookConfiguration))
-	})
-	return ret, err
+func NewMutatingWebhookConfigurationClusterLister(indexer cache.Indexer) MutatingWebhookConfigurationClusterLister {
+	return &mutatingWebhookConfigurationClusterLister{
+		kcplisters.NewCluster[*admissionregistrationv1.MutatingWebhookConfiguration](indexer, admissionregistrationv1.Resource("mutatingwebhookconfiguration")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get MutatingWebhookConfigurations.
-func (s *mutatingWebhookConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) admissionregistrationv1listers.MutatingWebhookConfigurationLister {
-	return &mutatingWebhookConfigurationLister{indexer: s.indexer, clusterName: clusterName}
+func (l *mutatingWebhookConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1.MutatingWebhookConfigurationLister {
+	return &mutatingWebhookConfigurationLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// mutatingWebhookConfigurationLister implements the admissionregistrationv1listers.MutatingWebhookConfigurationLister interface.
+// mutatingWebhookConfigurationLister can list all MutatingWebhookConfigurations inside a workspace
+// or scope down to a listersadmissionregistrationv1.MutatingWebhookConfigurationNamespaceLister for one namespace.
 type mutatingWebhookConfigurationLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*admissionregistrationv1.MutatingWebhookConfiguration]
 }
 
-// List lists all MutatingWebhookConfigurations in the indexer for a workspace.
-func (s *mutatingWebhookConfigurationLister) List(selector labels.Selector) (ret []*admissionregistrationv1.MutatingWebhookConfiguration, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*admissionregistrationv1.MutatingWebhookConfiguration))
-	})
-	return ret, err
-}
+var _ listersadmissionregistrationv1.MutatingWebhookConfigurationLister = new(mutatingWebhookConfigurationLister)
 
-// Get retrieves the MutatingWebhookConfiguration from the indexer for a given workspace and name.
-func (s *mutatingWebhookConfigurationLister) Get(name string) (*admissionregistrationv1.MutatingWebhookConfiguration, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(admissionregistrationv1.Resource("mutatingwebhookconfigurations"), name)
+// NewMutatingWebhookConfigurationLister returns a new MutatingWebhookConfigurationLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewMutatingWebhookConfigurationLister(indexer cache.Indexer) listersadmissionregistrationv1.MutatingWebhookConfigurationLister {
+	return &mutatingWebhookConfigurationLister{
+		kcplisters.New[*admissionregistrationv1.MutatingWebhookConfiguration](indexer, admissionregistrationv1.Resource("mutatingwebhookconfiguration")),
 	}
-	return obj.(*admissionregistrationv1.MutatingWebhookConfiguration), nil
+}
+
+// mutatingWebhookConfigurationScopedLister can list all MutatingWebhookConfigurations inside a workspace
+// or scope down to a listersadmissionregistrationv1.MutatingWebhookConfigurationNamespaceLister.
+type mutatingWebhookConfigurationScopedLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1.MutatingWebhookConfiguration]
 }
diff --git a/listers/admissionregistration/v1/mutatingwebhookconfiguration_expansion.go b/listers/admissionregistration/v1/mutatingwebhookconfiguration_expansion.go
index ad9ad945b..a5e155e39 100644
--- a/listers/admissionregistration/v1/mutatingwebhookconfiguration_expansion.go
+++ b/listers/admissionregistration/v1/mutatingwebhookconfiguration_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/admissionregistration/v1/validatingadmissionpolicy.go b/listers/admissionregistration/v1/validatingadmissionpolicy.go
new file mode 100644
index 000000000..e629be54a
--- /dev/null
+++ b/listers/admissionregistration/v1/validatingadmissionpolicy.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersadmissionregistrationv1 "k8s.io/client-go/listers/admissionregistration/v1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ValidatingAdmissionPolicyClusterLister helps list ValidatingAdmissionPolicies across all workspaces,
+// or scope down to a ValidatingAdmissionPolicyLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ValidatingAdmissionPolicyClusterLister interface {
+	// List lists all ValidatingAdmissionPolicies in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*admissionregistrationv1.ValidatingAdmissionPolicy, err error)
+	// Cluster returns a lister that can list and get ValidatingAdmissionPolicies in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1.ValidatingAdmissionPolicyLister
+	ValidatingAdmissionPolicyClusterListerExpansion
+}
+
+// validatingAdmissionPolicyClusterLister implements the ValidatingAdmissionPolicyClusterLister interface.
+type validatingAdmissionPolicyClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*admissionregistrationv1.ValidatingAdmissionPolicy]
+}
+
+var _ ValidatingAdmissionPolicyClusterLister = new(validatingAdmissionPolicyClusterLister)
+
+// NewValidatingAdmissionPolicyClusterLister returns a new ValidatingAdmissionPolicyClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewValidatingAdmissionPolicyClusterLister(indexer cache.Indexer) ValidatingAdmissionPolicyClusterLister {
+	return &validatingAdmissionPolicyClusterLister{
+		kcplisters.NewCluster[*admissionregistrationv1.ValidatingAdmissionPolicy](indexer, admissionregistrationv1.Resource("validatingadmissionpolicy")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ValidatingAdmissionPolicies.
+func (l *validatingAdmissionPolicyClusterLister) Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1.ValidatingAdmissionPolicyLister {
+	return &validatingAdmissionPolicyLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// validatingAdmissionPolicyLister can list all ValidatingAdmissionPolicies inside a workspace
+// or scope down to a listersadmissionregistrationv1.ValidatingAdmissionPolicyNamespaceLister for one namespace.
+type validatingAdmissionPolicyLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1.ValidatingAdmissionPolicy]
+}
+
+var _ listersadmissionregistrationv1.ValidatingAdmissionPolicyLister = new(validatingAdmissionPolicyLister)
+
+// NewValidatingAdmissionPolicyLister returns a new ValidatingAdmissionPolicyLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewValidatingAdmissionPolicyLister(indexer cache.Indexer) listersadmissionregistrationv1.ValidatingAdmissionPolicyLister {
+	return &validatingAdmissionPolicyLister{
+		kcplisters.New[*admissionregistrationv1.ValidatingAdmissionPolicy](indexer, admissionregistrationv1.Resource("validatingadmissionpolicy")),
+	}
+}
+
+// validatingAdmissionPolicyScopedLister can list all ValidatingAdmissionPolicies inside a workspace
+// or scope down to a listersadmissionregistrationv1.ValidatingAdmissionPolicyNamespaceLister.
+type validatingAdmissionPolicyScopedLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1.ValidatingAdmissionPolicy]
+}
diff --git a/listers/admissionregistration/v1/validatingadmissionpolicy_expansion.go b/listers/admissionregistration/v1/validatingadmissionpolicy_expansion.go
new file mode 100644
index 000000000..726ce2ea4
--- /dev/null
+++ b/listers/admissionregistration/v1/validatingadmissionpolicy_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1
+
+// ValidatingAdmissionPolicyClusterListerExpansion allows custom methods to be added to ValidatingAdmissionPolicyClusterLister.
+type ValidatingAdmissionPolicyClusterListerExpansion interface{}
diff --git a/listers/admissionregistration/v1/validatingadmissionpolicybinding.go b/listers/admissionregistration/v1/validatingadmissionpolicybinding.go
new file mode 100644
index 000000000..870606fc5
--- /dev/null
+++ b/listers/admissionregistration/v1/validatingadmissionpolicybinding.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersadmissionregistrationv1 "k8s.io/client-go/listers/admissionregistration/v1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ValidatingAdmissionPolicyBindingClusterLister helps list ValidatingAdmissionPolicyBindings across all workspaces,
+// or scope down to a ValidatingAdmissionPolicyBindingLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ValidatingAdmissionPolicyBindingClusterLister interface {
+	// List lists all ValidatingAdmissionPolicyBindings in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*admissionregistrationv1.ValidatingAdmissionPolicyBinding, err error)
+	// Cluster returns a lister that can list and get ValidatingAdmissionPolicyBindings in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1.ValidatingAdmissionPolicyBindingLister
+	ValidatingAdmissionPolicyBindingClusterListerExpansion
+}
+
+// validatingAdmissionPolicyBindingClusterLister implements the ValidatingAdmissionPolicyBindingClusterLister interface.
+type validatingAdmissionPolicyBindingClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*admissionregistrationv1.ValidatingAdmissionPolicyBinding]
+}
+
+var _ ValidatingAdmissionPolicyBindingClusterLister = new(validatingAdmissionPolicyBindingClusterLister)
+
+// NewValidatingAdmissionPolicyBindingClusterLister returns a new ValidatingAdmissionPolicyBindingClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewValidatingAdmissionPolicyBindingClusterLister(indexer cache.Indexer) ValidatingAdmissionPolicyBindingClusterLister {
+	return &validatingAdmissionPolicyBindingClusterLister{
+		kcplisters.NewCluster[*admissionregistrationv1.ValidatingAdmissionPolicyBinding](indexer, admissionregistrationv1.Resource("validatingadmissionpolicybinding")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ValidatingAdmissionPolicyBindings.
+func (l *validatingAdmissionPolicyBindingClusterLister) Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1.ValidatingAdmissionPolicyBindingLister {
+	return &validatingAdmissionPolicyBindingLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// validatingAdmissionPolicyBindingLister can list all ValidatingAdmissionPolicyBindings inside a workspace
+// or scope down to a listersadmissionregistrationv1.ValidatingAdmissionPolicyBindingNamespaceLister for one namespace.
+type validatingAdmissionPolicyBindingLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1.ValidatingAdmissionPolicyBinding]
+}
+
+var _ listersadmissionregistrationv1.ValidatingAdmissionPolicyBindingLister = new(validatingAdmissionPolicyBindingLister)
+
+// NewValidatingAdmissionPolicyBindingLister returns a new ValidatingAdmissionPolicyBindingLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewValidatingAdmissionPolicyBindingLister(indexer cache.Indexer) listersadmissionregistrationv1.ValidatingAdmissionPolicyBindingLister {
+	return &validatingAdmissionPolicyBindingLister{
+		kcplisters.New[*admissionregistrationv1.ValidatingAdmissionPolicyBinding](indexer, admissionregistrationv1.Resource("validatingadmissionpolicybinding")),
+	}
+}
+
+// validatingAdmissionPolicyBindingScopedLister can list all ValidatingAdmissionPolicyBindings inside a workspace
+// or scope down to a listersadmissionregistrationv1.ValidatingAdmissionPolicyBindingNamespaceLister.
+type validatingAdmissionPolicyBindingScopedLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1.ValidatingAdmissionPolicyBinding]
+}
diff --git a/listers/admissionregistration/v1/validatingadmissionpolicybinding_expansion.go b/listers/admissionregistration/v1/validatingadmissionpolicybinding_expansion.go
new file mode 100644
index 000000000..d1deade29
--- /dev/null
+++ b/listers/admissionregistration/v1/validatingadmissionpolicybinding_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1
+
+// ValidatingAdmissionPolicyBindingClusterListerExpansion allows custom methods to be added to ValidatingAdmissionPolicyBindingClusterLister.
+type ValidatingAdmissionPolicyBindingClusterListerExpansion interface{}
diff --git a/listers/admissionregistration/v1/validatingwebhookconfiguration.go b/listers/admissionregistration/v1/validatingwebhookconfiguration.go
index ee961bb34..cdd0b6ed4 100644
--- a/listers/admissionregistration/v1/validatingwebhookconfiguration.go
+++ b/listers/admissionregistration/v1/validatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	admissionregistrationv1listers "k8s.io/client-go/listers/admissionregistration/v1"
+	listersadmissionregistrationv1 "k8s.io/client-go/listers/admissionregistration/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ValidatingWebhookConfigurationClusterLister can list ValidatingWebhookConfigurations across all workspaces, or scope down to a ValidatingWebhookConfigurationLister for one workspace.
+// ValidatingWebhookConfigurationClusterLister helps list ValidatingWebhookConfigurations across all workspaces,
+// or scope down to a ValidatingWebhookConfigurationLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ValidatingWebhookConfigurationClusterLister interface {
 	// List lists all ValidatingWebhookConfigurations in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*admissionregistrationv1.ValidatingWebhookConfiguration, err error)
 	// Cluster returns a lister that can list and get ValidatingWebhookConfigurations in one workspace.
-	Cluster(clusterName logicalcluster.Name) admissionregistrationv1listers.ValidatingWebhookConfigurationLister
+	Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1.ValidatingWebhookConfigurationLister
 	ValidatingWebhookConfigurationClusterListerExpansion
 }
 
+// validatingWebhookConfigurationClusterLister implements the ValidatingWebhookConfigurationClusterLister interface.
 type validatingWebhookConfigurationClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*admissionregistrationv1.ValidatingWebhookConfiguration]
 }
 
+var _ ValidatingWebhookConfigurationClusterLister = new(validatingWebhookConfigurationClusterLister)
+
 // NewValidatingWebhookConfigurationClusterLister returns a new ValidatingWebhookConfigurationClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewValidatingWebhookConfigurationClusterLister(indexer cache.Indexer) *validatingWebhookConfigurationClusterLister {
-	return &validatingWebhookConfigurationClusterLister{indexer: indexer}
-}
-
-// List lists all ValidatingWebhookConfigurations in the indexer across all workspaces.
-func (s *validatingWebhookConfigurationClusterLister) List(selector labels.Selector) (ret []*admissionregistrationv1.ValidatingWebhookConfiguration, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*admissionregistrationv1.ValidatingWebhookConfiguration))
-	})
-	return ret, err
+func NewValidatingWebhookConfigurationClusterLister(indexer cache.Indexer) ValidatingWebhookConfigurationClusterLister {
+	return &validatingWebhookConfigurationClusterLister{
+		kcplisters.NewCluster[*admissionregistrationv1.ValidatingWebhookConfiguration](indexer, admissionregistrationv1.Resource("validatingwebhookconfiguration")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ValidatingWebhookConfigurations.
-func (s *validatingWebhookConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) admissionregistrationv1listers.ValidatingWebhookConfigurationLister {
-	return &validatingWebhookConfigurationLister{indexer: s.indexer, clusterName: clusterName}
+func (l *validatingWebhookConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1.ValidatingWebhookConfigurationLister {
+	return &validatingWebhookConfigurationLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// validatingWebhookConfigurationLister implements the admissionregistrationv1listers.ValidatingWebhookConfigurationLister interface.
+// validatingWebhookConfigurationLister can list all ValidatingWebhookConfigurations inside a workspace
+// or scope down to a listersadmissionregistrationv1.ValidatingWebhookConfigurationNamespaceLister for one namespace.
 type validatingWebhookConfigurationLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*admissionregistrationv1.ValidatingWebhookConfiguration]
 }
 
-// List lists all ValidatingWebhookConfigurations in the indexer for a workspace.
-func (s *validatingWebhookConfigurationLister) List(selector labels.Selector) (ret []*admissionregistrationv1.ValidatingWebhookConfiguration, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*admissionregistrationv1.ValidatingWebhookConfiguration))
-	})
-	return ret, err
-}
+var _ listersadmissionregistrationv1.ValidatingWebhookConfigurationLister = new(validatingWebhookConfigurationLister)
 
-// Get retrieves the ValidatingWebhookConfiguration from the indexer for a given workspace and name.
-func (s *validatingWebhookConfigurationLister) Get(name string) (*admissionregistrationv1.ValidatingWebhookConfiguration, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(admissionregistrationv1.Resource("validatingwebhookconfigurations"), name)
+// NewValidatingWebhookConfigurationLister returns a new ValidatingWebhookConfigurationLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewValidatingWebhookConfigurationLister(indexer cache.Indexer) listersadmissionregistrationv1.ValidatingWebhookConfigurationLister {
+	return &validatingWebhookConfigurationLister{
+		kcplisters.New[*admissionregistrationv1.ValidatingWebhookConfiguration](indexer, admissionregistrationv1.Resource("validatingwebhookconfiguration")),
 	}
-	return obj.(*admissionregistrationv1.ValidatingWebhookConfiguration), nil
+}
+
+// validatingWebhookConfigurationScopedLister can list all ValidatingWebhookConfigurations inside a workspace
+// or scope down to a listersadmissionregistrationv1.ValidatingWebhookConfigurationNamespaceLister.
+type validatingWebhookConfigurationScopedLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1.ValidatingWebhookConfiguration]
 }
diff --git a/listers/admissionregistration/v1/validatingwebhookconfiguration_expansion.go b/listers/admissionregistration/v1/validatingwebhookconfiguration_expansion.go
index bb551f8ed..f7aa161de 100644
--- a/listers/admissionregistration/v1/validatingwebhookconfiguration_expansion.go
+++ b/listers/admissionregistration/v1/validatingwebhookconfiguration_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/admissionregistration/v1alpha1/expansion_generated.go b/listers/admissionregistration/v1alpha1/expansion_generated.go
new file mode 100644
index 000000000..3b8521c00
--- /dev/null
+++ b/listers/admissionregistration/v1alpha1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
diff --git a/listers/admissionregistration/v1alpha1/mutatingadmissionpolicy.go b/listers/admissionregistration/v1alpha1/mutatingadmissionpolicy.go
new file mode 100644
index 000000000..24ccab7dc
--- /dev/null
+++ b/listers/admissionregistration/v1alpha1/mutatingadmissionpolicy.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersadmissionregistrationv1alpha1 "k8s.io/client-go/listers/admissionregistration/v1alpha1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// MutatingAdmissionPolicyClusterLister helps list MutatingAdmissionPolicies across all workspaces,
+// or scope down to a MutatingAdmissionPolicyLister for one workspace.
+// All objects returned here must be treated as read-only.
+type MutatingAdmissionPolicyClusterLister interface {
+	// List lists all MutatingAdmissionPolicies in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*admissionregistrationv1alpha1.MutatingAdmissionPolicy, err error)
+	// Cluster returns a lister that can list and get MutatingAdmissionPolicies in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyLister
+	MutatingAdmissionPolicyClusterListerExpansion
+}
+
+// mutatingAdmissionPolicyClusterLister implements the MutatingAdmissionPolicyClusterLister interface.
+type mutatingAdmissionPolicyClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*admissionregistrationv1alpha1.MutatingAdmissionPolicy]
+}
+
+var _ MutatingAdmissionPolicyClusterLister = new(mutatingAdmissionPolicyClusterLister)
+
+// NewMutatingAdmissionPolicyClusterLister returns a new MutatingAdmissionPolicyClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewMutatingAdmissionPolicyClusterLister(indexer cache.Indexer) MutatingAdmissionPolicyClusterLister {
+	return &mutatingAdmissionPolicyClusterLister{
+		kcplisters.NewCluster[*admissionregistrationv1alpha1.MutatingAdmissionPolicy](indexer, admissionregistrationv1alpha1.Resource("mutatingadmissionpolicy")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get MutatingAdmissionPolicies.
+func (l *mutatingAdmissionPolicyClusterLister) Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyLister {
+	return &mutatingAdmissionPolicyLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// mutatingAdmissionPolicyLister can list all MutatingAdmissionPolicies inside a workspace
+// or scope down to a listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyNamespaceLister for one namespace.
+type mutatingAdmissionPolicyLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1alpha1.MutatingAdmissionPolicy]
+}
+
+var _ listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyLister = new(mutatingAdmissionPolicyLister)
+
+// NewMutatingAdmissionPolicyLister returns a new MutatingAdmissionPolicyLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewMutatingAdmissionPolicyLister(indexer cache.Indexer) listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyLister {
+	return &mutatingAdmissionPolicyLister{
+		kcplisters.New[*admissionregistrationv1alpha1.MutatingAdmissionPolicy](indexer, admissionregistrationv1alpha1.Resource("mutatingadmissionpolicy")),
+	}
+}
+
+// mutatingAdmissionPolicyScopedLister can list all MutatingAdmissionPolicies inside a workspace
+// or scope down to a listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyNamespaceLister.
+type mutatingAdmissionPolicyScopedLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1alpha1.MutatingAdmissionPolicy]
+}
diff --git a/listers/networking/v1alpha1/clustercidr_expansion.go b/listers/admissionregistration/v1alpha1/mutatingadmissionpolicy_expansion.go
similarity index 74%
rename from listers/networking/v1alpha1/clustercidr_expansion.go
rename to listers/admissionregistration/v1alpha1/mutatingadmissionpolicy_expansion.go
index 3c4e409dd..44362c26a 100644
--- a/listers/networking/v1alpha1/clustercidr_expansion.go
+++ b/listers/admissionregistration/v1alpha1/mutatingadmissionpolicy_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
@@ -21,5 +18,5 @@ limitations under the License.
 
 package v1alpha1
 
-// ClusterCIDRClusterListerExpansion allows custom methods to be added to ClusterCIDRClusterLister.
-type ClusterCIDRClusterListerExpansion interface{}
+// MutatingAdmissionPolicyClusterListerExpansion allows custom methods to be added to MutatingAdmissionPolicyClusterLister.
+type MutatingAdmissionPolicyClusterListerExpansion interface{}
diff --git a/listers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go b/listers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go
new file mode 100644
index 000000000..00fc88963
--- /dev/null
+++ b/listers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersadmissionregistrationv1alpha1 "k8s.io/client-go/listers/admissionregistration/v1alpha1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// MutatingAdmissionPolicyBindingClusterLister helps list MutatingAdmissionPolicyBindings across all workspaces,
+// or scope down to a MutatingAdmissionPolicyBindingLister for one workspace.
+// All objects returned here must be treated as read-only.
+type MutatingAdmissionPolicyBindingClusterLister interface {
+	// List lists all MutatingAdmissionPolicyBindings in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding, err error)
+	// Cluster returns a lister that can list and get MutatingAdmissionPolicyBindings in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingLister
+	MutatingAdmissionPolicyBindingClusterListerExpansion
+}
+
+// mutatingAdmissionPolicyBindingClusterLister implements the MutatingAdmissionPolicyBindingClusterLister interface.
+type mutatingAdmissionPolicyBindingClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding]
+}
+
+var _ MutatingAdmissionPolicyBindingClusterLister = new(mutatingAdmissionPolicyBindingClusterLister)
+
+// NewMutatingAdmissionPolicyBindingClusterLister returns a new MutatingAdmissionPolicyBindingClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewMutatingAdmissionPolicyBindingClusterLister(indexer cache.Indexer) MutatingAdmissionPolicyBindingClusterLister {
+	return &mutatingAdmissionPolicyBindingClusterLister{
+		kcplisters.NewCluster[*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding](indexer, admissionregistrationv1alpha1.Resource("mutatingadmissionpolicybinding")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get MutatingAdmissionPolicyBindings.
+func (l *mutatingAdmissionPolicyBindingClusterLister) Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingLister {
+	return &mutatingAdmissionPolicyBindingLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// mutatingAdmissionPolicyBindingLister can list all MutatingAdmissionPolicyBindings inside a workspace
+// or scope down to a listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingNamespaceLister for one namespace.
+type mutatingAdmissionPolicyBindingLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding]
+}
+
+var _ listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingLister = new(mutatingAdmissionPolicyBindingLister)
+
+// NewMutatingAdmissionPolicyBindingLister returns a new MutatingAdmissionPolicyBindingLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewMutatingAdmissionPolicyBindingLister(indexer cache.Indexer) listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingLister {
+	return &mutatingAdmissionPolicyBindingLister{
+		kcplisters.New[*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding](indexer, admissionregistrationv1alpha1.Resource("mutatingadmissionpolicybinding")),
+	}
+}
+
+// mutatingAdmissionPolicyBindingScopedLister can list all MutatingAdmissionPolicyBindings inside a workspace
+// or scope down to a listersadmissionregistrationv1alpha1.MutatingAdmissionPolicyBindingNamespaceLister.
+type mutatingAdmissionPolicyBindingScopedLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1alpha1.MutatingAdmissionPolicyBinding]
+}
diff --git a/listers/resource/v1alpha1/resourceclass_expansion.go b/listers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding_expansion.go
similarity index 73%
rename from listers/resource/v1alpha1/resourceclass_expansion.go
rename to listers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding_expansion.go
index 558975914..cccaebc0f 100644
--- a/listers/resource/v1alpha1/resourceclass_expansion.go
+++ b/listers/admissionregistration/v1alpha1/mutatingadmissionpolicybinding_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
@@ -21,5 +18,5 @@ limitations under the License.
 
 package v1alpha1
 
-// ResourceClassClusterListerExpansion allows custom methods to be added to ResourceClassClusterLister.
-type ResourceClassClusterListerExpansion interface{}
+// MutatingAdmissionPolicyBindingClusterListerExpansion allows custom methods to be added to MutatingAdmissionPolicyBindingClusterLister.
+type MutatingAdmissionPolicyBindingClusterListerExpansion interface{}
diff --git a/listers/admissionregistration/v1alpha1/validatingadmissionpolicy.go b/listers/admissionregistration/v1alpha1/validatingadmissionpolicy.go
index 011839050..adb8bd5c2 100644
--- a/listers/admissionregistration/v1alpha1/validatingadmissionpolicy.go
+++ b/listers/admissionregistration/v1alpha1/validatingadmissionpolicy.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	admissionregistrationv1alpha1listers "k8s.io/client-go/listers/admissionregistration/v1alpha1"
+	listersadmissionregistrationv1alpha1 "k8s.io/client-go/listers/admissionregistration/v1alpha1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ValidatingAdmissionPolicyClusterLister can list ValidatingAdmissionPolicies across all workspaces, or scope down to a ValidatingAdmissionPolicyLister for one workspace.
+// ValidatingAdmissionPolicyClusterLister helps list ValidatingAdmissionPolicies across all workspaces,
+// or scope down to a ValidatingAdmissionPolicyLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ValidatingAdmissionPolicyClusterLister interface {
 	// List lists all ValidatingAdmissionPolicies in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, err error)
 	// Cluster returns a lister that can list and get ValidatingAdmissionPolicies in one workspace.
-	Cluster(clusterName logicalcluster.Name) admissionregistrationv1alpha1listers.ValidatingAdmissionPolicyLister
+	Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyLister
 	ValidatingAdmissionPolicyClusterListerExpansion
 }
 
+// validatingAdmissionPolicyClusterLister implements the ValidatingAdmissionPolicyClusterLister interface.
 type validatingAdmissionPolicyClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*admissionregistrationv1alpha1.ValidatingAdmissionPolicy]
 }
 
+var _ ValidatingAdmissionPolicyClusterLister = new(validatingAdmissionPolicyClusterLister)
+
 // NewValidatingAdmissionPolicyClusterLister returns a new ValidatingAdmissionPolicyClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewValidatingAdmissionPolicyClusterLister(indexer cache.Indexer) *validatingAdmissionPolicyClusterLister {
-	return &validatingAdmissionPolicyClusterLister{indexer: indexer}
-}
-
-// List lists all ValidatingAdmissionPolicies in the indexer across all workspaces.
-func (s *validatingAdmissionPolicyClusterLister) List(selector labels.Selector) (ret []*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicy))
-	})
-	return ret, err
+func NewValidatingAdmissionPolicyClusterLister(indexer cache.Indexer) ValidatingAdmissionPolicyClusterLister {
+	return &validatingAdmissionPolicyClusterLister{
+		kcplisters.NewCluster[*admissionregistrationv1alpha1.ValidatingAdmissionPolicy](indexer, admissionregistrationv1alpha1.Resource("validatingadmissionpolicy")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ValidatingAdmissionPolicies.
-func (s *validatingAdmissionPolicyClusterLister) Cluster(clusterName logicalcluster.Name) admissionregistrationv1alpha1listers.ValidatingAdmissionPolicyLister {
-	return &validatingAdmissionPolicyLister{indexer: s.indexer, clusterName: clusterName}
+func (l *validatingAdmissionPolicyClusterLister) Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyLister {
+	return &validatingAdmissionPolicyLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// validatingAdmissionPolicyLister implements the admissionregistrationv1alpha1listers.ValidatingAdmissionPolicyLister interface.
+// validatingAdmissionPolicyLister can list all ValidatingAdmissionPolicies inside a workspace
+// or scope down to a listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyNamespaceLister for one namespace.
 type validatingAdmissionPolicyLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*admissionregistrationv1alpha1.ValidatingAdmissionPolicy]
 }
 
-// List lists all ValidatingAdmissionPolicies in the indexer for a workspace.
-func (s *validatingAdmissionPolicyLister) List(selector labels.Selector) (ret []*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicy))
-	})
-	return ret, err
-}
+var _ listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyLister = new(validatingAdmissionPolicyLister)
 
-// Get retrieves the ValidatingAdmissionPolicy from the indexer for a given workspace and name.
-func (s *validatingAdmissionPolicyLister) Get(name string) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicy, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(admissionregistrationv1alpha1.Resource("validatingadmissionpolicies"), name)
+// NewValidatingAdmissionPolicyLister returns a new ValidatingAdmissionPolicyLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewValidatingAdmissionPolicyLister(indexer cache.Indexer) listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyLister {
+	return &validatingAdmissionPolicyLister{
+		kcplisters.New[*admissionregistrationv1alpha1.ValidatingAdmissionPolicy](indexer, admissionregistrationv1alpha1.Resource("validatingadmissionpolicy")),
 	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicy), nil
+}
+
+// validatingAdmissionPolicyScopedLister can list all ValidatingAdmissionPolicies inside a workspace
+// or scope down to a listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyNamespaceLister.
+type validatingAdmissionPolicyScopedLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1alpha1.ValidatingAdmissionPolicy]
 }
diff --git a/listers/admissionregistration/v1alpha1/validatingadmissionpolicy_expansion.go b/listers/admissionregistration/v1alpha1/validatingadmissionpolicy_expansion.go
index edbb3d388..d9b418cd5 100644
--- a/listers/admissionregistration/v1alpha1/validatingadmissionpolicy_expansion.go
+++ b/listers/admissionregistration/v1alpha1/validatingadmissionpolicy_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go b/listers/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
index e577d186d..0471766af 100644
--- a/listers/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
+++ b/listers/admissionregistration/v1alpha1/validatingadmissionpolicybinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	admissionregistrationv1alpha1listers "k8s.io/client-go/listers/admissionregistration/v1alpha1"
+	listersadmissionregistrationv1alpha1 "k8s.io/client-go/listers/admissionregistration/v1alpha1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ValidatingAdmissionPolicyBindingClusterLister can list ValidatingAdmissionPolicyBindings across all workspaces, or scope down to a ValidatingAdmissionPolicyBindingLister for one workspace.
+// ValidatingAdmissionPolicyBindingClusterLister helps list ValidatingAdmissionPolicyBindings across all workspaces,
+// or scope down to a ValidatingAdmissionPolicyBindingLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ValidatingAdmissionPolicyBindingClusterLister interface {
 	// List lists all ValidatingAdmissionPolicyBindings in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, err error)
 	// Cluster returns a lister that can list and get ValidatingAdmissionPolicyBindings in one workspace.
-	Cluster(clusterName logicalcluster.Name) admissionregistrationv1alpha1listers.ValidatingAdmissionPolicyBindingLister
+	Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingLister
 	ValidatingAdmissionPolicyBindingClusterListerExpansion
 }
 
+// validatingAdmissionPolicyBindingClusterLister implements the ValidatingAdmissionPolicyBindingClusterLister interface.
 type validatingAdmissionPolicyBindingClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding]
 }
 
+var _ ValidatingAdmissionPolicyBindingClusterLister = new(validatingAdmissionPolicyBindingClusterLister)
+
 // NewValidatingAdmissionPolicyBindingClusterLister returns a new ValidatingAdmissionPolicyBindingClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewValidatingAdmissionPolicyBindingClusterLister(indexer cache.Indexer) *validatingAdmissionPolicyBindingClusterLister {
-	return &validatingAdmissionPolicyBindingClusterLister{indexer: indexer}
-}
-
-// List lists all ValidatingAdmissionPolicyBindings in the indexer across all workspaces.
-func (s *validatingAdmissionPolicyBindingClusterLister) List(selector labels.Selector) (ret []*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding))
-	})
-	return ret, err
+func NewValidatingAdmissionPolicyBindingClusterLister(indexer cache.Indexer) ValidatingAdmissionPolicyBindingClusterLister {
+	return &validatingAdmissionPolicyBindingClusterLister{
+		kcplisters.NewCluster[*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding](indexer, admissionregistrationv1alpha1.Resource("validatingadmissionpolicybinding")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ValidatingAdmissionPolicyBindings.
-func (s *validatingAdmissionPolicyBindingClusterLister) Cluster(clusterName logicalcluster.Name) admissionregistrationv1alpha1listers.ValidatingAdmissionPolicyBindingLister {
-	return &validatingAdmissionPolicyBindingLister{indexer: s.indexer, clusterName: clusterName}
+func (l *validatingAdmissionPolicyBindingClusterLister) Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingLister {
+	return &validatingAdmissionPolicyBindingLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// validatingAdmissionPolicyBindingLister implements the admissionregistrationv1alpha1listers.ValidatingAdmissionPolicyBindingLister interface.
+// validatingAdmissionPolicyBindingLister can list all ValidatingAdmissionPolicyBindings inside a workspace
+// or scope down to a listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingNamespaceLister for one namespace.
 type validatingAdmissionPolicyBindingLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding]
 }
 
-// List lists all ValidatingAdmissionPolicyBindings in the indexer for a workspace.
-func (s *validatingAdmissionPolicyBindingLister) List(selector labels.Selector) (ret []*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding))
-	})
-	return ret, err
-}
+var _ listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingLister = new(validatingAdmissionPolicyBindingLister)
 
-// Get retrieves the ValidatingAdmissionPolicyBinding from the indexer for a given workspace and name.
-func (s *validatingAdmissionPolicyBindingLister) Get(name string) (*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(admissionregistrationv1alpha1.Resource("validatingadmissionpolicybindings"), name)
+// NewValidatingAdmissionPolicyBindingLister returns a new ValidatingAdmissionPolicyBindingLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewValidatingAdmissionPolicyBindingLister(indexer cache.Indexer) listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingLister {
+	return &validatingAdmissionPolicyBindingLister{
+		kcplisters.New[*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding](indexer, admissionregistrationv1alpha1.Resource("validatingadmissionpolicybinding")),
 	}
-	return obj.(*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding), nil
+}
+
+// validatingAdmissionPolicyBindingScopedLister can list all ValidatingAdmissionPolicyBindings inside a workspace
+// or scope down to a listersadmissionregistrationv1alpha1.ValidatingAdmissionPolicyBindingNamespaceLister.
+type validatingAdmissionPolicyBindingScopedLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding]
 }
diff --git a/listers/admissionregistration/v1alpha1/validatingadmissionpolicybinding_expansion.go b/listers/admissionregistration/v1alpha1/validatingadmissionpolicybinding_expansion.go
index b08ac3f77..ee8b51134 100644
--- a/listers/admissionregistration/v1alpha1/validatingadmissionpolicybinding_expansion.go
+++ b/listers/admissionregistration/v1alpha1/validatingadmissionpolicybinding_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/admissionregistration/v1beta1/expansion_generated.go b/listers/admissionregistration/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/admissionregistration/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/admissionregistration/v1beta1/mutatingwebhookconfiguration.go b/listers/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
index 0a602ae7a..f9c30681e 100644
--- a/listers/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
+++ b/listers/admissionregistration/v1beta1/mutatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	admissionregistrationv1beta1listers "k8s.io/client-go/listers/admissionregistration/v1beta1"
+	listersadmissionregistrationv1beta1 "k8s.io/client-go/listers/admissionregistration/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// MutatingWebhookConfigurationClusterLister can list MutatingWebhookConfigurations across all workspaces, or scope down to a MutatingWebhookConfigurationLister for one workspace.
+// MutatingWebhookConfigurationClusterLister helps list MutatingWebhookConfigurations across all workspaces,
+// or scope down to a MutatingWebhookConfigurationLister for one workspace.
 // All objects returned here must be treated as read-only.
 type MutatingWebhookConfigurationClusterLister interface {
 	// List lists all MutatingWebhookConfigurations in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*admissionregistrationv1beta1.MutatingWebhookConfiguration, err error)
 	// Cluster returns a lister that can list and get MutatingWebhookConfigurations in one workspace.
-	Cluster(clusterName logicalcluster.Name) admissionregistrationv1beta1listers.MutatingWebhookConfigurationLister
+	Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1beta1.MutatingWebhookConfigurationLister
 	MutatingWebhookConfigurationClusterListerExpansion
 }
 
+// mutatingWebhookConfigurationClusterLister implements the MutatingWebhookConfigurationClusterLister interface.
 type mutatingWebhookConfigurationClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*admissionregistrationv1beta1.MutatingWebhookConfiguration]
 }
 
+var _ MutatingWebhookConfigurationClusterLister = new(mutatingWebhookConfigurationClusterLister)
+
 // NewMutatingWebhookConfigurationClusterLister returns a new MutatingWebhookConfigurationClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewMutatingWebhookConfigurationClusterLister(indexer cache.Indexer) *mutatingWebhookConfigurationClusterLister {
-	return &mutatingWebhookConfigurationClusterLister{indexer: indexer}
-}
-
-// List lists all MutatingWebhookConfigurations in the indexer across all workspaces.
-func (s *mutatingWebhookConfigurationClusterLister) List(selector labels.Selector) (ret []*admissionregistrationv1beta1.MutatingWebhookConfiguration, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*admissionregistrationv1beta1.MutatingWebhookConfiguration))
-	})
-	return ret, err
+func NewMutatingWebhookConfigurationClusterLister(indexer cache.Indexer) MutatingWebhookConfigurationClusterLister {
+	return &mutatingWebhookConfigurationClusterLister{
+		kcplisters.NewCluster[*admissionregistrationv1beta1.MutatingWebhookConfiguration](indexer, admissionregistrationv1beta1.Resource("mutatingwebhookconfiguration")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get MutatingWebhookConfigurations.
-func (s *mutatingWebhookConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) admissionregistrationv1beta1listers.MutatingWebhookConfigurationLister {
-	return &mutatingWebhookConfigurationLister{indexer: s.indexer, clusterName: clusterName}
+func (l *mutatingWebhookConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1beta1.MutatingWebhookConfigurationLister {
+	return &mutatingWebhookConfigurationLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// mutatingWebhookConfigurationLister implements the admissionregistrationv1beta1listers.MutatingWebhookConfigurationLister interface.
+// mutatingWebhookConfigurationLister can list all MutatingWebhookConfigurations inside a workspace
+// or scope down to a listersadmissionregistrationv1beta1.MutatingWebhookConfigurationNamespaceLister for one namespace.
 type mutatingWebhookConfigurationLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*admissionregistrationv1beta1.MutatingWebhookConfiguration]
 }
 
-// List lists all MutatingWebhookConfigurations in the indexer for a workspace.
-func (s *mutatingWebhookConfigurationLister) List(selector labels.Selector) (ret []*admissionregistrationv1beta1.MutatingWebhookConfiguration, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*admissionregistrationv1beta1.MutatingWebhookConfiguration))
-	})
-	return ret, err
-}
+var _ listersadmissionregistrationv1beta1.MutatingWebhookConfigurationLister = new(mutatingWebhookConfigurationLister)
 
-// Get retrieves the MutatingWebhookConfiguration from the indexer for a given workspace and name.
-func (s *mutatingWebhookConfigurationLister) Get(name string) (*admissionregistrationv1beta1.MutatingWebhookConfiguration, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(admissionregistrationv1beta1.Resource("mutatingwebhookconfigurations"), name)
+// NewMutatingWebhookConfigurationLister returns a new MutatingWebhookConfigurationLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewMutatingWebhookConfigurationLister(indexer cache.Indexer) listersadmissionregistrationv1beta1.MutatingWebhookConfigurationLister {
+	return &mutatingWebhookConfigurationLister{
+		kcplisters.New[*admissionregistrationv1beta1.MutatingWebhookConfiguration](indexer, admissionregistrationv1beta1.Resource("mutatingwebhookconfiguration")),
 	}
-	return obj.(*admissionregistrationv1beta1.MutatingWebhookConfiguration), nil
+}
+
+// mutatingWebhookConfigurationScopedLister can list all MutatingWebhookConfigurations inside a workspace
+// or scope down to a listersadmissionregistrationv1beta1.MutatingWebhookConfigurationNamespaceLister.
+type mutatingWebhookConfigurationScopedLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1beta1.MutatingWebhookConfiguration]
 }
diff --git a/listers/admissionregistration/v1beta1/mutatingwebhookconfiguration_expansion.go b/listers/admissionregistration/v1beta1/mutatingwebhookconfiguration_expansion.go
index cb7937733..dc0b6257a 100644
--- a/listers/admissionregistration/v1beta1/mutatingwebhookconfiguration_expansion.go
+++ b/listers/admissionregistration/v1beta1/mutatingwebhookconfiguration_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/admissionregistration/v1beta1/validatingadmissionpolicy.go b/listers/admissionregistration/v1beta1/validatingadmissionpolicy.go
new file mode 100644
index 000000000..90d8c3dd8
--- /dev/null
+++ b/listers/admissionregistration/v1beta1/validatingadmissionpolicy.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersadmissionregistrationv1beta1 "k8s.io/client-go/listers/admissionregistration/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ValidatingAdmissionPolicyClusterLister helps list ValidatingAdmissionPolicies across all workspaces,
+// or scope down to a ValidatingAdmissionPolicyLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ValidatingAdmissionPolicyClusterLister interface {
+	// List lists all ValidatingAdmissionPolicies in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*admissionregistrationv1beta1.ValidatingAdmissionPolicy, err error)
+	// Cluster returns a lister that can list and get ValidatingAdmissionPolicies in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyLister
+	ValidatingAdmissionPolicyClusterListerExpansion
+}
+
+// validatingAdmissionPolicyClusterLister implements the ValidatingAdmissionPolicyClusterLister interface.
+type validatingAdmissionPolicyClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*admissionregistrationv1beta1.ValidatingAdmissionPolicy]
+}
+
+var _ ValidatingAdmissionPolicyClusterLister = new(validatingAdmissionPolicyClusterLister)
+
+// NewValidatingAdmissionPolicyClusterLister returns a new ValidatingAdmissionPolicyClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewValidatingAdmissionPolicyClusterLister(indexer cache.Indexer) ValidatingAdmissionPolicyClusterLister {
+	return &validatingAdmissionPolicyClusterLister{
+		kcplisters.NewCluster[*admissionregistrationv1beta1.ValidatingAdmissionPolicy](indexer, admissionregistrationv1beta1.Resource("validatingadmissionpolicy")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ValidatingAdmissionPolicies.
+func (l *validatingAdmissionPolicyClusterLister) Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyLister {
+	return &validatingAdmissionPolicyLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// validatingAdmissionPolicyLister can list all ValidatingAdmissionPolicies inside a workspace
+// or scope down to a listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyNamespaceLister for one namespace.
+type validatingAdmissionPolicyLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1beta1.ValidatingAdmissionPolicy]
+}
+
+var _ listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyLister = new(validatingAdmissionPolicyLister)
+
+// NewValidatingAdmissionPolicyLister returns a new ValidatingAdmissionPolicyLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewValidatingAdmissionPolicyLister(indexer cache.Indexer) listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyLister {
+	return &validatingAdmissionPolicyLister{
+		kcplisters.New[*admissionregistrationv1beta1.ValidatingAdmissionPolicy](indexer, admissionregistrationv1beta1.Resource("validatingadmissionpolicy")),
+	}
+}
+
+// validatingAdmissionPolicyScopedLister can list all ValidatingAdmissionPolicies inside a workspace
+// or scope down to a listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyNamespaceLister.
+type validatingAdmissionPolicyScopedLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1beta1.ValidatingAdmissionPolicy]
+}
diff --git a/listers/policy/v1beta1/podsecuritypolicy_expansion.go b/listers/admissionregistration/v1beta1/validatingadmissionpolicy_expansion.go
similarity index 72%
rename from listers/policy/v1beta1/podsecuritypolicy_expansion.go
rename to listers/admissionregistration/v1beta1/validatingadmissionpolicy_expansion.go
index 775adac81..b5632aad5 100644
--- a/listers/policy/v1beta1/podsecuritypolicy_expansion.go
+++ b/listers/admissionregistration/v1beta1/validatingadmissionpolicy_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
@@ -21,5 +18,5 @@ limitations under the License.
 
 package v1beta1
 
-// PodSecurityPolicyClusterListerExpansion allows custom methods to be added to PodSecurityPolicyClusterLister.
-type PodSecurityPolicyClusterListerExpansion interface{}
+// ValidatingAdmissionPolicyClusterListerExpansion allows custom methods to be added to ValidatingAdmissionPolicyClusterLister.
+type ValidatingAdmissionPolicyClusterListerExpansion interface{}
diff --git a/listers/admissionregistration/v1beta1/validatingadmissionpolicybinding.go b/listers/admissionregistration/v1beta1/validatingadmissionpolicybinding.go
new file mode 100644
index 000000000..8c7a5d166
--- /dev/null
+++ b/listers/admissionregistration/v1beta1/validatingadmissionpolicybinding.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersadmissionregistrationv1beta1 "k8s.io/client-go/listers/admissionregistration/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ValidatingAdmissionPolicyBindingClusterLister helps list ValidatingAdmissionPolicyBindings across all workspaces,
+// or scope down to a ValidatingAdmissionPolicyBindingLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ValidatingAdmissionPolicyBindingClusterLister interface {
+	// List lists all ValidatingAdmissionPolicyBindings in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding, err error)
+	// Cluster returns a lister that can list and get ValidatingAdmissionPolicyBindings in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingLister
+	ValidatingAdmissionPolicyBindingClusterListerExpansion
+}
+
+// validatingAdmissionPolicyBindingClusterLister implements the ValidatingAdmissionPolicyBindingClusterLister interface.
+type validatingAdmissionPolicyBindingClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding]
+}
+
+var _ ValidatingAdmissionPolicyBindingClusterLister = new(validatingAdmissionPolicyBindingClusterLister)
+
+// NewValidatingAdmissionPolicyBindingClusterLister returns a new ValidatingAdmissionPolicyBindingClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewValidatingAdmissionPolicyBindingClusterLister(indexer cache.Indexer) ValidatingAdmissionPolicyBindingClusterLister {
+	return &validatingAdmissionPolicyBindingClusterLister{
+		kcplisters.NewCluster[*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding](indexer, admissionregistrationv1beta1.Resource("validatingadmissionpolicybinding")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ValidatingAdmissionPolicyBindings.
+func (l *validatingAdmissionPolicyBindingClusterLister) Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingLister {
+	return &validatingAdmissionPolicyBindingLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// validatingAdmissionPolicyBindingLister can list all ValidatingAdmissionPolicyBindings inside a workspace
+// or scope down to a listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingNamespaceLister for one namespace.
+type validatingAdmissionPolicyBindingLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding]
+}
+
+var _ listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingLister = new(validatingAdmissionPolicyBindingLister)
+
+// NewValidatingAdmissionPolicyBindingLister returns a new ValidatingAdmissionPolicyBindingLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewValidatingAdmissionPolicyBindingLister(indexer cache.Indexer) listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingLister {
+	return &validatingAdmissionPolicyBindingLister{
+		kcplisters.New[*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding](indexer, admissionregistrationv1beta1.Resource("validatingadmissionpolicybinding")),
+	}
+}
+
+// validatingAdmissionPolicyBindingScopedLister can list all ValidatingAdmissionPolicyBindings inside a workspace
+// or scope down to a listersadmissionregistrationv1beta1.ValidatingAdmissionPolicyBindingNamespaceLister.
+type validatingAdmissionPolicyBindingScopedLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding]
+}
diff --git a/listers/extensions/v1beta1/podsecuritypolicy_expansion.go b/listers/admissionregistration/v1beta1/validatingadmissionpolicybinding_expansion.go
similarity index 72%
rename from listers/extensions/v1beta1/podsecuritypolicy_expansion.go
rename to listers/admissionregistration/v1beta1/validatingadmissionpolicybinding_expansion.go
index 775adac81..00a24cabb 100644
--- a/listers/extensions/v1beta1/podsecuritypolicy_expansion.go
+++ b/listers/admissionregistration/v1beta1/validatingadmissionpolicybinding_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
@@ -21,5 +18,5 @@ limitations under the License.
 
 package v1beta1
 
-// PodSecurityPolicyClusterListerExpansion allows custom methods to be added to PodSecurityPolicyClusterLister.
-type PodSecurityPolicyClusterListerExpansion interface{}
+// ValidatingAdmissionPolicyBindingClusterListerExpansion allows custom methods to be added to ValidatingAdmissionPolicyBindingClusterLister.
+type ValidatingAdmissionPolicyBindingClusterListerExpansion interface{}
diff --git a/listers/admissionregistration/v1beta1/validatingwebhookconfiguration.go b/listers/admissionregistration/v1beta1/validatingwebhookconfiguration.go
index 7927f174b..46be1a035 100644
--- a/listers/admissionregistration/v1beta1/validatingwebhookconfiguration.go
+++ b/listers/admissionregistration/v1beta1/validatingwebhookconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	admissionregistrationv1beta1listers "k8s.io/client-go/listers/admissionregistration/v1beta1"
+	listersadmissionregistrationv1beta1 "k8s.io/client-go/listers/admissionregistration/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ValidatingWebhookConfigurationClusterLister can list ValidatingWebhookConfigurations across all workspaces, or scope down to a ValidatingWebhookConfigurationLister for one workspace.
+// ValidatingWebhookConfigurationClusterLister helps list ValidatingWebhookConfigurations across all workspaces,
+// or scope down to a ValidatingWebhookConfigurationLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ValidatingWebhookConfigurationClusterLister interface {
 	// List lists all ValidatingWebhookConfigurations in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*admissionregistrationv1beta1.ValidatingWebhookConfiguration, err error)
 	// Cluster returns a lister that can list and get ValidatingWebhookConfigurations in one workspace.
-	Cluster(clusterName logicalcluster.Name) admissionregistrationv1beta1listers.ValidatingWebhookConfigurationLister
+	Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1beta1.ValidatingWebhookConfigurationLister
 	ValidatingWebhookConfigurationClusterListerExpansion
 }
 
+// validatingWebhookConfigurationClusterLister implements the ValidatingWebhookConfigurationClusterLister interface.
 type validatingWebhookConfigurationClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*admissionregistrationv1beta1.ValidatingWebhookConfiguration]
 }
 
+var _ ValidatingWebhookConfigurationClusterLister = new(validatingWebhookConfigurationClusterLister)
+
 // NewValidatingWebhookConfigurationClusterLister returns a new ValidatingWebhookConfigurationClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewValidatingWebhookConfigurationClusterLister(indexer cache.Indexer) *validatingWebhookConfigurationClusterLister {
-	return &validatingWebhookConfigurationClusterLister{indexer: indexer}
-}
-
-// List lists all ValidatingWebhookConfigurations in the indexer across all workspaces.
-func (s *validatingWebhookConfigurationClusterLister) List(selector labels.Selector) (ret []*admissionregistrationv1beta1.ValidatingWebhookConfiguration, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*admissionregistrationv1beta1.ValidatingWebhookConfiguration))
-	})
-	return ret, err
+func NewValidatingWebhookConfigurationClusterLister(indexer cache.Indexer) ValidatingWebhookConfigurationClusterLister {
+	return &validatingWebhookConfigurationClusterLister{
+		kcplisters.NewCluster[*admissionregistrationv1beta1.ValidatingWebhookConfiguration](indexer, admissionregistrationv1beta1.Resource("validatingwebhookconfiguration")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ValidatingWebhookConfigurations.
-func (s *validatingWebhookConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) admissionregistrationv1beta1listers.ValidatingWebhookConfigurationLister {
-	return &validatingWebhookConfigurationLister{indexer: s.indexer, clusterName: clusterName}
+func (l *validatingWebhookConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) listersadmissionregistrationv1beta1.ValidatingWebhookConfigurationLister {
+	return &validatingWebhookConfigurationLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// validatingWebhookConfigurationLister implements the admissionregistrationv1beta1listers.ValidatingWebhookConfigurationLister interface.
+// validatingWebhookConfigurationLister can list all ValidatingWebhookConfigurations inside a workspace
+// or scope down to a listersadmissionregistrationv1beta1.ValidatingWebhookConfigurationNamespaceLister for one namespace.
 type validatingWebhookConfigurationLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*admissionregistrationv1beta1.ValidatingWebhookConfiguration]
 }
 
-// List lists all ValidatingWebhookConfigurations in the indexer for a workspace.
-func (s *validatingWebhookConfigurationLister) List(selector labels.Selector) (ret []*admissionregistrationv1beta1.ValidatingWebhookConfiguration, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*admissionregistrationv1beta1.ValidatingWebhookConfiguration))
-	})
-	return ret, err
-}
+var _ listersadmissionregistrationv1beta1.ValidatingWebhookConfigurationLister = new(validatingWebhookConfigurationLister)
 
-// Get retrieves the ValidatingWebhookConfiguration from the indexer for a given workspace and name.
-func (s *validatingWebhookConfigurationLister) Get(name string) (*admissionregistrationv1beta1.ValidatingWebhookConfiguration, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(admissionregistrationv1beta1.Resource("validatingwebhookconfigurations"), name)
+// NewValidatingWebhookConfigurationLister returns a new ValidatingWebhookConfigurationLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewValidatingWebhookConfigurationLister(indexer cache.Indexer) listersadmissionregistrationv1beta1.ValidatingWebhookConfigurationLister {
+	return &validatingWebhookConfigurationLister{
+		kcplisters.New[*admissionregistrationv1beta1.ValidatingWebhookConfiguration](indexer, admissionregistrationv1beta1.Resource("validatingwebhookconfiguration")),
 	}
-	return obj.(*admissionregistrationv1beta1.ValidatingWebhookConfiguration), nil
+}
+
+// validatingWebhookConfigurationScopedLister can list all ValidatingWebhookConfigurations inside a workspace
+// or scope down to a listersadmissionregistrationv1beta1.ValidatingWebhookConfigurationNamespaceLister.
+type validatingWebhookConfigurationScopedLister struct {
+	kcplisters.ResourceIndexer[*admissionregistrationv1beta1.ValidatingWebhookConfiguration]
 }
diff --git a/listers/admissionregistration/v1beta1/validatingwebhookconfiguration_expansion.go b/listers/admissionregistration/v1beta1/validatingwebhookconfiguration_expansion.go
index ce50f471d..f3e99e6fb 100644
--- a/listers/admissionregistration/v1beta1/validatingwebhookconfiguration_expansion.go
+++ b/listers/admissionregistration/v1beta1/validatingwebhookconfiguration_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/apiserverinternal/v1alpha1/expansion_generated.go b/listers/apiserverinternal/v1alpha1/expansion_generated.go
new file mode 100644
index 000000000..3b8521c00
--- /dev/null
+++ b/listers/apiserverinternal/v1alpha1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
diff --git a/listers/apiserverinternal/v1alpha1/storageversion.go b/listers/apiserverinternal/v1alpha1/storageversion.go
index 6163124b6..f02fdcc28 100644
--- a/listers/apiserverinternal/v1alpha1/storageversion.go
+++ b/listers/apiserverinternal/v1alpha1/storageversion.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	internalv1alpha1 "k8s.io/api/apiserverinternal/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
+	apiserverinternalv1alpha1 "k8s.io/api/apiserverinternal/v1alpha1"
 	"k8s.io/apimachinery/pkg/labels"
-	internalv1alpha1listers "k8s.io/client-go/listers/apiserverinternal/v1alpha1"
+	listersapiserverinternalv1alpha1 "k8s.io/client-go/listers/apiserverinternal/v1alpha1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// StorageVersionClusterLister can list StorageVersions across all workspaces, or scope down to a StorageVersionLister for one workspace.
+// StorageVersionClusterLister helps list StorageVersions across all workspaces,
+// or scope down to a StorageVersionLister for one workspace.
 // All objects returned here must be treated as read-only.
 type StorageVersionClusterLister interface {
 	// List lists all StorageVersions in the indexer.
 	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*internalv1alpha1.StorageVersion, err error)
+	List(selector labels.Selector) (ret []*apiserverinternalv1alpha1.StorageVersion, err error)
 	// Cluster returns a lister that can list and get StorageVersions in one workspace.
-	Cluster(clusterName logicalcluster.Name) internalv1alpha1listers.StorageVersionLister
+	Cluster(clusterName logicalcluster.Name) listersapiserverinternalv1alpha1.StorageVersionLister
 	StorageVersionClusterListerExpansion
 }
 
+// storageVersionClusterLister implements the StorageVersionClusterLister interface.
 type storageVersionClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*apiserverinternalv1alpha1.StorageVersion]
 }
 
+var _ StorageVersionClusterLister = new(storageVersionClusterLister)
+
 // NewStorageVersionClusterLister returns a new StorageVersionClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewStorageVersionClusterLister(indexer cache.Indexer) *storageVersionClusterLister {
-	return &storageVersionClusterLister{indexer: indexer}
-}
-
-// List lists all StorageVersions in the indexer across all workspaces.
-func (s *storageVersionClusterLister) List(selector labels.Selector) (ret []*internalv1alpha1.StorageVersion, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*internalv1alpha1.StorageVersion))
-	})
-	return ret, err
+func NewStorageVersionClusterLister(indexer cache.Indexer) StorageVersionClusterLister {
+	return &storageVersionClusterLister{
+		kcplisters.NewCluster[*apiserverinternalv1alpha1.StorageVersion](indexer, apiserverinternalv1alpha1.Resource("storageversion")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get StorageVersions.
-func (s *storageVersionClusterLister) Cluster(clusterName logicalcluster.Name) internalv1alpha1listers.StorageVersionLister {
-	return &storageVersionLister{indexer: s.indexer, clusterName: clusterName}
+func (l *storageVersionClusterLister) Cluster(clusterName logicalcluster.Name) listersapiserverinternalv1alpha1.StorageVersionLister {
+	return &storageVersionLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// storageVersionLister implements the internalv1alpha1listers.StorageVersionLister interface.
+// storageVersionLister can list all StorageVersions inside a workspace
+// or scope down to a listersapiserverinternalv1alpha1.StorageVersionNamespaceLister for one namespace.
 type storageVersionLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*apiserverinternalv1alpha1.StorageVersion]
 }
 
-// List lists all StorageVersions in the indexer for a workspace.
-func (s *storageVersionLister) List(selector labels.Selector) (ret []*internalv1alpha1.StorageVersion, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*internalv1alpha1.StorageVersion))
-	})
-	return ret, err
-}
+var _ listersapiserverinternalv1alpha1.StorageVersionLister = new(storageVersionLister)
 
-// Get retrieves the StorageVersion from the indexer for a given workspace and name.
-func (s *storageVersionLister) Get(name string) (*internalv1alpha1.StorageVersion, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(internalv1alpha1.Resource("storageversions"), name)
+// NewStorageVersionLister returns a new StorageVersionLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewStorageVersionLister(indexer cache.Indexer) listersapiserverinternalv1alpha1.StorageVersionLister {
+	return &storageVersionLister{
+		kcplisters.New[*apiserverinternalv1alpha1.StorageVersion](indexer, apiserverinternalv1alpha1.Resource("storageversion")),
 	}
-	return obj.(*internalv1alpha1.StorageVersion), nil
+}
+
+// storageVersionScopedLister can list all StorageVersions inside a workspace
+// or scope down to a listersapiserverinternalv1alpha1.StorageVersionNamespaceLister.
+type storageVersionScopedLister struct {
+	kcplisters.ResourceIndexer[*apiserverinternalv1alpha1.StorageVersion]
 }
diff --git a/listers/apiserverinternal/v1alpha1/storageversion_expansion.go b/listers/apiserverinternal/v1alpha1/storageversion_expansion.go
index 63038d3f2..8e2db395c 100644
--- a/listers/apiserverinternal/v1alpha1/storageversion_expansion.go
+++ b/listers/apiserverinternal/v1alpha1/storageversion_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/apps/v1/controllerrevision.go b/listers/apps/v1/controllerrevision.go
index 45e8e5a54..2c13f3314 100644
--- a/listers/apps/v1/controllerrevision.go
+++ b/listers/apps/v1/controllerrevision.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1 "k8s.io/api/apps/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1listers "k8s.io/client-go/listers/apps/v1"
+	listersappsv1 "k8s.io/client-go/listers/apps/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ControllerRevisionClusterLister can list ControllerRevisions across all workspaces, or scope down to a ControllerRevisionLister for one workspace.
+// ControllerRevisionClusterLister helps list ControllerRevisions across all workspaces,
+// or scope down to a ControllerRevisionLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ControllerRevisionClusterLister interface {
 	// List lists all ControllerRevisions in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1.ControllerRevision, err error)
 	// Cluster returns a lister that can list and get ControllerRevisions in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1listers.ControllerRevisionLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1.ControllerRevisionLister
 	ControllerRevisionClusterListerExpansion
 }
 
+// controllerRevisionClusterLister implements the ControllerRevisionClusterLister interface.
 type controllerRevisionClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1.ControllerRevision]
 }
 
+var _ ControllerRevisionClusterLister = new(controllerRevisionClusterLister)
+
 // NewControllerRevisionClusterLister returns a new ControllerRevisionClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewControllerRevisionClusterLister(indexer cache.Indexer) *controllerRevisionClusterLister {
-	return &controllerRevisionClusterLister{indexer: indexer}
-}
-
-// List lists all ControllerRevisions in the indexer across all workspaces.
-func (s *controllerRevisionClusterLister) List(selector labels.Selector) (ret []*appsv1.ControllerRevision, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1.ControllerRevision))
-	})
-	return ret, err
+func NewControllerRevisionClusterLister(indexer cache.Indexer) ControllerRevisionClusterLister {
+	return &controllerRevisionClusterLister{
+		kcplisters.NewCluster[*appsv1.ControllerRevision](indexer, appsv1.Resource("controllerrevision")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ControllerRevisions.
-func (s *controllerRevisionClusterLister) Cluster(clusterName logicalcluster.Name) appsv1listers.ControllerRevisionLister {
-	return &controllerRevisionLister{indexer: s.indexer, clusterName: clusterName}
+func (l *controllerRevisionClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1.ControllerRevisionLister {
+	return &controllerRevisionLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// controllerRevisionLister implements the appsv1listers.ControllerRevisionLister interface.
+// controllerRevisionLister can list all ControllerRevisions inside a workspace
+// or scope down to a listersappsv1.ControllerRevisionNamespaceLister for one namespace.
 type controllerRevisionLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1.ControllerRevision]
 }
 
-// List lists all ControllerRevisions in the indexer for a workspace.
-func (s *controllerRevisionLister) List(selector labels.Selector) (ret []*appsv1.ControllerRevision, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1.ControllerRevision))
-	})
-	return ret, err
-}
+var _ listersappsv1.ControllerRevisionLister = new(controllerRevisionLister)
 
 // ControllerRevisions returns an object that can list and get ControllerRevisions in one namespace.
-func (s *controllerRevisionLister) ControllerRevisions(namespace string) appsv1listers.ControllerRevisionNamespaceLister {
-	return &controllerRevisionNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *controllerRevisionLister) ControllerRevisions(namespace string) listersappsv1.ControllerRevisionNamespaceLister {
+	return &controllerRevisionNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// controllerRevisionNamespaceLister implements the appsv1listers.ControllerRevisionNamespaceLister interface.
+// controllerRevisionNamespaceLister implements the listersappsv1.ControllerRevisionNamespaceLister
+// interface.
 type controllerRevisionNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1.ControllerRevision]
 }
 
-// List lists all ControllerRevisions in the indexer for a given workspace and namespace.
-func (s *controllerRevisionNamespaceLister) List(selector labels.Selector) (ret []*appsv1.ControllerRevision, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1.ControllerRevision))
-	})
-	return ret, err
-}
+var _ listersappsv1.ControllerRevisionNamespaceLister = new(controllerRevisionNamespaceLister)
 
-// Get retrieves the ControllerRevision from the indexer for a given workspace, namespace and name.
-func (s *controllerRevisionNamespaceLister) Get(name string) (*appsv1.ControllerRevision, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewControllerRevisionLister returns a new ControllerRevisionLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewControllerRevisionLister(indexer cache.Indexer) listersappsv1.ControllerRevisionLister {
+	return &controllerRevisionLister{
+		kcplisters.New[*appsv1.ControllerRevision](indexer, appsv1.Resource("controllerrevision")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1.Resource("controllerrevisions"), name)
+}
+
+// controllerRevisionScopedLister can list all ControllerRevisions inside a workspace
+// or scope down to a listersappsv1.ControllerRevisionNamespaceLister for one namespace.
+type controllerRevisionScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1.ControllerRevision]
+}
+
+// ControllerRevisions returns an object that can list and get ControllerRevisions in one namespace.
+func (l *controllerRevisionScopedLister) ControllerRevisions(namespace string) listersappsv1.ControllerRevisionLister {
+	return &controllerRevisionLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1.ControllerRevision), nil
 }
diff --git a/listers/apps/v1/controllerrevision_expansion.go b/listers/apps/v1/controllerrevision_expansion.go
index 121e47ec6..066da888a 100644
--- a/listers/apps/v1/controllerrevision_expansion.go
+++ b/listers/apps/v1/controllerrevision_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/apps/v1/daemonset.go b/listers/apps/v1/daemonset.go
index a3e2261fa..f3746ba88 100644
--- a/listers/apps/v1/daemonset.go
+++ b/listers/apps/v1/daemonset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1 "k8s.io/api/apps/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1listers "k8s.io/client-go/listers/apps/v1"
+	listersappsv1 "k8s.io/client-go/listers/apps/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// DaemonSetClusterLister can list DaemonSets across all workspaces, or scope down to a DaemonSetLister for one workspace.
+// DaemonSetClusterLister helps list DaemonSets across all workspaces,
+// or scope down to a DaemonSetLister for one workspace.
 // All objects returned here must be treated as read-only.
 type DaemonSetClusterLister interface {
 	// List lists all DaemonSets in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1.DaemonSet, err error)
 	// Cluster returns a lister that can list and get DaemonSets in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1listers.DaemonSetLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1.DaemonSetLister
 	DaemonSetClusterListerExpansion
 }
 
+// daemonSetClusterLister implements the DaemonSetClusterLister interface.
 type daemonSetClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1.DaemonSet]
 }
 
+var _ DaemonSetClusterLister = new(daemonSetClusterLister)
+
 // NewDaemonSetClusterLister returns a new DaemonSetClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewDaemonSetClusterLister(indexer cache.Indexer) *daemonSetClusterLister {
-	return &daemonSetClusterLister{indexer: indexer}
-}
-
-// List lists all DaemonSets in the indexer across all workspaces.
-func (s *daemonSetClusterLister) List(selector labels.Selector) (ret []*appsv1.DaemonSet, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1.DaemonSet))
-	})
-	return ret, err
+func NewDaemonSetClusterLister(indexer cache.Indexer) DaemonSetClusterLister {
+	return &daemonSetClusterLister{
+		kcplisters.NewCluster[*appsv1.DaemonSet](indexer, appsv1.Resource("daemonset")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get DaemonSets.
-func (s *daemonSetClusterLister) Cluster(clusterName logicalcluster.Name) appsv1listers.DaemonSetLister {
-	return &daemonSetLister{indexer: s.indexer, clusterName: clusterName}
+func (l *daemonSetClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1.DaemonSetLister {
+	return &daemonSetLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// daemonSetLister implements the appsv1listers.DaemonSetLister interface.
+// daemonSetLister can list all DaemonSets inside a workspace
+// or scope down to a listersappsv1.DaemonSetNamespaceLister for one namespace.
 type daemonSetLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1.DaemonSet]
 }
 
-// List lists all DaemonSets in the indexer for a workspace.
-func (s *daemonSetLister) List(selector labels.Selector) (ret []*appsv1.DaemonSet, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1.DaemonSet))
-	})
-	return ret, err
-}
+var _ listersappsv1.DaemonSetLister = new(daemonSetLister)
 
 // DaemonSets returns an object that can list and get DaemonSets in one namespace.
-func (s *daemonSetLister) DaemonSets(namespace string) appsv1listers.DaemonSetNamespaceLister {
-	return &daemonSetNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *daemonSetLister) DaemonSets(namespace string) listersappsv1.DaemonSetNamespaceLister {
+	return &daemonSetNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// daemonSetNamespaceLister implements the appsv1listers.DaemonSetNamespaceLister interface.
+// daemonSetNamespaceLister implements the listersappsv1.DaemonSetNamespaceLister
+// interface.
 type daemonSetNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1.DaemonSet]
 }
 
-// List lists all DaemonSets in the indexer for a given workspace and namespace.
-func (s *daemonSetNamespaceLister) List(selector labels.Selector) (ret []*appsv1.DaemonSet, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1.DaemonSet))
-	})
-	return ret, err
-}
+var _ listersappsv1.DaemonSetNamespaceLister = new(daemonSetNamespaceLister)
 
-// Get retrieves the DaemonSet from the indexer for a given workspace, namespace and name.
-func (s *daemonSetNamespaceLister) Get(name string) (*appsv1.DaemonSet, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewDaemonSetLister returns a new DaemonSetLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewDaemonSetLister(indexer cache.Indexer) listersappsv1.DaemonSetLister {
+	return &daemonSetLister{
+		kcplisters.New[*appsv1.DaemonSet](indexer, appsv1.Resource("daemonset")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1.Resource("daemonsets"), name)
+}
+
+// daemonSetScopedLister can list all DaemonSets inside a workspace
+// or scope down to a listersappsv1.DaemonSetNamespaceLister for one namespace.
+type daemonSetScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1.DaemonSet]
+}
+
+// DaemonSets returns an object that can list and get DaemonSets in one namespace.
+func (l *daemonSetScopedLister) DaemonSets(namespace string) listersappsv1.DaemonSetLister {
+	return &daemonSetLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1.DaemonSet), nil
 }
diff --git a/listers/apps/v1/daemonset_expansion.go b/listers/apps/v1/daemonset_expansion.go
index 689c9ec81..e48e01438 100644
--- a/listers/apps/v1/daemonset_expansion.go
+++ b/listers/apps/v1/daemonset_expansion.go
@@ -20,7 +20,7 @@ import (
 	"fmt"
 
 	apps "k8s.io/api/apps/v1"
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 )
diff --git a/listers/apps/v1/deployment.go b/listers/apps/v1/deployment.go
index 6e891e95d..e183a9d31 100644
--- a/listers/apps/v1/deployment.go
+++ b/listers/apps/v1/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1 "k8s.io/api/apps/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1listers "k8s.io/client-go/listers/apps/v1"
+	listersappsv1 "k8s.io/client-go/listers/apps/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// DeploymentClusterLister can list Deployments across all workspaces, or scope down to a DeploymentLister for one workspace.
+// DeploymentClusterLister helps list Deployments across all workspaces,
+// or scope down to a DeploymentLister for one workspace.
 // All objects returned here must be treated as read-only.
 type DeploymentClusterLister interface {
 	// List lists all Deployments in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1.Deployment, err error)
 	// Cluster returns a lister that can list and get Deployments in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1listers.DeploymentLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1.DeploymentLister
 	DeploymentClusterListerExpansion
 }
 
+// deploymentClusterLister implements the DeploymentClusterLister interface.
 type deploymentClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1.Deployment]
 }
 
+var _ DeploymentClusterLister = new(deploymentClusterLister)
+
 // NewDeploymentClusterLister returns a new DeploymentClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewDeploymentClusterLister(indexer cache.Indexer) *deploymentClusterLister {
-	return &deploymentClusterLister{indexer: indexer}
-}
-
-// List lists all Deployments in the indexer across all workspaces.
-func (s *deploymentClusterLister) List(selector labels.Selector) (ret []*appsv1.Deployment, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1.Deployment))
-	})
-	return ret, err
+func NewDeploymentClusterLister(indexer cache.Indexer) DeploymentClusterLister {
+	return &deploymentClusterLister{
+		kcplisters.NewCluster[*appsv1.Deployment](indexer, appsv1.Resource("deployment")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Deployments.
-func (s *deploymentClusterLister) Cluster(clusterName logicalcluster.Name) appsv1listers.DeploymentLister {
-	return &deploymentLister{indexer: s.indexer, clusterName: clusterName}
+func (l *deploymentClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1.DeploymentLister {
+	return &deploymentLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// deploymentLister implements the appsv1listers.DeploymentLister interface.
+// deploymentLister can list all Deployments inside a workspace
+// or scope down to a listersappsv1.DeploymentNamespaceLister for one namespace.
 type deploymentLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1.Deployment]
 }
 
-// List lists all Deployments in the indexer for a workspace.
-func (s *deploymentLister) List(selector labels.Selector) (ret []*appsv1.Deployment, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1.Deployment))
-	})
-	return ret, err
-}
+var _ listersappsv1.DeploymentLister = new(deploymentLister)
 
 // Deployments returns an object that can list and get Deployments in one namespace.
-func (s *deploymentLister) Deployments(namespace string) appsv1listers.DeploymentNamespaceLister {
-	return &deploymentNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *deploymentLister) Deployments(namespace string) listersappsv1.DeploymentNamespaceLister {
+	return &deploymentNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// deploymentNamespaceLister implements the appsv1listers.DeploymentNamespaceLister interface.
+// deploymentNamespaceLister implements the listersappsv1.DeploymentNamespaceLister
+// interface.
 type deploymentNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1.Deployment]
 }
 
-// List lists all Deployments in the indexer for a given workspace and namespace.
-func (s *deploymentNamespaceLister) List(selector labels.Selector) (ret []*appsv1.Deployment, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1.Deployment))
-	})
-	return ret, err
-}
+var _ listersappsv1.DeploymentNamespaceLister = new(deploymentNamespaceLister)
 
-// Get retrieves the Deployment from the indexer for a given workspace, namespace and name.
-func (s *deploymentNamespaceLister) Get(name string) (*appsv1.Deployment, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewDeploymentLister returns a new DeploymentLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewDeploymentLister(indexer cache.Indexer) listersappsv1.DeploymentLister {
+	return &deploymentLister{
+		kcplisters.New[*appsv1.Deployment](indexer, appsv1.Resource("deployment")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1.Resource("deployments"), name)
+}
+
+// deploymentScopedLister can list all Deployments inside a workspace
+// or scope down to a listersappsv1.DeploymentNamespaceLister for one namespace.
+type deploymentScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1.Deployment]
+}
+
+// Deployments returns an object that can list and get Deployments in one namespace.
+func (l *deploymentScopedLister) Deployments(namespace string) listersappsv1.DeploymentLister {
+	return &deploymentLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1.Deployment), nil
 }
diff --git a/listers/apps/v1/deployment_expansion.go b/listers/apps/v1/deployment_expansion.go
index b0dcdac73..eb37c3f65 100644
--- a/listers/apps/v1/deployment_expansion.go
+++ b/listers/apps/v1/deployment_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/apps/v1/expansion_generated.go b/listers/apps/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/apps/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/apps/v1/replicaset.go b/listers/apps/v1/replicaset.go
index 18798c4ee..b9ba4c606 100644
--- a/listers/apps/v1/replicaset.go
+++ b/listers/apps/v1/replicaset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1 "k8s.io/api/apps/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1listers "k8s.io/client-go/listers/apps/v1"
+	listersappsv1 "k8s.io/client-go/listers/apps/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ReplicaSetClusterLister can list ReplicaSets across all workspaces, or scope down to a ReplicaSetLister for one workspace.
+// ReplicaSetClusterLister helps list ReplicaSets across all workspaces,
+// or scope down to a ReplicaSetLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ReplicaSetClusterLister interface {
 	// List lists all ReplicaSets in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1.ReplicaSet, err error)
 	// Cluster returns a lister that can list and get ReplicaSets in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1listers.ReplicaSetLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1.ReplicaSetLister
 	ReplicaSetClusterListerExpansion
 }
 
+// replicaSetClusterLister implements the ReplicaSetClusterLister interface.
 type replicaSetClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1.ReplicaSet]
 }
 
+var _ ReplicaSetClusterLister = new(replicaSetClusterLister)
+
 // NewReplicaSetClusterLister returns a new ReplicaSetClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewReplicaSetClusterLister(indexer cache.Indexer) *replicaSetClusterLister {
-	return &replicaSetClusterLister{indexer: indexer}
-}
-
-// List lists all ReplicaSets in the indexer across all workspaces.
-func (s *replicaSetClusterLister) List(selector labels.Selector) (ret []*appsv1.ReplicaSet, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1.ReplicaSet))
-	})
-	return ret, err
+func NewReplicaSetClusterLister(indexer cache.Indexer) ReplicaSetClusterLister {
+	return &replicaSetClusterLister{
+		kcplisters.NewCluster[*appsv1.ReplicaSet](indexer, appsv1.Resource("replicaset")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ReplicaSets.
-func (s *replicaSetClusterLister) Cluster(clusterName logicalcluster.Name) appsv1listers.ReplicaSetLister {
-	return &replicaSetLister{indexer: s.indexer, clusterName: clusterName}
+func (l *replicaSetClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1.ReplicaSetLister {
+	return &replicaSetLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// replicaSetLister implements the appsv1listers.ReplicaSetLister interface.
+// replicaSetLister can list all ReplicaSets inside a workspace
+// or scope down to a listersappsv1.ReplicaSetNamespaceLister for one namespace.
 type replicaSetLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1.ReplicaSet]
 }
 
-// List lists all ReplicaSets in the indexer for a workspace.
-func (s *replicaSetLister) List(selector labels.Selector) (ret []*appsv1.ReplicaSet, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1.ReplicaSet))
-	})
-	return ret, err
-}
+var _ listersappsv1.ReplicaSetLister = new(replicaSetLister)
 
 // ReplicaSets returns an object that can list and get ReplicaSets in one namespace.
-func (s *replicaSetLister) ReplicaSets(namespace string) appsv1listers.ReplicaSetNamespaceLister {
-	return &replicaSetNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *replicaSetLister) ReplicaSets(namespace string) listersappsv1.ReplicaSetNamespaceLister {
+	return &replicaSetNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// replicaSetNamespaceLister implements the appsv1listers.ReplicaSetNamespaceLister interface.
+// replicaSetNamespaceLister implements the listersappsv1.ReplicaSetNamespaceLister
+// interface.
 type replicaSetNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1.ReplicaSet]
 }
 
-// List lists all ReplicaSets in the indexer for a given workspace and namespace.
-func (s *replicaSetNamespaceLister) List(selector labels.Selector) (ret []*appsv1.ReplicaSet, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1.ReplicaSet))
-	})
-	return ret, err
-}
+var _ listersappsv1.ReplicaSetNamespaceLister = new(replicaSetNamespaceLister)
 
-// Get retrieves the ReplicaSet from the indexer for a given workspace, namespace and name.
-func (s *replicaSetNamespaceLister) Get(name string) (*appsv1.ReplicaSet, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewReplicaSetLister returns a new ReplicaSetLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewReplicaSetLister(indexer cache.Indexer) listersappsv1.ReplicaSetLister {
+	return &replicaSetLister{
+		kcplisters.New[*appsv1.ReplicaSet](indexer, appsv1.Resource("replicaset")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1.Resource("replicasets"), name)
+}
+
+// replicaSetScopedLister can list all ReplicaSets inside a workspace
+// or scope down to a listersappsv1.ReplicaSetNamespaceLister for one namespace.
+type replicaSetScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1.ReplicaSet]
+}
+
+// ReplicaSets returns an object that can list and get ReplicaSets in one namespace.
+func (l *replicaSetScopedLister) ReplicaSets(namespace string) listersappsv1.ReplicaSetLister {
+	return &replicaSetLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1.ReplicaSet), nil
 }
diff --git a/listers/apps/v1/replicaset_expansion.go b/listers/apps/v1/replicaset_expansion.go
index 02d077461..233a8dab4 100644
--- a/listers/apps/v1/replicaset_expansion.go
+++ b/listers/apps/v1/replicaset_expansion.go
@@ -20,7 +20,7 @@ import (
 	"fmt"
 
 	apps "k8s.io/api/apps/v1"
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 )
diff --git a/listers/apps/v1/statefulset.go b/listers/apps/v1/statefulset.go
index ee9607b26..e6e1d1605 100644
--- a/listers/apps/v1/statefulset.go
+++ b/listers/apps/v1/statefulset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1 "k8s.io/api/apps/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1listers "k8s.io/client-go/listers/apps/v1"
+	listersappsv1 "k8s.io/client-go/listers/apps/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// StatefulSetClusterLister can list StatefulSets across all workspaces, or scope down to a StatefulSetLister for one workspace.
+// StatefulSetClusterLister helps list StatefulSets across all workspaces,
+// or scope down to a StatefulSetLister for one workspace.
 // All objects returned here must be treated as read-only.
 type StatefulSetClusterLister interface {
 	// List lists all StatefulSets in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1.StatefulSet, err error)
 	// Cluster returns a lister that can list and get StatefulSets in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1listers.StatefulSetLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1.StatefulSetLister
 	StatefulSetClusterListerExpansion
 }
 
+// statefulSetClusterLister implements the StatefulSetClusterLister interface.
 type statefulSetClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1.StatefulSet]
 }
 
+var _ StatefulSetClusterLister = new(statefulSetClusterLister)
+
 // NewStatefulSetClusterLister returns a new StatefulSetClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewStatefulSetClusterLister(indexer cache.Indexer) *statefulSetClusterLister {
-	return &statefulSetClusterLister{indexer: indexer}
-}
-
-// List lists all StatefulSets in the indexer across all workspaces.
-func (s *statefulSetClusterLister) List(selector labels.Selector) (ret []*appsv1.StatefulSet, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1.StatefulSet))
-	})
-	return ret, err
+func NewStatefulSetClusterLister(indexer cache.Indexer) StatefulSetClusterLister {
+	return &statefulSetClusterLister{
+		kcplisters.NewCluster[*appsv1.StatefulSet](indexer, appsv1.Resource("statefulset")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get StatefulSets.
-func (s *statefulSetClusterLister) Cluster(clusterName logicalcluster.Name) appsv1listers.StatefulSetLister {
-	return &statefulSetLister{indexer: s.indexer, clusterName: clusterName}
+func (l *statefulSetClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1.StatefulSetLister {
+	return &statefulSetLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// statefulSetLister implements the appsv1listers.StatefulSetLister interface.
+// statefulSetLister can list all StatefulSets inside a workspace
+// or scope down to a listersappsv1.StatefulSetNamespaceLister for one namespace.
 type statefulSetLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1.StatefulSet]
 }
 
-// List lists all StatefulSets in the indexer for a workspace.
-func (s *statefulSetLister) List(selector labels.Selector) (ret []*appsv1.StatefulSet, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1.StatefulSet))
-	})
-	return ret, err
-}
+var _ listersappsv1.StatefulSetLister = new(statefulSetLister)
 
 // StatefulSets returns an object that can list and get StatefulSets in one namespace.
-func (s *statefulSetLister) StatefulSets(namespace string) appsv1listers.StatefulSetNamespaceLister {
-	return &statefulSetNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *statefulSetLister) StatefulSets(namespace string) listersappsv1.StatefulSetNamespaceLister {
+	return &statefulSetNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// statefulSetNamespaceLister implements the appsv1listers.StatefulSetNamespaceLister interface.
+// statefulSetNamespaceLister implements the listersappsv1.StatefulSetNamespaceLister
+// interface.
 type statefulSetNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1.StatefulSet]
 }
 
-// List lists all StatefulSets in the indexer for a given workspace and namespace.
-func (s *statefulSetNamespaceLister) List(selector labels.Selector) (ret []*appsv1.StatefulSet, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1.StatefulSet))
-	})
-	return ret, err
-}
+var _ listersappsv1.StatefulSetNamespaceLister = new(statefulSetNamespaceLister)
 
-// Get retrieves the StatefulSet from the indexer for a given workspace, namespace and name.
-func (s *statefulSetNamespaceLister) Get(name string) (*appsv1.StatefulSet, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewStatefulSetLister returns a new StatefulSetLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewStatefulSetLister(indexer cache.Indexer) listersappsv1.StatefulSetLister {
+	return &statefulSetLister{
+		kcplisters.New[*appsv1.StatefulSet](indexer, appsv1.Resource("statefulset")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1.Resource("statefulsets"), name)
+}
+
+// statefulSetScopedLister can list all StatefulSets inside a workspace
+// or scope down to a listersappsv1.StatefulSetNamespaceLister for one namespace.
+type statefulSetScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1.StatefulSet]
+}
+
+// StatefulSets returns an object that can list and get StatefulSets in one namespace.
+func (l *statefulSetScopedLister) StatefulSets(namespace string) listersappsv1.StatefulSetLister {
+	return &statefulSetLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1.StatefulSet), nil
 }
diff --git a/listers/apps/v1/statefulset_expansion.go b/listers/apps/v1/statefulset_expansion.go
index b72ed2c32..205dcd673 100644
--- a/listers/apps/v1/statefulset_expansion.go
+++ b/listers/apps/v1/statefulset_expansion.go
@@ -20,7 +20,7 @@ import (
 	"fmt"
 
 	apps "k8s.io/api/apps/v1"
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 )
diff --git a/listers/apps/v1beta1/controllerrevision.go b/listers/apps/v1beta1/controllerrevision.go
index 111632151..0481f787d 100644
--- a/listers/apps/v1beta1/controllerrevision.go
+++ b/listers/apps/v1beta1/controllerrevision.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1beta1listers "k8s.io/client-go/listers/apps/v1beta1"
+	listersappsv1beta1 "k8s.io/client-go/listers/apps/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ControllerRevisionClusterLister can list ControllerRevisions across all workspaces, or scope down to a ControllerRevisionLister for one workspace.
+// ControllerRevisionClusterLister helps list ControllerRevisions across all workspaces,
+// or scope down to a ControllerRevisionLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ControllerRevisionClusterLister interface {
 	// List lists all ControllerRevisions in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1beta1.ControllerRevision, err error)
 	// Cluster returns a lister that can list and get ControllerRevisions in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1beta1listers.ControllerRevisionLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1beta1.ControllerRevisionLister
 	ControllerRevisionClusterListerExpansion
 }
 
+// controllerRevisionClusterLister implements the ControllerRevisionClusterLister interface.
 type controllerRevisionClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1beta1.ControllerRevision]
 }
 
+var _ ControllerRevisionClusterLister = new(controllerRevisionClusterLister)
+
 // NewControllerRevisionClusterLister returns a new ControllerRevisionClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewControllerRevisionClusterLister(indexer cache.Indexer) *controllerRevisionClusterLister {
-	return &controllerRevisionClusterLister{indexer: indexer}
-}
-
-// List lists all ControllerRevisions in the indexer across all workspaces.
-func (s *controllerRevisionClusterLister) List(selector labels.Selector) (ret []*appsv1beta1.ControllerRevision, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1beta1.ControllerRevision))
-	})
-	return ret, err
+func NewControllerRevisionClusterLister(indexer cache.Indexer) ControllerRevisionClusterLister {
+	return &controllerRevisionClusterLister{
+		kcplisters.NewCluster[*appsv1beta1.ControllerRevision](indexer, appsv1beta1.Resource("controllerrevision")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ControllerRevisions.
-func (s *controllerRevisionClusterLister) Cluster(clusterName logicalcluster.Name) appsv1beta1listers.ControllerRevisionLister {
-	return &controllerRevisionLister{indexer: s.indexer, clusterName: clusterName}
+func (l *controllerRevisionClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1beta1.ControllerRevisionLister {
+	return &controllerRevisionLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// controllerRevisionLister implements the appsv1beta1listers.ControllerRevisionLister interface.
+// controllerRevisionLister can list all ControllerRevisions inside a workspace
+// or scope down to a listersappsv1beta1.ControllerRevisionNamespaceLister for one namespace.
 type controllerRevisionLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1beta1.ControllerRevision]
 }
 
-// List lists all ControllerRevisions in the indexer for a workspace.
-func (s *controllerRevisionLister) List(selector labels.Selector) (ret []*appsv1beta1.ControllerRevision, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta1.ControllerRevision))
-	})
-	return ret, err
-}
+var _ listersappsv1beta1.ControllerRevisionLister = new(controllerRevisionLister)
 
 // ControllerRevisions returns an object that can list and get ControllerRevisions in one namespace.
-func (s *controllerRevisionLister) ControllerRevisions(namespace string) appsv1beta1listers.ControllerRevisionNamespaceLister {
-	return &controllerRevisionNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *controllerRevisionLister) ControllerRevisions(namespace string) listersappsv1beta1.ControllerRevisionNamespaceLister {
+	return &controllerRevisionNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// controllerRevisionNamespaceLister implements the appsv1beta1listers.ControllerRevisionNamespaceLister interface.
+// controllerRevisionNamespaceLister implements the listersappsv1beta1.ControllerRevisionNamespaceLister
+// interface.
 type controllerRevisionNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1beta1.ControllerRevision]
 }
 
-// List lists all ControllerRevisions in the indexer for a given workspace and namespace.
-func (s *controllerRevisionNamespaceLister) List(selector labels.Selector) (ret []*appsv1beta1.ControllerRevision, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta1.ControllerRevision))
-	})
-	return ret, err
-}
+var _ listersappsv1beta1.ControllerRevisionNamespaceLister = new(controllerRevisionNamespaceLister)
 
-// Get retrieves the ControllerRevision from the indexer for a given workspace, namespace and name.
-func (s *controllerRevisionNamespaceLister) Get(name string) (*appsv1beta1.ControllerRevision, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewControllerRevisionLister returns a new ControllerRevisionLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewControllerRevisionLister(indexer cache.Indexer) listersappsv1beta1.ControllerRevisionLister {
+	return &controllerRevisionLister{
+		kcplisters.New[*appsv1beta1.ControllerRevision](indexer, appsv1beta1.Resource("controllerrevision")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1beta1.Resource("controllerrevisions"), name)
+}
+
+// controllerRevisionScopedLister can list all ControllerRevisions inside a workspace
+// or scope down to a listersappsv1beta1.ControllerRevisionNamespaceLister for one namespace.
+type controllerRevisionScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1beta1.ControllerRevision]
+}
+
+// ControllerRevisions returns an object that can list and get ControllerRevisions in one namespace.
+func (l *controllerRevisionScopedLister) ControllerRevisions(namespace string) listersappsv1beta1.ControllerRevisionLister {
+	return &controllerRevisionLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1beta1.ControllerRevision), nil
 }
diff --git a/listers/apps/v1beta1/controllerrevision_expansion.go b/listers/apps/v1beta1/controllerrevision_expansion.go
index c0745283c..431159d57 100644
--- a/listers/apps/v1beta1/controllerrevision_expansion.go
+++ b/listers/apps/v1beta1/controllerrevision_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/apps/v1beta1/deployment.go b/listers/apps/v1beta1/deployment.go
index 2d0e1f71a..36b42b5be 100644
--- a/listers/apps/v1beta1/deployment.go
+++ b/listers/apps/v1beta1/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1beta1listers "k8s.io/client-go/listers/apps/v1beta1"
+	listersappsv1beta1 "k8s.io/client-go/listers/apps/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// DeploymentClusterLister can list Deployments across all workspaces, or scope down to a DeploymentLister for one workspace.
+// DeploymentClusterLister helps list Deployments across all workspaces,
+// or scope down to a DeploymentLister for one workspace.
 // All objects returned here must be treated as read-only.
 type DeploymentClusterLister interface {
 	// List lists all Deployments in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1beta1.Deployment, err error)
 	// Cluster returns a lister that can list and get Deployments in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1beta1listers.DeploymentLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1beta1.DeploymentLister
 	DeploymentClusterListerExpansion
 }
 
+// deploymentClusterLister implements the DeploymentClusterLister interface.
 type deploymentClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1beta1.Deployment]
 }
 
+var _ DeploymentClusterLister = new(deploymentClusterLister)
+
 // NewDeploymentClusterLister returns a new DeploymentClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewDeploymentClusterLister(indexer cache.Indexer) *deploymentClusterLister {
-	return &deploymentClusterLister{indexer: indexer}
-}
-
-// List lists all Deployments in the indexer across all workspaces.
-func (s *deploymentClusterLister) List(selector labels.Selector) (ret []*appsv1beta1.Deployment, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1beta1.Deployment))
-	})
-	return ret, err
+func NewDeploymentClusterLister(indexer cache.Indexer) DeploymentClusterLister {
+	return &deploymentClusterLister{
+		kcplisters.NewCluster[*appsv1beta1.Deployment](indexer, appsv1beta1.Resource("deployment")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Deployments.
-func (s *deploymentClusterLister) Cluster(clusterName logicalcluster.Name) appsv1beta1listers.DeploymentLister {
-	return &deploymentLister{indexer: s.indexer, clusterName: clusterName}
+func (l *deploymentClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1beta1.DeploymentLister {
+	return &deploymentLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// deploymentLister implements the appsv1beta1listers.DeploymentLister interface.
+// deploymentLister can list all Deployments inside a workspace
+// or scope down to a listersappsv1beta1.DeploymentNamespaceLister for one namespace.
 type deploymentLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1beta1.Deployment]
 }
 
-// List lists all Deployments in the indexer for a workspace.
-func (s *deploymentLister) List(selector labels.Selector) (ret []*appsv1beta1.Deployment, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta1.Deployment))
-	})
-	return ret, err
-}
+var _ listersappsv1beta1.DeploymentLister = new(deploymentLister)
 
 // Deployments returns an object that can list and get Deployments in one namespace.
-func (s *deploymentLister) Deployments(namespace string) appsv1beta1listers.DeploymentNamespaceLister {
-	return &deploymentNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *deploymentLister) Deployments(namespace string) listersappsv1beta1.DeploymentNamespaceLister {
+	return &deploymentNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// deploymentNamespaceLister implements the appsv1beta1listers.DeploymentNamespaceLister interface.
+// deploymentNamespaceLister implements the listersappsv1beta1.DeploymentNamespaceLister
+// interface.
 type deploymentNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1beta1.Deployment]
 }
 
-// List lists all Deployments in the indexer for a given workspace and namespace.
-func (s *deploymentNamespaceLister) List(selector labels.Selector) (ret []*appsv1beta1.Deployment, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta1.Deployment))
-	})
-	return ret, err
-}
+var _ listersappsv1beta1.DeploymentNamespaceLister = new(deploymentNamespaceLister)
 
-// Get retrieves the Deployment from the indexer for a given workspace, namespace and name.
-func (s *deploymentNamespaceLister) Get(name string) (*appsv1beta1.Deployment, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewDeploymentLister returns a new DeploymentLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewDeploymentLister(indexer cache.Indexer) listersappsv1beta1.DeploymentLister {
+	return &deploymentLister{
+		kcplisters.New[*appsv1beta1.Deployment](indexer, appsv1beta1.Resource("deployment")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1beta1.Resource("deployments"), name)
+}
+
+// deploymentScopedLister can list all Deployments inside a workspace
+// or scope down to a listersappsv1beta1.DeploymentNamespaceLister for one namespace.
+type deploymentScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1beta1.Deployment]
+}
+
+// Deployments returns an object that can list and get Deployments in one namespace.
+func (l *deploymentScopedLister) Deployments(namespace string) listersappsv1beta1.DeploymentLister {
+	return &deploymentLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1beta1.Deployment), nil
 }
diff --git a/listers/apps/v1beta1/deployment_expansion.go b/listers/apps/v1beta1/deployment_expansion.go
index 11a6cf51c..3c43c24f7 100644
--- a/listers/apps/v1beta1/deployment_expansion.go
+++ b/listers/apps/v1beta1/deployment_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/apps/v1beta1/expansion_generated.go b/listers/apps/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/apps/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/apps/v1beta1/statefulset.go b/listers/apps/v1beta1/statefulset.go
index 2c4f9fb57..62ba99a43 100644
--- a/listers/apps/v1beta1/statefulset.go
+++ b/listers/apps/v1beta1/statefulset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta1 "k8s.io/api/apps/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1beta1listers "k8s.io/client-go/listers/apps/v1beta1"
+	listersappsv1beta1 "k8s.io/client-go/listers/apps/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// StatefulSetClusterLister can list StatefulSets across all workspaces, or scope down to a StatefulSetLister for one workspace.
+// StatefulSetClusterLister helps list StatefulSets across all workspaces,
+// or scope down to a StatefulSetLister for one workspace.
 // All objects returned here must be treated as read-only.
 type StatefulSetClusterLister interface {
 	// List lists all StatefulSets in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1beta1.StatefulSet, err error)
 	// Cluster returns a lister that can list and get StatefulSets in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1beta1listers.StatefulSetLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1beta1.StatefulSetLister
 	StatefulSetClusterListerExpansion
 }
 
+// statefulSetClusterLister implements the StatefulSetClusterLister interface.
 type statefulSetClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1beta1.StatefulSet]
 }
 
+var _ StatefulSetClusterLister = new(statefulSetClusterLister)
+
 // NewStatefulSetClusterLister returns a new StatefulSetClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewStatefulSetClusterLister(indexer cache.Indexer) *statefulSetClusterLister {
-	return &statefulSetClusterLister{indexer: indexer}
-}
-
-// List lists all StatefulSets in the indexer across all workspaces.
-func (s *statefulSetClusterLister) List(selector labels.Selector) (ret []*appsv1beta1.StatefulSet, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1beta1.StatefulSet))
-	})
-	return ret, err
+func NewStatefulSetClusterLister(indexer cache.Indexer) StatefulSetClusterLister {
+	return &statefulSetClusterLister{
+		kcplisters.NewCluster[*appsv1beta1.StatefulSet](indexer, appsv1beta1.Resource("statefulset")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get StatefulSets.
-func (s *statefulSetClusterLister) Cluster(clusterName logicalcluster.Name) appsv1beta1listers.StatefulSetLister {
-	return &statefulSetLister{indexer: s.indexer, clusterName: clusterName}
+func (l *statefulSetClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1beta1.StatefulSetLister {
+	return &statefulSetLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// statefulSetLister implements the appsv1beta1listers.StatefulSetLister interface.
+// statefulSetLister can list all StatefulSets inside a workspace
+// or scope down to a listersappsv1beta1.StatefulSetNamespaceLister for one namespace.
 type statefulSetLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1beta1.StatefulSet]
 }
 
-// List lists all StatefulSets in the indexer for a workspace.
-func (s *statefulSetLister) List(selector labels.Selector) (ret []*appsv1beta1.StatefulSet, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta1.StatefulSet))
-	})
-	return ret, err
-}
+var _ listersappsv1beta1.StatefulSetLister = new(statefulSetLister)
 
 // StatefulSets returns an object that can list and get StatefulSets in one namespace.
-func (s *statefulSetLister) StatefulSets(namespace string) appsv1beta1listers.StatefulSetNamespaceLister {
-	return &statefulSetNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *statefulSetLister) StatefulSets(namespace string) listersappsv1beta1.StatefulSetNamespaceLister {
+	return &statefulSetNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// statefulSetNamespaceLister implements the appsv1beta1listers.StatefulSetNamespaceLister interface.
+// statefulSetNamespaceLister implements the listersappsv1beta1.StatefulSetNamespaceLister
+// interface.
 type statefulSetNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1beta1.StatefulSet]
 }
 
-// List lists all StatefulSets in the indexer for a given workspace and namespace.
-func (s *statefulSetNamespaceLister) List(selector labels.Selector) (ret []*appsv1beta1.StatefulSet, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta1.StatefulSet))
-	})
-	return ret, err
-}
+var _ listersappsv1beta1.StatefulSetNamespaceLister = new(statefulSetNamespaceLister)
 
-// Get retrieves the StatefulSet from the indexer for a given workspace, namespace and name.
-func (s *statefulSetNamespaceLister) Get(name string) (*appsv1beta1.StatefulSet, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewStatefulSetLister returns a new StatefulSetLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewStatefulSetLister(indexer cache.Indexer) listersappsv1beta1.StatefulSetLister {
+	return &statefulSetLister{
+		kcplisters.New[*appsv1beta1.StatefulSet](indexer, appsv1beta1.Resource("statefulset")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1beta1.Resource("statefulsets"), name)
+}
+
+// statefulSetScopedLister can list all StatefulSets inside a workspace
+// or scope down to a listersappsv1beta1.StatefulSetNamespaceLister for one namespace.
+type statefulSetScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1beta1.StatefulSet]
+}
+
+// StatefulSets returns an object that can list and get StatefulSets in one namespace.
+func (l *statefulSetScopedLister) StatefulSets(namespace string) listersappsv1beta1.StatefulSetLister {
+	return &statefulSetLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1beta1.StatefulSet), nil
 }
diff --git a/listers/apps/v1beta1/statefulset_expansion.go b/listers/apps/v1beta1/statefulset_expansion.go
index 24ef8ccb6..506cca09b 100644
--- a/listers/apps/v1beta1/statefulset_expansion.go
+++ b/listers/apps/v1beta1/statefulset_expansion.go
@@ -20,7 +20,7 @@ import (
 	"fmt"
 
 	apps "k8s.io/api/apps/v1beta1"
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 )
diff --git a/listers/apps/v1beta2/controllerrevision.go b/listers/apps/v1beta2/controllerrevision.go
index 99a85e81e..6bc9c57d2 100644
--- a/listers/apps/v1beta2/controllerrevision.go
+++ b/listers/apps/v1beta2/controllerrevision.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1beta2listers "k8s.io/client-go/listers/apps/v1beta2"
+	listersappsv1beta2 "k8s.io/client-go/listers/apps/v1beta2"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ControllerRevisionClusterLister can list ControllerRevisions across all workspaces, or scope down to a ControllerRevisionLister for one workspace.
+// ControllerRevisionClusterLister helps list ControllerRevisions across all workspaces,
+// or scope down to a ControllerRevisionLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ControllerRevisionClusterLister interface {
 	// List lists all ControllerRevisions in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1beta2.ControllerRevision, err error)
 	// Cluster returns a lister that can list and get ControllerRevisions in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1beta2listers.ControllerRevisionLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1beta2.ControllerRevisionLister
 	ControllerRevisionClusterListerExpansion
 }
 
+// controllerRevisionClusterLister implements the ControllerRevisionClusterLister interface.
 type controllerRevisionClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1beta2.ControllerRevision]
 }
 
+var _ ControllerRevisionClusterLister = new(controllerRevisionClusterLister)
+
 // NewControllerRevisionClusterLister returns a new ControllerRevisionClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewControllerRevisionClusterLister(indexer cache.Indexer) *controllerRevisionClusterLister {
-	return &controllerRevisionClusterLister{indexer: indexer}
-}
-
-// List lists all ControllerRevisions in the indexer across all workspaces.
-func (s *controllerRevisionClusterLister) List(selector labels.Selector) (ret []*appsv1beta2.ControllerRevision, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1beta2.ControllerRevision))
-	})
-	return ret, err
+func NewControllerRevisionClusterLister(indexer cache.Indexer) ControllerRevisionClusterLister {
+	return &controllerRevisionClusterLister{
+		kcplisters.NewCluster[*appsv1beta2.ControllerRevision](indexer, appsv1beta2.Resource("controllerrevision")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ControllerRevisions.
-func (s *controllerRevisionClusterLister) Cluster(clusterName logicalcluster.Name) appsv1beta2listers.ControllerRevisionLister {
-	return &controllerRevisionLister{indexer: s.indexer, clusterName: clusterName}
+func (l *controllerRevisionClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1beta2.ControllerRevisionLister {
+	return &controllerRevisionLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// controllerRevisionLister implements the appsv1beta2listers.ControllerRevisionLister interface.
+// controllerRevisionLister can list all ControllerRevisions inside a workspace
+// or scope down to a listersappsv1beta2.ControllerRevisionNamespaceLister for one namespace.
 type controllerRevisionLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1beta2.ControllerRevision]
 }
 
-// List lists all ControllerRevisions in the indexer for a workspace.
-func (s *controllerRevisionLister) List(selector labels.Selector) (ret []*appsv1beta2.ControllerRevision, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta2.ControllerRevision))
-	})
-	return ret, err
-}
+var _ listersappsv1beta2.ControllerRevisionLister = new(controllerRevisionLister)
 
 // ControllerRevisions returns an object that can list and get ControllerRevisions in one namespace.
-func (s *controllerRevisionLister) ControllerRevisions(namespace string) appsv1beta2listers.ControllerRevisionNamespaceLister {
-	return &controllerRevisionNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *controllerRevisionLister) ControllerRevisions(namespace string) listersappsv1beta2.ControllerRevisionNamespaceLister {
+	return &controllerRevisionNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// controllerRevisionNamespaceLister implements the appsv1beta2listers.ControllerRevisionNamespaceLister interface.
+// controllerRevisionNamespaceLister implements the listersappsv1beta2.ControllerRevisionNamespaceLister
+// interface.
 type controllerRevisionNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1beta2.ControllerRevision]
 }
 
-// List lists all ControllerRevisions in the indexer for a given workspace and namespace.
-func (s *controllerRevisionNamespaceLister) List(selector labels.Selector) (ret []*appsv1beta2.ControllerRevision, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta2.ControllerRevision))
-	})
-	return ret, err
-}
+var _ listersappsv1beta2.ControllerRevisionNamespaceLister = new(controllerRevisionNamespaceLister)
 
-// Get retrieves the ControllerRevision from the indexer for a given workspace, namespace and name.
-func (s *controllerRevisionNamespaceLister) Get(name string) (*appsv1beta2.ControllerRevision, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewControllerRevisionLister returns a new ControllerRevisionLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewControllerRevisionLister(indexer cache.Indexer) listersappsv1beta2.ControllerRevisionLister {
+	return &controllerRevisionLister{
+		kcplisters.New[*appsv1beta2.ControllerRevision](indexer, appsv1beta2.Resource("controllerrevision")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1beta2.Resource("controllerrevisions"), name)
+}
+
+// controllerRevisionScopedLister can list all ControllerRevisions inside a workspace
+// or scope down to a listersappsv1beta2.ControllerRevisionNamespaceLister for one namespace.
+type controllerRevisionScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1beta2.ControllerRevision]
+}
+
+// ControllerRevisions returns an object that can list and get ControllerRevisions in one namespace.
+func (l *controllerRevisionScopedLister) ControllerRevisions(namespace string) listersappsv1beta2.ControllerRevisionLister {
+	return &controllerRevisionLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1beta2.ControllerRevision), nil
 }
diff --git a/listers/apps/v1beta2/controllerrevision_expansion.go b/listers/apps/v1beta2/controllerrevision_expansion.go
index 0bb948b3e..6dc8757e2 100644
--- a/listers/apps/v1beta2/controllerrevision_expansion.go
+++ b/listers/apps/v1beta2/controllerrevision_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/apps/v1beta2/daemonset.go b/listers/apps/v1beta2/daemonset.go
index 97dfd39be..be0b7ac50 100644
--- a/listers/apps/v1beta2/daemonset.go
+++ b/listers/apps/v1beta2/daemonset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1beta2listers "k8s.io/client-go/listers/apps/v1beta2"
+	listersappsv1beta2 "k8s.io/client-go/listers/apps/v1beta2"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// DaemonSetClusterLister can list DaemonSets across all workspaces, or scope down to a DaemonSetLister for one workspace.
+// DaemonSetClusterLister helps list DaemonSets across all workspaces,
+// or scope down to a DaemonSetLister for one workspace.
 // All objects returned here must be treated as read-only.
 type DaemonSetClusterLister interface {
 	// List lists all DaemonSets in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1beta2.DaemonSet, err error)
 	// Cluster returns a lister that can list and get DaemonSets in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1beta2listers.DaemonSetLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1beta2.DaemonSetLister
 	DaemonSetClusterListerExpansion
 }
 
+// daemonSetClusterLister implements the DaemonSetClusterLister interface.
 type daemonSetClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1beta2.DaemonSet]
 }
 
+var _ DaemonSetClusterLister = new(daemonSetClusterLister)
+
 // NewDaemonSetClusterLister returns a new DaemonSetClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewDaemonSetClusterLister(indexer cache.Indexer) *daemonSetClusterLister {
-	return &daemonSetClusterLister{indexer: indexer}
-}
-
-// List lists all DaemonSets in the indexer across all workspaces.
-func (s *daemonSetClusterLister) List(selector labels.Selector) (ret []*appsv1beta2.DaemonSet, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1beta2.DaemonSet))
-	})
-	return ret, err
+func NewDaemonSetClusterLister(indexer cache.Indexer) DaemonSetClusterLister {
+	return &daemonSetClusterLister{
+		kcplisters.NewCluster[*appsv1beta2.DaemonSet](indexer, appsv1beta2.Resource("daemonset")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get DaemonSets.
-func (s *daemonSetClusterLister) Cluster(clusterName logicalcluster.Name) appsv1beta2listers.DaemonSetLister {
-	return &daemonSetLister{indexer: s.indexer, clusterName: clusterName}
+func (l *daemonSetClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1beta2.DaemonSetLister {
+	return &daemonSetLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// daemonSetLister implements the appsv1beta2listers.DaemonSetLister interface.
+// daemonSetLister can list all DaemonSets inside a workspace
+// or scope down to a listersappsv1beta2.DaemonSetNamespaceLister for one namespace.
 type daemonSetLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1beta2.DaemonSet]
 }
 
-// List lists all DaemonSets in the indexer for a workspace.
-func (s *daemonSetLister) List(selector labels.Selector) (ret []*appsv1beta2.DaemonSet, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta2.DaemonSet))
-	})
-	return ret, err
-}
+var _ listersappsv1beta2.DaemonSetLister = new(daemonSetLister)
 
 // DaemonSets returns an object that can list and get DaemonSets in one namespace.
-func (s *daemonSetLister) DaemonSets(namespace string) appsv1beta2listers.DaemonSetNamespaceLister {
-	return &daemonSetNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *daemonSetLister) DaemonSets(namespace string) listersappsv1beta2.DaemonSetNamespaceLister {
+	return &daemonSetNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// daemonSetNamespaceLister implements the appsv1beta2listers.DaemonSetNamespaceLister interface.
+// daemonSetNamespaceLister implements the listersappsv1beta2.DaemonSetNamespaceLister
+// interface.
 type daemonSetNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1beta2.DaemonSet]
 }
 
-// List lists all DaemonSets in the indexer for a given workspace and namespace.
-func (s *daemonSetNamespaceLister) List(selector labels.Selector) (ret []*appsv1beta2.DaemonSet, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta2.DaemonSet))
-	})
-	return ret, err
-}
+var _ listersappsv1beta2.DaemonSetNamespaceLister = new(daemonSetNamespaceLister)
 
-// Get retrieves the DaemonSet from the indexer for a given workspace, namespace and name.
-func (s *daemonSetNamespaceLister) Get(name string) (*appsv1beta2.DaemonSet, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewDaemonSetLister returns a new DaemonSetLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewDaemonSetLister(indexer cache.Indexer) listersappsv1beta2.DaemonSetLister {
+	return &daemonSetLister{
+		kcplisters.New[*appsv1beta2.DaemonSet](indexer, appsv1beta2.Resource("daemonset")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1beta2.Resource("daemonsets"), name)
+}
+
+// daemonSetScopedLister can list all DaemonSets inside a workspace
+// or scope down to a listersappsv1beta2.DaemonSetNamespaceLister for one namespace.
+type daemonSetScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1beta2.DaemonSet]
+}
+
+// DaemonSets returns an object that can list and get DaemonSets in one namespace.
+func (l *daemonSetScopedLister) DaemonSets(namespace string) listersappsv1beta2.DaemonSetLister {
+	return &daemonSetLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1beta2.DaemonSet), nil
 }
diff --git a/listers/apps/v1beta2/daemonset_expansion.go b/listers/apps/v1beta2/daemonset_expansion.go
index 169d7b667..eb17b02e2 100644
--- a/listers/apps/v1beta2/daemonset_expansion.go
+++ b/listers/apps/v1beta2/daemonset_expansion.go
@@ -20,7 +20,7 @@ import (
 	"fmt"
 
 	apps "k8s.io/api/apps/v1beta2"
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 )
diff --git a/listers/apps/v1beta2/deployment.go b/listers/apps/v1beta2/deployment.go
index e71b28cec..38f4891d1 100644
--- a/listers/apps/v1beta2/deployment.go
+++ b/listers/apps/v1beta2/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1beta2listers "k8s.io/client-go/listers/apps/v1beta2"
+	listersappsv1beta2 "k8s.io/client-go/listers/apps/v1beta2"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// DeploymentClusterLister can list Deployments across all workspaces, or scope down to a DeploymentLister for one workspace.
+// DeploymentClusterLister helps list Deployments across all workspaces,
+// or scope down to a DeploymentLister for one workspace.
 // All objects returned here must be treated as read-only.
 type DeploymentClusterLister interface {
 	// List lists all Deployments in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1beta2.Deployment, err error)
 	// Cluster returns a lister that can list and get Deployments in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1beta2listers.DeploymentLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1beta2.DeploymentLister
 	DeploymentClusterListerExpansion
 }
 
+// deploymentClusterLister implements the DeploymentClusterLister interface.
 type deploymentClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1beta2.Deployment]
 }
 
+var _ DeploymentClusterLister = new(deploymentClusterLister)
+
 // NewDeploymentClusterLister returns a new DeploymentClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewDeploymentClusterLister(indexer cache.Indexer) *deploymentClusterLister {
-	return &deploymentClusterLister{indexer: indexer}
-}
-
-// List lists all Deployments in the indexer across all workspaces.
-func (s *deploymentClusterLister) List(selector labels.Selector) (ret []*appsv1beta2.Deployment, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1beta2.Deployment))
-	})
-	return ret, err
+func NewDeploymentClusterLister(indexer cache.Indexer) DeploymentClusterLister {
+	return &deploymentClusterLister{
+		kcplisters.NewCluster[*appsv1beta2.Deployment](indexer, appsv1beta2.Resource("deployment")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Deployments.
-func (s *deploymentClusterLister) Cluster(clusterName logicalcluster.Name) appsv1beta2listers.DeploymentLister {
-	return &deploymentLister{indexer: s.indexer, clusterName: clusterName}
+func (l *deploymentClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1beta2.DeploymentLister {
+	return &deploymentLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// deploymentLister implements the appsv1beta2listers.DeploymentLister interface.
+// deploymentLister can list all Deployments inside a workspace
+// or scope down to a listersappsv1beta2.DeploymentNamespaceLister for one namespace.
 type deploymentLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1beta2.Deployment]
 }
 
-// List lists all Deployments in the indexer for a workspace.
-func (s *deploymentLister) List(selector labels.Selector) (ret []*appsv1beta2.Deployment, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta2.Deployment))
-	})
-	return ret, err
-}
+var _ listersappsv1beta2.DeploymentLister = new(deploymentLister)
 
 // Deployments returns an object that can list and get Deployments in one namespace.
-func (s *deploymentLister) Deployments(namespace string) appsv1beta2listers.DeploymentNamespaceLister {
-	return &deploymentNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *deploymentLister) Deployments(namespace string) listersappsv1beta2.DeploymentNamespaceLister {
+	return &deploymentNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// deploymentNamespaceLister implements the appsv1beta2listers.DeploymentNamespaceLister interface.
+// deploymentNamespaceLister implements the listersappsv1beta2.DeploymentNamespaceLister
+// interface.
 type deploymentNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1beta2.Deployment]
 }
 
-// List lists all Deployments in the indexer for a given workspace and namespace.
-func (s *deploymentNamespaceLister) List(selector labels.Selector) (ret []*appsv1beta2.Deployment, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta2.Deployment))
-	})
-	return ret, err
-}
+var _ listersappsv1beta2.DeploymentNamespaceLister = new(deploymentNamespaceLister)
 
-// Get retrieves the Deployment from the indexer for a given workspace, namespace and name.
-func (s *deploymentNamespaceLister) Get(name string) (*appsv1beta2.Deployment, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewDeploymentLister returns a new DeploymentLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewDeploymentLister(indexer cache.Indexer) listersappsv1beta2.DeploymentLister {
+	return &deploymentLister{
+		kcplisters.New[*appsv1beta2.Deployment](indexer, appsv1beta2.Resource("deployment")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1beta2.Resource("deployments"), name)
+}
+
+// deploymentScopedLister can list all Deployments inside a workspace
+// or scope down to a listersappsv1beta2.DeploymentNamespaceLister for one namespace.
+type deploymentScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1beta2.Deployment]
+}
+
+// Deployments returns an object that can list and get Deployments in one namespace.
+func (l *deploymentScopedLister) Deployments(namespace string) listersappsv1beta2.DeploymentLister {
+	return &deploymentLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1beta2.Deployment), nil
 }
diff --git a/listers/apps/v1beta2/deployment_expansion.go b/listers/apps/v1beta2/deployment_expansion.go
index df847acec..9464078de 100644
--- a/listers/apps/v1beta2/deployment_expansion.go
+++ b/listers/apps/v1beta2/deployment_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/apps/v1beta2/expansion_generated.go b/listers/apps/v1beta2/expansion_generated.go
new file mode 100644
index 000000000..3e58e545a
--- /dev/null
+++ b/listers/apps/v1beta2/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta2
diff --git a/listers/apps/v1beta2/replicaset.go b/listers/apps/v1beta2/replicaset.go
index f8a16e243..c2be3b42c 100644
--- a/listers/apps/v1beta2/replicaset.go
+++ b/listers/apps/v1beta2/replicaset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1beta2listers "k8s.io/client-go/listers/apps/v1beta2"
+	listersappsv1beta2 "k8s.io/client-go/listers/apps/v1beta2"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ReplicaSetClusterLister can list ReplicaSets across all workspaces, or scope down to a ReplicaSetLister for one workspace.
+// ReplicaSetClusterLister helps list ReplicaSets across all workspaces,
+// or scope down to a ReplicaSetLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ReplicaSetClusterLister interface {
 	// List lists all ReplicaSets in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1beta2.ReplicaSet, err error)
 	// Cluster returns a lister that can list and get ReplicaSets in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1beta2listers.ReplicaSetLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1beta2.ReplicaSetLister
 	ReplicaSetClusterListerExpansion
 }
 
+// replicaSetClusterLister implements the ReplicaSetClusterLister interface.
 type replicaSetClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1beta2.ReplicaSet]
 }
 
+var _ ReplicaSetClusterLister = new(replicaSetClusterLister)
+
 // NewReplicaSetClusterLister returns a new ReplicaSetClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewReplicaSetClusterLister(indexer cache.Indexer) *replicaSetClusterLister {
-	return &replicaSetClusterLister{indexer: indexer}
-}
-
-// List lists all ReplicaSets in the indexer across all workspaces.
-func (s *replicaSetClusterLister) List(selector labels.Selector) (ret []*appsv1beta2.ReplicaSet, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1beta2.ReplicaSet))
-	})
-	return ret, err
+func NewReplicaSetClusterLister(indexer cache.Indexer) ReplicaSetClusterLister {
+	return &replicaSetClusterLister{
+		kcplisters.NewCluster[*appsv1beta2.ReplicaSet](indexer, appsv1beta2.Resource("replicaset")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ReplicaSets.
-func (s *replicaSetClusterLister) Cluster(clusterName logicalcluster.Name) appsv1beta2listers.ReplicaSetLister {
-	return &replicaSetLister{indexer: s.indexer, clusterName: clusterName}
+func (l *replicaSetClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1beta2.ReplicaSetLister {
+	return &replicaSetLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// replicaSetLister implements the appsv1beta2listers.ReplicaSetLister interface.
+// replicaSetLister can list all ReplicaSets inside a workspace
+// or scope down to a listersappsv1beta2.ReplicaSetNamespaceLister for one namespace.
 type replicaSetLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1beta2.ReplicaSet]
 }
 
-// List lists all ReplicaSets in the indexer for a workspace.
-func (s *replicaSetLister) List(selector labels.Selector) (ret []*appsv1beta2.ReplicaSet, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta2.ReplicaSet))
-	})
-	return ret, err
-}
+var _ listersappsv1beta2.ReplicaSetLister = new(replicaSetLister)
 
 // ReplicaSets returns an object that can list and get ReplicaSets in one namespace.
-func (s *replicaSetLister) ReplicaSets(namespace string) appsv1beta2listers.ReplicaSetNamespaceLister {
-	return &replicaSetNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *replicaSetLister) ReplicaSets(namespace string) listersappsv1beta2.ReplicaSetNamespaceLister {
+	return &replicaSetNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// replicaSetNamespaceLister implements the appsv1beta2listers.ReplicaSetNamespaceLister interface.
+// replicaSetNamespaceLister implements the listersappsv1beta2.ReplicaSetNamespaceLister
+// interface.
 type replicaSetNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1beta2.ReplicaSet]
 }
 
-// List lists all ReplicaSets in the indexer for a given workspace and namespace.
-func (s *replicaSetNamespaceLister) List(selector labels.Selector) (ret []*appsv1beta2.ReplicaSet, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta2.ReplicaSet))
-	})
-	return ret, err
-}
+var _ listersappsv1beta2.ReplicaSetNamespaceLister = new(replicaSetNamespaceLister)
 
-// Get retrieves the ReplicaSet from the indexer for a given workspace, namespace and name.
-func (s *replicaSetNamespaceLister) Get(name string) (*appsv1beta2.ReplicaSet, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewReplicaSetLister returns a new ReplicaSetLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewReplicaSetLister(indexer cache.Indexer) listersappsv1beta2.ReplicaSetLister {
+	return &replicaSetLister{
+		kcplisters.New[*appsv1beta2.ReplicaSet](indexer, appsv1beta2.Resource("replicaset")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1beta2.Resource("replicasets"), name)
+}
+
+// replicaSetScopedLister can list all ReplicaSets inside a workspace
+// or scope down to a listersappsv1beta2.ReplicaSetNamespaceLister for one namespace.
+type replicaSetScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1beta2.ReplicaSet]
+}
+
+// ReplicaSets returns an object that can list and get ReplicaSets in one namespace.
+func (l *replicaSetScopedLister) ReplicaSets(namespace string) listersappsv1beta2.ReplicaSetLister {
+	return &replicaSetLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1beta2.ReplicaSet), nil
 }
diff --git a/listers/apps/v1beta2/replicaset_expansion.go b/listers/apps/v1beta2/replicaset_expansion.go
index 484eb6324..e691efb0e 100644
--- a/listers/apps/v1beta2/replicaset_expansion.go
+++ b/listers/apps/v1beta2/replicaset_expansion.go
@@ -20,7 +20,7 @@ import (
 	"fmt"
 
 	apps "k8s.io/api/apps/v1beta2"
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 )
diff --git a/listers/apps/v1beta2/statefulset.go b/listers/apps/v1beta2/statefulset.go
index 20660f4a9..0deb5adf7 100644
--- a/listers/apps/v1beta2/statefulset.go
+++ b/listers/apps/v1beta2/statefulset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	appsv1beta2 "k8s.io/api/apps/v1beta2"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	appsv1beta2listers "k8s.io/client-go/listers/apps/v1beta2"
+	listersappsv1beta2 "k8s.io/client-go/listers/apps/v1beta2"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// StatefulSetClusterLister can list StatefulSets across all workspaces, or scope down to a StatefulSetLister for one workspace.
+// StatefulSetClusterLister helps list StatefulSets across all workspaces,
+// or scope down to a StatefulSetLister for one workspace.
 // All objects returned here must be treated as read-only.
 type StatefulSetClusterLister interface {
 	// List lists all StatefulSets in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*appsv1beta2.StatefulSet, err error)
 	// Cluster returns a lister that can list and get StatefulSets in one workspace.
-	Cluster(clusterName logicalcluster.Name) appsv1beta2listers.StatefulSetLister
+	Cluster(clusterName logicalcluster.Name) listersappsv1beta2.StatefulSetLister
 	StatefulSetClusterListerExpansion
 }
 
+// statefulSetClusterLister implements the StatefulSetClusterLister interface.
 type statefulSetClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*appsv1beta2.StatefulSet]
 }
 
+var _ StatefulSetClusterLister = new(statefulSetClusterLister)
+
 // NewStatefulSetClusterLister returns a new StatefulSetClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewStatefulSetClusterLister(indexer cache.Indexer) *statefulSetClusterLister {
-	return &statefulSetClusterLister{indexer: indexer}
-}
-
-// List lists all StatefulSets in the indexer across all workspaces.
-func (s *statefulSetClusterLister) List(selector labels.Selector) (ret []*appsv1beta2.StatefulSet, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*appsv1beta2.StatefulSet))
-	})
-	return ret, err
+func NewStatefulSetClusterLister(indexer cache.Indexer) StatefulSetClusterLister {
+	return &statefulSetClusterLister{
+		kcplisters.NewCluster[*appsv1beta2.StatefulSet](indexer, appsv1beta2.Resource("statefulset")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get StatefulSets.
-func (s *statefulSetClusterLister) Cluster(clusterName logicalcluster.Name) appsv1beta2listers.StatefulSetLister {
-	return &statefulSetLister{indexer: s.indexer, clusterName: clusterName}
+func (l *statefulSetClusterLister) Cluster(clusterName logicalcluster.Name) listersappsv1beta2.StatefulSetLister {
+	return &statefulSetLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// statefulSetLister implements the appsv1beta2listers.StatefulSetLister interface.
+// statefulSetLister can list all StatefulSets inside a workspace
+// or scope down to a listersappsv1beta2.StatefulSetNamespaceLister for one namespace.
 type statefulSetLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*appsv1beta2.StatefulSet]
 }
 
-// List lists all StatefulSets in the indexer for a workspace.
-func (s *statefulSetLister) List(selector labels.Selector) (ret []*appsv1beta2.StatefulSet, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta2.StatefulSet))
-	})
-	return ret, err
-}
+var _ listersappsv1beta2.StatefulSetLister = new(statefulSetLister)
 
 // StatefulSets returns an object that can list and get StatefulSets in one namespace.
-func (s *statefulSetLister) StatefulSets(namespace string) appsv1beta2listers.StatefulSetNamespaceLister {
-	return &statefulSetNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *statefulSetLister) StatefulSets(namespace string) listersappsv1beta2.StatefulSetNamespaceLister {
+	return &statefulSetNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// statefulSetNamespaceLister implements the appsv1beta2listers.StatefulSetNamespaceLister interface.
+// statefulSetNamespaceLister implements the listersappsv1beta2.StatefulSetNamespaceLister
+// interface.
 type statefulSetNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*appsv1beta2.StatefulSet]
 }
 
-// List lists all StatefulSets in the indexer for a given workspace and namespace.
-func (s *statefulSetNamespaceLister) List(selector labels.Selector) (ret []*appsv1beta2.StatefulSet, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*appsv1beta2.StatefulSet))
-	})
-	return ret, err
-}
+var _ listersappsv1beta2.StatefulSetNamespaceLister = new(statefulSetNamespaceLister)
 
-// Get retrieves the StatefulSet from the indexer for a given workspace, namespace and name.
-func (s *statefulSetNamespaceLister) Get(name string) (*appsv1beta2.StatefulSet, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewStatefulSetLister returns a new StatefulSetLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewStatefulSetLister(indexer cache.Indexer) listersappsv1beta2.StatefulSetLister {
+	return &statefulSetLister{
+		kcplisters.New[*appsv1beta2.StatefulSet](indexer, appsv1beta2.Resource("statefulset")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(appsv1beta2.Resource("statefulsets"), name)
+}
+
+// statefulSetScopedLister can list all StatefulSets inside a workspace
+// or scope down to a listersappsv1beta2.StatefulSetNamespaceLister for one namespace.
+type statefulSetScopedLister struct {
+	kcplisters.ResourceIndexer[*appsv1beta2.StatefulSet]
+}
+
+// StatefulSets returns an object that can list and get StatefulSets in one namespace.
+func (l *statefulSetScopedLister) StatefulSets(namespace string) listersappsv1beta2.StatefulSetLister {
+	return &statefulSetLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*appsv1beta2.StatefulSet), nil
 }
diff --git a/listers/apps/v1beta2/statefulset_expansion.go b/listers/apps/v1beta2/statefulset_expansion.go
index f9a3b38cb..a9a6b84d0 100644
--- a/listers/apps/v1beta2/statefulset_expansion.go
+++ b/listers/apps/v1beta2/statefulset_expansion.go
@@ -20,7 +20,7 @@ import (
 	"fmt"
 
 	apps "k8s.io/api/apps/v1beta2"
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 )
diff --git a/listers/autoscaling/v1/expansion_generated.go b/listers/autoscaling/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/autoscaling/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/autoscaling/v1/horizontalpodautoscaler.go b/listers/autoscaling/v1/horizontalpodautoscaler.go
index 8acdcd17d..a3d63609b 100644
--- a/listers/autoscaling/v1/horizontalpodautoscaler.go
+++ b/listers/autoscaling/v1/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	autoscalingv1 "k8s.io/api/autoscaling/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	autoscalingv1listers "k8s.io/client-go/listers/autoscaling/v1"
+	listersautoscalingv1 "k8s.io/client-go/listers/autoscaling/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// HorizontalPodAutoscalerClusterLister can list HorizontalPodAutoscalers across all workspaces, or scope down to a HorizontalPodAutoscalerLister for one workspace.
+// HorizontalPodAutoscalerClusterLister helps list HorizontalPodAutoscalers across all workspaces,
+// or scope down to a HorizontalPodAutoscalerLister for one workspace.
 // All objects returned here must be treated as read-only.
 type HorizontalPodAutoscalerClusterLister interface {
 	// List lists all HorizontalPodAutoscalers in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*autoscalingv1.HorizontalPodAutoscaler, err error)
 	// Cluster returns a lister that can list and get HorizontalPodAutoscalers in one workspace.
-	Cluster(clusterName logicalcluster.Name) autoscalingv1listers.HorizontalPodAutoscalerLister
+	Cluster(clusterName logicalcluster.Name) listersautoscalingv1.HorizontalPodAutoscalerLister
 	HorizontalPodAutoscalerClusterListerExpansion
 }
 
+// horizontalPodAutoscalerClusterLister implements the HorizontalPodAutoscalerClusterLister interface.
 type horizontalPodAutoscalerClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*autoscalingv1.HorizontalPodAutoscaler]
 }
 
+var _ HorizontalPodAutoscalerClusterLister = new(horizontalPodAutoscalerClusterLister)
+
 // NewHorizontalPodAutoscalerClusterLister returns a new HorizontalPodAutoscalerClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewHorizontalPodAutoscalerClusterLister(indexer cache.Indexer) *horizontalPodAutoscalerClusterLister {
-	return &horizontalPodAutoscalerClusterLister{indexer: indexer}
-}
-
-// List lists all HorizontalPodAutoscalers in the indexer across all workspaces.
-func (s *horizontalPodAutoscalerClusterLister) List(selector labels.Selector) (ret []*autoscalingv1.HorizontalPodAutoscaler, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*autoscalingv1.HorizontalPodAutoscaler))
-	})
-	return ret, err
+func NewHorizontalPodAutoscalerClusterLister(indexer cache.Indexer) HorizontalPodAutoscalerClusterLister {
+	return &horizontalPodAutoscalerClusterLister{
+		kcplisters.NewCluster[*autoscalingv1.HorizontalPodAutoscaler](indexer, autoscalingv1.Resource("horizontalpodautoscaler")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get HorizontalPodAutoscalers.
-func (s *horizontalPodAutoscalerClusterLister) Cluster(clusterName logicalcluster.Name) autoscalingv1listers.HorizontalPodAutoscalerLister {
-	return &horizontalPodAutoscalerLister{indexer: s.indexer, clusterName: clusterName}
+func (l *horizontalPodAutoscalerClusterLister) Cluster(clusterName logicalcluster.Name) listersautoscalingv1.HorizontalPodAutoscalerLister {
+	return &horizontalPodAutoscalerLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// horizontalPodAutoscalerLister implements the autoscalingv1listers.HorizontalPodAutoscalerLister interface.
+// horizontalPodAutoscalerLister can list all HorizontalPodAutoscalers inside a workspace
+// or scope down to a listersautoscalingv1.HorizontalPodAutoscalerNamespaceLister for one namespace.
 type horizontalPodAutoscalerLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*autoscalingv1.HorizontalPodAutoscaler]
 }
 
-// List lists all HorizontalPodAutoscalers in the indexer for a workspace.
-func (s *horizontalPodAutoscalerLister) List(selector labels.Selector) (ret []*autoscalingv1.HorizontalPodAutoscaler, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*autoscalingv1.HorizontalPodAutoscaler))
-	})
-	return ret, err
-}
+var _ listersautoscalingv1.HorizontalPodAutoscalerLister = new(horizontalPodAutoscalerLister)
 
 // HorizontalPodAutoscalers returns an object that can list and get HorizontalPodAutoscalers in one namespace.
-func (s *horizontalPodAutoscalerLister) HorizontalPodAutoscalers(namespace string) autoscalingv1listers.HorizontalPodAutoscalerNamespaceLister {
-	return &horizontalPodAutoscalerNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *horizontalPodAutoscalerLister) HorizontalPodAutoscalers(namespace string) listersautoscalingv1.HorizontalPodAutoscalerNamespaceLister {
+	return &horizontalPodAutoscalerNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// horizontalPodAutoscalerNamespaceLister implements the autoscalingv1listers.HorizontalPodAutoscalerNamespaceLister interface.
+// horizontalPodAutoscalerNamespaceLister implements the listersautoscalingv1.HorizontalPodAutoscalerNamespaceLister
+// interface.
 type horizontalPodAutoscalerNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*autoscalingv1.HorizontalPodAutoscaler]
 }
 
-// List lists all HorizontalPodAutoscalers in the indexer for a given workspace and namespace.
-func (s *horizontalPodAutoscalerNamespaceLister) List(selector labels.Selector) (ret []*autoscalingv1.HorizontalPodAutoscaler, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*autoscalingv1.HorizontalPodAutoscaler))
-	})
-	return ret, err
-}
+var _ listersautoscalingv1.HorizontalPodAutoscalerNamespaceLister = new(horizontalPodAutoscalerNamespaceLister)
 
-// Get retrieves the HorizontalPodAutoscaler from the indexer for a given workspace, namespace and name.
-func (s *horizontalPodAutoscalerNamespaceLister) Get(name string) (*autoscalingv1.HorizontalPodAutoscaler, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewHorizontalPodAutoscalerLister returns a new HorizontalPodAutoscalerLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewHorizontalPodAutoscalerLister(indexer cache.Indexer) listersautoscalingv1.HorizontalPodAutoscalerLister {
+	return &horizontalPodAutoscalerLister{
+		kcplisters.New[*autoscalingv1.HorizontalPodAutoscaler](indexer, autoscalingv1.Resource("horizontalpodautoscaler")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(autoscalingv1.Resource("horizontalpodautoscalers"), name)
+}
+
+// horizontalPodAutoscalerScopedLister can list all HorizontalPodAutoscalers inside a workspace
+// or scope down to a listersautoscalingv1.HorizontalPodAutoscalerNamespaceLister for one namespace.
+type horizontalPodAutoscalerScopedLister struct {
+	kcplisters.ResourceIndexer[*autoscalingv1.HorizontalPodAutoscaler]
+}
+
+// HorizontalPodAutoscalers returns an object that can list and get HorizontalPodAutoscalers in one namespace.
+func (l *horizontalPodAutoscalerScopedLister) HorizontalPodAutoscalers(namespace string) listersautoscalingv1.HorizontalPodAutoscalerLister {
+	return &horizontalPodAutoscalerLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*autoscalingv1.HorizontalPodAutoscaler), nil
 }
diff --git a/listers/autoscaling/v1/horizontalpodautoscaler_expansion.go b/listers/autoscaling/v1/horizontalpodautoscaler_expansion.go
index 65785806b..860110654 100644
--- a/listers/autoscaling/v1/horizontalpodautoscaler_expansion.go
+++ b/listers/autoscaling/v1/horizontalpodautoscaler_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/autoscaling/v2/expansion_generated.go b/listers/autoscaling/v2/expansion_generated.go
new file mode 100644
index 000000000..5dc07a5a6
--- /dev/null
+++ b/listers/autoscaling/v2/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v2
diff --git a/listers/autoscaling/v2/horizontalpodautoscaler.go b/listers/autoscaling/v2/horizontalpodautoscaler.go
index e1e446b41..3c28bb372 100644
--- a/listers/autoscaling/v2/horizontalpodautoscaler.go
+++ b/listers/autoscaling/v2/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v2
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	autoscalingv2 "k8s.io/api/autoscaling/v2"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	autoscalingv2listers "k8s.io/client-go/listers/autoscaling/v2"
+	listersautoscalingv2 "k8s.io/client-go/listers/autoscaling/v2"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// HorizontalPodAutoscalerClusterLister can list HorizontalPodAutoscalers across all workspaces, or scope down to a HorizontalPodAutoscalerLister for one workspace.
+// HorizontalPodAutoscalerClusterLister helps list HorizontalPodAutoscalers across all workspaces,
+// or scope down to a HorizontalPodAutoscalerLister for one workspace.
 // All objects returned here must be treated as read-only.
 type HorizontalPodAutoscalerClusterLister interface {
 	// List lists all HorizontalPodAutoscalers in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*autoscalingv2.HorizontalPodAutoscaler, err error)
 	// Cluster returns a lister that can list and get HorizontalPodAutoscalers in one workspace.
-	Cluster(clusterName logicalcluster.Name) autoscalingv2listers.HorizontalPodAutoscalerLister
+	Cluster(clusterName logicalcluster.Name) listersautoscalingv2.HorizontalPodAutoscalerLister
 	HorizontalPodAutoscalerClusterListerExpansion
 }
 
+// horizontalPodAutoscalerClusterLister implements the HorizontalPodAutoscalerClusterLister interface.
 type horizontalPodAutoscalerClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*autoscalingv2.HorizontalPodAutoscaler]
 }
 
+var _ HorizontalPodAutoscalerClusterLister = new(horizontalPodAutoscalerClusterLister)
+
 // NewHorizontalPodAutoscalerClusterLister returns a new HorizontalPodAutoscalerClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewHorizontalPodAutoscalerClusterLister(indexer cache.Indexer) *horizontalPodAutoscalerClusterLister {
-	return &horizontalPodAutoscalerClusterLister{indexer: indexer}
-}
-
-// List lists all HorizontalPodAutoscalers in the indexer across all workspaces.
-func (s *horizontalPodAutoscalerClusterLister) List(selector labels.Selector) (ret []*autoscalingv2.HorizontalPodAutoscaler, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*autoscalingv2.HorizontalPodAutoscaler))
-	})
-	return ret, err
+func NewHorizontalPodAutoscalerClusterLister(indexer cache.Indexer) HorizontalPodAutoscalerClusterLister {
+	return &horizontalPodAutoscalerClusterLister{
+		kcplisters.NewCluster[*autoscalingv2.HorizontalPodAutoscaler](indexer, autoscalingv2.Resource("horizontalpodautoscaler")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get HorizontalPodAutoscalers.
-func (s *horizontalPodAutoscalerClusterLister) Cluster(clusterName logicalcluster.Name) autoscalingv2listers.HorizontalPodAutoscalerLister {
-	return &horizontalPodAutoscalerLister{indexer: s.indexer, clusterName: clusterName}
+func (l *horizontalPodAutoscalerClusterLister) Cluster(clusterName logicalcluster.Name) listersautoscalingv2.HorizontalPodAutoscalerLister {
+	return &horizontalPodAutoscalerLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// horizontalPodAutoscalerLister implements the autoscalingv2listers.HorizontalPodAutoscalerLister interface.
+// horizontalPodAutoscalerLister can list all HorizontalPodAutoscalers inside a workspace
+// or scope down to a listersautoscalingv2.HorizontalPodAutoscalerNamespaceLister for one namespace.
 type horizontalPodAutoscalerLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*autoscalingv2.HorizontalPodAutoscaler]
 }
 
-// List lists all HorizontalPodAutoscalers in the indexer for a workspace.
-func (s *horizontalPodAutoscalerLister) List(selector labels.Selector) (ret []*autoscalingv2.HorizontalPodAutoscaler, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*autoscalingv2.HorizontalPodAutoscaler))
-	})
-	return ret, err
-}
+var _ listersautoscalingv2.HorizontalPodAutoscalerLister = new(horizontalPodAutoscalerLister)
 
 // HorizontalPodAutoscalers returns an object that can list and get HorizontalPodAutoscalers in one namespace.
-func (s *horizontalPodAutoscalerLister) HorizontalPodAutoscalers(namespace string) autoscalingv2listers.HorizontalPodAutoscalerNamespaceLister {
-	return &horizontalPodAutoscalerNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *horizontalPodAutoscalerLister) HorizontalPodAutoscalers(namespace string) listersautoscalingv2.HorizontalPodAutoscalerNamespaceLister {
+	return &horizontalPodAutoscalerNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// horizontalPodAutoscalerNamespaceLister implements the autoscalingv2listers.HorizontalPodAutoscalerNamespaceLister interface.
+// horizontalPodAutoscalerNamespaceLister implements the listersautoscalingv2.HorizontalPodAutoscalerNamespaceLister
+// interface.
 type horizontalPodAutoscalerNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*autoscalingv2.HorizontalPodAutoscaler]
 }
 
-// List lists all HorizontalPodAutoscalers in the indexer for a given workspace and namespace.
-func (s *horizontalPodAutoscalerNamespaceLister) List(selector labels.Selector) (ret []*autoscalingv2.HorizontalPodAutoscaler, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*autoscalingv2.HorizontalPodAutoscaler))
-	})
-	return ret, err
-}
+var _ listersautoscalingv2.HorizontalPodAutoscalerNamespaceLister = new(horizontalPodAutoscalerNamespaceLister)
 
-// Get retrieves the HorizontalPodAutoscaler from the indexer for a given workspace, namespace and name.
-func (s *horizontalPodAutoscalerNamespaceLister) Get(name string) (*autoscalingv2.HorizontalPodAutoscaler, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewHorizontalPodAutoscalerLister returns a new HorizontalPodAutoscalerLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewHorizontalPodAutoscalerLister(indexer cache.Indexer) listersautoscalingv2.HorizontalPodAutoscalerLister {
+	return &horizontalPodAutoscalerLister{
+		kcplisters.New[*autoscalingv2.HorizontalPodAutoscaler](indexer, autoscalingv2.Resource("horizontalpodautoscaler")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(autoscalingv2.Resource("horizontalpodautoscalers"), name)
+}
+
+// horizontalPodAutoscalerScopedLister can list all HorizontalPodAutoscalers inside a workspace
+// or scope down to a listersautoscalingv2.HorizontalPodAutoscalerNamespaceLister for one namespace.
+type horizontalPodAutoscalerScopedLister struct {
+	kcplisters.ResourceIndexer[*autoscalingv2.HorizontalPodAutoscaler]
+}
+
+// HorizontalPodAutoscalers returns an object that can list and get HorizontalPodAutoscalers in one namespace.
+func (l *horizontalPodAutoscalerScopedLister) HorizontalPodAutoscalers(namespace string) listersautoscalingv2.HorizontalPodAutoscalerLister {
+	return &horizontalPodAutoscalerLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*autoscalingv2.HorizontalPodAutoscaler), nil
 }
diff --git a/listers/autoscaling/v2/horizontalpodautoscaler_expansion.go b/listers/autoscaling/v2/horizontalpodautoscaler_expansion.go
index f186ef85d..57334c551 100644
--- a/listers/autoscaling/v2/horizontalpodautoscaler_expansion.go
+++ b/listers/autoscaling/v2/horizontalpodautoscaler_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/autoscaling/v2beta1/expansion_generated.go b/listers/autoscaling/v2beta1/expansion_generated.go
new file mode 100644
index 000000000..fb1dcf717
--- /dev/null
+++ b/listers/autoscaling/v2beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v2beta1
diff --git a/listers/autoscaling/v2beta1/horizontalpodautoscaler.go b/listers/autoscaling/v2beta1/horizontalpodautoscaler.go
index 2408474c3..a6122af17 100644
--- a/listers/autoscaling/v2beta1/horizontalpodautoscaler.go
+++ b/listers/autoscaling/v2beta1/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v2beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	autoscalingv2beta1 "k8s.io/api/autoscaling/v2beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	autoscalingv2beta1listers "k8s.io/client-go/listers/autoscaling/v2beta1"
+	listersautoscalingv2beta1 "k8s.io/client-go/listers/autoscaling/v2beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// HorizontalPodAutoscalerClusterLister can list HorizontalPodAutoscalers across all workspaces, or scope down to a HorizontalPodAutoscalerLister for one workspace.
+// HorizontalPodAutoscalerClusterLister helps list HorizontalPodAutoscalers across all workspaces,
+// or scope down to a HorizontalPodAutoscalerLister for one workspace.
 // All objects returned here must be treated as read-only.
 type HorizontalPodAutoscalerClusterLister interface {
 	// List lists all HorizontalPodAutoscalers in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*autoscalingv2beta1.HorizontalPodAutoscaler, err error)
 	// Cluster returns a lister that can list and get HorizontalPodAutoscalers in one workspace.
-	Cluster(clusterName logicalcluster.Name) autoscalingv2beta1listers.HorizontalPodAutoscalerLister
+	Cluster(clusterName logicalcluster.Name) listersautoscalingv2beta1.HorizontalPodAutoscalerLister
 	HorizontalPodAutoscalerClusterListerExpansion
 }
 
+// horizontalPodAutoscalerClusterLister implements the HorizontalPodAutoscalerClusterLister interface.
 type horizontalPodAutoscalerClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*autoscalingv2beta1.HorizontalPodAutoscaler]
 }
 
+var _ HorizontalPodAutoscalerClusterLister = new(horizontalPodAutoscalerClusterLister)
+
 // NewHorizontalPodAutoscalerClusterLister returns a new HorizontalPodAutoscalerClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewHorizontalPodAutoscalerClusterLister(indexer cache.Indexer) *horizontalPodAutoscalerClusterLister {
-	return &horizontalPodAutoscalerClusterLister{indexer: indexer}
-}
-
-// List lists all HorizontalPodAutoscalers in the indexer across all workspaces.
-func (s *horizontalPodAutoscalerClusterLister) List(selector labels.Selector) (ret []*autoscalingv2beta1.HorizontalPodAutoscaler, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*autoscalingv2beta1.HorizontalPodAutoscaler))
-	})
-	return ret, err
+func NewHorizontalPodAutoscalerClusterLister(indexer cache.Indexer) HorizontalPodAutoscalerClusterLister {
+	return &horizontalPodAutoscalerClusterLister{
+		kcplisters.NewCluster[*autoscalingv2beta1.HorizontalPodAutoscaler](indexer, autoscalingv2beta1.Resource("horizontalpodautoscaler")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get HorizontalPodAutoscalers.
-func (s *horizontalPodAutoscalerClusterLister) Cluster(clusterName logicalcluster.Name) autoscalingv2beta1listers.HorizontalPodAutoscalerLister {
-	return &horizontalPodAutoscalerLister{indexer: s.indexer, clusterName: clusterName}
+func (l *horizontalPodAutoscalerClusterLister) Cluster(clusterName logicalcluster.Name) listersautoscalingv2beta1.HorizontalPodAutoscalerLister {
+	return &horizontalPodAutoscalerLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// horizontalPodAutoscalerLister implements the autoscalingv2beta1listers.HorizontalPodAutoscalerLister interface.
+// horizontalPodAutoscalerLister can list all HorizontalPodAutoscalers inside a workspace
+// or scope down to a listersautoscalingv2beta1.HorizontalPodAutoscalerNamespaceLister for one namespace.
 type horizontalPodAutoscalerLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*autoscalingv2beta1.HorizontalPodAutoscaler]
 }
 
-// List lists all HorizontalPodAutoscalers in the indexer for a workspace.
-func (s *horizontalPodAutoscalerLister) List(selector labels.Selector) (ret []*autoscalingv2beta1.HorizontalPodAutoscaler, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*autoscalingv2beta1.HorizontalPodAutoscaler))
-	})
-	return ret, err
-}
+var _ listersautoscalingv2beta1.HorizontalPodAutoscalerLister = new(horizontalPodAutoscalerLister)
 
 // HorizontalPodAutoscalers returns an object that can list and get HorizontalPodAutoscalers in one namespace.
-func (s *horizontalPodAutoscalerLister) HorizontalPodAutoscalers(namespace string) autoscalingv2beta1listers.HorizontalPodAutoscalerNamespaceLister {
-	return &horizontalPodAutoscalerNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *horizontalPodAutoscalerLister) HorizontalPodAutoscalers(namespace string) listersautoscalingv2beta1.HorizontalPodAutoscalerNamespaceLister {
+	return &horizontalPodAutoscalerNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// horizontalPodAutoscalerNamespaceLister implements the autoscalingv2beta1listers.HorizontalPodAutoscalerNamespaceLister interface.
+// horizontalPodAutoscalerNamespaceLister implements the listersautoscalingv2beta1.HorizontalPodAutoscalerNamespaceLister
+// interface.
 type horizontalPodAutoscalerNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*autoscalingv2beta1.HorizontalPodAutoscaler]
 }
 
-// List lists all HorizontalPodAutoscalers in the indexer for a given workspace and namespace.
-func (s *horizontalPodAutoscalerNamespaceLister) List(selector labels.Selector) (ret []*autoscalingv2beta1.HorizontalPodAutoscaler, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*autoscalingv2beta1.HorizontalPodAutoscaler))
-	})
-	return ret, err
-}
+var _ listersautoscalingv2beta1.HorizontalPodAutoscalerNamespaceLister = new(horizontalPodAutoscalerNamespaceLister)
 
-// Get retrieves the HorizontalPodAutoscaler from the indexer for a given workspace, namespace and name.
-func (s *horizontalPodAutoscalerNamespaceLister) Get(name string) (*autoscalingv2beta1.HorizontalPodAutoscaler, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewHorizontalPodAutoscalerLister returns a new HorizontalPodAutoscalerLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewHorizontalPodAutoscalerLister(indexer cache.Indexer) listersautoscalingv2beta1.HorizontalPodAutoscalerLister {
+	return &horizontalPodAutoscalerLister{
+		kcplisters.New[*autoscalingv2beta1.HorizontalPodAutoscaler](indexer, autoscalingv2beta1.Resource("horizontalpodautoscaler")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(autoscalingv2beta1.Resource("horizontalpodautoscalers"), name)
+}
+
+// horizontalPodAutoscalerScopedLister can list all HorizontalPodAutoscalers inside a workspace
+// or scope down to a listersautoscalingv2beta1.HorizontalPodAutoscalerNamespaceLister for one namespace.
+type horizontalPodAutoscalerScopedLister struct {
+	kcplisters.ResourceIndexer[*autoscalingv2beta1.HorizontalPodAutoscaler]
+}
+
+// HorizontalPodAutoscalers returns an object that can list and get HorizontalPodAutoscalers in one namespace.
+func (l *horizontalPodAutoscalerScopedLister) HorizontalPodAutoscalers(namespace string) listersautoscalingv2beta1.HorizontalPodAutoscalerLister {
+	return &horizontalPodAutoscalerLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*autoscalingv2beta1.HorizontalPodAutoscaler), nil
 }
diff --git a/listers/autoscaling/v2beta1/horizontalpodautoscaler_expansion.go b/listers/autoscaling/v2beta1/horizontalpodautoscaler_expansion.go
index 30954c982..d7993a256 100644
--- a/listers/autoscaling/v2beta1/horizontalpodautoscaler_expansion.go
+++ b/listers/autoscaling/v2beta1/horizontalpodautoscaler_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/autoscaling/v2beta2/expansion_generated.go b/listers/autoscaling/v2beta2/expansion_generated.go
new file mode 100644
index 000000000..2b868fbf6
--- /dev/null
+++ b/listers/autoscaling/v2beta2/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v2beta2
diff --git a/listers/autoscaling/v2beta2/horizontalpodautoscaler.go b/listers/autoscaling/v2beta2/horizontalpodautoscaler.go
index b6e8d9da0..8e2824660 100644
--- a/listers/autoscaling/v2beta2/horizontalpodautoscaler.go
+++ b/listers/autoscaling/v2beta2/horizontalpodautoscaler.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v2beta2
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	autoscalingv2beta2 "k8s.io/api/autoscaling/v2beta2"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	autoscalingv2beta2listers "k8s.io/client-go/listers/autoscaling/v2beta2"
+	listersautoscalingv2beta2 "k8s.io/client-go/listers/autoscaling/v2beta2"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// HorizontalPodAutoscalerClusterLister can list HorizontalPodAutoscalers across all workspaces, or scope down to a HorizontalPodAutoscalerLister for one workspace.
+// HorizontalPodAutoscalerClusterLister helps list HorizontalPodAutoscalers across all workspaces,
+// or scope down to a HorizontalPodAutoscalerLister for one workspace.
 // All objects returned here must be treated as read-only.
 type HorizontalPodAutoscalerClusterLister interface {
 	// List lists all HorizontalPodAutoscalers in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*autoscalingv2beta2.HorizontalPodAutoscaler, err error)
 	// Cluster returns a lister that can list and get HorizontalPodAutoscalers in one workspace.
-	Cluster(clusterName logicalcluster.Name) autoscalingv2beta2listers.HorizontalPodAutoscalerLister
+	Cluster(clusterName logicalcluster.Name) listersautoscalingv2beta2.HorizontalPodAutoscalerLister
 	HorizontalPodAutoscalerClusterListerExpansion
 }
 
+// horizontalPodAutoscalerClusterLister implements the HorizontalPodAutoscalerClusterLister interface.
 type horizontalPodAutoscalerClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*autoscalingv2beta2.HorizontalPodAutoscaler]
 }
 
+var _ HorizontalPodAutoscalerClusterLister = new(horizontalPodAutoscalerClusterLister)
+
 // NewHorizontalPodAutoscalerClusterLister returns a new HorizontalPodAutoscalerClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewHorizontalPodAutoscalerClusterLister(indexer cache.Indexer) *horizontalPodAutoscalerClusterLister {
-	return &horizontalPodAutoscalerClusterLister{indexer: indexer}
-}
-
-// List lists all HorizontalPodAutoscalers in the indexer across all workspaces.
-func (s *horizontalPodAutoscalerClusterLister) List(selector labels.Selector) (ret []*autoscalingv2beta2.HorizontalPodAutoscaler, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*autoscalingv2beta2.HorizontalPodAutoscaler))
-	})
-	return ret, err
+func NewHorizontalPodAutoscalerClusterLister(indexer cache.Indexer) HorizontalPodAutoscalerClusterLister {
+	return &horizontalPodAutoscalerClusterLister{
+		kcplisters.NewCluster[*autoscalingv2beta2.HorizontalPodAutoscaler](indexer, autoscalingv2beta2.Resource("horizontalpodautoscaler")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get HorizontalPodAutoscalers.
-func (s *horizontalPodAutoscalerClusterLister) Cluster(clusterName logicalcluster.Name) autoscalingv2beta2listers.HorizontalPodAutoscalerLister {
-	return &horizontalPodAutoscalerLister{indexer: s.indexer, clusterName: clusterName}
+func (l *horizontalPodAutoscalerClusterLister) Cluster(clusterName logicalcluster.Name) listersautoscalingv2beta2.HorizontalPodAutoscalerLister {
+	return &horizontalPodAutoscalerLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// horizontalPodAutoscalerLister implements the autoscalingv2beta2listers.HorizontalPodAutoscalerLister interface.
+// horizontalPodAutoscalerLister can list all HorizontalPodAutoscalers inside a workspace
+// or scope down to a listersautoscalingv2beta2.HorizontalPodAutoscalerNamespaceLister for one namespace.
 type horizontalPodAutoscalerLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*autoscalingv2beta2.HorizontalPodAutoscaler]
 }
 
-// List lists all HorizontalPodAutoscalers in the indexer for a workspace.
-func (s *horizontalPodAutoscalerLister) List(selector labels.Selector) (ret []*autoscalingv2beta2.HorizontalPodAutoscaler, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*autoscalingv2beta2.HorizontalPodAutoscaler))
-	})
-	return ret, err
-}
+var _ listersautoscalingv2beta2.HorizontalPodAutoscalerLister = new(horizontalPodAutoscalerLister)
 
 // HorizontalPodAutoscalers returns an object that can list and get HorizontalPodAutoscalers in one namespace.
-func (s *horizontalPodAutoscalerLister) HorizontalPodAutoscalers(namespace string) autoscalingv2beta2listers.HorizontalPodAutoscalerNamespaceLister {
-	return &horizontalPodAutoscalerNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *horizontalPodAutoscalerLister) HorizontalPodAutoscalers(namespace string) listersautoscalingv2beta2.HorizontalPodAutoscalerNamespaceLister {
+	return &horizontalPodAutoscalerNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// horizontalPodAutoscalerNamespaceLister implements the autoscalingv2beta2listers.HorizontalPodAutoscalerNamespaceLister interface.
+// horizontalPodAutoscalerNamespaceLister implements the listersautoscalingv2beta2.HorizontalPodAutoscalerNamespaceLister
+// interface.
 type horizontalPodAutoscalerNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*autoscalingv2beta2.HorizontalPodAutoscaler]
 }
 
-// List lists all HorizontalPodAutoscalers in the indexer for a given workspace and namespace.
-func (s *horizontalPodAutoscalerNamespaceLister) List(selector labels.Selector) (ret []*autoscalingv2beta2.HorizontalPodAutoscaler, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*autoscalingv2beta2.HorizontalPodAutoscaler))
-	})
-	return ret, err
-}
+var _ listersautoscalingv2beta2.HorizontalPodAutoscalerNamespaceLister = new(horizontalPodAutoscalerNamespaceLister)
 
-// Get retrieves the HorizontalPodAutoscaler from the indexer for a given workspace, namespace and name.
-func (s *horizontalPodAutoscalerNamespaceLister) Get(name string) (*autoscalingv2beta2.HorizontalPodAutoscaler, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewHorizontalPodAutoscalerLister returns a new HorizontalPodAutoscalerLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewHorizontalPodAutoscalerLister(indexer cache.Indexer) listersautoscalingv2beta2.HorizontalPodAutoscalerLister {
+	return &horizontalPodAutoscalerLister{
+		kcplisters.New[*autoscalingv2beta2.HorizontalPodAutoscaler](indexer, autoscalingv2beta2.Resource("horizontalpodautoscaler")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(autoscalingv2beta2.Resource("horizontalpodautoscalers"), name)
+}
+
+// horizontalPodAutoscalerScopedLister can list all HorizontalPodAutoscalers inside a workspace
+// or scope down to a listersautoscalingv2beta2.HorizontalPodAutoscalerNamespaceLister for one namespace.
+type horizontalPodAutoscalerScopedLister struct {
+	kcplisters.ResourceIndexer[*autoscalingv2beta2.HorizontalPodAutoscaler]
+}
+
+// HorizontalPodAutoscalers returns an object that can list and get HorizontalPodAutoscalers in one namespace.
+func (l *horizontalPodAutoscalerScopedLister) HorizontalPodAutoscalers(namespace string) listersautoscalingv2beta2.HorizontalPodAutoscalerLister {
+	return &horizontalPodAutoscalerLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*autoscalingv2beta2.HorizontalPodAutoscaler), nil
 }
diff --git a/listers/autoscaling/v2beta2/horizontalpodautoscaler_expansion.go b/listers/autoscaling/v2beta2/horizontalpodautoscaler_expansion.go
index 9d264c8ef..b5624ae75 100644
--- a/listers/autoscaling/v2beta2/horizontalpodautoscaler_expansion.go
+++ b/listers/autoscaling/v2beta2/horizontalpodautoscaler_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/batch/v1/cronjob.go b/listers/batch/v1/cronjob.go
index b267727a5..4960df44f 100644
--- a/listers/batch/v1/cronjob.go
+++ b/listers/batch/v1/cronjob.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	batchv1 "k8s.io/api/batch/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	batchv1listers "k8s.io/client-go/listers/batch/v1"
+	listersbatchv1 "k8s.io/client-go/listers/batch/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// CronJobClusterLister can list CronJobs across all workspaces, or scope down to a CronJobLister for one workspace.
+// CronJobClusterLister helps list CronJobs across all workspaces,
+// or scope down to a CronJobLister for one workspace.
 // All objects returned here must be treated as read-only.
 type CronJobClusterLister interface {
 	// List lists all CronJobs in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*batchv1.CronJob, err error)
 	// Cluster returns a lister that can list and get CronJobs in one workspace.
-	Cluster(clusterName logicalcluster.Name) batchv1listers.CronJobLister
+	Cluster(clusterName logicalcluster.Name) listersbatchv1.CronJobLister
 	CronJobClusterListerExpansion
 }
 
+// cronJobClusterLister implements the CronJobClusterLister interface.
 type cronJobClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*batchv1.CronJob]
 }
 
+var _ CronJobClusterLister = new(cronJobClusterLister)
+
 // NewCronJobClusterLister returns a new CronJobClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewCronJobClusterLister(indexer cache.Indexer) *cronJobClusterLister {
-	return &cronJobClusterLister{indexer: indexer}
-}
-
-// List lists all CronJobs in the indexer across all workspaces.
-func (s *cronJobClusterLister) List(selector labels.Selector) (ret []*batchv1.CronJob, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*batchv1.CronJob))
-	})
-	return ret, err
+func NewCronJobClusterLister(indexer cache.Indexer) CronJobClusterLister {
+	return &cronJobClusterLister{
+		kcplisters.NewCluster[*batchv1.CronJob](indexer, batchv1.Resource("cronjob")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get CronJobs.
-func (s *cronJobClusterLister) Cluster(clusterName logicalcluster.Name) batchv1listers.CronJobLister {
-	return &cronJobLister{indexer: s.indexer, clusterName: clusterName}
+func (l *cronJobClusterLister) Cluster(clusterName logicalcluster.Name) listersbatchv1.CronJobLister {
+	return &cronJobLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// cronJobLister implements the batchv1listers.CronJobLister interface.
+// cronJobLister can list all CronJobs inside a workspace
+// or scope down to a listersbatchv1.CronJobNamespaceLister for one namespace.
 type cronJobLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*batchv1.CronJob]
 }
 
-// List lists all CronJobs in the indexer for a workspace.
-func (s *cronJobLister) List(selector labels.Selector) (ret []*batchv1.CronJob, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*batchv1.CronJob))
-	})
-	return ret, err
-}
+var _ listersbatchv1.CronJobLister = new(cronJobLister)
 
 // CronJobs returns an object that can list and get CronJobs in one namespace.
-func (s *cronJobLister) CronJobs(namespace string) batchv1listers.CronJobNamespaceLister {
-	return &cronJobNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *cronJobLister) CronJobs(namespace string) listersbatchv1.CronJobNamespaceLister {
+	return &cronJobNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// cronJobNamespaceLister implements the batchv1listers.CronJobNamespaceLister interface.
+// cronJobNamespaceLister implements the listersbatchv1.CronJobNamespaceLister
+// interface.
 type cronJobNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*batchv1.CronJob]
 }
 
-// List lists all CronJobs in the indexer for a given workspace and namespace.
-func (s *cronJobNamespaceLister) List(selector labels.Selector) (ret []*batchv1.CronJob, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*batchv1.CronJob))
-	})
-	return ret, err
-}
+var _ listersbatchv1.CronJobNamespaceLister = new(cronJobNamespaceLister)
 
-// Get retrieves the CronJob from the indexer for a given workspace, namespace and name.
-func (s *cronJobNamespaceLister) Get(name string) (*batchv1.CronJob, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewCronJobLister returns a new CronJobLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewCronJobLister(indexer cache.Indexer) listersbatchv1.CronJobLister {
+	return &cronJobLister{
+		kcplisters.New[*batchv1.CronJob](indexer, batchv1.Resource("cronjob")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(batchv1.Resource("cronjobs"), name)
+}
+
+// cronJobScopedLister can list all CronJobs inside a workspace
+// or scope down to a listersbatchv1.CronJobNamespaceLister for one namespace.
+type cronJobScopedLister struct {
+	kcplisters.ResourceIndexer[*batchv1.CronJob]
+}
+
+// CronJobs returns an object that can list and get CronJobs in one namespace.
+func (l *cronJobScopedLister) CronJobs(namespace string) listersbatchv1.CronJobLister {
+	return &cronJobLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*batchv1.CronJob), nil
 }
diff --git a/listers/batch/v1/cronjob_expansion.go b/listers/batch/v1/cronjob_expansion.go
index b398acdae..41c86205c 100644
--- a/listers/batch/v1/cronjob_expansion.go
+++ b/listers/batch/v1/cronjob_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/batch/v1/expansion_generated.go b/listers/batch/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/batch/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/batch/v1/job.go b/listers/batch/v1/job.go
index b529dfe43..088f3b4cb 100644
--- a/listers/batch/v1/job.go
+++ b/listers/batch/v1/job.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	batchv1 "k8s.io/api/batch/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	batchv1listers "k8s.io/client-go/listers/batch/v1"
+	listersbatchv1 "k8s.io/client-go/listers/batch/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// JobClusterLister can list Jobs across all workspaces, or scope down to a JobLister for one workspace.
+// JobClusterLister helps list Jobs across all workspaces,
+// or scope down to a JobLister for one workspace.
 // All objects returned here must be treated as read-only.
 type JobClusterLister interface {
 	// List lists all Jobs in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*batchv1.Job, err error)
 	// Cluster returns a lister that can list and get Jobs in one workspace.
-	Cluster(clusterName logicalcluster.Name) batchv1listers.JobLister
+	Cluster(clusterName logicalcluster.Name) listersbatchv1.JobLister
 	JobClusterListerExpansion
 }
 
+// jobClusterLister implements the JobClusterLister interface.
 type jobClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*batchv1.Job]
 }
 
+var _ JobClusterLister = new(jobClusterLister)
+
 // NewJobClusterLister returns a new JobClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewJobClusterLister(indexer cache.Indexer) *jobClusterLister {
-	return &jobClusterLister{indexer: indexer}
-}
-
-// List lists all Jobs in the indexer across all workspaces.
-func (s *jobClusterLister) List(selector labels.Selector) (ret []*batchv1.Job, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*batchv1.Job))
-	})
-	return ret, err
+func NewJobClusterLister(indexer cache.Indexer) JobClusterLister {
+	return &jobClusterLister{
+		kcplisters.NewCluster[*batchv1.Job](indexer, batchv1.Resource("job")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Jobs.
-func (s *jobClusterLister) Cluster(clusterName logicalcluster.Name) batchv1listers.JobLister {
-	return &jobLister{indexer: s.indexer, clusterName: clusterName}
+func (l *jobClusterLister) Cluster(clusterName logicalcluster.Name) listersbatchv1.JobLister {
+	return &jobLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// jobLister implements the batchv1listers.JobLister interface.
+// jobLister can list all Jobs inside a workspace
+// or scope down to a listersbatchv1.JobNamespaceLister for one namespace.
 type jobLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*batchv1.Job]
 }
 
-// List lists all Jobs in the indexer for a workspace.
-func (s *jobLister) List(selector labels.Selector) (ret []*batchv1.Job, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*batchv1.Job))
-	})
-	return ret, err
-}
+var _ listersbatchv1.JobLister = new(jobLister)
 
 // Jobs returns an object that can list and get Jobs in one namespace.
-func (s *jobLister) Jobs(namespace string) batchv1listers.JobNamespaceLister {
-	return &jobNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *jobLister) Jobs(namespace string) listersbatchv1.JobNamespaceLister {
+	return &jobNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// jobNamespaceLister implements the batchv1listers.JobNamespaceLister interface.
+// jobNamespaceLister implements the listersbatchv1.JobNamespaceLister
+// interface.
 type jobNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*batchv1.Job]
 }
 
-// List lists all Jobs in the indexer for a given workspace and namespace.
-func (s *jobNamespaceLister) List(selector labels.Selector) (ret []*batchv1.Job, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*batchv1.Job))
-	})
-	return ret, err
-}
+var _ listersbatchv1.JobNamespaceLister = new(jobNamespaceLister)
 
-// Get retrieves the Job from the indexer for a given workspace, namespace and name.
-func (s *jobNamespaceLister) Get(name string) (*batchv1.Job, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewJobLister returns a new JobLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewJobLister(indexer cache.Indexer) listersbatchv1.JobLister {
+	return &jobLister{
+		kcplisters.New[*batchv1.Job](indexer, batchv1.Resource("job")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(batchv1.Resource("jobs"), name)
+}
+
+// jobScopedLister can list all Jobs inside a workspace
+// or scope down to a listersbatchv1.JobNamespaceLister for one namespace.
+type jobScopedLister struct {
+	kcplisters.ResourceIndexer[*batchv1.Job]
+}
+
+// Jobs returns an object that can list and get Jobs in one namespace.
+func (l *jobScopedLister) Jobs(namespace string) listersbatchv1.JobLister {
+	return &jobLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*batchv1.Job), nil
 }
diff --git a/listers/batch/v1/job_expansion.go b/listers/batch/v1/job_expansion.go
index 5258f4353..2003595cd 100644
--- a/listers/batch/v1/job_expansion.go
+++ b/listers/batch/v1/job_expansion.go
@@ -20,7 +20,7 @@ import (
 	"fmt"
 
 	batch "k8s.io/api/batch/v1"
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 )
diff --git a/listers/batch/v1beta1/cronjob.go b/listers/batch/v1beta1/cronjob.go
index e63314aab..06f7baf12 100644
--- a/listers/batch/v1beta1/cronjob.go
+++ b/listers/batch/v1beta1/cronjob.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	batchv1beta1 "k8s.io/api/batch/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	batchv1beta1listers "k8s.io/client-go/listers/batch/v1beta1"
+	listersbatchv1beta1 "k8s.io/client-go/listers/batch/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// CronJobClusterLister can list CronJobs across all workspaces, or scope down to a CronJobLister for one workspace.
+// CronJobClusterLister helps list CronJobs across all workspaces,
+// or scope down to a CronJobLister for one workspace.
 // All objects returned here must be treated as read-only.
 type CronJobClusterLister interface {
 	// List lists all CronJobs in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*batchv1beta1.CronJob, err error)
 	// Cluster returns a lister that can list and get CronJobs in one workspace.
-	Cluster(clusterName logicalcluster.Name) batchv1beta1listers.CronJobLister
+	Cluster(clusterName logicalcluster.Name) listersbatchv1beta1.CronJobLister
 	CronJobClusterListerExpansion
 }
 
+// cronJobClusterLister implements the CronJobClusterLister interface.
 type cronJobClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*batchv1beta1.CronJob]
 }
 
+var _ CronJobClusterLister = new(cronJobClusterLister)
+
 // NewCronJobClusterLister returns a new CronJobClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewCronJobClusterLister(indexer cache.Indexer) *cronJobClusterLister {
-	return &cronJobClusterLister{indexer: indexer}
-}
-
-// List lists all CronJobs in the indexer across all workspaces.
-func (s *cronJobClusterLister) List(selector labels.Selector) (ret []*batchv1beta1.CronJob, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*batchv1beta1.CronJob))
-	})
-	return ret, err
+func NewCronJobClusterLister(indexer cache.Indexer) CronJobClusterLister {
+	return &cronJobClusterLister{
+		kcplisters.NewCluster[*batchv1beta1.CronJob](indexer, batchv1beta1.Resource("cronjob")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get CronJobs.
-func (s *cronJobClusterLister) Cluster(clusterName logicalcluster.Name) batchv1beta1listers.CronJobLister {
-	return &cronJobLister{indexer: s.indexer, clusterName: clusterName}
+func (l *cronJobClusterLister) Cluster(clusterName logicalcluster.Name) listersbatchv1beta1.CronJobLister {
+	return &cronJobLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// cronJobLister implements the batchv1beta1listers.CronJobLister interface.
+// cronJobLister can list all CronJobs inside a workspace
+// or scope down to a listersbatchv1beta1.CronJobNamespaceLister for one namespace.
 type cronJobLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*batchv1beta1.CronJob]
 }
 
-// List lists all CronJobs in the indexer for a workspace.
-func (s *cronJobLister) List(selector labels.Selector) (ret []*batchv1beta1.CronJob, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*batchv1beta1.CronJob))
-	})
-	return ret, err
-}
+var _ listersbatchv1beta1.CronJobLister = new(cronJobLister)
 
 // CronJobs returns an object that can list and get CronJobs in one namespace.
-func (s *cronJobLister) CronJobs(namespace string) batchv1beta1listers.CronJobNamespaceLister {
-	return &cronJobNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *cronJobLister) CronJobs(namespace string) listersbatchv1beta1.CronJobNamespaceLister {
+	return &cronJobNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// cronJobNamespaceLister implements the batchv1beta1listers.CronJobNamespaceLister interface.
+// cronJobNamespaceLister implements the listersbatchv1beta1.CronJobNamespaceLister
+// interface.
 type cronJobNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*batchv1beta1.CronJob]
 }
 
-// List lists all CronJobs in the indexer for a given workspace and namespace.
-func (s *cronJobNamespaceLister) List(selector labels.Selector) (ret []*batchv1beta1.CronJob, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*batchv1beta1.CronJob))
-	})
-	return ret, err
-}
+var _ listersbatchv1beta1.CronJobNamespaceLister = new(cronJobNamespaceLister)
 
-// Get retrieves the CronJob from the indexer for a given workspace, namespace and name.
-func (s *cronJobNamespaceLister) Get(name string) (*batchv1beta1.CronJob, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewCronJobLister returns a new CronJobLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewCronJobLister(indexer cache.Indexer) listersbatchv1beta1.CronJobLister {
+	return &cronJobLister{
+		kcplisters.New[*batchv1beta1.CronJob](indexer, batchv1beta1.Resource("cronjob")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(batchv1beta1.Resource("cronjobs"), name)
+}
+
+// cronJobScopedLister can list all CronJobs inside a workspace
+// or scope down to a listersbatchv1beta1.CronJobNamespaceLister for one namespace.
+type cronJobScopedLister struct {
+	kcplisters.ResourceIndexer[*batchv1beta1.CronJob]
+}
+
+// CronJobs returns an object that can list and get CronJobs in one namespace.
+func (l *cronJobScopedLister) CronJobs(namespace string) listersbatchv1beta1.CronJobLister {
+	return &cronJobLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*batchv1beta1.CronJob), nil
 }
diff --git a/listers/batch/v1beta1/cronjob_expansion.go b/listers/batch/v1beta1/cronjob_expansion.go
index a9de967e3..c8bed8a7e 100644
--- a/listers/batch/v1beta1/cronjob_expansion.go
+++ b/listers/batch/v1beta1/cronjob_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/batch/v1beta1/expansion_generated.go b/listers/batch/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/batch/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/certificates/v1/certificatesigningrequest.go b/listers/certificates/v1/certificatesigningrequest.go
index 38876ae69..905ee1079 100644
--- a/listers/certificates/v1/certificatesigningrequest.go
+++ b/listers/certificates/v1/certificatesigningrequest.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	certificatesv1 "k8s.io/api/certificates/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	certificatesv1listers "k8s.io/client-go/listers/certificates/v1"
+	listerscertificatesv1 "k8s.io/client-go/listers/certificates/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// CertificateSigningRequestClusterLister can list CertificateSigningRequests across all workspaces, or scope down to a CertificateSigningRequestLister for one workspace.
+// CertificateSigningRequestClusterLister helps list CertificateSigningRequests across all workspaces,
+// or scope down to a CertificateSigningRequestLister for one workspace.
 // All objects returned here must be treated as read-only.
 type CertificateSigningRequestClusterLister interface {
 	// List lists all CertificateSigningRequests in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*certificatesv1.CertificateSigningRequest, err error)
 	// Cluster returns a lister that can list and get CertificateSigningRequests in one workspace.
-	Cluster(clusterName logicalcluster.Name) certificatesv1listers.CertificateSigningRequestLister
+	Cluster(clusterName logicalcluster.Name) listerscertificatesv1.CertificateSigningRequestLister
 	CertificateSigningRequestClusterListerExpansion
 }
 
+// certificateSigningRequestClusterLister implements the CertificateSigningRequestClusterLister interface.
 type certificateSigningRequestClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*certificatesv1.CertificateSigningRequest]
 }
 
+var _ CertificateSigningRequestClusterLister = new(certificateSigningRequestClusterLister)
+
 // NewCertificateSigningRequestClusterLister returns a new CertificateSigningRequestClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewCertificateSigningRequestClusterLister(indexer cache.Indexer) *certificateSigningRequestClusterLister {
-	return &certificateSigningRequestClusterLister{indexer: indexer}
-}
-
-// List lists all CertificateSigningRequests in the indexer across all workspaces.
-func (s *certificateSigningRequestClusterLister) List(selector labels.Selector) (ret []*certificatesv1.CertificateSigningRequest, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*certificatesv1.CertificateSigningRequest))
-	})
-	return ret, err
+func NewCertificateSigningRequestClusterLister(indexer cache.Indexer) CertificateSigningRequestClusterLister {
+	return &certificateSigningRequestClusterLister{
+		kcplisters.NewCluster[*certificatesv1.CertificateSigningRequest](indexer, certificatesv1.Resource("certificatesigningrequest")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get CertificateSigningRequests.
-func (s *certificateSigningRequestClusterLister) Cluster(clusterName logicalcluster.Name) certificatesv1listers.CertificateSigningRequestLister {
-	return &certificateSigningRequestLister{indexer: s.indexer, clusterName: clusterName}
+func (l *certificateSigningRequestClusterLister) Cluster(clusterName logicalcluster.Name) listerscertificatesv1.CertificateSigningRequestLister {
+	return &certificateSigningRequestLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// certificateSigningRequestLister implements the certificatesv1listers.CertificateSigningRequestLister interface.
+// certificateSigningRequestLister can list all CertificateSigningRequests inside a workspace
+// or scope down to a listerscertificatesv1.CertificateSigningRequestNamespaceLister for one namespace.
 type certificateSigningRequestLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*certificatesv1.CertificateSigningRequest]
 }
 
-// List lists all CertificateSigningRequests in the indexer for a workspace.
-func (s *certificateSigningRequestLister) List(selector labels.Selector) (ret []*certificatesv1.CertificateSigningRequest, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*certificatesv1.CertificateSigningRequest))
-	})
-	return ret, err
-}
+var _ listerscertificatesv1.CertificateSigningRequestLister = new(certificateSigningRequestLister)
 
-// Get retrieves the CertificateSigningRequest from the indexer for a given workspace and name.
-func (s *certificateSigningRequestLister) Get(name string) (*certificatesv1.CertificateSigningRequest, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(certificatesv1.Resource("certificatesigningrequests"), name)
+// NewCertificateSigningRequestLister returns a new CertificateSigningRequestLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewCertificateSigningRequestLister(indexer cache.Indexer) listerscertificatesv1.CertificateSigningRequestLister {
+	return &certificateSigningRequestLister{
+		kcplisters.New[*certificatesv1.CertificateSigningRequest](indexer, certificatesv1.Resource("certificatesigningrequest")),
 	}
-	return obj.(*certificatesv1.CertificateSigningRequest), nil
+}
+
+// certificateSigningRequestScopedLister can list all CertificateSigningRequests inside a workspace
+// or scope down to a listerscertificatesv1.CertificateSigningRequestNamespaceLister.
+type certificateSigningRequestScopedLister struct {
+	kcplisters.ResourceIndexer[*certificatesv1.CertificateSigningRequest]
 }
diff --git a/listers/certificates/v1/certificatesigningrequest_expansion.go b/listers/certificates/v1/certificatesigningrequest_expansion.go
index 35c07886d..a3eed0c84 100644
--- a/listers/certificates/v1/certificatesigningrequest_expansion.go
+++ b/listers/certificates/v1/certificatesigningrequest_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/certificates/v1/expansion_generated.go b/listers/certificates/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/certificates/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/certificates/v1alpha1/clustertrustbundle.go b/listers/certificates/v1alpha1/clustertrustbundle.go
new file mode 100644
index 000000000..175e2e2c8
--- /dev/null
+++ b/listers/certificates/v1alpha1/clustertrustbundle.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	certificatesv1alpha1 "k8s.io/api/certificates/v1alpha1"
+	"k8s.io/apimachinery/pkg/labels"
+	listerscertificatesv1alpha1 "k8s.io/client-go/listers/certificates/v1alpha1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ClusterTrustBundleClusterLister helps list ClusterTrustBundles across all workspaces,
+// or scope down to a ClusterTrustBundleLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ClusterTrustBundleClusterLister interface {
+	// List lists all ClusterTrustBundles in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*certificatesv1alpha1.ClusterTrustBundle, err error)
+	// Cluster returns a lister that can list and get ClusterTrustBundles in one workspace.
+	Cluster(clusterName logicalcluster.Name) listerscertificatesv1alpha1.ClusterTrustBundleLister
+	ClusterTrustBundleClusterListerExpansion
+}
+
+// clusterTrustBundleClusterLister implements the ClusterTrustBundleClusterLister interface.
+type clusterTrustBundleClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*certificatesv1alpha1.ClusterTrustBundle]
+}
+
+var _ ClusterTrustBundleClusterLister = new(clusterTrustBundleClusterLister)
+
+// NewClusterTrustBundleClusterLister returns a new ClusterTrustBundleClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewClusterTrustBundleClusterLister(indexer cache.Indexer) ClusterTrustBundleClusterLister {
+	return &clusterTrustBundleClusterLister{
+		kcplisters.NewCluster[*certificatesv1alpha1.ClusterTrustBundle](indexer, certificatesv1alpha1.Resource("clustertrustbundle")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ClusterTrustBundles.
+func (l *clusterTrustBundleClusterLister) Cluster(clusterName logicalcluster.Name) listerscertificatesv1alpha1.ClusterTrustBundleLister {
+	return &clusterTrustBundleLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// clusterTrustBundleLister can list all ClusterTrustBundles inside a workspace
+// or scope down to a listerscertificatesv1alpha1.ClusterTrustBundleNamespaceLister for one namespace.
+type clusterTrustBundleLister struct {
+	kcplisters.ResourceIndexer[*certificatesv1alpha1.ClusterTrustBundle]
+}
+
+var _ listerscertificatesv1alpha1.ClusterTrustBundleLister = new(clusterTrustBundleLister)
+
+// NewClusterTrustBundleLister returns a new ClusterTrustBundleLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewClusterTrustBundleLister(indexer cache.Indexer) listerscertificatesv1alpha1.ClusterTrustBundleLister {
+	return &clusterTrustBundleLister{
+		kcplisters.New[*certificatesv1alpha1.ClusterTrustBundle](indexer, certificatesv1alpha1.Resource("clustertrustbundle")),
+	}
+}
+
+// clusterTrustBundleScopedLister can list all ClusterTrustBundles inside a workspace
+// or scope down to a listerscertificatesv1alpha1.ClusterTrustBundleNamespaceLister.
+type clusterTrustBundleScopedLister struct {
+	kcplisters.ResourceIndexer[*certificatesv1alpha1.ClusterTrustBundle]
+}
diff --git a/listers/resource/v1alpha1/podscheduling_expansion.go b/listers/certificates/v1alpha1/clustertrustbundle_expansion.go
similarity index 73%
rename from listers/resource/v1alpha1/podscheduling_expansion.go
rename to listers/certificates/v1alpha1/clustertrustbundle_expansion.go
index 8898d5d66..96e41b1bd 100644
--- a/listers/resource/v1alpha1/podscheduling_expansion.go
+++ b/listers/certificates/v1alpha1/clustertrustbundle_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
@@ -21,5 +18,5 @@ limitations under the License.
 
 package v1alpha1
 
-// PodSchedulingClusterListerExpansion allows custom methods to be added to PodSchedulingClusterLister.
-type PodSchedulingClusterListerExpansion interface{}
+// ClusterTrustBundleClusterListerExpansion allows custom methods to be added to ClusterTrustBundleClusterLister.
+type ClusterTrustBundleClusterListerExpansion interface{}
diff --git a/listers/certificates/v1alpha1/expansion_generated.go b/listers/certificates/v1alpha1/expansion_generated.go
new file mode 100644
index 000000000..3b8521c00
--- /dev/null
+++ b/listers/certificates/v1alpha1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
diff --git a/listers/certificates/v1beta1/certificatesigningrequest.go b/listers/certificates/v1beta1/certificatesigningrequest.go
index d8863ce90..6ae587178 100644
--- a/listers/certificates/v1beta1/certificatesigningrequest.go
+++ b/listers/certificates/v1beta1/certificatesigningrequest.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	certificatesv1beta1listers "k8s.io/client-go/listers/certificates/v1beta1"
+	listerscertificatesv1beta1 "k8s.io/client-go/listers/certificates/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// CertificateSigningRequestClusterLister can list CertificateSigningRequests across all workspaces, or scope down to a CertificateSigningRequestLister for one workspace.
+// CertificateSigningRequestClusterLister helps list CertificateSigningRequests across all workspaces,
+// or scope down to a CertificateSigningRequestLister for one workspace.
 // All objects returned here must be treated as read-only.
 type CertificateSigningRequestClusterLister interface {
 	// List lists all CertificateSigningRequests in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*certificatesv1beta1.CertificateSigningRequest, err error)
 	// Cluster returns a lister that can list and get CertificateSigningRequests in one workspace.
-	Cluster(clusterName logicalcluster.Name) certificatesv1beta1listers.CertificateSigningRequestLister
+	Cluster(clusterName logicalcluster.Name) listerscertificatesv1beta1.CertificateSigningRequestLister
 	CertificateSigningRequestClusterListerExpansion
 }
 
+// certificateSigningRequestClusterLister implements the CertificateSigningRequestClusterLister interface.
 type certificateSigningRequestClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*certificatesv1beta1.CertificateSigningRequest]
 }
 
+var _ CertificateSigningRequestClusterLister = new(certificateSigningRequestClusterLister)
+
 // NewCertificateSigningRequestClusterLister returns a new CertificateSigningRequestClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewCertificateSigningRequestClusterLister(indexer cache.Indexer) *certificateSigningRequestClusterLister {
-	return &certificateSigningRequestClusterLister{indexer: indexer}
-}
-
-// List lists all CertificateSigningRequests in the indexer across all workspaces.
-func (s *certificateSigningRequestClusterLister) List(selector labels.Selector) (ret []*certificatesv1beta1.CertificateSigningRequest, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*certificatesv1beta1.CertificateSigningRequest))
-	})
-	return ret, err
+func NewCertificateSigningRequestClusterLister(indexer cache.Indexer) CertificateSigningRequestClusterLister {
+	return &certificateSigningRequestClusterLister{
+		kcplisters.NewCluster[*certificatesv1beta1.CertificateSigningRequest](indexer, certificatesv1beta1.Resource("certificatesigningrequest")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get CertificateSigningRequests.
-func (s *certificateSigningRequestClusterLister) Cluster(clusterName logicalcluster.Name) certificatesv1beta1listers.CertificateSigningRequestLister {
-	return &certificateSigningRequestLister{indexer: s.indexer, clusterName: clusterName}
+func (l *certificateSigningRequestClusterLister) Cluster(clusterName logicalcluster.Name) listerscertificatesv1beta1.CertificateSigningRequestLister {
+	return &certificateSigningRequestLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// certificateSigningRequestLister implements the certificatesv1beta1listers.CertificateSigningRequestLister interface.
+// certificateSigningRequestLister can list all CertificateSigningRequests inside a workspace
+// or scope down to a listerscertificatesv1beta1.CertificateSigningRequestNamespaceLister for one namespace.
 type certificateSigningRequestLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*certificatesv1beta1.CertificateSigningRequest]
 }
 
-// List lists all CertificateSigningRequests in the indexer for a workspace.
-func (s *certificateSigningRequestLister) List(selector labels.Selector) (ret []*certificatesv1beta1.CertificateSigningRequest, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*certificatesv1beta1.CertificateSigningRequest))
-	})
-	return ret, err
-}
+var _ listerscertificatesv1beta1.CertificateSigningRequestLister = new(certificateSigningRequestLister)
 
-// Get retrieves the CertificateSigningRequest from the indexer for a given workspace and name.
-func (s *certificateSigningRequestLister) Get(name string) (*certificatesv1beta1.CertificateSigningRequest, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(certificatesv1beta1.Resource("certificatesigningrequests"), name)
+// NewCertificateSigningRequestLister returns a new CertificateSigningRequestLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewCertificateSigningRequestLister(indexer cache.Indexer) listerscertificatesv1beta1.CertificateSigningRequestLister {
+	return &certificateSigningRequestLister{
+		kcplisters.New[*certificatesv1beta1.CertificateSigningRequest](indexer, certificatesv1beta1.Resource("certificatesigningrequest")),
 	}
-	return obj.(*certificatesv1beta1.CertificateSigningRequest), nil
+}
+
+// certificateSigningRequestScopedLister can list all CertificateSigningRequests inside a workspace
+// or scope down to a listerscertificatesv1beta1.CertificateSigningRequestNamespaceLister.
+type certificateSigningRequestScopedLister struct {
+	kcplisters.ResourceIndexer[*certificatesv1beta1.CertificateSigningRequest]
 }
diff --git a/listers/certificates/v1beta1/certificatesigningrequest_expansion.go b/listers/certificates/v1beta1/certificatesigningrequest_expansion.go
index 91dc37427..8f1bc06dd 100644
--- a/listers/certificates/v1beta1/certificatesigningrequest_expansion.go
+++ b/listers/certificates/v1beta1/certificatesigningrequest_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/certificates/v1beta1/clustertrustbundle.go b/listers/certificates/v1beta1/clustertrustbundle.go
new file mode 100644
index 000000000..357b4626b
--- /dev/null
+++ b/listers/certificates/v1beta1/clustertrustbundle.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	listerscertificatesv1beta1 "k8s.io/client-go/listers/certificates/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ClusterTrustBundleClusterLister helps list ClusterTrustBundles across all workspaces,
+// or scope down to a ClusterTrustBundleLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ClusterTrustBundleClusterLister interface {
+	// List lists all ClusterTrustBundles in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*certificatesv1beta1.ClusterTrustBundle, err error)
+	// Cluster returns a lister that can list and get ClusterTrustBundles in one workspace.
+	Cluster(clusterName logicalcluster.Name) listerscertificatesv1beta1.ClusterTrustBundleLister
+	ClusterTrustBundleClusterListerExpansion
+}
+
+// clusterTrustBundleClusterLister implements the ClusterTrustBundleClusterLister interface.
+type clusterTrustBundleClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*certificatesv1beta1.ClusterTrustBundle]
+}
+
+var _ ClusterTrustBundleClusterLister = new(clusterTrustBundleClusterLister)
+
+// NewClusterTrustBundleClusterLister returns a new ClusterTrustBundleClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewClusterTrustBundleClusterLister(indexer cache.Indexer) ClusterTrustBundleClusterLister {
+	return &clusterTrustBundleClusterLister{
+		kcplisters.NewCluster[*certificatesv1beta1.ClusterTrustBundle](indexer, certificatesv1beta1.Resource("clustertrustbundle")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ClusterTrustBundles.
+func (l *clusterTrustBundleClusterLister) Cluster(clusterName logicalcluster.Name) listerscertificatesv1beta1.ClusterTrustBundleLister {
+	return &clusterTrustBundleLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// clusterTrustBundleLister can list all ClusterTrustBundles inside a workspace
+// or scope down to a listerscertificatesv1beta1.ClusterTrustBundleNamespaceLister for one namespace.
+type clusterTrustBundleLister struct {
+	kcplisters.ResourceIndexer[*certificatesv1beta1.ClusterTrustBundle]
+}
+
+var _ listerscertificatesv1beta1.ClusterTrustBundleLister = new(clusterTrustBundleLister)
+
+// NewClusterTrustBundleLister returns a new ClusterTrustBundleLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewClusterTrustBundleLister(indexer cache.Indexer) listerscertificatesv1beta1.ClusterTrustBundleLister {
+	return &clusterTrustBundleLister{
+		kcplisters.New[*certificatesv1beta1.ClusterTrustBundle](indexer, certificatesv1beta1.Resource("clustertrustbundle")),
+	}
+}
+
+// clusterTrustBundleScopedLister can list all ClusterTrustBundles inside a workspace
+// or scope down to a listerscertificatesv1beta1.ClusterTrustBundleNamespaceLister.
+type clusterTrustBundleScopedLister struct {
+	kcplisters.ResourceIndexer[*certificatesv1beta1.ClusterTrustBundle]
+}
diff --git a/listers/certificates/v1beta1/expansion_generated.go b/listers/certificates/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..b32342be4
--- /dev/null
+++ b/listers/certificates/v1beta1/expansion_generated.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+// ClusterTrustBundleClusterListerExpansion allows custom methods to be added to
+// ClusterTrustBundleClusterLister.
+type ClusterTrustBundleClusterListerExpansion interface{}
diff --git a/listers/coordination/v1/expansion_generated.go b/listers/coordination/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/coordination/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/coordination/v1/lease.go b/listers/coordination/v1/lease.go
index 60adb6932..973ad38b6 100644
--- a/listers/coordination/v1/lease.go
+++ b/listers/coordination/v1/lease.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	coordinationv1 "k8s.io/api/coordination/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	coordinationv1listers "k8s.io/client-go/listers/coordination/v1"
+	listerscoordinationv1 "k8s.io/client-go/listers/coordination/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// LeaseClusterLister can list Leases across all workspaces, or scope down to a LeaseLister for one workspace.
+// LeaseClusterLister helps list Leases across all workspaces,
+// or scope down to a LeaseLister for one workspace.
 // All objects returned here must be treated as read-only.
 type LeaseClusterLister interface {
 	// List lists all Leases in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*coordinationv1.Lease, err error)
 	// Cluster returns a lister that can list and get Leases in one workspace.
-	Cluster(clusterName logicalcluster.Name) coordinationv1listers.LeaseLister
+	Cluster(clusterName logicalcluster.Name) listerscoordinationv1.LeaseLister
 	LeaseClusterListerExpansion
 }
 
+// leaseClusterLister implements the LeaseClusterLister interface.
 type leaseClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*coordinationv1.Lease]
 }
 
+var _ LeaseClusterLister = new(leaseClusterLister)
+
 // NewLeaseClusterLister returns a new LeaseClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewLeaseClusterLister(indexer cache.Indexer) *leaseClusterLister {
-	return &leaseClusterLister{indexer: indexer}
-}
-
-// List lists all Leases in the indexer across all workspaces.
-func (s *leaseClusterLister) List(selector labels.Selector) (ret []*coordinationv1.Lease, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*coordinationv1.Lease))
-	})
-	return ret, err
+func NewLeaseClusterLister(indexer cache.Indexer) LeaseClusterLister {
+	return &leaseClusterLister{
+		kcplisters.NewCluster[*coordinationv1.Lease](indexer, coordinationv1.Resource("lease")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Leases.
-func (s *leaseClusterLister) Cluster(clusterName logicalcluster.Name) coordinationv1listers.LeaseLister {
-	return &leaseLister{indexer: s.indexer, clusterName: clusterName}
+func (l *leaseClusterLister) Cluster(clusterName logicalcluster.Name) listerscoordinationv1.LeaseLister {
+	return &leaseLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// leaseLister implements the coordinationv1listers.LeaseLister interface.
+// leaseLister can list all Leases inside a workspace
+// or scope down to a listerscoordinationv1.LeaseNamespaceLister for one namespace.
 type leaseLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*coordinationv1.Lease]
 }
 
-// List lists all Leases in the indexer for a workspace.
-func (s *leaseLister) List(selector labels.Selector) (ret []*coordinationv1.Lease, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*coordinationv1.Lease))
-	})
-	return ret, err
-}
+var _ listerscoordinationv1.LeaseLister = new(leaseLister)
 
 // Leases returns an object that can list and get Leases in one namespace.
-func (s *leaseLister) Leases(namespace string) coordinationv1listers.LeaseNamespaceLister {
-	return &leaseNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *leaseLister) Leases(namespace string) listerscoordinationv1.LeaseNamespaceLister {
+	return &leaseNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// leaseNamespaceLister implements the coordinationv1listers.LeaseNamespaceLister interface.
+// leaseNamespaceLister implements the listerscoordinationv1.LeaseNamespaceLister
+// interface.
 type leaseNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*coordinationv1.Lease]
 }
 
-// List lists all Leases in the indexer for a given workspace and namespace.
-func (s *leaseNamespaceLister) List(selector labels.Selector) (ret []*coordinationv1.Lease, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*coordinationv1.Lease))
-	})
-	return ret, err
-}
+var _ listerscoordinationv1.LeaseNamespaceLister = new(leaseNamespaceLister)
 
-// Get retrieves the Lease from the indexer for a given workspace, namespace and name.
-func (s *leaseNamespaceLister) Get(name string) (*coordinationv1.Lease, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewLeaseLister returns a new LeaseLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewLeaseLister(indexer cache.Indexer) listerscoordinationv1.LeaseLister {
+	return &leaseLister{
+		kcplisters.New[*coordinationv1.Lease](indexer, coordinationv1.Resource("lease")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(coordinationv1.Resource("leases"), name)
+}
+
+// leaseScopedLister can list all Leases inside a workspace
+// or scope down to a listerscoordinationv1.LeaseNamespaceLister for one namespace.
+type leaseScopedLister struct {
+	kcplisters.ResourceIndexer[*coordinationv1.Lease]
+}
+
+// Leases returns an object that can list and get Leases in one namespace.
+func (l *leaseScopedLister) Leases(namespace string) listerscoordinationv1.LeaseLister {
+	return &leaseLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*coordinationv1.Lease), nil
 }
diff --git a/listers/coordination/v1/lease_expansion.go b/listers/coordination/v1/lease_expansion.go
index 614b152fb..70360ca1e 100644
--- a/listers/coordination/v1/lease_expansion.go
+++ b/listers/coordination/v1/lease_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/coordination/v1alpha2/expansion_generated.go b/listers/coordination/v1alpha2/expansion_generated.go
new file mode 100644
index 000000000..458098c97
--- /dev/null
+++ b/listers/coordination/v1alpha2/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha2
diff --git a/listers/coordination/v1alpha2/leasecandidate.go b/listers/coordination/v1alpha2/leasecandidate.go
new file mode 100644
index 000000000..ef9261807
--- /dev/null
+++ b/listers/coordination/v1alpha2/leasecandidate.go
@@ -0,0 +1,115 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	coordinationv1alpha2 "k8s.io/api/coordination/v1alpha2"
+	"k8s.io/apimachinery/pkg/labels"
+	listerscoordinationv1alpha2 "k8s.io/client-go/listers/coordination/v1alpha2"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// LeaseCandidateClusterLister helps list LeaseCandidates across all workspaces,
+// or scope down to a LeaseCandidateLister for one workspace.
+// All objects returned here must be treated as read-only.
+type LeaseCandidateClusterLister interface {
+	// List lists all LeaseCandidates in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*coordinationv1alpha2.LeaseCandidate, err error)
+	// Cluster returns a lister that can list and get LeaseCandidates in one workspace.
+	Cluster(clusterName logicalcluster.Name) listerscoordinationv1alpha2.LeaseCandidateLister
+	LeaseCandidateClusterListerExpansion
+}
+
+// leaseCandidateClusterLister implements the LeaseCandidateClusterLister interface.
+type leaseCandidateClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*coordinationv1alpha2.LeaseCandidate]
+}
+
+var _ LeaseCandidateClusterLister = new(leaseCandidateClusterLister)
+
+// NewLeaseCandidateClusterLister returns a new LeaseCandidateClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewLeaseCandidateClusterLister(indexer cache.Indexer) LeaseCandidateClusterLister {
+	return &leaseCandidateClusterLister{
+		kcplisters.NewCluster[*coordinationv1alpha2.LeaseCandidate](indexer, coordinationv1alpha2.Resource("leasecandidate")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get LeaseCandidates.
+func (l *leaseCandidateClusterLister) Cluster(clusterName logicalcluster.Name) listerscoordinationv1alpha2.LeaseCandidateLister {
+	return &leaseCandidateLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// leaseCandidateLister can list all LeaseCandidates inside a workspace
+// or scope down to a listerscoordinationv1alpha2.LeaseCandidateNamespaceLister for one namespace.
+type leaseCandidateLister struct {
+	kcplisters.ResourceIndexer[*coordinationv1alpha2.LeaseCandidate]
+}
+
+var _ listerscoordinationv1alpha2.LeaseCandidateLister = new(leaseCandidateLister)
+
+// LeaseCandidates returns an object that can list and get LeaseCandidates in one namespace.
+func (l *leaseCandidateLister) LeaseCandidates(namespace string) listerscoordinationv1alpha2.LeaseCandidateNamespaceLister {
+	return &leaseCandidateNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
+
+// leaseCandidateNamespaceLister implements the listerscoordinationv1alpha2.LeaseCandidateNamespaceLister
+// interface.
+type leaseCandidateNamespaceLister struct {
+	kcplisters.ResourceIndexer[*coordinationv1alpha2.LeaseCandidate]
+}
+
+var _ listerscoordinationv1alpha2.LeaseCandidateNamespaceLister = new(leaseCandidateNamespaceLister)
+
+// NewLeaseCandidateLister returns a new LeaseCandidateLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewLeaseCandidateLister(indexer cache.Indexer) listerscoordinationv1alpha2.LeaseCandidateLister {
+	return &leaseCandidateLister{
+		kcplisters.New[*coordinationv1alpha2.LeaseCandidate](indexer, coordinationv1alpha2.Resource("leasecandidate")),
+	}
+}
+
+// leaseCandidateScopedLister can list all LeaseCandidates inside a workspace
+// or scope down to a listerscoordinationv1alpha2.LeaseCandidateNamespaceLister for one namespace.
+type leaseCandidateScopedLister struct {
+	kcplisters.ResourceIndexer[*coordinationv1alpha2.LeaseCandidate]
+}
+
+// LeaseCandidates returns an object that can list and get LeaseCandidates in one namespace.
+func (l *leaseCandidateScopedLister) LeaseCandidates(namespace string) listerscoordinationv1alpha2.LeaseCandidateLister {
+	return &leaseCandidateLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
diff --git a/listers/coordination/v1alpha2/leasecandidate_expansion.go b/listers/coordination/v1alpha2/leasecandidate_expansion.go
new file mode 100644
index 000000000..e7111c298
--- /dev/null
+++ b/listers/coordination/v1alpha2/leasecandidate_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1alpha2
+
+// LeaseCandidateClusterListerExpansion allows custom methods to be added to LeaseCandidateClusterLister.
+type LeaseCandidateClusterListerExpansion interface{}
diff --git a/listers/coordination/v1beta1/expansion_generated.go b/listers/coordination/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..1c80beeda
--- /dev/null
+++ b/listers/coordination/v1beta1/expansion_generated.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+// LeaseCandidateClusterListerExpansion allows custom methods to be added to
+// LeaseCandidateClusterLister.
+type LeaseCandidateClusterListerExpansion interface{}
diff --git a/listers/coordination/v1beta1/lease.go b/listers/coordination/v1beta1/lease.go
index 7dc0989c4..40f5477ad 100644
--- a/listers/coordination/v1beta1/lease.go
+++ b/listers/coordination/v1beta1/lease.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	coordinationv1beta1 "k8s.io/api/coordination/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	coordinationv1beta1listers "k8s.io/client-go/listers/coordination/v1beta1"
+	listerscoordinationv1beta1 "k8s.io/client-go/listers/coordination/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// LeaseClusterLister can list Leases across all workspaces, or scope down to a LeaseLister for one workspace.
+// LeaseClusterLister helps list Leases across all workspaces,
+// or scope down to a LeaseLister for one workspace.
 // All objects returned here must be treated as read-only.
 type LeaseClusterLister interface {
 	// List lists all Leases in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*coordinationv1beta1.Lease, err error)
 	// Cluster returns a lister that can list and get Leases in one workspace.
-	Cluster(clusterName logicalcluster.Name) coordinationv1beta1listers.LeaseLister
+	Cluster(clusterName logicalcluster.Name) listerscoordinationv1beta1.LeaseLister
 	LeaseClusterListerExpansion
 }
 
+// leaseClusterLister implements the LeaseClusterLister interface.
 type leaseClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*coordinationv1beta1.Lease]
 }
 
+var _ LeaseClusterLister = new(leaseClusterLister)
+
 // NewLeaseClusterLister returns a new LeaseClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewLeaseClusterLister(indexer cache.Indexer) *leaseClusterLister {
-	return &leaseClusterLister{indexer: indexer}
-}
-
-// List lists all Leases in the indexer across all workspaces.
-func (s *leaseClusterLister) List(selector labels.Selector) (ret []*coordinationv1beta1.Lease, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*coordinationv1beta1.Lease))
-	})
-	return ret, err
+func NewLeaseClusterLister(indexer cache.Indexer) LeaseClusterLister {
+	return &leaseClusterLister{
+		kcplisters.NewCluster[*coordinationv1beta1.Lease](indexer, coordinationv1beta1.Resource("lease")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Leases.
-func (s *leaseClusterLister) Cluster(clusterName logicalcluster.Name) coordinationv1beta1listers.LeaseLister {
-	return &leaseLister{indexer: s.indexer, clusterName: clusterName}
+func (l *leaseClusterLister) Cluster(clusterName logicalcluster.Name) listerscoordinationv1beta1.LeaseLister {
+	return &leaseLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// leaseLister implements the coordinationv1beta1listers.LeaseLister interface.
+// leaseLister can list all Leases inside a workspace
+// or scope down to a listerscoordinationv1beta1.LeaseNamespaceLister for one namespace.
 type leaseLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*coordinationv1beta1.Lease]
 }
 
-// List lists all Leases in the indexer for a workspace.
-func (s *leaseLister) List(selector labels.Selector) (ret []*coordinationv1beta1.Lease, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*coordinationv1beta1.Lease))
-	})
-	return ret, err
-}
+var _ listerscoordinationv1beta1.LeaseLister = new(leaseLister)
 
 // Leases returns an object that can list and get Leases in one namespace.
-func (s *leaseLister) Leases(namespace string) coordinationv1beta1listers.LeaseNamespaceLister {
-	return &leaseNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *leaseLister) Leases(namespace string) listerscoordinationv1beta1.LeaseNamespaceLister {
+	return &leaseNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// leaseNamespaceLister implements the coordinationv1beta1listers.LeaseNamespaceLister interface.
+// leaseNamespaceLister implements the listerscoordinationv1beta1.LeaseNamespaceLister
+// interface.
 type leaseNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*coordinationv1beta1.Lease]
 }
 
-// List lists all Leases in the indexer for a given workspace and namespace.
-func (s *leaseNamespaceLister) List(selector labels.Selector) (ret []*coordinationv1beta1.Lease, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*coordinationv1beta1.Lease))
-	})
-	return ret, err
-}
+var _ listerscoordinationv1beta1.LeaseNamespaceLister = new(leaseNamespaceLister)
 
-// Get retrieves the Lease from the indexer for a given workspace, namespace and name.
-func (s *leaseNamespaceLister) Get(name string) (*coordinationv1beta1.Lease, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewLeaseLister returns a new LeaseLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewLeaseLister(indexer cache.Indexer) listerscoordinationv1beta1.LeaseLister {
+	return &leaseLister{
+		kcplisters.New[*coordinationv1beta1.Lease](indexer, coordinationv1beta1.Resource("lease")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(coordinationv1beta1.Resource("leases"), name)
+}
+
+// leaseScopedLister can list all Leases inside a workspace
+// or scope down to a listerscoordinationv1beta1.LeaseNamespaceLister for one namespace.
+type leaseScopedLister struct {
+	kcplisters.ResourceIndexer[*coordinationv1beta1.Lease]
+}
+
+// Leases returns an object that can list and get Leases in one namespace.
+func (l *leaseScopedLister) Leases(namespace string) listerscoordinationv1beta1.LeaseLister {
+	return &leaseLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*coordinationv1beta1.Lease), nil
 }
diff --git a/listers/coordination/v1beta1/lease_expansion.go b/listers/coordination/v1beta1/lease_expansion.go
index 0f27bbd50..379bafcd5 100644
--- a/listers/coordination/v1beta1/lease_expansion.go
+++ b/listers/coordination/v1beta1/lease_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/coordination/v1beta1/leasecandidate.go b/listers/coordination/v1beta1/leasecandidate.go
new file mode 100644
index 000000000..b7c6d32c1
--- /dev/null
+++ b/listers/coordination/v1beta1/leasecandidate.go
@@ -0,0 +1,115 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	coordinationv1beta1 "k8s.io/api/coordination/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	listerscoordinationv1beta1 "k8s.io/client-go/listers/coordination/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// LeaseCandidateClusterLister helps list LeaseCandidates across all workspaces,
+// or scope down to a LeaseCandidateLister for one workspace.
+// All objects returned here must be treated as read-only.
+type LeaseCandidateClusterLister interface {
+	// List lists all LeaseCandidates in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*coordinationv1beta1.LeaseCandidate, err error)
+	// Cluster returns a lister that can list and get LeaseCandidates in one workspace.
+	Cluster(clusterName logicalcluster.Name) listerscoordinationv1beta1.LeaseCandidateLister
+	LeaseCandidateClusterListerExpansion
+}
+
+// leaseCandidateClusterLister implements the LeaseCandidateClusterLister interface.
+type leaseCandidateClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*coordinationv1beta1.LeaseCandidate]
+}
+
+var _ LeaseCandidateClusterLister = new(leaseCandidateClusterLister)
+
+// NewLeaseCandidateClusterLister returns a new LeaseCandidateClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewLeaseCandidateClusterLister(indexer cache.Indexer) LeaseCandidateClusterLister {
+	return &leaseCandidateClusterLister{
+		kcplisters.NewCluster[*coordinationv1beta1.LeaseCandidate](indexer, coordinationv1beta1.Resource("leasecandidate")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get LeaseCandidates.
+func (l *leaseCandidateClusterLister) Cluster(clusterName logicalcluster.Name) listerscoordinationv1beta1.LeaseCandidateLister {
+	return &leaseCandidateLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// leaseCandidateLister can list all LeaseCandidates inside a workspace
+// or scope down to a listerscoordinationv1beta1.LeaseCandidateNamespaceLister for one namespace.
+type leaseCandidateLister struct {
+	kcplisters.ResourceIndexer[*coordinationv1beta1.LeaseCandidate]
+}
+
+var _ listerscoordinationv1beta1.LeaseCandidateLister = new(leaseCandidateLister)
+
+// LeaseCandidates returns an object that can list and get LeaseCandidates in one namespace.
+func (l *leaseCandidateLister) LeaseCandidates(namespace string) listerscoordinationv1beta1.LeaseCandidateNamespaceLister {
+	return &leaseCandidateNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
+
+// leaseCandidateNamespaceLister implements the listerscoordinationv1beta1.LeaseCandidateNamespaceLister
+// interface.
+type leaseCandidateNamespaceLister struct {
+	kcplisters.ResourceIndexer[*coordinationv1beta1.LeaseCandidate]
+}
+
+var _ listerscoordinationv1beta1.LeaseCandidateNamespaceLister = new(leaseCandidateNamespaceLister)
+
+// NewLeaseCandidateLister returns a new LeaseCandidateLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewLeaseCandidateLister(indexer cache.Indexer) listerscoordinationv1beta1.LeaseCandidateLister {
+	return &leaseCandidateLister{
+		kcplisters.New[*coordinationv1beta1.LeaseCandidate](indexer, coordinationv1beta1.Resource("leasecandidate")),
+	}
+}
+
+// leaseCandidateScopedLister can list all LeaseCandidates inside a workspace
+// or scope down to a listerscoordinationv1beta1.LeaseCandidateNamespaceLister for one namespace.
+type leaseCandidateScopedLister struct {
+	kcplisters.ResourceIndexer[*coordinationv1beta1.LeaseCandidate]
+}
+
+// LeaseCandidates returns an object that can list and get LeaseCandidates in one namespace.
+func (l *leaseCandidateScopedLister) LeaseCandidates(namespace string) listerscoordinationv1beta1.LeaseCandidateLister {
+	return &leaseCandidateLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
diff --git a/listers/core/v1/componentstatus.go b/listers/core/v1/componentstatus.go
index 96eca5b0b..bf3cc38c8 100644
--- a/listers/core/v1/componentstatus.go
+++ b/listers/core/v1/componentstatus.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ComponentStatusClusterLister can list ComponentStatuses across all workspaces, or scope down to a ComponentStatusLister for one workspace.
+// ComponentStatusClusterLister helps list ComponentStatuses across all workspaces,
+// or scope down to a ComponentStatusLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ComponentStatusClusterLister interface {
 	// List lists all ComponentStatuses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.ComponentStatus, err error)
 	// Cluster returns a lister that can list and get ComponentStatuses in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.ComponentStatusLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.ComponentStatusLister
 	ComponentStatusClusterListerExpansion
 }
 
+// componentStatusClusterLister implements the ComponentStatusClusterLister interface.
 type componentStatusClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.ComponentStatus]
 }
 
+var _ ComponentStatusClusterLister = new(componentStatusClusterLister)
+
 // NewComponentStatusClusterLister returns a new ComponentStatusClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewComponentStatusClusterLister(indexer cache.Indexer) *componentStatusClusterLister {
-	return &componentStatusClusterLister{indexer: indexer}
-}
-
-// List lists all ComponentStatuses in the indexer across all workspaces.
-func (s *componentStatusClusterLister) List(selector labels.Selector) (ret []*corev1.ComponentStatus, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.ComponentStatus))
-	})
-	return ret, err
+func NewComponentStatusClusterLister(indexer cache.Indexer) ComponentStatusClusterLister {
+	return &componentStatusClusterLister{
+		kcplisters.NewCluster[*corev1.ComponentStatus](indexer, corev1.Resource("componentstatus")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ComponentStatuses.
-func (s *componentStatusClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.ComponentStatusLister {
-	return &componentStatusLister{indexer: s.indexer, clusterName: clusterName}
+func (l *componentStatusClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.ComponentStatusLister {
+	return &componentStatusLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// componentStatusLister implements the corev1listers.ComponentStatusLister interface.
+// componentStatusLister can list all ComponentStatuses inside a workspace
+// or scope down to a listerscorev1.ComponentStatusNamespaceLister for one namespace.
 type componentStatusLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.ComponentStatus]
 }
 
-// List lists all ComponentStatuses in the indexer for a workspace.
-func (s *componentStatusLister) List(selector labels.Selector) (ret []*corev1.ComponentStatus, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.ComponentStatus))
-	})
-	return ret, err
-}
+var _ listerscorev1.ComponentStatusLister = new(componentStatusLister)
 
-// Get retrieves the ComponentStatus from the indexer for a given workspace and name.
-func (s *componentStatusLister) Get(name string) (*corev1.ComponentStatus, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("componentstatuses"), name)
+// NewComponentStatusLister returns a new ComponentStatusLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewComponentStatusLister(indexer cache.Indexer) listerscorev1.ComponentStatusLister {
+	return &componentStatusLister{
+		kcplisters.New[*corev1.ComponentStatus](indexer, corev1.Resource("componentstatus")),
 	}
-	return obj.(*corev1.ComponentStatus), nil
+}
+
+// componentStatusScopedLister can list all ComponentStatuses inside a workspace
+// or scope down to a listerscorev1.ComponentStatusNamespaceLister.
+type componentStatusScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.ComponentStatus]
 }
diff --git a/listers/core/v1/componentstatus_expansion.go b/listers/core/v1/componentstatus_expansion.go
index 68585eb2b..301d9113a 100644
--- a/listers/core/v1/componentstatus_expansion.go
+++ b/listers/core/v1/componentstatus_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/configmap.go b/listers/core/v1/configmap.go
index 63cdd08e5..e57e9d1dc 100644
--- a/listers/core/v1/configmap.go
+++ b/listers/core/v1/configmap.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ConfigMapClusterLister can list ConfigMaps across all workspaces, or scope down to a ConfigMapLister for one workspace.
+// ConfigMapClusterLister helps list ConfigMaps across all workspaces,
+// or scope down to a ConfigMapLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ConfigMapClusterLister interface {
 	// List lists all ConfigMaps in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.ConfigMap, err error)
 	// Cluster returns a lister that can list and get ConfigMaps in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.ConfigMapLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.ConfigMapLister
 	ConfigMapClusterListerExpansion
 }
 
+// configMapClusterLister implements the ConfigMapClusterLister interface.
 type configMapClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.ConfigMap]
 }
 
+var _ ConfigMapClusterLister = new(configMapClusterLister)
+
 // NewConfigMapClusterLister returns a new ConfigMapClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewConfigMapClusterLister(indexer cache.Indexer) *configMapClusterLister {
-	return &configMapClusterLister{indexer: indexer}
-}
-
-// List lists all ConfigMaps in the indexer across all workspaces.
-func (s *configMapClusterLister) List(selector labels.Selector) (ret []*corev1.ConfigMap, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.ConfigMap))
-	})
-	return ret, err
+func NewConfigMapClusterLister(indexer cache.Indexer) ConfigMapClusterLister {
+	return &configMapClusterLister{
+		kcplisters.NewCluster[*corev1.ConfigMap](indexer, corev1.Resource("configmap")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ConfigMaps.
-func (s *configMapClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.ConfigMapLister {
-	return &configMapLister{indexer: s.indexer, clusterName: clusterName}
+func (l *configMapClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.ConfigMapLister {
+	return &configMapLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// configMapLister implements the corev1listers.ConfigMapLister interface.
+// configMapLister can list all ConfigMaps inside a workspace
+// or scope down to a listerscorev1.ConfigMapNamespaceLister for one namespace.
 type configMapLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.ConfigMap]
 }
 
-// List lists all ConfigMaps in the indexer for a workspace.
-func (s *configMapLister) List(selector labels.Selector) (ret []*corev1.ConfigMap, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.ConfigMap))
-	})
-	return ret, err
-}
+var _ listerscorev1.ConfigMapLister = new(configMapLister)
 
 // ConfigMaps returns an object that can list and get ConfigMaps in one namespace.
-func (s *configMapLister) ConfigMaps(namespace string) corev1listers.ConfigMapNamespaceLister {
-	return &configMapNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *configMapLister) ConfigMaps(namespace string) listerscorev1.ConfigMapNamespaceLister {
+	return &configMapNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// configMapNamespaceLister implements the corev1listers.ConfigMapNamespaceLister interface.
+// configMapNamespaceLister implements the listerscorev1.ConfigMapNamespaceLister
+// interface.
 type configMapNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*corev1.ConfigMap]
 }
 
-// List lists all ConfigMaps in the indexer for a given workspace and namespace.
-func (s *configMapNamespaceLister) List(selector labels.Selector) (ret []*corev1.ConfigMap, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.ConfigMap))
-	})
-	return ret, err
-}
+var _ listerscorev1.ConfigMapNamespaceLister = new(configMapNamespaceLister)
 
-// Get retrieves the ConfigMap from the indexer for a given workspace, namespace and name.
-func (s *configMapNamespaceLister) Get(name string) (*corev1.ConfigMap, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewConfigMapLister returns a new ConfigMapLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewConfigMapLister(indexer cache.Indexer) listerscorev1.ConfigMapLister {
+	return &configMapLister{
+		kcplisters.New[*corev1.ConfigMap](indexer, corev1.Resource("configmap")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("configmaps"), name)
+}
+
+// configMapScopedLister can list all ConfigMaps inside a workspace
+// or scope down to a listerscorev1.ConfigMapNamespaceLister for one namespace.
+type configMapScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.ConfigMap]
+}
+
+// ConfigMaps returns an object that can list and get ConfigMaps in one namespace.
+func (l *configMapScopedLister) ConfigMaps(namespace string) listerscorev1.ConfigMapLister {
+	return &configMapLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*corev1.ConfigMap), nil
 }
diff --git a/listers/core/v1/configmap_expansion.go b/listers/core/v1/configmap_expansion.go
index 42a2c1707..67ab850e3 100644
--- a/listers/core/v1/configmap_expansion.go
+++ b/listers/core/v1/configmap_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/endpoints.go b/listers/core/v1/endpoints.go
index 3cfc3c581..d3fa2539c 100644
--- a/listers/core/v1/endpoints.go
+++ b/listers/core/v1/endpoints.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// EndpointsClusterLister can list Endpoints across all workspaces, or scope down to a EndpointsLister for one workspace.
+// EndpointsClusterLister helps list Endpoints across all workspaces,
+// or scope down to a EndpointsLister for one workspace.
 // All objects returned here must be treated as read-only.
 type EndpointsClusterLister interface {
 	// List lists all Endpoints in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.Endpoints, err error)
 	// Cluster returns a lister that can list and get Endpoints in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.EndpointsLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.EndpointsLister
 	EndpointsClusterListerExpansion
 }
 
+// endpointsClusterLister implements the EndpointsClusterLister interface.
 type endpointsClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.Endpoints]
 }
 
+var _ EndpointsClusterLister = new(endpointsClusterLister)
+
 // NewEndpointsClusterLister returns a new EndpointsClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewEndpointsClusterLister(indexer cache.Indexer) *endpointsClusterLister {
-	return &endpointsClusterLister{indexer: indexer}
-}
-
-// List lists all Endpoints in the indexer across all workspaces.
-func (s *endpointsClusterLister) List(selector labels.Selector) (ret []*corev1.Endpoints, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.Endpoints))
-	})
-	return ret, err
+func NewEndpointsClusterLister(indexer cache.Indexer) EndpointsClusterLister {
+	return &endpointsClusterLister{
+		kcplisters.NewCluster[*corev1.Endpoints](indexer, corev1.Resource("endpoints")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Endpoints.
-func (s *endpointsClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.EndpointsLister {
-	return &endpointsLister{indexer: s.indexer, clusterName: clusterName}
+func (l *endpointsClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.EndpointsLister {
+	return &endpointsLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// endpointsLister implements the corev1listers.EndpointsLister interface.
+// endpointsLister can list all Endpoints inside a workspace
+// or scope down to a listerscorev1.EndpointsNamespaceLister for one namespace.
 type endpointsLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.Endpoints]
 }
 
-// List lists all Endpoints in the indexer for a workspace.
-func (s *endpointsLister) List(selector labels.Selector) (ret []*corev1.Endpoints, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.Endpoints))
-	})
-	return ret, err
-}
+var _ listerscorev1.EndpointsLister = new(endpointsLister)
 
 // Endpoints returns an object that can list and get Endpoints in one namespace.
-func (s *endpointsLister) Endpoints(namespace string) corev1listers.EndpointsNamespaceLister {
-	return &endpointsNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *endpointsLister) Endpoints(namespace string) listerscorev1.EndpointsNamespaceLister {
+	return &endpointsNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// endpointsNamespaceLister implements the corev1listers.EndpointsNamespaceLister interface.
+// endpointsNamespaceLister implements the listerscorev1.EndpointsNamespaceLister
+// interface.
 type endpointsNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*corev1.Endpoints]
 }
 
-// List lists all Endpoints in the indexer for a given workspace and namespace.
-func (s *endpointsNamespaceLister) List(selector labels.Selector) (ret []*corev1.Endpoints, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.Endpoints))
-	})
-	return ret, err
-}
+var _ listerscorev1.EndpointsNamespaceLister = new(endpointsNamespaceLister)
 
-// Get retrieves the Endpoints from the indexer for a given workspace, namespace and name.
-func (s *endpointsNamespaceLister) Get(name string) (*corev1.Endpoints, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewEndpointsLister returns a new EndpointsLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewEndpointsLister(indexer cache.Indexer) listerscorev1.EndpointsLister {
+	return &endpointsLister{
+		kcplisters.New[*corev1.Endpoints](indexer, corev1.Resource("endpoints")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("endpoints"), name)
+}
+
+// endpointsScopedLister can list all Endpoints inside a workspace
+// or scope down to a listerscorev1.EndpointsNamespaceLister for one namespace.
+type endpointsScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.Endpoints]
+}
+
+// Endpoints returns an object that can list and get Endpoints in one namespace.
+func (l *endpointsScopedLister) Endpoints(namespace string) listerscorev1.EndpointsLister {
+	return &endpointsLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*corev1.Endpoints), nil
 }
diff --git a/listers/core/v1/endpoints_expansion.go b/listers/core/v1/endpoints_expansion.go
index 8183e8065..099ab4270 100644
--- a/listers/core/v1/endpoints_expansion.go
+++ b/listers/core/v1/endpoints_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/event.go b/listers/core/v1/event.go
index 0ead5523b..f29c36e87 100644
--- a/listers/core/v1/event.go
+++ b/listers/core/v1/event.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// EventClusterLister can list Events across all workspaces, or scope down to a EventLister for one workspace.
+// EventClusterLister helps list Events across all workspaces,
+// or scope down to a EventLister for one workspace.
 // All objects returned here must be treated as read-only.
 type EventClusterLister interface {
 	// List lists all Events in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.Event, err error)
 	// Cluster returns a lister that can list and get Events in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.EventLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.EventLister
 	EventClusterListerExpansion
 }
 
+// eventClusterLister implements the EventClusterLister interface.
 type eventClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.Event]
 }
 
+var _ EventClusterLister = new(eventClusterLister)
+
 // NewEventClusterLister returns a new EventClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewEventClusterLister(indexer cache.Indexer) *eventClusterLister {
-	return &eventClusterLister{indexer: indexer}
-}
-
-// List lists all Events in the indexer across all workspaces.
-func (s *eventClusterLister) List(selector labels.Selector) (ret []*corev1.Event, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.Event))
-	})
-	return ret, err
+func NewEventClusterLister(indexer cache.Indexer) EventClusterLister {
+	return &eventClusterLister{
+		kcplisters.NewCluster[*corev1.Event](indexer, corev1.Resource("event")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Events.
-func (s *eventClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.EventLister {
-	return &eventLister{indexer: s.indexer, clusterName: clusterName}
+func (l *eventClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.EventLister {
+	return &eventLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// eventLister implements the corev1listers.EventLister interface.
+// eventLister can list all Events inside a workspace
+// or scope down to a listerscorev1.EventNamespaceLister for one namespace.
 type eventLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.Event]
 }
 
-// List lists all Events in the indexer for a workspace.
-func (s *eventLister) List(selector labels.Selector) (ret []*corev1.Event, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.Event))
-	})
-	return ret, err
-}
+var _ listerscorev1.EventLister = new(eventLister)
 
 // Events returns an object that can list and get Events in one namespace.
-func (s *eventLister) Events(namespace string) corev1listers.EventNamespaceLister {
-	return &eventNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *eventLister) Events(namespace string) listerscorev1.EventNamespaceLister {
+	return &eventNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// eventNamespaceLister implements the corev1listers.EventNamespaceLister interface.
+// eventNamespaceLister implements the listerscorev1.EventNamespaceLister
+// interface.
 type eventNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*corev1.Event]
 }
 
-// List lists all Events in the indexer for a given workspace and namespace.
-func (s *eventNamespaceLister) List(selector labels.Selector) (ret []*corev1.Event, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.Event))
-	})
-	return ret, err
-}
+var _ listerscorev1.EventNamespaceLister = new(eventNamespaceLister)
 
-// Get retrieves the Event from the indexer for a given workspace, namespace and name.
-func (s *eventNamespaceLister) Get(name string) (*corev1.Event, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewEventLister returns a new EventLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewEventLister(indexer cache.Indexer) listerscorev1.EventLister {
+	return &eventLister{
+		kcplisters.New[*corev1.Event](indexer, corev1.Resource("event")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("events"), name)
+}
+
+// eventScopedLister can list all Events inside a workspace
+// or scope down to a listerscorev1.EventNamespaceLister for one namespace.
+type eventScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.Event]
+}
+
+// Events returns an object that can list and get Events in one namespace.
+func (l *eventScopedLister) Events(namespace string) listerscorev1.EventLister {
+	return &eventLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*corev1.Event), nil
 }
diff --git a/listers/core/v1/event_expansion.go b/listers/core/v1/event_expansion.go
index bdb79e6ed..d43a29751 100644
--- a/listers/core/v1/event_expansion.go
+++ b/listers/core/v1/event_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/expansion_generated.go b/listers/core/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/core/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/core/v1/limitrange.go b/listers/core/v1/limitrange.go
index 3653eaf9f..e1dff6185 100644
--- a/listers/core/v1/limitrange.go
+++ b/listers/core/v1/limitrange.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// LimitRangeClusterLister can list LimitRanges across all workspaces, or scope down to a LimitRangeLister for one workspace.
+// LimitRangeClusterLister helps list LimitRanges across all workspaces,
+// or scope down to a LimitRangeLister for one workspace.
 // All objects returned here must be treated as read-only.
 type LimitRangeClusterLister interface {
 	// List lists all LimitRanges in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.LimitRange, err error)
 	// Cluster returns a lister that can list and get LimitRanges in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.LimitRangeLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.LimitRangeLister
 	LimitRangeClusterListerExpansion
 }
 
+// limitRangeClusterLister implements the LimitRangeClusterLister interface.
 type limitRangeClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.LimitRange]
 }
 
+var _ LimitRangeClusterLister = new(limitRangeClusterLister)
+
 // NewLimitRangeClusterLister returns a new LimitRangeClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewLimitRangeClusterLister(indexer cache.Indexer) *limitRangeClusterLister {
-	return &limitRangeClusterLister{indexer: indexer}
-}
-
-// List lists all LimitRanges in the indexer across all workspaces.
-func (s *limitRangeClusterLister) List(selector labels.Selector) (ret []*corev1.LimitRange, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.LimitRange))
-	})
-	return ret, err
+func NewLimitRangeClusterLister(indexer cache.Indexer) LimitRangeClusterLister {
+	return &limitRangeClusterLister{
+		kcplisters.NewCluster[*corev1.LimitRange](indexer, corev1.Resource("limitrange")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get LimitRanges.
-func (s *limitRangeClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.LimitRangeLister {
-	return &limitRangeLister{indexer: s.indexer, clusterName: clusterName}
+func (l *limitRangeClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.LimitRangeLister {
+	return &limitRangeLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// limitRangeLister implements the corev1listers.LimitRangeLister interface.
+// limitRangeLister can list all LimitRanges inside a workspace
+// or scope down to a listerscorev1.LimitRangeNamespaceLister for one namespace.
 type limitRangeLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.LimitRange]
 }
 
-// List lists all LimitRanges in the indexer for a workspace.
-func (s *limitRangeLister) List(selector labels.Selector) (ret []*corev1.LimitRange, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.LimitRange))
-	})
-	return ret, err
-}
+var _ listerscorev1.LimitRangeLister = new(limitRangeLister)
 
 // LimitRanges returns an object that can list and get LimitRanges in one namespace.
-func (s *limitRangeLister) LimitRanges(namespace string) corev1listers.LimitRangeNamespaceLister {
-	return &limitRangeNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *limitRangeLister) LimitRanges(namespace string) listerscorev1.LimitRangeNamespaceLister {
+	return &limitRangeNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// limitRangeNamespaceLister implements the corev1listers.LimitRangeNamespaceLister interface.
+// limitRangeNamespaceLister implements the listerscorev1.LimitRangeNamespaceLister
+// interface.
 type limitRangeNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*corev1.LimitRange]
 }
 
-// List lists all LimitRanges in the indexer for a given workspace and namespace.
-func (s *limitRangeNamespaceLister) List(selector labels.Selector) (ret []*corev1.LimitRange, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.LimitRange))
-	})
-	return ret, err
-}
+var _ listerscorev1.LimitRangeNamespaceLister = new(limitRangeNamespaceLister)
 
-// Get retrieves the LimitRange from the indexer for a given workspace, namespace and name.
-func (s *limitRangeNamespaceLister) Get(name string) (*corev1.LimitRange, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewLimitRangeLister returns a new LimitRangeLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewLimitRangeLister(indexer cache.Indexer) listerscorev1.LimitRangeLister {
+	return &limitRangeLister{
+		kcplisters.New[*corev1.LimitRange](indexer, corev1.Resource("limitrange")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("limitranges"), name)
+}
+
+// limitRangeScopedLister can list all LimitRanges inside a workspace
+// or scope down to a listerscorev1.LimitRangeNamespaceLister for one namespace.
+type limitRangeScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.LimitRange]
+}
+
+// LimitRanges returns an object that can list and get LimitRanges in one namespace.
+func (l *limitRangeScopedLister) LimitRanges(namespace string) listerscorev1.LimitRangeLister {
+	return &limitRangeLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*corev1.LimitRange), nil
 }
diff --git a/listers/core/v1/limitrange_expansion.go b/listers/core/v1/limitrange_expansion.go
index 7c72c7177..eb916f700 100644
--- a/listers/core/v1/limitrange_expansion.go
+++ b/listers/core/v1/limitrange_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/namespace.go b/listers/core/v1/namespace.go
index afcb7f6ad..739951dec 100644
--- a/listers/core/v1/namespace.go
+++ b/listers/core/v1/namespace.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// NamespaceClusterLister can list Namespaces across all workspaces, or scope down to a NamespaceLister for one workspace.
+// NamespaceClusterLister helps list Namespaces across all workspaces,
+// or scope down to a NamespaceLister for one workspace.
 // All objects returned here must be treated as read-only.
 type NamespaceClusterLister interface {
 	// List lists all Namespaces in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.Namespace, err error)
 	// Cluster returns a lister that can list and get Namespaces in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.NamespaceLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.NamespaceLister
 	NamespaceClusterListerExpansion
 }
 
+// namespaceClusterLister implements the NamespaceClusterLister interface.
 type namespaceClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.Namespace]
 }
 
+var _ NamespaceClusterLister = new(namespaceClusterLister)
+
 // NewNamespaceClusterLister returns a new NamespaceClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewNamespaceClusterLister(indexer cache.Indexer) *namespaceClusterLister {
-	return &namespaceClusterLister{indexer: indexer}
-}
-
-// List lists all Namespaces in the indexer across all workspaces.
-func (s *namespaceClusterLister) List(selector labels.Selector) (ret []*corev1.Namespace, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.Namespace))
-	})
-	return ret, err
+func NewNamespaceClusterLister(indexer cache.Indexer) NamespaceClusterLister {
+	return &namespaceClusterLister{
+		kcplisters.NewCluster[*corev1.Namespace](indexer, corev1.Resource("namespace")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Namespaces.
-func (s *namespaceClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.NamespaceLister {
-	return &namespaceLister{indexer: s.indexer, clusterName: clusterName}
+func (l *namespaceClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.NamespaceLister {
+	return &namespaceLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// namespaceLister implements the corev1listers.NamespaceLister interface.
+// namespaceLister can list all Namespaces inside a workspace
+// or scope down to a listerscorev1.NamespaceNamespaceLister for one namespace.
 type namespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.Namespace]
 }
 
-// List lists all Namespaces in the indexer for a workspace.
-func (s *namespaceLister) List(selector labels.Selector) (ret []*corev1.Namespace, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.Namespace))
-	})
-	return ret, err
-}
+var _ listerscorev1.NamespaceLister = new(namespaceLister)
 
-// Get retrieves the Namespace from the indexer for a given workspace and name.
-func (s *namespaceLister) Get(name string) (*corev1.Namespace, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("namespaces"), name)
+// NewNamespaceLister returns a new NamespaceLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewNamespaceLister(indexer cache.Indexer) listerscorev1.NamespaceLister {
+	return &namespaceLister{
+		kcplisters.New[*corev1.Namespace](indexer, corev1.Resource("namespace")),
 	}
-	return obj.(*corev1.Namespace), nil
+}
+
+// namespaceScopedLister can list all Namespaces inside a workspace
+// or scope down to a listerscorev1.NamespaceNamespaceLister.
+type namespaceScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.Namespace]
 }
diff --git a/listers/core/v1/namespace_expansion.go b/listers/core/v1/namespace_expansion.go
index ea8e99ced..cd7eb0f54 100644
--- a/listers/core/v1/namespace_expansion.go
+++ b/listers/core/v1/namespace_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/node.go b/listers/core/v1/node.go
index 27510fdeb..e3f957def 100644
--- a/listers/core/v1/node.go
+++ b/listers/core/v1/node.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// NodeClusterLister can list Nodes across all workspaces, or scope down to a NodeLister for one workspace.
+// NodeClusterLister helps list Nodes across all workspaces,
+// or scope down to a NodeLister for one workspace.
 // All objects returned here must be treated as read-only.
 type NodeClusterLister interface {
 	// List lists all Nodes in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.Node, err error)
 	// Cluster returns a lister that can list and get Nodes in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.NodeLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.NodeLister
 	NodeClusterListerExpansion
 }
 
+// nodeClusterLister implements the NodeClusterLister interface.
 type nodeClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.Node]
 }
 
+var _ NodeClusterLister = new(nodeClusterLister)
+
 // NewNodeClusterLister returns a new NodeClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewNodeClusterLister(indexer cache.Indexer) *nodeClusterLister {
-	return &nodeClusterLister{indexer: indexer}
-}
-
-// List lists all Nodes in the indexer across all workspaces.
-func (s *nodeClusterLister) List(selector labels.Selector) (ret []*corev1.Node, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.Node))
-	})
-	return ret, err
+func NewNodeClusterLister(indexer cache.Indexer) NodeClusterLister {
+	return &nodeClusterLister{
+		kcplisters.NewCluster[*corev1.Node](indexer, corev1.Resource("node")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Nodes.
-func (s *nodeClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.NodeLister {
-	return &nodeLister{indexer: s.indexer, clusterName: clusterName}
+func (l *nodeClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.NodeLister {
+	return &nodeLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// nodeLister implements the corev1listers.NodeLister interface.
+// nodeLister can list all Nodes inside a workspace
+// or scope down to a listerscorev1.NodeNamespaceLister for one namespace.
 type nodeLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.Node]
 }
 
-// List lists all Nodes in the indexer for a workspace.
-func (s *nodeLister) List(selector labels.Selector) (ret []*corev1.Node, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.Node))
-	})
-	return ret, err
-}
+var _ listerscorev1.NodeLister = new(nodeLister)
 
-// Get retrieves the Node from the indexer for a given workspace and name.
-func (s *nodeLister) Get(name string) (*corev1.Node, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("nodes"), name)
+// NewNodeLister returns a new NodeLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewNodeLister(indexer cache.Indexer) listerscorev1.NodeLister {
+	return &nodeLister{
+		kcplisters.New[*corev1.Node](indexer, corev1.Resource("node")),
 	}
-	return obj.(*corev1.Node), nil
+}
+
+// nodeScopedLister can list all Nodes inside a workspace
+// or scope down to a listerscorev1.NodeNamespaceLister.
+type nodeScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.Node]
 }
diff --git a/listers/core/v1/node_expansion.go b/listers/core/v1/node_expansion.go
index 3a2f35bfd..4c228c130 100644
--- a/listers/core/v1/node_expansion.go
+++ b/listers/core/v1/node_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/persistentvolume.go b/listers/core/v1/persistentvolume.go
index 86cb80a28..704e86efb 100644
--- a/listers/core/v1/persistentvolume.go
+++ b/listers/core/v1/persistentvolume.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// PersistentVolumeClusterLister can list PersistentVolumes across all workspaces, or scope down to a PersistentVolumeLister for one workspace.
+// PersistentVolumeClusterLister helps list PersistentVolumes across all workspaces,
+// or scope down to a PersistentVolumeLister for one workspace.
 // All objects returned here must be treated as read-only.
 type PersistentVolumeClusterLister interface {
 	// List lists all PersistentVolumes in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.PersistentVolume, err error)
 	// Cluster returns a lister that can list and get PersistentVolumes in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.PersistentVolumeLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.PersistentVolumeLister
 	PersistentVolumeClusterListerExpansion
 }
 
+// persistentVolumeClusterLister implements the PersistentVolumeClusterLister interface.
 type persistentVolumeClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.PersistentVolume]
 }
 
+var _ PersistentVolumeClusterLister = new(persistentVolumeClusterLister)
+
 // NewPersistentVolumeClusterLister returns a new PersistentVolumeClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewPersistentVolumeClusterLister(indexer cache.Indexer) *persistentVolumeClusterLister {
-	return &persistentVolumeClusterLister{indexer: indexer}
-}
-
-// List lists all PersistentVolumes in the indexer across all workspaces.
-func (s *persistentVolumeClusterLister) List(selector labels.Selector) (ret []*corev1.PersistentVolume, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.PersistentVolume))
-	})
-	return ret, err
+func NewPersistentVolumeClusterLister(indexer cache.Indexer) PersistentVolumeClusterLister {
+	return &persistentVolumeClusterLister{
+		kcplisters.NewCluster[*corev1.PersistentVolume](indexer, corev1.Resource("persistentvolume")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get PersistentVolumes.
-func (s *persistentVolumeClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.PersistentVolumeLister {
-	return &persistentVolumeLister{indexer: s.indexer, clusterName: clusterName}
+func (l *persistentVolumeClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.PersistentVolumeLister {
+	return &persistentVolumeLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// persistentVolumeLister implements the corev1listers.PersistentVolumeLister interface.
+// persistentVolumeLister can list all PersistentVolumes inside a workspace
+// or scope down to a listerscorev1.PersistentVolumeNamespaceLister for one namespace.
 type persistentVolumeLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.PersistentVolume]
 }
 
-// List lists all PersistentVolumes in the indexer for a workspace.
-func (s *persistentVolumeLister) List(selector labels.Selector) (ret []*corev1.PersistentVolume, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.PersistentVolume))
-	})
-	return ret, err
-}
+var _ listerscorev1.PersistentVolumeLister = new(persistentVolumeLister)
 
-// Get retrieves the PersistentVolume from the indexer for a given workspace and name.
-func (s *persistentVolumeLister) Get(name string) (*corev1.PersistentVolume, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("persistentvolumes"), name)
+// NewPersistentVolumeLister returns a new PersistentVolumeLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewPersistentVolumeLister(indexer cache.Indexer) listerscorev1.PersistentVolumeLister {
+	return &persistentVolumeLister{
+		kcplisters.New[*corev1.PersistentVolume](indexer, corev1.Resource("persistentvolume")),
 	}
-	return obj.(*corev1.PersistentVolume), nil
+}
+
+// persistentVolumeScopedLister can list all PersistentVolumes inside a workspace
+// or scope down to a listerscorev1.PersistentVolumeNamespaceLister.
+type persistentVolumeScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.PersistentVolume]
 }
diff --git a/listers/core/v1/persistentvolume_expansion.go b/listers/core/v1/persistentvolume_expansion.go
index 1cf27f753..8b21ac0ab 100644
--- a/listers/core/v1/persistentvolume_expansion.go
+++ b/listers/core/v1/persistentvolume_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/persistentvolumeclaim.go b/listers/core/v1/persistentvolumeclaim.go
index 7124b33d4..9c57d2299 100644
--- a/listers/core/v1/persistentvolumeclaim.go
+++ b/listers/core/v1/persistentvolumeclaim.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// PersistentVolumeClaimClusterLister can list PersistentVolumeClaims across all workspaces, or scope down to a PersistentVolumeClaimLister for one workspace.
+// PersistentVolumeClaimClusterLister helps list PersistentVolumeClaims across all workspaces,
+// or scope down to a PersistentVolumeClaimLister for one workspace.
 // All objects returned here must be treated as read-only.
 type PersistentVolumeClaimClusterLister interface {
 	// List lists all PersistentVolumeClaims in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.PersistentVolumeClaim, err error)
 	// Cluster returns a lister that can list and get PersistentVolumeClaims in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.PersistentVolumeClaimLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.PersistentVolumeClaimLister
 	PersistentVolumeClaimClusterListerExpansion
 }
 
+// persistentVolumeClaimClusterLister implements the PersistentVolumeClaimClusterLister interface.
 type persistentVolumeClaimClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.PersistentVolumeClaim]
 }
 
+var _ PersistentVolumeClaimClusterLister = new(persistentVolumeClaimClusterLister)
+
 // NewPersistentVolumeClaimClusterLister returns a new PersistentVolumeClaimClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewPersistentVolumeClaimClusterLister(indexer cache.Indexer) *persistentVolumeClaimClusterLister {
-	return &persistentVolumeClaimClusterLister{indexer: indexer}
-}
-
-// List lists all PersistentVolumeClaims in the indexer across all workspaces.
-func (s *persistentVolumeClaimClusterLister) List(selector labels.Selector) (ret []*corev1.PersistentVolumeClaim, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.PersistentVolumeClaim))
-	})
-	return ret, err
+func NewPersistentVolumeClaimClusterLister(indexer cache.Indexer) PersistentVolumeClaimClusterLister {
+	return &persistentVolumeClaimClusterLister{
+		kcplisters.NewCluster[*corev1.PersistentVolumeClaim](indexer, corev1.Resource("persistentvolumeclaim")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get PersistentVolumeClaims.
-func (s *persistentVolumeClaimClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.PersistentVolumeClaimLister {
-	return &persistentVolumeClaimLister{indexer: s.indexer, clusterName: clusterName}
+func (l *persistentVolumeClaimClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.PersistentVolumeClaimLister {
+	return &persistentVolumeClaimLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// persistentVolumeClaimLister implements the corev1listers.PersistentVolumeClaimLister interface.
+// persistentVolumeClaimLister can list all PersistentVolumeClaims inside a workspace
+// or scope down to a listerscorev1.PersistentVolumeClaimNamespaceLister for one namespace.
 type persistentVolumeClaimLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.PersistentVolumeClaim]
 }
 
-// List lists all PersistentVolumeClaims in the indexer for a workspace.
-func (s *persistentVolumeClaimLister) List(selector labels.Selector) (ret []*corev1.PersistentVolumeClaim, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.PersistentVolumeClaim))
-	})
-	return ret, err
-}
+var _ listerscorev1.PersistentVolumeClaimLister = new(persistentVolumeClaimLister)
 
 // PersistentVolumeClaims returns an object that can list and get PersistentVolumeClaims in one namespace.
-func (s *persistentVolumeClaimLister) PersistentVolumeClaims(namespace string) corev1listers.PersistentVolumeClaimNamespaceLister {
-	return &persistentVolumeClaimNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *persistentVolumeClaimLister) PersistentVolumeClaims(namespace string) listerscorev1.PersistentVolumeClaimNamespaceLister {
+	return &persistentVolumeClaimNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// persistentVolumeClaimNamespaceLister implements the corev1listers.PersistentVolumeClaimNamespaceLister interface.
+// persistentVolumeClaimNamespaceLister implements the listerscorev1.PersistentVolumeClaimNamespaceLister
+// interface.
 type persistentVolumeClaimNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*corev1.PersistentVolumeClaim]
 }
 
-// List lists all PersistentVolumeClaims in the indexer for a given workspace and namespace.
-func (s *persistentVolumeClaimNamespaceLister) List(selector labels.Selector) (ret []*corev1.PersistentVolumeClaim, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.PersistentVolumeClaim))
-	})
-	return ret, err
-}
+var _ listerscorev1.PersistentVolumeClaimNamespaceLister = new(persistentVolumeClaimNamespaceLister)
 
-// Get retrieves the PersistentVolumeClaim from the indexer for a given workspace, namespace and name.
-func (s *persistentVolumeClaimNamespaceLister) Get(name string) (*corev1.PersistentVolumeClaim, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewPersistentVolumeClaimLister returns a new PersistentVolumeClaimLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewPersistentVolumeClaimLister(indexer cache.Indexer) listerscorev1.PersistentVolumeClaimLister {
+	return &persistentVolumeClaimLister{
+		kcplisters.New[*corev1.PersistentVolumeClaim](indexer, corev1.Resource("persistentvolumeclaim")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("persistentvolumeclaims"), name)
+}
+
+// persistentVolumeClaimScopedLister can list all PersistentVolumeClaims inside a workspace
+// or scope down to a listerscorev1.PersistentVolumeClaimNamespaceLister for one namespace.
+type persistentVolumeClaimScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.PersistentVolumeClaim]
+}
+
+// PersistentVolumeClaims returns an object that can list and get PersistentVolumeClaims in one namespace.
+func (l *persistentVolumeClaimScopedLister) PersistentVolumeClaims(namespace string) listerscorev1.PersistentVolumeClaimLister {
+	return &persistentVolumeClaimLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*corev1.PersistentVolumeClaim), nil
 }
diff --git a/listers/core/v1/persistentvolumeclaim_expansion.go b/listers/core/v1/persistentvolumeclaim_expansion.go
index 94e33ca0b..107f37297 100644
--- a/listers/core/v1/persistentvolumeclaim_expansion.go
+++ b/listers/core/v1/persistentvolumeclaim_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/pod.go b/listers/core/v1/pod.go
index c66fc6587..c25e3b8b3 100644
--- a/listers/core/v1/pod.go
+++ b/listers/core/v1/pod.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// PodClusterLister can list Pods across all workspaces, or scope down to a PodLister for one workspace.
+// PodClusterLister helps list Pods across all workspaces,
+// or scope down to a PodLister for one workspace.
 // All objects returned here must be treated as read-only.
 type PodClusterLister interface {
 	// List lists all Pods in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.Pod, err error)
 	// Cluster returns a lister that can list and get Pods in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.PodLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.PodLister
 	PodClusterListerExpansion
 }
 
+// podClusterLister implements the PodClusterLister interface.
 type podClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.Pod]
 }
 
+var _ PodClusterLister = new(podClusterLister)
+
 // NewPodClusterLister returns a new PodClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewPodClusterLister(indexer cache.Indexer) *podClusterLister {
-	return &podClusterLister{indexer: indexer}
-}
-
-// List lists all Pods in the indexer across all workspaces.
-func (s *podClusterLister) List(selector labels.Selector) (ret []*corev1.Pod, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.Pod))
-	})
-	return ret, err
+func NewPodClusterLister(indexer cache.Indexer) PodClusterLister {
+	return &podClusterLister{
+		kcplisters.NewCluster[*corev1.Pod](indexer, corev1.Resource("pod")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Pods.
-func (s *podClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.PodLister {
-	return &podLister{indexer: s.indexer, clusterName: clusterName}
+func (l *podClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.PodLister {
+	return &podLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// podLister implements the corev1listers.PodLister interface.
+// podLister can list all Pods inside a workspace
+// or scope down to a listerscorev1.PodNamespaceLister for one namespace.
 type podLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.Pod]
 }
 
-// List lists all Pods in the indexer for a workspace.
-func (s *podLister) List(selector labels.Selector) (ret []*corev1.Pod, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.Pod))
-	})
-	return ret, err
-}
+var _ listerscorev1.PodLister = new(podLister)
 
 // Pods returns an object that can list and get Pods in one namespace.
-func (s *podLister) Pods(namespace string) corev1listers.PodNamespaceLister {
-	return &podNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *podLister) Pods(namespace string) listerscorev1.PodNamespaceLister {
+	return &podNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// podNamespaceLister implements the corev1listers.PodNamespaceLister interface.
+// podNamespaceLister implements the listerscorev1.PodNamespaceLister
+// interface.
 type podNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*corev1.Pod]
 }
 
-// List lists all Pods in the indexer for a given workspace and namespace.
-func (s *podNamespaceLister) List(selector labels.Selector) (ret []*corev1.Pod, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.Pod))
-	})
-	return ret, err
-}
+var _ listerscorev1.PodNamespaceLister = new(podNamespaceLister)
 
-// Get retrieves the Pod from the indexer for a given workspace, namespace and name.
-func (s *podNamespaceLister) Get(name string) (*corev1.Pod, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewPodLister returns a new PodLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewPodLister(indexer cache.Indexer) listerscorev1.PodLister {
+	return &podLister{
+		kcplisters.New[*corev1.Pod](indexer, corev1.Resource("pod")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("pods"), name)
+}
+
+// podScopedLister can list all Pods inside a workspace
+// or scope down to a listerscorev1.PodNamespaceLister for one namespace.
+type podScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.Pod]
+}
+
+// Pods returns an object that can list and get Pods in one namespace.
+func (l *podScopedLister) Pods(namespace string) listerscorev1.PodLister {
+	return &podLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*corev1.Pod), nil
 }
diff --git a/listers/core/v1/pod_expansion.go b/listers/core/v1/pod_expansion.go
index e4bfca6a6..05fac6885 100644
--- a/listers/core/v1/pod_expansion.go
+++ b/listers/core/v1/pod_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/podtemplate.go b/listers/core/v1/podtemplate.go
index 6e0ec7403..3e90b8d69 100644
--- a/listers/core/v1/podtemplate.go
+++ b/listers/core/v1/podtemplate.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// PodTemplateClusterLister can list PodTemplates across all workspaces, or scope down to a PodTemplateLister for one workspace.
+// PodTemplateClusterLister helps list PodTemplates across all workspaces,
+// or scope down to a PodTemplateLister for one workspace.
 // All objects returned here must be treated as read-only.
 type PodTemplateClusterLister interface {
 	// List lists all PodTemplates in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.PodTemplate, err error)
 	// Cluster returns a lister that can list and get PodTemplates in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.PodTemplateLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.PodTemplateLister
 	PodTemplateClusterListerExpansion
 }
 
+// podTemplateClusterLister implements the PodTemplateClusterLister interface.
 type podTemplateClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.PodTemplate]
 }
 
+var _ PodTemplateClusterLister = new(podTemplateClusterLister)
+
 // NewPodTemplateClusterLister returns a new PodTemplateClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewPodTemplateClusterLister(indexer cache.Indexer) *podTemplateClusterLister {
-	return &podTemplateClusterLister{indexer: indexer}
-}
-
-// List lists all PodTemplates in the indexer across all workspaces.
-func (s *podTemplateClusterLister) List(selector labels.Selector) (ret []*corev1.PodTemplate, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.PodTemplate))
-	})
-	return ret, err
+func NewPodTemplateClusterLister(indexer cache.Indexer) PodTemplateClusterLister {
+	return &podTemplateClusterLister{
+		kcplisters.NewCluster[*corev1.PodTemplate](indexer, corev1.Resource("podtemplate")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get PodTemplates.
-func (s *podTemplateClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.PodTemplateLister {
-	return &podTemplateLister{indexer: s.indexer, clusterName: clusterName}
+func (l *podTemplateClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.PodTemplateLister {
+	return &podTemplateLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// podTemplateLister implements the corev1listers.PodTemplateLister interface.
+// podTemplateLister can list all PodTemplates inside a workspace
+// or scope down to a listerscorev1.PodTemplateNamespaceLister for one namespace.
 type podTemplateLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.PodTemplate]
 }
 
-// List lists all PodTemplates in the indexer for a workspace.
-func (s *podTemplateLister) List(selector labels.Selector) (ret []*corev1.PodTemplate, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.PodTemplate))
-	})
-	return ret, err
-}
+var _ listerscorev1.PodTemplateLister = new(podTemplateLister)
 
 // PodTemplates returns an object that can list and get PodTemplates in one namespace.
-func (s *podTemplateLister) PodTemplates(namespace string) corev1listers.PodTemplateNamespaceLister {
-	return &podTemplateNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *podTemplateLister) PodTemplates(namespace string) listerscorev1.PodTemplateNamespaceLister {
+	return &podTemplateNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// podTemplateNamespaceLister implements the corev1listers.PodTemplateNamespaceLister interface.
+// podTemplateNamespaceLister implements the listerscorev1.PodTemplateNamespaceLister
+// interface.
 type podTemplateNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*corev1.PodTemplate]
 }
 
-// List lists all PodTemplates in the indexer for a given workspace and namespace.
-func (s *podTemplateNamespaceLister) List(selector labels.Selector) (ret []*corev1.PodTemplate, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.PodTemplate))
-	})
-	return ret, err
-}
+var _ listerscorev1.PodTemplateNamespaceLister = new(podTemplateNamespaceLister)
 
-// Get retrieves the PodTemplate from the indexer for a given workspace, namespace and name.
-func (s *podTemplateNamespaceLister) Get(name string) (*corev1.PodTemplate, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewPodTemplateLister returns a new PodTemplateLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewPodTemplateLister(indexer cache.Indexer) listerscorev1.PodTemplateLister {
+	return &podTemplateLister{
+		kcplisters.New[*corev1.PodTemplate](indexer, corev1.Resource("podtemplate")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("podtemplates"), name)
+}
+
+// podTemplateScopedLister can list all PodTemplates inside a workspace
+// or scope down to a listerscorev1.PodTemplateNamespaceLister for one namespace.
+type podTemplateScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.PodTemplate]
+}
+
+// PodTemplates returns an object that can list and get PodTemplates in one namespace.
+func (l *podTemplateScopedLister) PodTemplates(namespace string) listerscorev1.PodTemplateLister {
+	return &podTemplateLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*corev1.PodTemplate), nil
 }
diff --git a/listers/core/v1/podtemplate_expansion.go b/listers/core/v1/podtemplate_expansion.go
index 778cf1723..485c13260 100644
--- a/listers/core/v1/podtemplate_expansion.go
+++ b/listers/core/v1/podtemplate_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/replicationcontroller.go b/listers/core/v1/replicationcontroller.go
index c1dfe3299..a50d8b382 100644
--- a/listers/core/v1/replicationcontroller.go
+++ b/listers/core/v1/replicationcontroller.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ReplicationControllerClusterLister can list ReplicationControllers across all workspaces, or scope down to a ReplicationControllerLister for one workspace.
+// ReplicationControllerClusterLister helps list ReplicationControllers across all workspaces,
+// or scope down to a ReplicationControllerLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ReplicationControllerClusterLister interface {
 	// List lists all ReplicationControllers in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.ReplicationController, err error)
 	// Cluster returns a lister that can list and get ReplicationControllers in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.ReplicationControllerLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.ReplicationControllerLister
 	ReplicationControllerClusterListerExpansion
 }
 
+// replicationControllerClusterLister implements the ReplicationControllerClusterLister interface.
 type replicationControllerClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.ReplicationController]
 }
 
+var _ ReplicationControllerClusterLister = new(replicationControllerClusterLister)
+
 // NewReplicationControllerClusterLister returns a new ReplicationControllerClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewReplicationControllerClusterLister(indexer cache.Indexer) *replicationControllerClusterLister {
-	return &replicationControllerClusterLister{indexer: indexer}
-}
-
-// List lists all ReplicationControllers in the indexer across all workspaces.
-func (s *replicationControllerClusterLister) List(selector labels.Selector) (ret []*corev1.ReplicationController, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.ReplicationController))
-	})
-	return ret, err
+func NewReplicationControllerClusterLister(indexer cache.Indexer) ReplicationControllerClusterLister {
+	return &replicationControllerClusterLister{
+		kcplisters.NewCluster[*corev1.ReplicationController](indexer, corev1.Resource("replicationcontroller")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ReplicationControllers.
-func (s *replicationControllerClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.ReplicationControllerLister {
-	return &replicationControllerLister{indexer: s.indexer, clusterName: clusterName}
+func (l *replicationControllerClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.ReplicationControllerLister {
+	return &replicationControllerLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// replicationControllerLister implements the corev1listers.ReplicationControllerLister interface.
+// replicationControllerLister can list all ReplicationControllers inside a workspace
+// or scope down to a listerscorev1.ReplicationControllerNamespaceLister for one namespace.
 type replicationControllerLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.ReplicationController]
 }
 
-// List lists all ReplicationControllers in the indexer for a workspace.
-func (s *replicationControllerLister) List(selector labels.Selector) (ret []*corev1.ReplicationController, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.ReplicationController))
-	})
-	return ret, err
-}
+var _ listerscorev1.ReplicationControllerLister = new(replicationControllerLister)
 
 // ReplicationControllers returns an object that can list and get ReplicationControllers in one namespace.
-func (s *replicationControllerLister) ReplicationControllers(namespace string) corev1listers.ReplicationControllerNamespaceLister {
-	return &replicationControllerNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *replicationControllerLister) ReplicationControllers(namespace string) listerscorev1.ReplicationControllerNamespaceLister {
+	return &replicationControllerNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// replicationControllerNamespaceLister implements the corev1listers.ReplicationControllerNamespaceLister interface.
+// replicationControllerNamespaceLister implements the listerscorev1.ReplicationControllerNamespaceLister
+// interface.
 type replicationControllerNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*corev1.ReplicationController]
 }
 
-// List lists all ReplicationControllers in the indexer for a given workspace and namespace.
-func (s *replicationControllerNamespaceLister) List(selector labels.Selector) (ret []*corev1.ReplicationController, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.ReplicationController))
-	})
-	return ret, err
-}
+var _ listerscorev1.ReplicationControllerNamespaceLister = new(replicationControllerNamespaceLister)
 
-// Get retrieves the ReplicationController from the indexer for a given workspace, namespace and name.
-func (s *replicationControllerNamespaceLister) Get(name string) (*corev1.ReplicationController, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewReplicationControllerLister returns a new ReplicationControllerLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewReplicationControllerLister(indexer cache.Indexer) listerscorev1.ReplicationControllerLister {
+	return &replicationControllerLister{
+		kcplisters.New[*corev1.ReplicationController](indexer, corev1.Resource("replicationcontroller")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("replicationcontrollers"), name)
+}
+
+// replicationControllerScopedLister can list all ReplicationControllers inside a workspace
+// or scope down to a listerscorev1.ReplicationControllerNamespaceLister for one namespace.
+type replicationControllerScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.ReplicationController]
+}
+
+// ReplicationControllers returns an object that can list and get ReplicationControllers in one namespace.
+func (l *replicationControllerScopedLister) ReplicationControllers(namespace string) listerscorev1.ReplicationControllerLister {
+	return &replicationControllerLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*corev1.ReplicationController), nil
 }
diff --git a/listers/core/v1/replicationcontroller_expansion.go b/listers/core/v1/replicationcontroller_expansion.go
index 31a116a09..46d2e1309 100644
--- a/listers/core/v1/replicationcontroller_expansion.go
+++ b/listers/core/v1/replicationcontroller_expansion.go
@@ -19,7 +19,7 @@ package v1
 import (
 	"fmt"
 
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/labels"
 )
 
diff --git a/listers/core/v1/resourcequota.go b/listers/core/v1/resourcequota.go
index d6f052f13..080df87ac 100644
--- a/listers/core/v1/resourcequota.go
+++ b/listers/core/v1/resourcequota.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ResourceQuotaClusterLister can list ResourceQuotas across all workspaces, or scope down to a ResourceQuotaLister for one workspace.
+// ResourceQuotaClusterLister helps list ResourceQuotas across all workspaces,
+// or scope down to a ResourceQuotaLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ResourceQuotaClusterLister interface {
 	// List lists all ResourceQuotas in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.ResourceQuota, err error)
 	// Cluster returns a lister that can list and get ResourceQuotas in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.ResourceQuotaLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.ResourceQuotaLister
 	ResourceQuotaClusterListerExpansion
 }
 
+// resourceQuotaClusterLister implements the ResourceQuotaClusterLister interface.
 type resourceQuotaClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.ResourceQuota]
 }
 
+var _ ResourceQuotaClusterLister = new(resourceQuotaClusterLister)
+
 // NewResourceQuotaClusterLister returns a new ResourceQuotaClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewResourceQuotaClusterLister(indexer cache.Indexer) *resourceQuotaClusterLister {
-	return &resourceQuotaClusterLister{indexer: indexer}
-}
-
-// List lists all ResourceQuotas in the indexer across all workspaces.
-func (s *resourceQuotaClusterLister) List(selector labels.Selector) (ret []*corev1.ResourceQuota, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.ResourceQuota))
-	})
-	return ret, err
+func NewResourceQuotaClusterLister(indexer cache.Indexer) ResourceQuotaClusterLister {
+	return &resourceQuotaClusterLister{
+		kcplisters.NewCluster[*corev1.ResourceQuota](indexer, corev1.Resource("resourcequota")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ResourceQuotas.
-func (s *resourceQuotaClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.ResourceQuotaLister {
-	return &resourceQuotaLister{indexer: s.indexer, clusterName: clusterName}
+func (l *resourceQuotaClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.ResourceQuotaLister {
+	return &resourceQuotaLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// resourceQuotaLister implements the corev1listers.ResourceQuotaLister interface.
+// resourceQuotaLister can list all ResourceQuotas inside a workspace
+// or scope down to a listerscorev1.ResourceQuotaNamespaceLister for one namespace.
 type resourceQuotaLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.ResourceQuota]
 }
 
-// List lists all ResourceQuotas in the indexer for a workspace.
-func (s *resourceQuotaLister) List(selector labels.Selector) (ret []*corev1.ResourceQuota, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.ResourceQuota))
-	})
-	return ret, err
-}
+var _ listerscorev1.ResourceQuotaLister = new(resourceQuotaLister)
 
 // ResourceQuotas returns an object that can list and get ResourceQuotas in one namespace.
-func (s *resourceQuotaLister) ResourceQuotas(namespace string) corev1listers.ResourceQuotaNamespaceLister {
-	return &resourceQuotaNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *resourceQuotaLister) ResourceQuotas(namespace string) listerscorev1.ResourceQuotaNamespaceLister {
+	return &resourceQuotaNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// resourceQuotaNamespaceLister implements the corev1listers.ResourceQuotaNamespaceLister interface.
+// resourceQuotaNamespaceLister implements the listerscorev1.ResourceQuotaNamespaceLister
+// interface.
 type resourceQuotaNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*corev1.ResourceQuota]
 }
 
-// List lists all ResourceQuotas in the indexer for a given workspace and namespace.
-func (s *resourceQuotaNamespaceLister) List(selector labels.Selector) (ret []*corev1.ResourceQuota, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.ResourceQuota))
-	})
-	return ret, err
-}
+var _ listerscorev1.ResourceQuotaNamespaceLister = new(resourceQuotaNamespaceLister)
 
-// Get retrieves the ResourceQuota from the indexer for a given workspace, namespace and name.
-func (s *resourceQuotaNamespaceLister) Get(name string) (*corev1.ResourceQuota, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewResourceQuotaLister returns a new ResourceQuotaLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceQuotaLister(indexer cache.Indexer) listerscorev1.ResourceQuotaLister {
+	return &resourceQuotaLister{
+		kcplisters.New[*corev1.ResourceQuota](indexer, corev1.Resource("resourcequota")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("resourcequotas"), name)
+}
+
+// resourceQuotaScopedLister can list all ResourceQuotas inside a workspace
+// or scope down to a listerscorev1.ResourceQuotaNamespaceLister for one namespace.
+type resourceQuotaScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.ResourceQuota]
+}
+
+// ResourceQuotas returns an object that can list and get ResourceQuotas in one namespace.
+func (l *resourceQuotaScopedLister) ResourceQuotas(namespace string) listerscorev1.ResourceQuotaLister {
+	return &resourceQuotaLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*corev1.ResourceQuota), nil
 }
diff --git a/listers/core/v1/resourcequota_expansion.go b/listers/core/v1/resourcequota_expansion.go
index a7d6eaed9..98776b0ff 100644
--- a/listers/core/v1/resourcequota_expansion.go
+++ b/listers/core/v1/resourcequota_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/secret.go b/listers/core/v1/secret.go
index e3c68bd9f..e8eedd5dc 100644
--- a/listers/core/v1/secret.go
+++ b/listers/core/v1/secret.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// SecretClusterLister can list Secrets across all workspaces, or scope down to a SecretLister for one workspace.
+// SecretClusterLister helps list Secrets across all workspaces,
+// or scope down to a SecretLister for one workspace.
 // All objects returned here must be treated as read-only.
 type SecretClusterLister interface {
 	// List lists all Secrets in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.Secret, err error)
 	// Cluster returns a lister that can list and get Secrets in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.SecretLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.SecretLister
 	SecretClusterListerExpansion
 }
 
+// secretClusterLister implements the SecretClusterLister interface.
 type secretClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.Secret]
 }
 
+var _ SecretClusterLister = new(secretClusterLister)
+
 // NewSecretClusterLister returns a new SecretClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewSecretClusterLister(indexer cache.Indexer) *secretClusterLister {
-	return &secretClusterLister{indexer: indexer}
-}
-
-// List lists all Secrets in the indexer across all workspaces.
-func (s *secretClusterLister) List(selector labels.Selector) (ret []*corev1.Secret, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.Secret))
-	})
-	return ret, err
+func NewSecretClusterLister(indexer cache.Indexer) SecretClusterLister {
+	return &secretClusterLister{
+		kcplisters.NewCluster[*corev1.Secret](indexer, corev1.Resource("secret")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Secrets.
-func (s *secretClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.SecretLister {
-	return &secretLister{indexer: s.indexer, clusterName: clusterName}
+func (l *secretClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.SecretLister {
+	return &secretLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// secretLister implements the corev1listers.SecretLister interface.
+// secretLister can list all Secrets inside a workspace
+// or scope down to a listerscorev1.SecretNamespaceLister for one namespace.
 type secretLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.Secret]
 }
 
-// List lists all Secrets in the indexer for a workspace.
-func (s *secretLister) List(selector labels.Selector) (ret []*corev1.Secret, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.Secret))
-	})
-	return ret, err
-}
+var _ listerscorev1.SecretLister = new(secretLister)
 
 // Secrets returns an object that can list and get Secrets in one namespace.
-func (s *secretLister) Secrets(namespace string) corev1listers.SecretNamespaceLister {
-	return &secretNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *secretLister) Secrets(namespace string) listerscorev1.SecretNamespaceLister {
+	return &secretNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// secretNamespaceLister implements the corev1listers.SecretNamespaceLister interface.
+// secretNamespaceLister implements the listerscorev1.SecretNamespaceLister
+// interface.
 type secretNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*corev1.Secret]
 }
 
-// List lists all Secrets in the indexer for a given workspace and namespace.
-func (s *secretNamespaceLister) List(selector labels.Selector) (ret []*corev1.Secret, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.Secret))
-	})
-	return ret, err
-}
+var _ listerscorev1.SecretNamespaceLister = new(secretNamespaceLister)
 
-// Get retrieves the Secret from the indexer for a given workspace, namespace and name.
-func (s *secretNamespaceLister) Get(name string) (*corev1.Secret, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewSecretLister returns a new SecretLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewSecretLister(indexer cache.Indexer) listerscorev1.SecretLister {
+	return &secretLister{
+		kcplisters.New[*corev1.Secret](indexer, corev1.Resource("secret")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("secrets"), name)
+}
+
+// secretScopedLister can list all Secrets inside a workspace
+// or scope down to a listerscorev1.SecretNamespaceLister for one namespace.
+type secretScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.Secret]
+}
+
+// Secrets returns an object that can list and get Secrets in one namespace.
+func (l *secretScopedLister) Secrets(namespace string) listerscorev1.SecretLister {
+	return &secretLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*corev1.Secret), nil
 }
diff --git a/listers/core/v1/secret_expansion.go b/listers/core/v1/secret_expansion.go
index 717fd920c..72bc44feb 100644
--- a/listers/core/v1/secret_expansion.go
+++ b/listers/core/v1/secret_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/service.go b/listers/core/v1/service.go
index 9501eb395..16d147b7f 100644
--- a/listers/core/v1/service.go
+++ b/listers/core/v1/service.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ServiceClusterLister can list Services across all workspaces, or scope down to a ServiceLister for one workspace.
+// ServiceClusterLister helps list Services across all workspaces,
+// or scope down to a ServiceLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ServiceClusterLister interface {
 	// List lists all Services in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.Service, err error)
 	// Cluster returns a lister that can list and get Services in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.ServiceLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.ServiceLister
 	ServiceClusterListerExpansion
 }
 
+// serviceClusterLister implements the ServiceClusterLister interface.
 type serviceClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.Service]
 }
 
+var _ ServiceClusterLister = new(serviceClusterLister)
+
 // NewServiceClusterLister returns a new ServiceClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewServiceClusterLister(indexer cache.Indexer) *serviceClusterLister {
-	return &serviceClusterLister{indexer: indexer}
-}
-
-// List lists all Services in the indexer across all workspaces.
-func (s *serviceClusterLister) List(selector labels.Selector) (ret []*corev1.Service, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.Service))
-	})
-	return ret, err
+func NewServiceClusterLister(indexer cache.Indexer) ServiceClusterLister {
+	return &serviceClusterLister{
+		kcplisters.NewCluster[*corev1.Service](indexer, corev1.Resource("service")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Services.
-func (s *serviceClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.ServiceLister {
-	return &serviceLister{indexer: s.indexer, clusterName: clusterName}
+func (l *serviceClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.ServiceLister {
+	return &serviceLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// serviceLister implements the corev1listers.ServiceLister interface.
+// serviceLister can list all Services inside a workspace
+// or scope down to a listerscorev1.ServiceNamespaceLister for one namespace.
 type serviceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.Service]
 }
 
-// List lists all Services in the indexer for a workspace.
-func (s *serviceLister) List(selector labels.Selector) (ret []*corev1.Service, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.Service))
-	})
-	return ret, err
-}
+var _ listerscorev1.ServiceLister = new(serviceLister)
 
 // Services returns an object that can list and get Services in one namespace.
-func (s *serviceLister) Services(namespace string) corev1listers.ServiceNamespaceLister {
-	return &serviceNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *serviceLister) Services(namespace string) listerscorev1.ServiceNamespaceLister {
+	return &serviceNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// serviceNamespaceLister implements the corev1listers.ServiceNamespaceLister interface.
+// serviceNamespaceLister implements the listerscorev1.ServiceNamespaceLister
+// interface.
 type serviceNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*corev1.Service]
 }
 
-// List lists all Services in the indexer for a given workspace and namespace.
-func (s *serviceNamespaceLister) List(selector labels.Selector) (ret []*corev1.Service, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.Service))
-	})
-	return ret, err
-}
+var _ listerscorev1.ServiceNamespaceLister = new(serviceNamespaceLister)
 
-// Get retrieves the Service from the indexer for a given workspace, namespace and name.
-func (s *serviceNamespaceLister) Get(name string) (*corev1.Service, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewServiceLister returns a new ServiceLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewServiceLister(indexer cache.Indexer) listerscorev1.ServiceLister {
+	return &serviceLister{
+		kcplisters.New[*corev1.Service](indexer, corev1.Resource("service")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("services"), name)
+}
+
+// serviceScopedLister can list all Services inside a workspace
+// or scope down to a listerscorev1.ServiceNamespaceLister for one namespace.
+type serviceScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.Service]
+}
+
+// Services returns an object that can list and get Services in one namespace.
+func (l *serviceScopedLister) Services(namespace string) listerscorev1.ServiceLister {
+	return &serviceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*corev1.Service), nil
 }
diff --git a/listers/core/v1/service_expansion.go b/listers/core/v1/service_expansion.go
index c9c2c3af3..c812d5019 100644
--- a/listers/core/v1/service_expansion.go
+++ b/listers/core/v1/service_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/core/v1/serviceaccount.go b/listers/core/v1/serviceaccount.go
index 7f756fa4b..7726974d9 100644
--- a/listers/core/v1/serviceaccount.go
+++ b/listers/core/v1/serviceaccount.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	corev1listers "k8s.io/client-go/listers/core/v1"
+	listerscorev1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ServiceAccountClusterLister can list ServiceAccounts across all workspaces, or scope down to a ServiceAccountLister for one workspace.
+// ServiceAccountClusterLister helps list ServiceAccounts across all workspaces,
+// or scope down to a ServiceAccountLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ServiceAccountClusterLister interface {
 	// List lists all ServiceAccounts in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*corev1.ServiceAccount, err error)
 	// Cluster returns a lister that can list and get ServiceAccounts in one workspace.
-	Cluster(clusterName logicalcluster.Name) corev1listers.ServiceAccountLister
+	Cluster(clusterName logicalcluster.Name) listerscorev1.ServiceAccountLister
 	ServiceAccountClusterListerExpansion
 }
 
+// serviceAccountClusterLister implements the ServiceAccountClusterLister interface.
 type serviceAccountClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*corev1.ServiceAccount]
 }
 
+var _ ServiceAccountClusterLister = new(serviceAccountClusterLister)
+
 // NewServiceAccountClusterLister returns a new ServiceAccountClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewServiceAccountClusterLister(indexer cache.Indexer) *serviceAccountClusterLister {
-	return &serviceAccountClusterLister{indexer: indexer}
-}
-
-// List lists all ServiceAccounts in the indexer across all workspaces.
-func (s *serviceAccountClusterLister) List(selector labels.Selector) (ret []*corev1.ServiceAccount, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*corev1.ServiceAccount))
-	})
-	return ret, err
+func NewServiceAccountClusterLister(indexer cache.Indexer) ServiceAccountClusterLister {
+	return &serviceAccountClusterLister{
+		kcplisters.NewCluster[*corev1.ServiceAccount](indexer, corev1.Resource("serviceaccount")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ServiceAccounts.
-func (s *serviceAccountClusterLister) Cluster(clusterName logicalcluster.Name) corev1listers.ServiceAccountLister {
-	return &serviceAccountLister{indexer: s.indexer, clusterName: clusterName}
+func (l *serviceAccountClusterLister) Cluster(clusterName logicalcluster.Name) listerscorev1.ServiceAccountLister {
+	return &serviceAccountLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// serviceAccountLister implements the corev1listers.ServiceAccountLister interface.
+// serviceAccountLister can list all ServiceAccounts inside a workspace
+// or scope down to a listerscorev1.ServiceAccountNamespaceLister for one namespace.
 type serviceAccountLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*corev1.ServiceAccount]
 }
 
-// List lists all ServiceAccounts in the indexer for a workspace.
-func (s *serviceAccountLister) List(selector labels.Selector) (ret []*corev1.ServiceAccount, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.ServiceAccount))
-	})
-	return ret, err
-}
+var _ listerscorev1.ServiceAccountLister = new(serviceAccountLister)
 
 // ServiceAccounts returns an object that can list and get ServiceAccounts in one namespace.
-func (s *serviceAccountLister) ServiceAccounts(namespace string) corev1listers.ServiceAccountNamespaceLister {
-	return &serviceAccountNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *serviceAccountLister) ServiceAccounts(namespace string) listerscorev1.ServiceAccountNamespaceLister {
+	return &serviceAccountNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// serviceAccountNamespaceLister implements the corev1listers.ServiceAccountNamespaceLister interface.
+// serviceAccountNamespaceLister implements the listerscorev1.ServiceAccountNamespaceLister
+// interface.
 type serviceAccountNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*corev1.ServiceAccount]
 }
 
-// List lists all ServiceAccounts in the indexer for a given workspace and namespace.
-func (s *serviceAccountNamespaceLister) List(selector labels.Selector) (ret []*corev1.ServiceAccount, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*corev1.ServiceAccount))
-	})
-	return ret, err
-}
+var _ listerscorev1.ServiceAccountNamespaceLister = new(serviceAccountNamespaceLister)
 
-// Get retrieves the ServiceAccount from the indexer for a given workspace, namespace and name.
-func (s *serviceAccountNamespaceLister) Get(name string) (*corev1.ServiceAccount, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewServiceAccountLister returns a new ServiceAccountLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewServiceAccountLister(indexer cache.Indexer) listerscorev1.ServiceAccountLister {
+	return &serviceAccountLister{
+		kcplisters.New[*corev1.ServiceAccount](indexer, corev1.Resource("serviceaccount")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(corev1.Resource("serviceaccounts"), name)
+}
+
+// serviceAccountScopedLister can list all ServiceAccounts inside a workspace
+// or scope down to a listerscorev1.ServiceAccountNamespaceLister for one namespace.
+type serviceAccountScopedLister struct {
+	kcplisters.ResourceIndexer[*corev1.ServiceAccount]
+}
+
+// ServiceAccounts returns an object that can list and get ServiceAccounts in one namespace.
+func (l *serviceAccountScopedLister) ServiceAccounts(namespace string) listerscorev1.ServiceAccountLister {
+	return &serviceAccountLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*corev1.ServiceAccount), nil
 }
diff --git a/listers/core/v1/serviceaccount_expansion.go b/listers/core/v1/serviceaccount_expansion.go
index 4d4047a51..f8042e1b5 100644
--- a/listers/core/v1/serviceaccount_expansion.go
+++ b/listers/core/v1/serviceaccount_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/discovery/v1/endpointslice.go b/listers/discovery/v1/endpointslice.go
index 3de90b165..754968ef6 100644
--- a/listers/discovery/v1/endpointslice.go
+++ b/listers/discovery/v1/endpointslice.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	discoveryv1 "k8s.io/api/discovery/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	discoveryv1listers "k8s.io/client-go/listers/discovery/v1"
+	listersdiscoveryv1 "k8s.io/client-go/listers/discovery/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// EndpointSliceClusterLister can list EndpointSlices across all workspaces, or scope down to a EndpointSliceLister for one workspace.
+// EndpointSliceClusterLister helps list EndpointSlices across all workspaces,
+// or scope down to a EndpointSliceLister for one workspace.
 // All objects returned here must be treated as read-only.
 type EndpointSliceClusterLister interface {
 	// List lists all EndpointSlices in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*discoveryv1.EndpointSlice, err error)
 	// Cluster returns a lister that can list and get EndpointSlices in one workspace.
-	Cluster(clusterName logicalcluster.Name) discoveryv1listers.EndpointSliceLister
+	Cluster(clusterName logicalcluster.Name) listersdiscoveryv1.EndpointSliceLister
 	EndpointSliceClusterListerExpansion
 }
 
+// endpointSliceClusterLister implements the EndpointSliceClusterLister interface.
 type endpointSliceClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*discoveryv1.EndpointSlice]
 }
 
+var _ EndpointSliceClusterLister = new(endpointSliceClusterLister)
+
 // NewEndpointSliceClusterLister returns a new EndpointSliceClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewEndpointSliceClusterLister(indexer cache.Indexer) *endpointSliceClusterLister {
-	return &endpointSliceClusterLister{indexer: indexer}
-}
-
-// List lists all EndpointSlices in the indexer across all workspaces.
-func (s *endpointSliceClusterLister) List(selector labels.Selector) (ret []*discoveryv1.EndpointSlice, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*discoveryv1.EndpointSlice))
-	})
-	return ret, err
+func NewEndpointSliceClusterLister(indexer cache.Indexer) EndpointSliceClusterLister {
+	return &endpointSliceClusterLister{
+		kcplisters.NewCluster[*discoveryv1.EndpointSlice](indexer, discoveryv1.Resource("endpointslice")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get EndpointSlices.
-func (s *endpointSliceClusterLister) Cluster(clusterName logicalcluster.Name) discoveryv1listers.EndpointSliceLister {
-	return &endpointSliceLister{indexer: s.indexer, clusterName: clusterName}
+func (l *endpointSliceClusterLister) Cluster(clusterName logicalcluster.Name) listersdiscoveryv1.EndpointSliceLister {
+	return &endpointSliceLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// endpointSliceLister implements the discoveryv1listers.EndpointSliceLister interface.
+// endpointSliceLister can list all EndpointSlices inside a workspace
+// or scope down to a listersdiscoveryv1.EndpointSliceNamespaceLister for one namespace.
 type endpointSliceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*discoveryv1.EndpointSlice]
 }
 
-// List lists all EndpointSlices in the indexer for a workspace.
-func (s *endpointSliceLister) List(selector labels.Selector) (ret []*discoveryv1.EndpointSlice, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*discoveryv1.EndpointSlice))
-	})
-	return ret, err
-}
+var _ listersdiscoveryv1.EndpointSliceLister = new(endpointSliceLister)
 
 // EndpointSlices returns an object that can list and get EndpointSlices in one namespace.
-func (s *endpointSliceLister) EndpointSlices(namespace string) discoveryv1listers.EndpointSliceNamespaceLister {
-	return &endpointSliceNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *endpointSliceLister) EndpointSlices(namespace string) listersdiscoveryv1.EndpointSliceNamespaceLister {
+	return &endpointSliceNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// endpointSliceNamespaceLister implements the discoveryv1listers.EndpointSliceNamespaceLister interface.
+// endpointSliceNamespaceLister implements the listersdiscoveryv1.EndpointSliceNamespaceLister
+// interface.
 type endpointSliceNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*discoveryv1.EndpointSlice]
 }
 
-// List lists all EndpointSlices in the indexer for a given workspace and namespace.
-func (s *endpointSliceNamespaceLister) List(selector labels.Selector) (ret []*discoveryv1.EndpointSlice, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*discoveryv1.EndpointSlice))
-	})
-	return ret, err
-}
+var _ listersdiscoveryv1.EndpointSliceNamespaceLister = new(endpointSliceNamespaceLister)
 
-// Get retrieves the EndpointSlice from the indexer for a given workspace, namespace and name.
-func (s *endpointSliceNamespaceLister) Get(name string) (*discoveryv1.EndpointSlice, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewEndpointSliceLister returns a new EndpointSliceLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewEndpointSliceLister(indexer cache.Indexer) listersdiscoveryv1.EndpointSliceLister {
+	return &endpointSliceLister{
+		kcplisters.New[*discoveryv1.EndpointSlice](indexer, discoveryv1.Resource("endpointslice")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(discoveryv1.Resource("endpointslices"), name)
+}
+
+// endpointSliceScopedLister can list all EndpointSlices inside a workspace
+// or scope down to a listersdiscoveryv1.EndpointSliceNamespaceLister for one namespace.
+type endpointSliceScopedLister struct {
+	kcplisters.ResourceIndexer[*discoveryv1.EndpointSlice]
+}
+
+// EndpointSlices returns an object that can list and get EndpointSlices in one namespace.
+func (l *endpointSliceScopedLister) EndpointSlices(namespace string) listersdiscoveryv1.EndpointSliceLister {
+	return &endpointSliceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*discoveryv1.EndpointSlice), nil
 }
diff --git a/listers/discovery/v1/endpointslice_expansion.go b/listers/discovery/v1/endpointslice_expansion.go
index 35e480934..298e5f701 100644
--- a/listers/discovery/v1/endpointslice_expansion.go
+++ b/listers/discovery/v1/endpointslice_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/discovery/v1/expansion_generated.go b/listers/discovery/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/discovery/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/discovery/v1beta1/endpointslice.go b/listers/discovery/v1beta1/endpointslice.go
index 2fc8aa68e..8b6cd4d78 100644
--- a/listers/discovery/v1beta1/endpointslice.go
+++ b/listers/discovery/v1beta1/endpointslice.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	discoveryv1beta1 "k8s.io/api/discovery/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	discoveryv1beta1listers "k8s.io/client-go/listers/discovery/v1beta1"
+	listersdiscoveryv1beta1 "k8s.io/client-go/listers/discovery/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// EndpointSliceClusterLister can list EndpointSlices across all workspaces, or scope down to a EndpointSliceLister for one workspace.
+// EndpointSliceClusterLister helps list EndpointSlices across all workspaces,
+// or scope down to a EndpointSliceLister for one workspace.
 // All objects returned here must be treated as read-only.
 type EndpointSliceClusterLister interface {
 	// List lists all EndpointSlices in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*discoveryv1beta1.EndpointSlice, err error)
 	// Cluster returns a lister that can list and get EndpointSlices in one workspace.
-	Cluster(clusterName logicalcluster.Name) discoveryv1beta1listers.EndpointSliceLister
+	Cluster(clusterName logicalcluster.Name) listersdiscoveryv1beta1.EndpointSliceLister
 	EndpointSliceClusterListerExpansion
 }
 
+// endpointSliceClusterLister implements the EndpointSliceClusterLister interface.
 type endpointSliceClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*discoveryv1beta1.EndpointSlice]
 }
 
+var _ EndpointSliceClusterLister = new(endpointSliceClusterLister)
+
 // NewEndpointSliceClusterLister returns a new EndpointSliceClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewEndpointSliceClusterLister(indexer cache.Indexer) *endpointSliceClusterLister {
-	return &endpointSliceClusterLister{indexer: indexer}
-}
-
-// List lists all EndpointSlices in the indexer across all workspaces.
-func (s *endpointSliceClusterLister) List(selector labels.Selector) (ret []*discoveryv1beta1.EndpointSlice, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*discoveryv1beta1.EndpointSlice))
-	})
-	return ret, err
+func NewEndpointSliceClusterLister(indexer cache.Indexer) EndpointSliceClusterLister {
+	return &endpointSliceClusterLister{
+		kcplisters.NewCluster[*discoveryv1beta1.EndpointSlice](indexer, discoveryv1beta1.Resource("endpointslice")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get EndpointSlices.
-func (s *endpointSliceClusterLister) Cluster(clusterName logicalcluster.Name) discoveryv1beta1listers.EndpointSliceLister {
-	return &endpointSliceLister{indexer: s.indexer, clusterName: clusterName}
+func (l *endpointSliceClusterLister) Cluster(clusterName logicalcluster.Name) listersdiscoveryv1beta1.EndpointSliceLister {
+	return &endpointSliceLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// endpointSliceLister implements the discoveryv1beta1listers.EndpointSliceLister interface.
+// endpointSliceLister can list all EndpointSlices inside a workspace
+// or scope down to a listersdiscoveryv1beta1.EndpointSliceNamespaceLister for one namespace.
 type endpointSliceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*discoveryv1beta1.EndpointSlice]
 }
 
-// List lists all EndpointSlices in the indexer for a workspace.
-func (s *endpointSliceLister) List(selector labels.Selector) (ret []*discoveryv1beta1.EndpointSlice, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*discoveryv1beta1.EndpointSlice))
-	})
-	return ret, err
-}
+var _ listersdiscoveryv1beta1.EndpointSliceLister = new(endpointSliceLister)
 
 // EndpointSlices returns an object that can list and get EndpointSlices in one namespace.
-func (s *endpointSliceLister) EndpointSlices(namespace string) discoveryv1beta1listers.EndpointSliceNamespaceLister {
-	return &endpointSliceNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *endpointSliceLister) EndpointSlices(namespace string) listersdiscoveryv1beta1.EndpointSliceNamespaceLister {
+	return &endpointSliceNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// endpointSliceNamespaceLister implements the discoveryv1beta1listers.EndpointSliceNamespaceLister interface.
+// endpointSliceNamespaceLister implements the listersdiscoveryv1beta1.EndpointSliceNamespaceLister
+// interface.
 type endpointSliceNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*discoveryv1beta1.EndpointSlice]
 }
 
-// List lists all EndpointSlices in the indexer for a given workspace and namespace.
-func (s *endpointSliceNamespaceLister) List(selector labels.Selector) (ret []*discoveryv1beta1.EndpointSlice, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*discoveryv1beta1.EndpointSlice))
-	})
-	return ret, err
-}
+var _ listersdiscoveryv1beta1.EndpointSliceNamespaceLister = new(endpointSliceNamespaceLister)
 
-// Get retrieves the EndpointSlice from the indexer for a given workspace, namespace and name.
-func (s *endpointSliceNamespaceLister) Get(name string) (*discoveryv1beta1.EndpointSlice, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewEndpointSliceLister returns a new EndpointSliceLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewEndpointSliceLister(indexer cache.Indexer) listersdiscoveryv1beta1.EndpointSliceLister {
+	return &endpointSliceLister{
+		kcplisters.New[*discoveryv1beta1.EndpointSlice](indexer, discoveryv1beta1.Resource("endpointslice")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(discoveryv1beta1.Resource("endpointslices"), name)
+}
+
+// endpointSliceScopedLister can list all EndpointSlices inside a workspace
+// or scope down to a listersdiscoveryv1beta1.EndpointSliceNamespaceLister for one namespace.
+type endpointSliceScopedLister struct {
+	kcplisters.ResourceIndexer[*discoveryv1beta1.EndpointSlice]
+}
+
+// EndpointSlices returns an object that can list and get EndpointSlices in one namespace.
+func (l *endpointSliceScopedLister) EndpointSlices(namespace string) listersdiscoveryv1beta1.EndpointSliceLister {
+	return &endpointSliceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*discoveryv1beta1.EndpointSlice), nil
 }
diff --git a/listers/discovery/v1beta1/endpointslice_expansion.go b/listers/discovery/v1beta1/endpointslice_expansion.go
index 8e5c10af3..8103228ee 100644
--- a/listers/discovery/v1beta1/endpointslice_expansion.go
+++ b/listers/discovery/v1beta1/endpointslice_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/discovery/v1beta1/expansion_generated.go b/listers/discovery/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/discovery/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/events/v1/event.go b/listers/events/v1/event.go
index 4ad18c270..bf06c32c8 100644
--- a/listers/events/v1/event.go
+++ b/listers/events/v1/event.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	eventsv1 "k8s.io/api/events/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	eventsv1listers "k8s.io/client-go/listers/events/v1"
+	listerseventsv1 "k8s.io/client-go/listers/events/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// EventClusterLister can list Events across all workspaces, or scope down to a EventLister for one workspace.
+// EventClusterLister helps list Events across all workspaces,
+// or scope down to a EventLister for one workspace.
 // All objects returned here must be treated as read-only.
 type EventClusterLister interface {
 	// List lists all Events in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*eventsv1.Event, err error)
 	// Cluster returns a lister that can list and get Events in one workspace.
-	Cluster(clusterName logicalcluster.Name) eventsv1listers.EventLister
+	Cluster(clusterName logicalcluster.Name) listerseventsv1.EventLister
 	EventClusterListerExpansion
 }
 
+// eventClusterLister implements the EventClusterLister interface.
 type eventClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*eventsv1.Event]
 }
 
+var _ EventClusterLister = new(eventClusterLister)
+
 // NewEventClusterLister returns a new EventClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewEventClusterLister(indexer cache.Indexer) *eventClusterLister {
-	return &eventClusterLister{indexer: indexer}
-}
-
-// List lists all Events in the indexer across all workspaces.
-func (s *eventClusterLister) List(selector labels.Selector) (ret []*eventsv1.Event, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*eventsv1.Event))
-	})
-	return ret, err
+func NewEventClusterLister(indexer cache.Indexer) EventClusterLister {
+	return &eventClusterLister{
+		kcplisters.NewCluster[*eventsv1.Event](indexer, eventsv1.Resource("event")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Events.
-func (s *eventClusterLister) Cluster(clusterName logicalcluster.Name) eventsv1listers.EventLister {
-	return &eventLister{indexer: s.indexer, clusterName: clusterName}
+func (l *eventClusterLister) Cluster(clusterName logicalcluster.Name) listerseventsv1.EventLister {
+	return &eventLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// eventLister implements the eventsv1listers.EventLister interface.
+// eventLister can list all Events inside a workspace
+// or scope down to a listerseventsv1.EventNamespaceLister for one namespace.
 type eventLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*eventsv1.Event]
 }
 
-// List lists all Events in the indexer for a workspace.
-func (s *eventLister) List(selector labels.Selector) (ret []*eventsv1.Event, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*eventsv1.Event))
-	})
-	return ret, err
-}
+var _ listerseventsv1.EventLister = new(eventLister)
 
 // Events returns an object that can list and get Events in one namespace.
-func (s *eventLister) Events(namespace string) eventsv1listers.EventNamespaceLister {
-	return &eventNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *eventLister) Events(namespace string) listerseventsv1.EventNamespaceLister {
+	return &eventNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// eventNamespaceLister implements the eventsv1listers.EventNamespaceLister interface.
+// eventNamespaceLister implements the listerseventsv1.EventNamespaceLister
+// interface.
 type eventNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*eventsv1.Event]
 }
 
-// List lists all Events in the indexer for a given workspace and namespace.
-func (s *eventNamespaceLister) List(selector labels.Selector) (ret []*eventsv1.Event, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*eventsv1.Event))
-	})
-	return ret, err
-}
+var _ listerseventsv1.EventNamespaceLister = new(eventNamespaceLister)
 
-// Get retrieves the Event from the indexer for a given workspace, namespace and name.
-func (s *eventNamespaceLister) Get(name string) (*eventsv1.Event, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewEventLister returns a new EventLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewEventLister(indexer cache.Indexer) listerseventsv1.EventLister {
+	return &eventLister{
+		kcplisters.New[*eventsv1.Event](indexer, eventsv1.Resource("event")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(eventsv1.Resource("events"), name)
+}
+
+// eventScopedLister can list all Events inside a workspace
+// or scope down to a listerseventsv1.EventNamespaceLister for one namespace.
+type eventScopedLister struct {
+	kcplisters.ResourceIndexer[*eventsv1.Event]
+}
+
+// Events returns an object that can list and get Events in one namespace.
+func (l *eventScopedLister) Events(namespace string) listerseventsv1.EventLister {
+	return &eventLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*eventsv1.Event), nil
 }
diff --git a/listers/events/v1/event_expansion.go b/listers/events/v1/event_expansion.go
index bdb79e6ed..d43a29751 100644
--- a/listers/events/v1/event_expansion.go
+++ b/listers/events/v1/event_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/events/v1/expansion_generated.go b/listers/events/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/events/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/events/v1beta1/event.go b/listers/events/v1beta1/event.go
index 5cf506333..5f9261452 100644
--- a/listers/events/v1beta1/event.go
+++ b/listers/events/v1beta1/event.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	eventsv1beta1 "k8s.io/api/events/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	eventsv1beta1listers "k8s.io/client-go/listers/events/v1beta1"
+	listerseventsv1beta1 "k8s.io/client-go/listers/events/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// EventClusterLister can list Events across all workspaces, or scope down to a EventLister for one workspace.
+// EventClusterLister helps list Events across all workspaces,
+// or scope down to a EventLister for one workspace.
 // All objects returned here must be treated as read-only.
 type EventClusterLister interface {
 	// List lists all Events in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*eventsv1beta1.Event, err error)
 	// Cluster returns a lister that can list and get Events in one workspace.
-	Cluster(clusterName logicalcluster.Name) eventsv1beta1listers.EventLister
+	Cluster(clusterName logicalcluster.Name) listerseventsv1beta1.EventLister
 	EventClusterListerExpansion
 }
 
+// eventClusterLister implements the EventClusterLister interface.
 type eventClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*eventsv1beta1.Event]
 }
 
+var _ EventClusterLister = new(eventClusterLister)
+
 // NewEventClusterLister returns a new EventClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewEventClusterLister(indexer cache.Indexer) *eventClusterLister {
-	return &eventClusterLister{indexer: indexer}
-}
-
-// List lists all Events in the indexer across all workspaces.
-func (s *eventClusterLister) List(selector labels.Selector) (ret []*eventsv1beta1.Event, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*eventsv1beta1.Event))
-	})
-	return ret, err
+func NewEventClusterLister(indexer cache.Indexer) EventClusterLister {
+	return &eventClusterLister{
+		kcplisters.NewCluster[*eventsv1beta1.Event](indexer, eventsv1beta1.Resource("event")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Events.
-func (s *eventClusterLister) Cluster(clusterName logicalcluster.Name) eventsv1beta1listers.EventLister {
-	return &eventLister{indexer: s.indexer, clusterName: clusterName}
+func (l *eventClusterLister) Cluster(clusterName logicalcluster.Name) listerseventsv1beta1.EventLister {
+	return &eventLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// eventLister implements the eventsv1beta1listers.EventLister interface.
+// eventLister can list all Events inside a workspace
+// or scope down to a listerseventsv1beta1.EventNamespaceLister for one namespace.
 type eventLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*eventsv1beta1.Event]
 }
 
-// List lists all Events in the indexer for a workspace.
-func (s *eventLister) List(selector labels.Selector) (ret []*eventsv1beta1.Event, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*eventsv1beta1.Event))
-	})
-	return ret, err
-}
+var _ listerseventsv1beta1.EventLister = new(eventLister)
 
 // Events returns an object that can list and get Events in one namespace.
-func (s *eventLister) Events(namespace string) eventsv1beta1listers.EventNamespaceLister {
-	return &eventNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *eventLister) Events(namespace string) listerseventsv1beta1.EventNamespaceLister {
+	return &eventNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// eventNamespaceLister implements the eventsv1beta1listers.EventNamespaceLister interface.
+// eventNamespaceLister implements the listerseventsv1beta1.EventNamespaceLister
+// interface.
 type eventNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*eventsv1beta1.Event]
 }
 
-// List lists all Events in the indexer for a given workspace and namespace.
-func (s *eventNamespaceLister) List(selector labels.Selector) (ret []*eventsv1beta1.Event, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*eventsv1beta1.Event))
-	})
-	return ret, err
-}
+var _ listerseventsv1beta1.EventNamespaceLister = new(eventNamespaceLister)
 
-// Get retrieves the Event from the indexer for a given workspace, namespace and name.
-func (s *eventNamespaceLister) Get(name string) (*eventsv1beta1.Event, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewEventLister returns a new EventLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewEventLister(indexer cache.Indexer) listerseventsv1beta1.EventLister {
+	return &eventLister{
+		kcplisters.New[*eventsv1beta1.Event](indexer, eventsv1beta1.Resource("event")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(eventsv1beta1.Resource("events"), name)
+}
+
+// eventScopedLister can list all Events inside a workspace
+// or scope down to a listerseventsv1beta1.EventNamespaceLister for one namespace.
+type eventScopedLister struct {
+	kcplisters.ResourceIndexer[*eventsv1beta1.Event]
+}
+
+// Events returns an object that can list and get Events in one namespace.
+func (l *eventScopedLister) Events(namespace string) listerseventsv1beta1.EventLister {
+	return &eventLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*eventsv1beta1.Event), nil
 }
diff --git a/listers/events/v1beta1/event_expansion.go b/listers/events/v1beta1/event_expansion.go
index c9901ed25..c1472469a 100644
--- a/listers/events/v1beta1/event_expansion.go
+++ b/listers/events/v1beta1/event_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/events/v1beta1/expansion_generated.go b/listers/events/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/events/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/extensions/v1beta1/daemonset.go b/listers/extensions/v1beta1/daemonset.go
index e890c2bc9..d2633539f 100644
--- a/listers/extensions/v1beta1/daemonset.go
+++ b/listers/extensions/v1beta1/daemonset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	extensionsv1beta1listers "k8s.io/client-go/listers/extensions/v1beta1"
+	listersextensionsv1beta1 "k8s.io/client-go/listers/extensions/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// DaemonSetClusterLister can list DaemonSets across all workspaces, or scope down to a DaemonSetLister for one workspace.
+// DaemonSetClusterLister helps list DaemonSets across all workspaces,
+// or scope down to a DaemonSetLister for one workspace.
 // All objects returned here must be treated as read-only.
 type DaemonSetClusterLister interface {
 	// List lists all DaemonSets in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*extensionsv1beta1.DaemonSet, err error)
 	// Cluster returns a lister that can list and get DaemonSets in one workspace.
-	Cluster(clusterName logicalcluster.Name) extensionsv1beta1listers.DaemonSetLister
+	Cluster(clusterName logicalcluster.Name) listersextensionsv1beta1.DaemonSetLister
 	DaemonSetClusterListerExpansion
 }
 
+// daemonSetClusterLister implements the DaemonSetClusterLister interface.
 type daemonSetClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*extensionsv1beta1.DaemonSet]
 }
 
+var _ DaemonSetClusterLister = new(daemonSetClusterLister)
+
 // NewDaemonSetClusterLister returns a new DaemonSetClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewDaemonSetClusterLister(indexer cache.Indexer) *daemonSetClusterLister {
-	return &daemonSetClusterLister{indexer: indexer}
-}
-
-// List lists all DaemonSets in the indexer across all workspaces.
-func (s *daemonSetClusterLister) List(selector labels.Selector) (ret []*extensionsv1beta1.DaemonSet, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*extensionsv1beta1.DaemonSet))
-	})
-	return ret, err
+func NewDaemonSetClusterLister(indexer cache.Indexer) DaemonSetClusterLister {
+	return &daemonSetClusterLister{
+		kcplisters.NewCluster[*extensionsv1beta1.DaemonSet](indexer, extensionsv1beta1.Resource("daemonset")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get DaemonSets.
-func (s *daemonSetClusterLister) Cluster(clusterName logicalcluster.Name) extensionsv1beta1listers.DaemonSetLister {
-	return &daemonSetLister{indexer: s.indexer, clusterName: clusterName}
+func (l *daemonSetClusterLister) Cluster(clusterName logicalcluster.Name) listersextensionsv1beta1.DaemonSetLister {
+	return &daemonSetLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// daemonSetLister implements the extensionsv1beta1listers.DaemonSetLister interface.
+// daemonSetLister can list all DaemonSets inside a workspace
+// or scope down to a listersextensionsv1beta1.DaemonSetNamespaceLister for one namespace.
 type daemonSetLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*extensionsv1beta1.DaemonSet]
 }
 
-// List lists all DaemonSets in the indexer for a workspace.
-func (s *daemonSetLister) List(selector labels.Selector) (ret []*extensionsv1beta1.DaemonSet, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*extensionsv1beta1.DaemonSet))
-	})
-	return ret, err
-}
+var _ listersextensionsv1beta1.DaemonSetLister = new(daemonSetLister)
 
 // DaemonSets returns an object that can list and get DaemonSets in one namespace.
-func (s *daemonSetLister) DaemonSets(namespace string) extensionsv1beta1listers.DaemonSetNamespaceLister {
-	return &daemonSetNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *daemonSetLister) DaemonSets(namespace string) listersextensionsv1beta1.DaemonSetNamespaceLister {
+	return &daemonSetNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// daemonSetNamespaceLister implements the extensionsv1beta1listers.DaemonSetNamespaceLister interface.
+// daemonSetNamespaceLister implements the listersextensionsv1beta1.DaemonSetNamespaceLister
+// interface.
 type daemonSetNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*extensionsv1beta1.DaemonSet]
 }
 
-// List lists all DaemonSets in the indexer for a given workspace and namespace.
-func (s *daemonSetNamespaceLister) List(selector labels.Selector) (ret []*extensionsv1beta1.DaemonSet, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*extensionsv1beta1.DaemonSet))
-	})
-	return ret, err
-}
+var _ listersextensionsv1beta1.DaemonSetNamespaceLister = new(daemonSetNamespaceLister)
 
-// Get retrieves the DaemonSet from the indexer for a given workspace, namespace and name.
-func (s *daemonSetNamespaceLister) Get(name string) (*extensionsv1beta1.DaemonSet, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewDaemonSetLister returns a new DaemonSetLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewDaemonSetLister(indexer cache.Indexer) listersextensionsv1beta1.DaemonSetLister {
+	return &daemonSetLister{
+		kcplisters.New[*extensionsv1beta1.DaemonSet](indexer, extensionsv1beta1.Resource("daemonset")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(extensionsv1beta1.Resource("daemonsets"), name)
+}
+
+// daemonSetScopedLister can list all DaemonSets inside a workspace
+// or scope down to a listersextensionsv1beta1.DaemonSetNamespaceLister for one namespace.
+type daemonSetScopedLister struct {
+	kcplisters.ResourceIndexer[*extensionsv1beta1.DaemonSet]
+}
+
+// DaemonSets returns an object that can list and get DaemonSets in one namespace.
+func (l *daemonSetScopedLister) DaemonSets(namespace string) listersextensionsv1beta1.DaemonSetLister {
+	return &daemonSetLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*extensionsv1beta1.DaemonSet), nil
 }
diff --git a/listers/extensions/v1beta1/daemonset_expansion.go b/listers/extensions/v1beta1/daemonset_expansion.go
index 3b2a9e39f..7166f131d 100644
--- a/listers/extensions/v1beta1/daemonset_expansion.go
+++ b/listers/extensions/v1beta1/daemonset_expansion.go
@@ -20,7 +20,7 @@ import (
 	"fmt"
 
 	apps "k8s.io/api/apps/v1beta1"
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	"k8s.io/api/extensions/v1beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
diff --git a/listers/extensions/v1beta1/deployment.go b/listers/extensions/v1beta1/deployment.go
index 6ddf00e50..cd503b410 100644
--- a/listers/extensions/v1beta1/deployment.go
+++ b/listers/extensions/v1beta1/deployment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	extensionsv1beta1listers "k8s.io/client-go/listers/extensions/v1beta1"
+	listersextensionsv1beta1 "k8s.io/client-go/listers/extensions/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// DeploymentClusterLister can list Deployments across all workspaces, or scope down to a DeploymentLister for one workspace.
+// DeploymentClusterLister helps list Deployments across all workspaces,
+// or scope down to a DeploymentLister for one workspace.
 // All objects returned here must be treated as read-only.
 type DeploymentClusterLister interface {
 	// List lists all Deployments in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*extensionsv1beta1.Deployment, err error)
 	// Cluster returns a lister that can list and get Deployments in one workspace.
-	Cluster(clusterName logicalcluster.Name) extensionsv1beta1listers.DeploymentLister
+	Cluster(clusterName logicalcluster.Name) listersextensionsv1beta1.DeploymentLister
 	DeploymentClusterListerExpansion
 }
 
+// deploymentClusterLister implements the DeploymentClusterLister interface.
 type deploymentClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*extensionsv1beta1.Deployment]
 }
 
+var _ DeploymentClusterLister = new(deploymentClusterLister)
+
 // NewDeploymentClusterLister returns a new DeploymentClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewDeploymentClusterLister(indexer cache.Indexer) *deploymentClusterLister {
-	return &deploymentClusterLister{indexer: indexer}
-}
-
-// List lists all Deployments in the indexer across all workspaces.
-func (s *deploymentClusterLister) List(selector labels.Selector) (ret []*extensionsv1beta1.Deployment, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*extensionsv1beta1.Deployment))
-	})
-	return ret, err
+func NewDeploymentClusterLister(indexer cache.Indexer) DeploymentClusterLister {
+	return &deploymentClusterLister{
+		kcplisters.NewCluster[*extensionsv1beta1.Deployment](indexer, extensionsv1beta1.Resource("deployment")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Deployments.
-func (s *deploymentClusterLister) Cluster(clusterName logicalcluster.Name) extensionsv1beta1listers.DeploymentLister {
-	return &deploymentLister{indexer: s.indexer, clusterName: clusterName}
+func (l *deploymentClusterLister) Cluster(clusterName logicalcluster.Name) listersextensionsv1beta1.DeploymentLister {
+	return &deploymentLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// deploymentLister implements the extensionsv1beta1listers.DeploymentLister interface.
+// deploymentLister can list all Deployments inside a workspace
+// or scope down to a listersextensionsv1beta1.DeploymentNamespaceLister for one namespace.
 type deploymentLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*extensionsv1beta1.Deployment]
 }
 
-// List lists all Deployments in the indexer for a workspace.
-func (s *deploymentLister) List(selector labels.Selector) (ret []*extensionsv1beta1.Deployment, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*extensionsv1beta1.Deployment))
-	})
-	return ret, err
-}
+var _ listersextensionsv1beta1.DeploymentLister = new(deploymentLister)
 
 // Deployments returns an object that can list and get Deployments in one namespace.
-func (s *deploymentLister) Deployments(namespace string) extensionsv1beta1listers.DeploymentNamespaceLister {
-	return &deploymentNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *deploymentLister) Deployments(namespace string) listersextensionsv1beta1.DeploymentNamespaceLister {
+	return &deploymentNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// deploymentNamespaceLister implements the extensionsv1beta1listers.DeploymentNamespaceLister interface.
+// deploymentNamespaceLister implements the listersextensionsv1beta1.DeploymentNamespaceLister
+// interface.
 type deploymentNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*extensionsv1beta1.Deployment]
 }
 
-// List lists all Deployments in the indexer for a given workspace and namespace.
-func (s *deploymentNamespaceLister) List(selector labels.Selector) (ret []*extensionsv1beta1.Deployment, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*extensionsv1beta1.Deployment))
-	})
-	return ret, err
-}
+var _ listersextensionsv1beta1.DeploymentNamespaceLister = new(deploymentNamespaceLister)
 
-// Get retrieves the Deployment from the indexer for a given workspace, namespace and name.
-func (s *deploymentNamespaceLister) Get(name string) (*extensionsv1beta1.Deployment, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewDeploymentLister returns a new DeploymentLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewDeploymentLister(indexer cache.Indexer) listersextensionsv1beta1.DeploymentLister {
+	return &deploymentLister{
+		kcplisters.New[*extensionsv1beta1.Deployment](indexer, extensionsv1beta1.Resource("deployment")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(extensionsv1beta1.Resource("deployments"), name)
+}
+
+// deploymentScopedLister can list all Deployments inside a workspace
+// or scope down to a listersextensionsv1beta1.DeploymentNamespaceLister for one namespace.
+type deploymentScopedLister struct {
+	kcplisters.ResourceIndexer[*extensionsv1beta1.Deployment]
+}
+
+// Deployments returns an object that can list and get Deployments in one namespace.
+func (l *deploymentScopedLister) Deployments(namespace string) listersextensionsv1beta1.DeploymentLister {
+	return &deploymentLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*extensionsv1beta1.Deployment), nil
 }
diff --git a/listers/extensions/v1beta1/deployment_expansion.go b/listers/extensions/v1beta1/deployment_expansion.go
index 11a6cf51c..3c43c24f7 100644
--- a/listers/extensions/v1beta1/deployment_expansion.go
+++ b/listers/extensions/v1beta1/deployment_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/extensions/v1beta1/expansion_generated.go b/listers/extensions/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/extensions/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/extensions/v1beta1/ingress.go b/listers/extensions/v1beta1/ingress.go
index 708744223..2f659d6e1 100644
--- a/listers/extensions/v1beta1/ingress.go
+++ b/listers/extensions/v1beta1/ingress.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	extensionsv1beta1listers "k8s.io/client-go/listers/extensions/v1beta1"
+	listersextensionsv1beta1 "k8s.io/client-go/listers/extensions/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// IngressClusterLister can list Ingresses across all workspaces, or scope down to a IngressLister for one workspace.
+// IngressClusterLister helps list Ingresses across all workspaces,
+// or scope down to a IngressLister for one workspace.
 // All objects returned here must be treated as read-only.
 type IngressClusterLister interface {
 	// List lists all Ingresses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*extensionsv1beta1.Ingress, err error)
 	// Cluster returns a lister that can list and get Ingresses in one workspace.
-	Cluster(clusterName logicalcluster.Name) extensionsv1beta1listers.IngressLister
+	Cluster(clusterName logicalcluster.Name) listersextensionsv1beta1.IngressLister
 	IngressClusterListerExpansion
 }
 
+// ingressClusterLister implements the IngressClusterLister interface.
 type ingressClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*extensionsv1beta1.Ingress]
 }
 
+var _ IngressClusterLister = new(ingressClusterLister)
+
 // NewIngressClusterLister returns a new IngressClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewIngressClusterLister(indexer cache.Indexer) *ingressClusterLister {
-	return &ingressClusterLister{indexer: indexer}
-}
-
-// List lists all Ingresses in the indexer across all workspaces.
-func (s *ingressClusterLister) List(selector labels.Selector) (ret []*extensionsv1beta1.Ingress, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*extensionsv1beta1.Ingress))
-	})
-	return ret, err
+func NewIngressClusterLister(indexer cache.Indexer) IngressClusterLister {
+	return &ingressClusterLister{
+		kcplisters.NewCluster[*extensionsv1beta1.Ingress](indexer, extensionsv1beta1.Resource("ingress")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Ingresses.
-func (s *ingressClusterLister) Cluster(clusterName logicalcluster.Name) extensionsv1beta1listers.IngressLister {
-	return &ingressLister{indexer: s.indexer, clusterName: clusterName}
+func (l *ingressClusterLister) Cluster(clusterName logicalcluster.Name) listersextensionsv1beta1.IngressLister {
+	return &ingressLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// ingressLister implements the extensionsv1beta1listers.IngressLister interface.
+// ingressLister can list all Ingresses inside a workspace
+// or scope down to a listersextensionsv1beta1.IngressNamespaceLister for one namespace.
 type ingressLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*extensionsv1beta1.Ingress]
 }
 
-// List lists all Ingresses in the indexer for a workspace.
-func (s *ingressLister) List(selector labels.Selector) (ret []*extensionsv1beta1.Ingress, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*extensionsv1beta1.Ingress))
-	})
-	return ret, err
-}
+var _ listersextensionsv1beta1.IngressLister = new(ingressLister)
 
 // Ingresses returns an object that can list and get Ingresses in one namespace.
-func (s *ingressLister) Ingresses(namespace string) extensionsv1beta1listers.IngressNamespaceLister {
-	return &ingressNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *ingressLister) Ingresses(namespace string) listersextensionsv1beta1.IngressNamespaceLister {
+	return &ingressNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// ingressNamespaceLister implements the extensionsv1beta1listers.IngressNamespaceLister interface.
+// ingressNamespaceLister implements the listersextensionsv1beta1.IngressNamespaceLister
+// interface.
 type ingressNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*extensionsv1beta1.Ingress]
 }
 
-// List lists all Ingresses in the indexer for a given workspace and namespace.
-func (s *ingressNamespaceLister) List(selector labels.Selector) (ret []*extensionsv1beta1.Ingress, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*extensionsv1beta1.Ingress))
-	})
-	return ret, err
-}
+var _ listersextensionsv1beta1.IngressNamespaceLister = new(ingressNamespaceLister)
 
-// Get retrieves the Ingress from the indexer for a given workspace, namespace and name.
-func (s *ingressNamespaceLister) Get(name string) (*extensionsv1beta1.Ingress, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewIngressLister returns a new IngressLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewIngressLister(indexer cache.Indexer) listersextensionsv1beta1.IngressLister {
+	return &ingressLister{
+		kcplisters.New[*extensionsv1beta1.Ingress](indexer, extensionsv1beta1.Resource("ingress")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(extensionsv1beta1.Resource("ingresses"), name)
+}
+
+// ingressScopedLister can list all Ingresses inside a workspace
+// or scope down to a listersextensionsv1beta1.IngressNamespaceLister for one namespace.
+type ingressScopedLister struct {
+	kcplisters.ResourceIndexer[*extensionsv1beta1.Ingress]
+}
+
+// Ingresses returns an object that can list and get Ingresses in one namespace.
+func (l *ingressScopedLister) Ingresses(namespace string) listersextensionsv1beta1.IngressLister {
+	return &ingressLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*extensionsv1beta1.Ingress), nil
 }
diff --git a/listers/extensions/v1beta1/ingress_expansion.go b/listers/extensions/v1beta1/ingress_expansion.go
index 4f130cdf8..d81ed6bcc 100644
--- a/listers/extensions/v1beta1/ingress_expansion.go
+++ b/listers/extensions/v1beta1/ingress_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/extensions/v1beta1/networkpolicy.go b/listers/extensions/v1beta1/networkpolicy.go
index 26b0a45b5..fb8cb8888 100644
--- a/listers/extensions/v1beta1/networkpolicy.go
+++ b/listers/extensions/v1beta1/networkpolicy.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	extensionsv1beta1listers "k8s.io/client-go/listers/extensions/v1beta1"
+	listersextensionsv1beta1 "k8s.io/client-go/listers/extensions/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// NetworkPolicyClusterLister can list NetworkPolicies across all workspaces, or scope down to a NetworkPolicyLister for one workspace.
+// NetworkPolicyClusterLister helps list NetworkPolicies across all workspaces,
+// or scope down to a NetworkPolicyLister for one workspace.
 // All objects returned here must be treated as read-only.
 type NetworkPolicyClusterLister interface {
 	// List lists all NetworkPolicies in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*extensionsv1beta1.NetworkPolicy, err error)
 	// Cluster returns a lister that can list and get NetworkPolicies in one workspace.
-	Cluster(clusterName logicalcluster.Name) extensionsv1beta1listers.NetworkPolicyLister
+	Cluster(clusterName logicalcluster.Name) listersextensionsv1beta1.NetworkPolicyLister
 	NetworkPolicyClusterListerExpansion
 }
 
+// networkPolicyClusterLister implements the NetworkPolicyClusterLister interface.
 type networkPolicyClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*extensionsv1beta1.NetworkPolicy]
 }
 
+var _ NetworkPolicyClusterLister = new(networkPolicyClusterLister)
+
 // NewNetworkPolicyClusterLister returns a new NetworkPolicyClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewNetworkPolicyClusterLister(indexer cache.Indexer) *networkPolicyClusterLister {
-	return &networkPolicyClusterLister{indexer: indexer}
-}
-
-// List lists all NetworkPolicies in the indexer across all workspaces.
-func (s *networkPolicyClusterLister) List(selector labels.Selector) (ret []*extensionsv1beta1.NetworkPolicy, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*extensionsv1beta1.NetworkPolicy))
-	})
-	return ret, err
+func NewNetworkPolicyClusterLister(indexer cache.Indexer) NetworkPolicyClusterLister {
+	return &networkPolicyClusterLister{
+		kcplisters.NewCluster[*extensionsv1beta1.NetworkPolicy](indexer, extensionsv1beta1.Resource("networkpolicy")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get NetworkPolicies.
-func (s *networkPolicyClusterLister) Cluster(clusterName logicalcluster.Name) extensionsv1beta1listers.NetworkPolicyLister {
-	return &networkPolicyLister{indexer: s.indexer, clusterName: clusterName}
+func (l *networkPolicyClusterLister) Cluster(clusterName logicalcluster.Name) listersextensionsv1beta1.NetworkPolicyLister {
+	return &networkPolicyLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// networkPolicyLister implements the extensionsv1beta1listers.NetworkPolicyLister interface.
+// networkPolicyLister can list all NetworkPolicies inside a workspace
+// or scope down to a listersextensionsv1beta1.NetworkPolicyNamespaceLister for one namespace.
 type networkPolicyLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*extensionsv1beta1.NetworkPolicy]
 }
 
-// List lists all NetworkPolicies in the indexer for a workspace.
-func (s *networkPolicyLister) List(selector labels.Selector) (ret []*extensionsv1beta1.NetworkPolicy, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*extensionsv1beta1.NetworkPolicy))
-	})
-	return ret, err
-}
+var _ listersextensionsv1beta1.NetworkPolicyLister = new(networkPolicyLister)
 
 // NetworkPolicies returns an object that can list and get NetworkPolicies in one namespace.
-func (s *networkPolicyLister) NetworkPolicies(namespace string) extensionsv1beta1listers.NetworkPolicyNamespaceLister {
-	return &networkPolicyNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *networkPolicyLister) NetworkPolicies(namespace string) listersextensionsv1beta1.NetworkPolicyNamespaceLister {
+	return &networkPolicyNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// networkPolicyNamespaceLister implements the extensionsv1beta1listers.NetworkPolicyNamespaceLister interface.
+// networkPolicyNamespaceLister implements the listersextensionsv1beta1.NetworkPolicyNamespaceLister
+// interface.
 type networkPolicyNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*extensionsv1beta1.NetworkPolicy]
 }
 
-// List lists all NetworkPolicies in the indexer for a given workspace and namespace.
-func (s *networkPolicyNamespaceLister) List(selector labels.Selector) (ret []*extensionsv1beta1.NetworkPolicy, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*extensionsv1beta1.NetworkPolicy))
-	})
-	return ret, err
-}
+var _ listersextensionsv1beta1.NetworkPolicyNamespaceLister = new(networkPolicyNamespaceLister)
 
-// Get retrieves the NetworkPolicy from the indexer for a given workspace, namespace and name.
-func (s *networkPolicyNamespaceLister) Get(name string) (*extensionsv1beta1.NetworkPolicy, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewNetworkPolicyLister returns a new NetworkPolicyLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewNetworkPolicyLister(indexer cache.Indexer) listersextensionsv1beta1.NetworkPolicyLister {
+	return &networkPolicyLister{
+		kcplisters.New[*extensionsv1beta1.NetworkPolicy](indexer, extensionsv1beta1.Resource("networkpolicy")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(extensionsv1beta1.Resource("networkpolicies"), name)
+}
+
+// networkPolicyScopedLister can list all NetworkPolicies inside a workspace
+// or scope down to a listersextensionsv1beta1.NetworkPolicyNamespaceLister for one namespace.
+type networkPolicyScopedLister struct {
+	kcplisters.ResourceIndexer[*extensionsv1beta1.NetworkPolicy]
+}
+
+// NetworkPolicies returns an object that can list and get NetworkPolicies in one namespace.
+func (l *networkPolicyScopedLister) NetworkPolicies(namespace string) listersextensionsv1beta1.NetworkPolicyLister {
+	return &networkPolicyLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*extensionsv1beta1.NetworkPolicy), nil
 }
diff --git a/listers/extensions/v1beta1/networkpolicy_expansion.go b/listers/extensions/v1beta1/networkpolicy_expansion.go
index e9d5f4ec1..90d8ecb09 100644
--- a/listers/extensions/v1beta1/networkpolicy_expansion.go
+++ b/listers/extensions/v1beta1/networkpolicy_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/extensions/v1beta1/podsecuritypolicy.go b/listers/extensions/v1beta1/podsecuritypolicy.go
deleted file mode 100644
index 057b2c277..000000000
--- a/listers/extensions/v1beta1/podsecuritypolicy.go
+++ /dev/null
@@ -1,97 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1beta1
-
-import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	extensionsv1beta1listers "k8s.io/client-go/listers/extensions/v1beta1"
-	"k8s.io/client-go/tools/cache"
-)
-
-// PodSecurityPolicyClusterLister can list PodSecurityPolicies across all workspaces, or scope down to a PodSecurityPolicyLister for one workspace.
-// All objects returned here must be treated as read-only.
-type PodSecurityPolicyClusterLister interface {
-	// List lists all PodSecurityPolicies in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*extensionsv1beta1.PodSecurityPolicy, err error)
-	// Cluster returns a lister that can list and get PodSecurityPolicies in one workspace.
-	Cluster(clusterName logicalcluster.Name) extensionsv1beta1listers.PodSecurityPolicyLister
-	PodSecurityPolicyClusterListerExpansion
-}
-
-type podSecurityPolicyClusterLister struct {
-	indexer cache.Indexer
-}
-
-// NewPodSecurityPolicyClusterLister returns a new PodSecurityPolicyClusterLister.
-// We assume that the indexer:
-// - is fed by a cross-workspace LIST+WATCH
-// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
-// - has the kcpcache.ClusterIndex as an index
-func NewPodSecurityPolicyClusterLister(indexer cache.Indexer) *podSecurityPolicyClusterLister {
-	return &podSecurityPolicyClusterLister{indexer: indexer}
-}
-
-// List lists all PodSecurityPolicies in the indexer across all workspaces.
-func (s *podSecurityPolicyClusterLister) List(selector labels.Selector) (ret []*extensionsv1beta1.PodSecurityPolicy, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*extensionsv1beta1.PodSecurityPolicy))
-	})
-	return ret, err
-}
-
-// Cluster scopes the lister to one workspace, allowing users to list and get PodSecurityPolicies.
-func (s *podSecurityPolicyClusterLister) Cluster(clusterName logicalcluster.Name) extensionsv1beta1listers.PodSecurityPolicyLister {
-	return &podSecurityPolicyLister{indexer: s.indexer, clusterName: clusterName}
-}
-
-// podSecurityPolicyLister implements the extensionsv1beta1listers.PodSecurityPolicyLister interface.
-type podSecurityPolicyLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-}
-
-// List lists all PodSecurityPolicies in the indexer for a workspace.
-func (s *podSecurityPolicyLister) List(selector labels.Selector) (ret []*extensionsv1beta1.PodSecurityPolicy, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*extensionsv1beta1.PodSecurityPolicy))
-	})
-	return ret, err
-}
-
-// Get retrieves the PodSecurityPolicy from the indexer for a given workspace and name.
-func (s *podSecurityPolicyLister) Get(name string) (*extensionsv1beta1.PodSecurityPolicy, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(extensionsv1beta1.Resource("podsecuritypolicies"), name)
-	}
-	return obj.(*extensionsv1beta1.PodSecurityPolicy), nil
-}
diff --git a/listers/extensions/v1beta1/replicaset.go b/listers/extensions/v1beta1/replicaset.go
index b908303b3..2be46bdfe 100644
--- a/listers/extensions/v1beta1/replicaset.go
+++ b/listers/extensions/v1beta1/replicaset.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	extensionsv1beta1listers "k8s.io/client-go/listers/extensions/v1beta1"
+	listersextensionsv1beta1 "k8s.io/client-go/listers/extensions/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ReplicaSetClusterLister can list ReplicaSets across all workspaces, or scope down to a ReplicaSetLister for one workspace.
+// ReplicaSetClusterLister helps list ReplicaSets across all workspaces,
+// or scope down to a ReplicaSetLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ReplicaSetClusterLister interface {
 	// List lists all ReplicaSets in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*extensionsv1beta1.ReplicaSet, err error)
 	// Cluster returns a lister that can list and get ReplicaSets in one workspace.
-	Cluster(clusterName logicalcluster.Name) extensionsv1beta1listers.ReplicaSetLister
+	Cluster(clusterName logicalcluster.Name) listersextensionsv1beta1.ReplicaSetLister
 	ReplicaSetClusterListerExpansion
 }
 
+// replicaSetClusterLister implements the ReplicaSetClusterLister interface.
 type replicaSetClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*extensionsv1beta1.ReplicaSet]
 }
 
+var _ ReplicaSetClusterLister = new(replicaSetClusterLister)
+
 // NewReplicaSetClusterLister returns a new ReplicaSetClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewReplicaSetClusterLister(indexer cache.Indexer) *replicaSetClusterLister {
-	return &replicaSetClusterLister{indexer: indexer}
-}
-
-// List lists all ReplicaSets in the indexer across all workspaces.
-func (s *replicaSetClusterLister) List(selector labels.Selector) (ret []*extensionsv1beta1.ReplicaSet, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*extensionsv1beta1.ReplicaSet))
-	})
-	return ret, err
+func NewReplicaSetClusterLister(indexer cache.Indexer) ReplicaSetClusterLister {
+	return &replicaSetClusterLister{
+		kcplisters.NewCluster[*extensionsv1beta1.ReplicaSet](indexer, extensionsv1beta1.Resource("replicaset")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ReplicaSets.
-func (s *replicaSetClusterLister) Cluster(clusterName logicalcluster.Name) extensionsv1beta1listers.ReplicaSetLister {
-	return &replicaSetLister{indexer: s.indexer, clusterName: clusterName}
+func (l *replicaSetClusterLister) Cluster(clusterName logicalcluster.Name) listersextensionsv1beta1.ReplicaSetLister {
+	return &replicaSetLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// replicaSetLister implements the extensionsv1beta1listers.ReplicaSetLister interface.
+// replicaSetLister can list all ReplicaSets inside a workspace
+// or scope down to a listersextensionsv1beta1.ReplicaSetNamespaceLister for one namespace.
 type replicaSetLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*extensionsv1beta1.ReplicaSet]
 }
 
-// List lists all ReplicaSets in the indexer for a workspace.
-func (s *replicaSetLister) List(selector labels.Selector) (ret []*extensionsv1beta1.ReplicaSet, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*extensionsv1beta1.ReplicaSet))
-	})
-	return ret, err
-}
+var _ listersextensionsv1beta1.ReplicaSetLister = new(replicaSetLister)
 
 // ReplicaSets returns an object that can list and get ReplicaSets in one namespace.
-func (s *replicaSetLister) ReplicaSets(namespace string) extensionsv1beta1listers.ReplicaSetNamespaceLister {
-	return &replicaSetNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *replicaSetLister) ReplicaSets(namespace string) listersextensionsv1beta1.ReplicaSetNamespaceLister {
+	return &replicaSetNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// replicaSetNamespaceLister implements the extensionsv1beta1listers.ReplicaSetNamespaceLister interface.
+// replicaSetNamespaceLister implements the listersextensionsv1beta1.ReplicaSetNamespaceLister
+// interface.
 type replicaSetNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*extensionsv1beta1.ReplicaSet]
 }
 
-// List lists all ReplicaSets in the indexer for a given workspace and namespace.
-func (s *replicaSetNamespaceLister) List(selector labels.Selector) (ret []*extensionsv1beta1.ReplicaSet, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*extensionsv1beta1.ReplicaSet))
-	})
-	return ret, err
-}
+var _ listersextensionsv1beta1.ReplicaSetNamespaceLister = new(replicaSetNamespaceLister)
 
-// Get retrieves the ReplicaSet from the indexer for a given workspace, namespace and name.
-func (s *replicaSetNamespaceLister) Get(name string) (*extensionsv1beta1.ReplicaSet, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewReplicaSetLister returns a new ReplicaSetLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewReplicaSetLister(indexer cache.Indexer) listersextensionsv1beta1.ReplicaSetLister {
+	return &replicaSetLister{
+		kcplisters.New[*extensionsv1beta1.ReplicaSet](indexer, extensionsv1beta1.Resource("replicaset")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(extensionsv1beta1.Resource("replicasets"), name)
+}
+
+// replicaSetScopedLister can list all ReplicaSets inside a workspace
+// or scope down to a listersextensionsv1beta1.ReplicaSetNamespaceLister for one namespace.
+type replicaSetScopedLister struct {
+	kcplisters.ResourceIndexer[*extensionsv1beta1.ReplicaSet]
+}
+
+// ReplicaSets returns an object that can list and get ReplicaSets in one namespace.
+func (l *replicaSetScopedLister) ReplicaSets(namespace string) listersextensionsv1beta1.ReplicaSetLister {
+	return &replicaSetLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*extensionsv1beta1.ReplicaSet), nil
 }
diff --git a/listers/extensions/v1beta1/replicaset_expansion.go b/listers/extensions/v1beta1/replicaset_expansion.go
index 53f5b3e1c..0b7c0fb23 100644
--- a/listers/extensions/v1beta1/replicaset_expansion.go
+++ b/listers/extensions/v1beta1/replicaset_expansion.go
@@ -19,7 +19,7 @@ package v1beta1
 import (
 	"fmt"
 
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	extensions "k8s.io/api/extensions/v1beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
diff --git a/listers/flowcontrol/v1/expansion_generated.go b/listers/flowcontrol/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/flowcontrol/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/flowcontrol/v1/flowschema.go b/listers/flowcontrol/v1/flowschema.go
new file mode 100644
index 000000000..1e5525972
--- /dev/null
+++ b/listers/flowcontrol/v1/flowschema.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	flowcontrolv1 "k8s.io/api/flowcontrol/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersflowcontrolv1 "k8s.io/client-go/listers/flowcontrol/v1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// FlowSchemaClusterLister helps list FlowSchemas across all workspaces,
+// or scope down to a FlowSchemaLister for one workspace.
+// All objects returned here must be treated as read-only.
+type FlowSchemaClusterLister interface {
+	// List lists all FlowSchemas in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*flowcontrolv1.FlowSchema, err error)
+	// Cluster returns a lister that can list and get FlowSchemas in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersflowcontrolv1.FlowSchemaLister
+	FlowSchemaClusterListerExpansion
+}
+
+// flowSchemaClusterLister implements the FlowSchemaClusterLister interface.
+type flowSchemaClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*flowcontrolv1.FlowSchema]
+}
+
+var _ FlowSchemaClusterLister = new(flowSchemaClusterLister)
+
+// NewFlowSchemaClusterLister returns a new FlowSchemaClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewFlowSchemaClusterLister(indexer cache.Indexer) FlowSchemaClusterLister {
+	return &flowSchemaClusterLister{
+		kcplisters.NewCluster[*flowcontrolv1.FlowSchema](indexer, flowcontrolv1.Resource("flowschema")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get FlowSchemas.
+func (l *flowSchemaClusterLister) Cluster(clusterName logicalcluster.Name) listersflowcontrolv1.FlowSchemaLister {
+	return &flowSchemaLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// flowSchemaLister can list all FlowSchemas inside a workspace
+// or scope down to a listersflowcontrolv1.FlowSchemaNamespaceLister for one namespace.
+type flowSchemaLister struct {
+	kcplisters.ResourceIndexer[*flowcontrolv1.FlowSchema]
+}
+
+var _ listersflowcontrolv1.FlowSchemaLister = new(flowSchemaLister)
+
+// NewFlowSchemaLister returns a new FlowSchemaLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewFlowSchemaLister(indexer cache.Indexer) listersflowcontrolv1.FlowSchemaLister {
+	return &flowSchemaLister{
+		kcplisters.New[*flowcontrolv1.FlowSchema](indexer, flowcontrolv1.Resource("flowschema")),
+	}
+}
+
+// flowSchemaScopedLister can list all FlowSchemas inside a workspace
+// or scope down to a listersflowcontrolv1.FlowSchemaNamespaceLister.
+type flowSchemaScopedLister struct {
+	kcplisters.ResourceIndexer[*flowcontrolv1.FlowSchema]
+}
diff --git a/listers/flowcontrol/v1alpha1/flowschema_expansion.go b/listers/flowcontrol/v1/flowschema_expansion.go
similarity index 90%
rename from listers/flowcontrol/v1alpha1/flowschema_expansion.go
rename to listers/flowcontrol/v1/flowschema_expansion.go
index 4da91d226..ea1bcff31 100644
--- a/listers/flowcontrol/v1alpha1/flowschema_expansion.go
+++ b/listers/flowcontrol/v1/flowschema_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
@@ -19,7 +16,7 @@ limitations under the License.
 
 // Code generated by kcp code-generator. DO NOT EDIT.
 
-package v1alpha1
+package v1
 
 // FlowSchemaClusterListerExpansion allows custom methods to be added to FlowSchemaClusterLister.
 type FlowSchemaClusterListerExpansion interface{}
diff --git a/listers/flowcontrol/v1/prioritylevelconfiguration.go b/listers/flowcontrol/v1/prioritylevelconfiguration.go
new file mode 100644
index 000000000..7f1142b88
--- /dev/null
+++ b/listers/flowcontrol/v1/prioritylevelconfiguration.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	flowcontrolv1 "k8s.io/api/flowcontrol/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersflowcontrolv1 "k8s.io/client-go/listers/flowcontrol/v1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// PriorityLevelConfigurationClusterLister helps list PriorityLevelConfigurations across all workspaces,
+// or scope down to a PriorityLevelConfigurationLister for one workspace.
+// All objects returned here must be treated as read-only.
+type PriorityLevelConfigurationClusterLister interface {
+	// List lists all PriorityLevelConfigurations in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*flowcontrolv1.PriorityLevelConfiguration, err error)
+	// Cluster returns a lister that can list and get PriorityLevelConfigurations in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersflowcontrolv1.PriorityLevelConfigurationLister
+	PriorityLevelConfigurationClusterListerExpansion
+}
+
+// priorityLevelConfigurationClusterLister implements the PriorityLevelConfigurationClusterLister interface.
+type priorityLevelConfigurationClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*flowcontrolv1.PriorityLevelConfiguration]
+}
+
+var _ PriorityLevelConfigurationClusterLister = new(priorityLevelConfigurationClusterLister)
+
+// NewPriorityLevelConfigurationClusterLister returns a new PriorityLevelConfigurationClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewPriorityLevelConfigurationClusterLister(indexer cache.Indexer) PriorityLevelConfigurationClusterLister {
+	return &priorityLevelConfigurationClusterLister{
+		kcplisters.NewCluster[*flowcontrolv1.PriorityLevelConfiguration](indexer, flowcontrolv1.Resource("prioritylevelconfiguration")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get PriorityLevelConfigurations.
+func (l *priorityLevelConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) listersflowcontrolv1.PriorityLevelConfigurationLister {
+	return &priorityLevelConfigurationLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// priorityLevelConfigurationLister can list all PriorityLevelConfigurations inside a workspace
+// or scope down to a listersflowcontrolv1.PriorityLevelConfigurationNamespaceLister for one namespace.
+type priorityLevelConfigurationLister struct {
+	kcplisters.ResourceIndexer[*flowcontrolv1.PriorityLevelConfiguration]
+}
+
+var _ listersflowcontrolv1.PriorityLevelConfigurationLister = new(priorityLevelConfigurationLister)
+
+// NewPriorityLevelConfigurationLister returns a new PriorityLevelConfigurationLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewPriorityLevelConfigurationLister(indexer cache.Indexer) listersflowcontrolv1.PriorityLevelConfigurationLister {
+	return &priorityLevelConfigurationLister{
+		kcplisters.New[*flowcontrolv1.PriorityLevelConfiguration](indexer, flowcontrolv1.Resource("prioritylevelconfiguration")),
+	}
+}
+
+// priorityLevelConfigurationScopedLister can list all PriorityLevelConfigurations inside a workspace
+// or scope down to a listersflowcontrolv1.PriorityLevelConfigurationNamespaceLister.
+type priorityLevelConfigurationScopedLister struct {
+	kcplisters.ResourceIndexer[*flowcontrolv1.PriorityLevelConfiguration]
+}
diff --git a/listers/flowcontrol/v1alpha1/prioritylevelconfiguration_expansion.go b/listers/flowcontrol/v1/prioritylevelconfiguration_expansion.go
similarity index 90%
rename from listers/flowcontrol/v1alpha1/prioritylevelconfiguration_expansion.go
rename to listers/flowcontrol/v1/prioritylevelconfiguration_expansion.go
index 9179ae0d6..183d33c39 100644
--- a/listers/flowcontrol/v1alpha1/prioritylevelconfiguration_expansion.go
+++ b/listers/flowcontrol/v1/prioritylevelconfiguration_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
@@ -19,7 +16,7 @@ limitations under the License.
 
 // Code generated by kcp code-generator. DO NOT EDIT.
 
-package v1alpha1
+package v1
 
 // PriorityLevelConfigurationClusterListerExpansion allows custom methods to be added to PriorityLevelConfigurationClusterLister.
 type PriorityLevelConfigurationClusterListerExpansion interface{}
diff --git a/listers/flowcontrol/v1alpha1/flowschema.go b/listers/flowcontrol/v1alpha1/flowschema.go
deleted file mode 100644
index f76bd5868..000000000
--- a/listers/flowcontrol/v1alpha1/flowschema.go
+++ /dev/null
@@ -1,97 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1alpha1 "k8s.io/api/flowcontrol/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	flowcontrolv1alpha1listers "k8s.io/client-go/listers/flowcontrol/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-)
-
-// FlowSchemaClusterLister can list FlowSchemas across all workspaces, or scope down to a FlowSchemaLister for one workspace.
-// All objects returned here must be treated as read-only.
-type FlowSchemaClusterLister interface {
-	// List lists all FlowSchemas in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*flowcontrolv1alpha1.FlowSchema, err error)
-	// Cluster returns a lister that can list and get FlowSchemas in one workspace.
-	Cluster(clusterName logicalcluster.Name) flowcontrolv1alpha1listers.FlowSchemaLister
-	FlowSchemaClusterListerExpansion
-}
-
-type flowSchemaClusterLister struct {
-	indexer cache.Indexer
-}
-
-// NewFlowSchemaClusterLister returns a new FlowSchemaClusterLister.
-// We assume that the indexer:
-// - is fed by a cross-workspace LIST+WATCH
-// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
-// - has the kcpcache.ClusterIndex as an index
-func NewFlowSchemaClusterLister(indexer cache.Indexer) *flowSchemaClusterLister {
-	return &flowSchemaClusterLister{indexer: indexer}
-}
-
-// List lists all FlowSchemas in the indexer across all workspaces.
-func (s *flowSchemaClusterLister) List(selector labels.Selector) (ret []*flowcontrolv1alpha1.FlowSchema, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*flowcontrolv1alpha1.FlowSchema))
-	})
-	return ret, err
-}
-
-// Cluster scopes the lister to one workspace, allowing users to list and get FlowSchemas.
-func (s *flowSchemaClusterLister) Cluster(clusterName logicalcluster.Name) flowcontrolv1alpha1listers.FlowSchemaLister {
-	return &flowSchemaLister{indexer: s.indexer, clusterName: clusterName}
-}
-
-// flowSchemaLister implements the flowcontrolv1alpha1listers.FlowSchemaLister interface.
-type flowSchemaLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-}
-
-// List lists all FlowSchemas in the indexer for a workspace.
-func (s *flowSchemaLister) List(selector labels.Selector) (ret []*flowcontrolv1alpha1.FlowSchema, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*flowcontrolv1alpha1.FlowSchema))
-	})
-	return ret, err
-}
-
-// Get retrieves the FlowSchema from the indexer for a given workspace and name.
-func (s *flowSchemaLister) Get(name string) (*flowcontrolv1alpha1.FlowSchema, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(flowcontrolv1alpha1.Resource("flowschemas"), name)
-	}
-	return obj.(*flowcontrolv1alpha1.FlowSchema), nil
-}
diff --git a/listers/flowcontrol/v1alpha1/prioritylevelconfiguration.go b/listers/flowcontrol/v1alpha1/prioritylevelconfiguration.go
deleted file mode 100644
index 9429d37fb..000000000
--- a/listers/flowcontrol/v1alpha1/prioritylevelconfiguration.go
+++ /dev/null
@@ -1,97 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	flowcontrolv1alpha1 "k8s.io/api/flowcontrol/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	flowcontrolv1alpha1listers "k8s.io/client-go/listers/flowcontrol/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-)
-
-// PriorityLevelConfigurationClusterLister can list PriorityLevelConfigurations across all workspaces, or scope down to a PriorityLevelConfigurationLister for one workspace.
-// All objects returned here must be treated as read-only.
-type PriorityLevelConfigurationClusterLister interface {
-	// List lists all PriorityLevelConfigurations in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*flowcontrolv1alpha1.PriorityLevelConfiguration, err error)
-	// Cluster returns a lister that can list and get PriorityLevelConfigurations in one workspace.
-	Cluster(clusterName logicalcluster.Name) flowcontrolv1alpha1listers.PriorityLevelConfigurationLister
-	PriorityLevelConfigurationClusterListerExpansion
-}
-
-type priorityLevelConfigurationClusterLister struct {
-	indexer cache.Indexer
-}
-
-// NewPriorityLevelConfigurationClusterLister returns a new PriorityLevelConfigurationClusterLister.
-// We assume that the indexer:
-// - is fed by a cross-workspace LIST+WATCH
-// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
-// - has the kcpcache.ClusterIndex as an index
-func NewPriorityLevelConfigurationClusterLister(indexer cache.Indexer) *priorityLevelConfigurationClusterLister {
-	return &priorityLevelConfigurationClusterLister{indexer: indexer}
-}
-
-// List lists all PriorityLevelConfigurations in the indexer across all workspaces.
-func (s *priorityLevelConfigurationClusterLister) List(selector labels.Selector) (ret []*flowcontrolv1alpha1.PriorityLevelConfiguration, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*flowcontrolv1alpha1.PriorityLevelConfiguration))
-	})
-	return ret, err
-}
-
-// Cluster scopes the lister to one workspace, allowing users to list and get PriorityLevelConfigurations.
-func (s *priorityLevelConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) flowcontrolv1alpha1listers.PriorityLevelConfigurationLister {
-	return &priorityLevelConfigurationLister{indexer: s.indexer, clusterName: clusterName}
-}
-
-// priorityLevelConfigurationLister implements the flowcontrolv1alpha1listers.PriorityLevelConfigurationLister interface.
-type priorityLevelConfigurationLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-}
-
-// List lists all PriorityLevelConfigurations in the indexer for a workspace.
-func (s *priorityLevelConfigurationLister) List(selector labels.Selector) (ret []*flowcontrolv1alpha1.PriorityLevelConfiguration, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*flowcontrolv1alpha1.PriorityLevelConfiguration))
-	})
-	return ret, err
-}
-
-// Get retrieves the PriorityLevelConfiguration from the indexer for a given workspace and name.
-func (s *priorityLevelConfigurationLister) Get(name string) (*flowcontrolv1alpha1.PriorityLevelConfiguration, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(flowcontrolv1alpha1.Resource("prioritylevelconfigurations"), name)
-	}
-	return obj.(*flowcontrolv1alpha1.PriorityLevelConfiguration), nil
-}
diff --git a/listers/flowcontrol/v1beta1/expansion_generated.go b/listers/flowcontrol/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/flowcontrol/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/flowcontrol/v1beta1/flowschema.go b/listers/flowcontrol/v1beta1/flowschema.go
index df8c63e6e..7dec79d53 100644
--- a/listers/flowcontrol/v1beta1/flowschema.go
+++ b/listers/flowcontrol/v1beta1/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	flowcontrolv1beta1listers "k8s.io/client-go/listers/flowcontrol/v1beta1"
+	listersflowcontrolv1beta1 "k8s.io/client-go/listers/flowcontrol/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// FlowSchemaClusterLister can list FlowSchemas across all workspaces, or scope down to a FlowSchemaLister for one workspace.
+// FlowSchemaClusterLister helps list FlowSchemas across all workspaces,
+// or scope down to a FlowSchemaLister for one workspace.
 // All objects returned here must be treated as read-only.
 type FlowSchemaClusterLister interface {
 	// List lists all FlowSchemas in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*flowcontrolv1beta1.FlowSchema, err error)
 	// Cluster returns a lister that can list and get FlowSchemas in one workspace.
-	Cluster(clusterName logicalcluster.Name) flowcontrolv1beta1listers.FlowSchemaLister
+	Cluster(clusterName logicalcluster.Name) listersflowcontrolv1beta1.FlowSchemaLister
 	FlowSchemaClusterListerExpansion
 }
 
+// flowSchemaClusterLister implements the FlowSchemaClusterLister interface.
 type flowSchemaClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*flowcontrolv1beta1.FlowSchema]
 }
 
+var _ FlowSchemaClusterLister = new(flowSchemaClusterLister)
+
 // NewFlowSchemaClusterLister returns a new FlowSchemaClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewFlowSchemaClusterLister(indexer cache.Indexer) *flowSchemaClusterLister {
-	return &flowSchemaClusterLister{indexer: indexer}
-}
-
-// List lists all FlowSchemas in the indexer across all workspaces.
-func (s *flowSchemaClusterLister) List(selector labels.Selector) (ret []*flowcontrolv1beta1.FlowSchema, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*flowcontrolv1beta1.FlowSchema))
-	})
-	return ret, err
+func NewFlowSchemaClusterLister(indexer cache.Indexer) FlowSchemaClusterLister {
+	return &flowSchemaClusterLister{
+		kcplisters.NewCluster[*flowcontrolv1beta1.FlowSchema](indexer, flowcontrolv1beta1.Resource("flowschema")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get FlowSchemas.
-func (s *flowSchemaClusterLister) Cluster(clusterName logicalcluster.Name) flowcontrolv1beta1listers.FlowSchemaLister {
-	return &flowSchemaLister{indexer: s.indexer, clusterName: clusterName}
+func (l *flowSchemaClusterLister) Cluster(clusterName logicalcluster.Name) listersflowcontrolv1beta1.FlowSchemaLister {
+	return &flowSchemaLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// flowSchemaLister implements the flowcontrolv1beta1listers.FlowSchemaLister interface.
+// flowSchemaLister can list all FlowSchemas inside a workspace
+// or scope down to a listersflowcontrolv1beta1.FlowSchemaNamespaceLister for one namespace.
 type flowSchemaLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*flowcontrolv1beta1.FlowSchema]
 }
 
-// List lists all FlowSchemas in the indexer for a workspace.
-func (s *flowSchemaLister) List(selector labels.Selector) (ret []*flowcontrolv1beta1.FlowSchema, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*flowcontrolv1beta1.FlowSchema))
-	})
-	return ret, err
-}
+var _ listersflowcontrolv1beta1.FlowSchemaLister = new(flowSchemaLister)
 
-// Get retrieves the FlowSchema from the indexer for a given workspace and name.
-func (s *flowSchemaLister) Get(name string) (*flowcontrolv1beta1.FlowSchema, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(flowcontrolv1beta1.Resource("flowschemas"), name)
+// NewFlowSchemaLister returns a new FlowSchemaLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewFlowSchemaLister(indexer cache.Indexer) listersflowcontrolv1beta1.FlowSchemaLister {
+	return &flowSchemaLister{
+		kcplisters.New[*flowcontrolv1beta1.FlowSchema](indexer, flowcontrolv1beta1.Resource("flowschema")),
 	}
-	return obj.(*flowcontrolv1beta1.FlowSchema), nil
+}
+
+// flowSchemaScopedLister can list all FlowSchemas inside a workspace
+// or scope down to a listersflowcontrolv1beta1.FlowSchemaNamespaceLister.
+type flowSchemaScopedLister struct {
+	kcplisters.ResourceIndexer[*flowcontrolv1beta1.FlowSchema]
 }
diff --git a/listers/flowcontrol/v1beta1/flowschema_expansion.go b/listers/flowcontrol/v1beta1/flowschema_expansion.go
index 14fe7ca39..707b36dc9 100644
--- a/listers/flowcontrol/v1beta1/flowschema_expansion.go
+++ b/listers/flowcontrol/v1beta1/flowschema_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/flowcontrol/v1beta1/prioritylevelconfiguration.go b/listers/flowcontrol/v1beta1/prioritylevelconfiguration.go
index 322c9ccc4..a19aaeb0b 100644
--- a/listers/flowcontrol/v1beta1/prioritylevelconfiguration.go
+++ b/listers/flowcontrol/v1beta1/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta1 "k8s.io/api/flowcontrol/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	flowcontrolv1beta1listers "k8s.io/client-go/listers/flowcontrol/v1beta1"
+	listersflowcontrolv1beta1 "k8s.io/client-go/listers/flowcontrol/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// PriorityLevelConfigurationClusterLister can list PriorityLevelConfigurations across all workspaces, or scope down to a PriorityLevelConfigurationLister for one workspace.
+// PriorityLevelConfigurationClusterLister helps list PriorityLevelConfigurations across all workspaces,
+// or scope down to a PriorityLevelConfigurationLister for one workspace.
 // All objects returned here must be treated as read-only.
 type PriorityLevelConfigurationClusterLister interface {
 	// List lists all PriorityLevelConfigurations in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*flowcontrolv1beta1.PriorityLevelConfiguration, err error)
 	// Cluster returns a lister that can list and get PriorityLevelConfigurations in one workspace.
-	Cluster(clusterName logicalcluster.Name) flowcontrolv1beta1listers.PriorityLevelConfigurationLister
+	Cluster(clusterName logicalcluster.Name) listersflowcontrolv1beta1.PriorityLevelConfigurationLister
 	PriorityLevelConfigurationClusterListerExpansion
 }
 
+// priorityLevelConfigurationClusterLister implements the PriorityLevelConfigurationClusterLister interface.
 type priorityLevelConfigurationClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*flowcontrolv1beta1.PriorityLevelConfiguration]
 }
 
+var _ PriorityLevelConfigurationClusterLister = new(priorityLevelConfigurationClusterLister)
+
 // NewPriorityLevelConfigurationClusterLister returns a new PriorityLevelConfigurationClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewPriorityLevelConfigurationClusterLister(indexer cache.Indexer) *priorityLevelConfigurationClusterLister {
-	return &priorityLevelConfigurationClusterLister{indexer: indexer}
-}
-
-// List lists all PriorityLevelConfigurations in the indexer across all workspaces.
-func (s *priorityLevelConfigurationClusterLister) List(selector labels.Selector) (ret []*flowcontrolv1beta1.PriorityLevelConfiguration, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*flowcontrolv1beta1.PriorityLevelConfiguration))
-	})
-	return ret, err
+func NewPriorityLevelConfigurationClusterLister(indexer cache.Indexer) PriorityLevelConfigurationClusterLister {
+	return &priorityLevelConfigurationClusterLister{
+		kcplisters.NewCluster[*flowcontrolv1beta1.PriorityLevelConfiguration](indexer, flowcontrolv1beta1.Resource("prioritylevelconfiguration")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get PriorityLevelConfigurations.
-func (s *priorityLevelConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) flowcontrolv1beta1listers.PriorityLevelConfigurationLister {
-	return &priorityLevelConfigurationLister{indexer: s.indexer, clusterName: clusterName}
+func (l *priorityLevelConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) listersflowcontrolv1beta1.PriorityLevelConfigurationLister {
+	return &priorityLevelConfigurationLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// priorityLevelConfigurationLister implements the flowcontrolv1beta1listers.PriorityLevelConfigurationLister interface.
+// priorityLevelConfigurationLister can list all PriorityLevelConfigurations inside a workspace
+// or scope down to a listersflowcontrolv1beta1.PriorityLevelConfigurationNamespaceLister for one namespace.
 type priorityLevelConfigurationLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*flowcontrolv1beta1.PriorityLevelConfiguration]
 }
 
-// List lists all PriorityLevelConfigurations in the indexer for a workspace.
-func (s *priorityLevelConfigurationLister) List(selector labels.Selector) (ret []*flowcontrolv1beta1.PriorityLevelConfiguration, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*flowcontrolv1beta1.PriorityLevelConfiguration))
-	})
-	return ret, err
-}
+var _ listersflowcontrolv1beta1.PriorityLevelConfigurationLister = new(priorityLevelConfigurationLister)
 
-// Get retrieves the PriorityLevelConfiguration from the indexer for a given workspace and name.
-func (s *priorityLevelConfigurationLister) Get(name string) (*flowcontrolv1beta1.PriorityLevelConfiguration, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(flowcontrolv1beta1.Resource("prioritylevelconfigurations"), name)
+// NewPriorityLevelConfigurationLister returns a new PriorityLevelConfigurationLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewPriorityLevelConfigurationLister(indexer cache.Indexer) listersflowcontrolv1beta1.PriorityLevelConfigurationLister {
+	return &priorityLevelConfigurationLister{
+		kcplisters.New[*flowcontrolv1beta1.PriorityLevelConfiguration](indexer, flowcontrolv1beta1.Resource("prioritylevelconfiguration")),
 	}
-	return obj.(*flowcontrolv1beta1.PriorityLevelConfiguration), nil
+}
+
+// priorityLevelConfigurationScopedLister can list all PriorityLevelConfigurations inside a workspace
+// or scope down to a listersflowcontrolv1beta1.PriorityLevelConfigurationNamespaceLister.
+type priorityLevelConfigurationScopedLister struct {
+	kcplisters.ResourceIndexer[*flowcontrolv1beta1.PriorityLevelConfiguration]
 }
diff --git a/listers/flowcontrol/v1beta1/prioritylevelconfiguration_expansion.go b/listers/flowcontrol/v1beta1/prioritylevelconfiguration_expansion.go
index 25ea6a230..8c57993bb 100644
--- a/listers/flowcontrol/v1beta1/prioritylevelconfiguration_expansion.go
+++ b/listers/flowcontrol/v1beta1/prioritylevelconfiguration_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/flowcontrol/v1beta2/expansion_generated.go b/listers/flowcontrol/v1beta2/expansion_generated.go
new file mode 100644
index 000000000..3e58e545a
--- /dev/null
+++ b/listers/flowcontrol/v1beta2/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta2
diff --git a/listers/flowcontrol/v1beta2/flowschema.go b/listers/flowcontrol/v1beta2/flowschema.go
index cf0718185..73386e791 100644
--- a/listers/flowcontrol/v1beta2/flowschema.go
+++ b/listers/flowcontrol/v1beta2/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	flowcontrolv1beta2listers "k8s.io/client-go/listers/flowcontrol/v1beta2"
+	listersflowcontrolv1beta2 "k8s.io/client-go/listers/flowcontrol/v1beta2"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// FlowSchemaClusterLister can list FlowSchemas across all workspaces, or scope down to a FlowSchemaLister for one workspace.
+// FlowSchemaClusterLister helps list FlowSchemas across all workspaces,
+// or scope down to a FlowSchemaLister for one workspace.
 // All objects returned here must be treated as read-only.
 type FlowSchemaClusterLister interface {
 	// List lists all FlowSchemas in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*flowcontrolv1beta2.FlowSchema, err error)
 	// Cluster returns a lister that can list and get FlowSchemas in one workspace.
-	Cluster(clusterName logicalcluster.Name) flowcontrolv1beta2listers.FlowSchemaLister
+	Cluster(clusterName logicalcluster.Name) listersflowcontrolv1beta2.FlowSchemaLister
 	FlowSchemaClusterListerExpansion
 }
 
+// flowSchemaClusterLister implements the FlowSchemaClusterLister interface.
 type flowSchemaClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*flowcontrolv1beta2.FlowSchema]
 }
 
+var _ FlowSchemaClusterLister = new(flowSchemaClusterLister)
+
 // NewFlowSchemaClusterLister returns a new FlowSchemaClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewFlowSchemaClusterLister(indexer cache.Indexer) *flowSchemaClusterLister {
-	return &flowSchemaClusterLister{indexer: indexer}
-}
-
-// List lists all FlowSchemas in the indexer across all workspaces.
-func (s *flowSchemaClusterLister) List(selector labels.Selector) (ret []*flowcontrolv1beta2.FlowSchema, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*flowcontrolv1beta2.FlowSchema))
-	})
-	return ret, err
+func NewFlowSchemaClusterLister(indexer cache.Indexer) FlowSchemaClusterLister {
+	return &flowSchemaClusterLister{
+		kcplisters.NewCluster[*flowcontrolv1beta2.FlowSchema](indexer, flowcontrolv1beta2.Resource("flowschema")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get FlowSchemas.
-func (s *flowSchemaClusterLister) Cluster(clusterName logicalcluster.Name) flowcontrolv1beta2listers.FlowSchemaLister {
-	return &flowSchemaLister{indexer: s.indexer, clusterName: clusterName}
+func (l *flowSchemaClusterLister) Cluster(clusterName logicalcluster.Name) listersflowcontrolv1beta2.FlowSchemaLister {
+	return &flowSchemaLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// flowSchemaLister implements the flowcontrolv1beta2listers.FlowSchemaLister interface.
+// flowSchemaLister can list all FlowSchemas inside a workspace
+// or scope down to a listersflowcontrolv1beta2.FlowSchemaNamespaceLister for one namespace.
 type flowSchemaLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*flowcontrolv1beta2.FlowSchema]
 }
 
-// List lists all FlowSchemas in the indexer for a workspace.
-func (s *flowSchemaLister) List(selector labels.Selector) (ret []*flowcontrolv1beta2.FlowSchema, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*flowcontrolv1beta2.FlowSchema))
-	})
-	return ret, err
-}
+var _ listersflowcontrolv1beta2.FlowSchemaLister = new(flowSchemaLister)
 
-// Get retrieves the FlowSchema from the indexer for a given workspace and name.
-func (s *flowSchemaLister) Get(name string) (*flowcontrolv1beta2.FlowSchema, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(flowcontrolv1beta2.Resource("flowschemas"), name)
+// NewFlowSchemaLister returns a new FlowSchemaLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewFlowSchemaLister(indexer cache.Indexer) listersflowcontrolv1beta2.FlowSchemaLister {
+	return &flowSchemaLister{
+		kcplisters.New[*flowcontrolv1beta2.FlowSchema](indexer, flowcontrolv1beta2.Resource("flowschema")),
 	}
-	return obj.(*flowcontrolv1beta2.FlowSchema), nil
+}
+
+// flowSchemaScopedLister can list all FlowSchemas inside a workspace
+// or scope down to a listersflowcontrolv1beta2.FlowSchemaNamespaceLister.
+type flowSchemaScopedLister struct {
+	kcplisters.ResourceIndexer[*flowcontrolv1beta2.FlowSchema]
 }
diff --git a/listers/flowcontrol/v1beta2/flowschema_expansion.go b/listers/flowcontrol/v1beta2/flowschema_expansion.go
index 002d1a0e1..f18fcb623 100644
--- a/listers/flowcontrol/v1beta2/flowschema_expansion.go
+++ b/listers/flowcontrol/v1beta2/flowschema_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/flowcontrol/v1beta2/prioritylevelconfiguration.go b/listers/flowcontrol/v1beta2/prioritylevelconfiguration.go
index f8a9a85be..be2c7de04 100644
--- a/listers/flowcontrol/v1beta2/prioritylevelconfiguration.go
+++ b/listers/flowcontrol/v1beta2/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta2
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta2 "k8s.io/api/flowcontrol/v1beta2"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	flowcontrolv1beta2listers "k8s.io/client-go/listers/flowcontrol/v1beta2"
+	listersflowcontrolv1beta2 "k8s.io/client-go/listers/flowcontrol/v1beta2"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// PriorityLevelConfigurationClusterLister can list PriorityLevelConfigurations across all workspaces, or scope down to a PriorityLevelConfigurationLister for one workspace.
+// PriorityLevelConfigurationClusterLister helps list PriorityLevelConfigurations across all workspaces,
+// or scope down to a PriorityLevelConfigurationLister for one workspace.
 // All objects returned here must be treated as read-only.
 type PriorityLevelConfigurationClusterLister interface {
 	// List lists all PriorityLevelConfigurations in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*flowcontrolv1beta2.PriorityLevelConfiguration, err error)
 	// Cluster returns a lister that can list and get PriorityLevelConfigurations in one workspace.
-	Cluster(clusterName logicalcluster.Name) flowcontrolv1beta2listers.PriorityLevelConfigurationLister
+	Cluster(clusterName logicalcluster.Name) listersflowcontrolv1beta2.PriorityLevelConfigurationLister
 	PriorityLevelConfigurationClusterListerExpansion
 }
 
+// priorityLevelConfigurationClusterLister implements the PriorityLevelConfigurationClusterLister interface.
 type priorityLevelConfigurationClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*flowcontrolv1beta2.PriorityLevelConfiguration]
 }
 
+var _ PriorityLevelConfigurationClusterLister = new(priorityLevelConfigurationClusterLister)
+
 // NewPriorityLevelConfigurationClusterLister returns a new PriorityLevelConfigurationClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewPriorityLevelConfigurationClusterLister(indexer cache.Indexer) *priorityLevelConfigurationClusterLister {
-	return &priorityLevelConfigurationClusterLister{indexer: indexer}
-}
-
-// List lists all PriorityLevelConfigurations in the indexer across all workspaces.
-func (s *priorityLevelConfigurationClusterLister) List(selector labels.Selector) (ret []*flowcontrolv1beta2.PriorityLevelConfiguration, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*flowcontrolv1beta2.PriorityLevelConfiguration))
-	})
-	return ret, err
+func NewPriorityLevelConfigurationClusterLister(indexer cache.Indexer) PriorityLevelConfigurationClusterLister {
+	return &priorityLevelConfigurationClusterLister{
+		kcplisters.NewCluster[*flowcontrolv1beta2.PriorityLevelConfiguration](indexer, flowcontrolv1beta2.Resource("prioritylevelconfiguration")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get PriorityLevelConfigurations.
-func (s *priorityLevelConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) flowcontrolv1beta2listers.PriorityLevelConfigurationLister {
-	return &priorityLevelConfigurationLister{indexer: s.indexer, clusterName: clusterName}
+func (l *priorityLevelConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) listersflowcontrolv1beta2.PriorityLevelConfigurationLister {
+	return &priorityLevelConfigurationLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// priorityLevelConfigurationLister implements the flowcontrolv1beta2listers.PriorityLevelConfigurationLister interface.
+// priorityLevelConfigurationLister can list all PriorityLevelConfigurations inside a workspace
+// or scope down to a listersflowcontrolv1beta2.PriorityLevelConfigurationNamespaceLister for one namespace.
 type priorityLevelConfigurationLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*flowcontrolv1beta2.PriorityLevelConfiguration]
 }
 
-// List lists all PriorityLevelConfigurations in the indexer for a workspace.
-func (s *priorityLevelConfigurationLister) List(selector labels.Selector) (ret []*flowcontrolv1beta2.PriorityLevelConfiguration, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*flowcontrolv1beta2.PriorityLevelConfiguration))
-	})
-	return ret, err
-}
+var _ listersflowcontrolv1beta2.PriorityLevelConfigurationLister = new(priorityLevelConfigurationLister)
 
-// Get retrieves the PriorityLevelConfiguration from the indexer for a given workspace and name.
-func (s *priorityLevelConfigurationLister) Get(name string) (*flowcontrolv1beta2.PriorityLevelConfiguration, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(flowcontrolv1beta2.Resource("prioritylevelconfigurations"), name)
+// NewPriorityLevelConfigurationLister returns a new PriorityLevelConfigurationLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewPriorityLevelConfigurationLister(indexer cache.Indexer) listersflowcontrolv1beta2.PriorityLevelConfigurationLister {
+	return &priorityLevelConfigurationLister{
+		kcplisters.New[*flowcontrolv1beta2.PriorityLevelConfiguration](indexer, flowcontrolv1beta2.Resource("prioritylevelconfiguration")),
 	}
-	return obj.(*flowcontrolv1beta2.PriorityLevelConfiguration), nil
+}
+
+// priorityLevelConfigurationScopedLister can list all PriorityLevelConfigurations inside a workspace
+// or scope down to a listersflowcontrolv1beta2.PriorityLevelConfigurationNamespaceLister.
+type priorityLevelConfigurationScopedLister struct {
+	kcplisters.ResourceIndexer[*flowcontrolv1beta2.PriorityLevelConfiguration]
 }
diff --git a/listers/flowcontrol/v1beta2/prioritylevelconfiguration_expansion.go b/listers/flowcontrol/v1beta2/prioritylevelconfiguration_expansion.go
index 8fbfa4e13..b3501744e 100644
--- a/listers/flowcontrol/v1beta2/prioritylevelconfiguration_expansion.go
+++ b/listers/flowcontrol/v1beta2/prioritylevelconfiguration_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/flowcontrol/v1beta3/expansion_generated.go b/listers/flowcontrol/v1beta3/expansion_generated.go
new file mode 100644
index 000000000..a7b2c2f60
--- /dev/null
+++ b/listers/flowcontrol/v1beta3/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta3
diff --git a/listers/flowcontrol/v1beta3/flowschema.go b/listers/flowcontrol/v1beta3/flowschema.go
index 9e7ed97d2..7e29143fb 100644
--- a/listers/flowcontrol/v1beta3/flowschema.go
+++ b/listers/flowcontrol/v1beta3/flowschema.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta3
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	flowcontrolv1beta3listers "k8s.io/client-go/listers/flowcontrol/v1beta3"
+	listersflowcontrolv1beta3 "k8s.io/client-go/listers/flowcontrol/v1beta3"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// FlowSchemaClusterLister can list FlowSchemas across all workspaces, or scope down to a FlowSchemaLister for one workspace.
+// FlowSchemaClusterLister helps list FlowSchemas across all workspaces,
+// or scope down to a FlowSchemaLister for one workspace.
 // All objects returned here must be treated as read-only.
 type FlowSchemaClusterLister interface {
 	// List lists all FlowSchemas in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*flowcontrolv1beta3.FlowSchema, err error)
 	// Cluster returns a lister that can list and get FlowSchemas in one workspace.
-	Cluster(clusterName logicalcluster.Name) flowcontrolv1beta3listers.FlowSchemaLister
+	Cluster(clusterName logicalcluster.Name) listersflowcontrolv1beta3.FlowSchemaLister
 	FlowSchemaClusterListerExpansion
 }
 
+// flowSchemaClusterLister implements the FlowSchemaClusterLister interface.
 type flowSchemaClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*flowcontrolv1beta3.FlowSchema]
 }
 
+var _ FlowSchemaClusterLister = new(flowSchemaClusterLister)
+
 // NewFlowSchemaClusterLister returns a new FlowSchemaClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewFlowSchemaClusterLister(indexer cache.Indexer) *flowSchemaClusterLister {
-	return &flowSchemaClusterLister{indexer: indexer}
-}
-
-// List lists all FlowSchemas in the indexer across all workspaces.
-func (s *flowSchemaClusterLister) List(selector labels.Selector) (ret []*flowcontrolv1beta3.FlowSchema, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*flowcontrolv1beta3.FlowSchema))
-	})
-	return ret, err
+func NewFlowSchemaClusterLister(indexer cache.Indexer) FlowSchemaClusterLister {
+	return &flowSchemaClusterLister{
+		kcplisters.NewCluster[*flowcontrolv1beta3.FlowSchema](indexer, flowcontrolv1beta3.Resource("flowschema")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get FlowSchemas.
-func (s *flowSchemaClusterLister) Cluster(clusterName logicalcluster.Name) flowcontrolv1beta3listers.FlowSchemaLister {
-	return &flowSchemaLister{indexer: s.indexer, clusterName: clusterName}
+func (l *flowSchemaClusterLister) Cluster(clusterName logicalcluster.Name) listersflowcontrolv1beta3.FlowSchemaLister {
+	return &flowSchemaLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// flowSchemaLister implements the flowcontrolv1beta3listers.FlowSchemaLister interface.
+// flowSchemaLister can list all FlowSchemas inside a workspace
+// or scope down to a listersflowcontrolv1beta3.FlowSchemaNamespaceLister for one namespace.
 type flowSchemaLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*flowcontrolv1beta3.FlowSchema]
 }
 
-// List lists all FlowSchemas in the indexer for a workspace.
-func (s *flowSchemaLister) List(selector labels.Selector) (ret []*flowcontrolv1beta3.FlowSchema, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*flowcontrolv1beta3.FlowSchema))
-	})
-	return ret, err
-}
+var _ listersflowcontrolv1beta3.FlowSchemaLister = new(flowSchemaLister)
 
-// Get retrieves the FlowSchema from the indexer for a given workspace and name.
-func (s *flowSchemaLister) Get(name string) (*flowcontrolv1beta3.FlowSchema, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(flowcontrolv1beta3.Resource("flowschemas"), name)
+// NewFlowSchemaLister returns a new FlowSchemaLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewFlowSchemaLister(indexer cache.Indexer) listersflowcontrolv1beta3.FlowSchemaLister {
+	return &flowSchemaLister{
+		kcplisters.New[*flowcontrolv1beta3.FlowSchema](indexer, flowcontrolv1beta3.Resource("flowschema")),
 	}
-	return obj.(*flowcontrolv1beta3.FlowSchema), nil
+}
+
+// flowSchemaScopedLister can list all FlowSchemas inside a workspace
+// or scope down to a listersflowcontrolv1beta3.FlowSchemaNamespaceLister.
+type flowSchemaScopedLister struct {
+	kcplisters.ResourceIndexer[*flowcontrolv1beta3.FlowSchema]
 }
diff --git a/listers/flowcontrol/v1beta3/flowschema_expansion.go b/listers/flowcontrol/v1beta3/flowschema_expansion.go
index e10efeabb..28d4c0d74 100644
--- a/listers/flowcontrol/v1beta3/flowschema_expansion.go
+++ b/listers/flowcontrol/v1beta3/flowschema_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/flowcontrol/v1beta3/prioritylevelconfiguration.go b/listers/flowcontrol/v1beta3/prioritylevelconfiguration.go
index 02f13e699..c5b64a596 100644
--- a/listers/flowcontrol/v1beta3/prioritylevelconfiguration.go
+++ b/listers/flowcontrol/v1beta3/prioritylevelconfiguration.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta3
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	flowcontrolv1beta3 "k8s.io/api/flowcontrol/v1beta3"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	flowcontrolv1beta3listers "k8s.io/client-go/listers/flowcontrol/v1beta3"
+	listersflowcontrolv1beta3 "k8s.io/client-go/listers/flowcontrol/v1beta3"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// PriorityLevelConfigurationClusterLister can list PriorityLevelConfigurations across all workspaces, or scope down to a PriorityLevelConfigurationLister for one workspace.
+// PriorityLevelConfigurationClusterLister helps list PriorityLevelConfigurations across all workspaces,
+// or scope down to a PriorityLevelConfigurationLister for one workspace.
 // All objects returned here must be treated as read-only.
 type PriorityLevelConfigurationClusterLister interface {
 	// List lists all PriorityLevelConfigurations in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*flowcontrolv1beta3.PriorityLevelConfiguration, err error)
 	// Cluster returns a lister that can list and get PriorityLevelConfigurations in one workspace.
-	Cluster(clusterName logicalcluster.Name) flowcontrolv1beta3listers.PriorityLevelConfigurationLister
+	Cluster(clusterName logicalcluster.Name) listersflowcontrolv1beta3.PriorityLevelConfigurationLister
 	PriorityLevelConfigurationClusterListerExpansion
 }
 
+// priorityLevelConfigurationClusterLister implements the PriorityLevelConfigurationClusterLister interface.
 type priorityLevelConfigurationClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*flowcontrolv1beta3.PriorityLevelConfiguration]
 }
 
+var _ PriorityLevelConfigurationClusterLister = new(priorityLevelConfigurationClusterLister)
+
 // NewPriorityLevelConfigurationClusterLister returns a new PriorityLevelConfigurationClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewPriorityLevelConfigurationClusterLister(indexer cache.Indexer) *priorityLevelConfigurationClusterLister {
-	return &priorityLevelConfigurationClusterLister{indexer: indexer}
-}
-
-// List lists all PriorityLevelConfigurations in the indexer across all workspaces.
-func (s *priorityLevelConfigurationClusterLister) List(selector labels.Selector) (ret []*flowcontrolv1beta3.PriorityLevelConfiguration, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*flowcontrolv1beta3.PriorityLevelConfiguration))
-	})
-	return ret, err
+func NewPriorityLevelConfigurationClusterLister(indexer cache.Indexer) PriorityLevelConfigurationClusterLister {
+	return &priorityLevelConfigurationClusterLister{
+		kcplisters.NewCluster[*flowcontrolv1beta3.PriorityLevelConfiguration](indexer, flowcontrolv1beta3.Resource("prioritylevelconfiguration")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get PriorityLevelConfigurations.
-func (s *priorityLevelConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) flowcontrolv1beta3listers.PriorityLevelConfigurationLister {
-	return &priorityLevelConfigurationLister{indexer: s.indexer, clusterName: clusterName}
+func (l *priorityLevelConfigurationClusterLister) Cluster(clusterName logicalcluster.Name) listersflowcontrolv1beta3.PriorityLevelConfigurationLister {
+	return &priorityLevelConfigurationLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// priorityLevelConfigurationLister implements the flowcontrolv1beta3listers.PriorityLevelConfigurationLister interface.
+// priorityLevelConfigurationLister can list all PriorityLevelConfigurations inside a workspace
+// or scope down to a listersflowcontrolv1beta3.PriorityLevelConfigurationNamespaceLister for one namespace.
 type priorityLevelConfigurationLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*flowcontrolv1beta3.PriorityLevelConfiguration]
 }
 
-// List lists all PriorityLevelConfigurations in the indexer for a workspace.
-func (s *priorityLevelConfigurationLister) List(selector labels.Selector) (ret []*flowcontrolv1beta3.PriorityLevelConfiguration, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*flowcontrolv1beta3.PriorityLevelConfiguration))
-	})
-	return ret, err
-}
+var _ listersflowcontrolv1beta3.PriorityLevelConfigurationLister = new(priorityLevelConfigurationLister)
 
-// Get retrieves the PriorityLevelConfiguration from the indexer for a given workspace and name.
-func (s *priorityLevelConfigurationLister) Get(name string) (*flowcontrolv1beta3.PriorityLevelConfiguration, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(flowcontrolv1beta3.Resource("prioritylevelconfigurations"), name)
+// NewPriorityLevelConfigurationLister returns a new PriorityLevelConfigurationLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewPriorityLevelConfigurationLister(indexer cache.Indexer) listersflowcontrolv1beta3.PriorityLevelConfigurationLister {
+	return &priorityLevelConfigurationLister{
+		kcplisters.New[*flowcontrolv1beta3.PriorityLevelConfiguration](indexer, flowcontrolv1beta3.Resource("prioritylevelconfiguration")),
 	}
-	return obj.(*flowcontrolv1beta3.PriorityLevelConfiguration), nil
+}
+
+// priorityLevelConfigurationScopedLister can list all PriorityLevelConfigurations inside a workspace
+// or scope down to a listersflowcontrolv1beta3.PriorityLevelConfigurationNamespaceLister.
+type priorityLevelConfigurationScopedLister struct {
+	kcplisters.ResourceIndexer[*flowcontrolv1beta3.PriorityLevelConfiguration]
 }
diff --git a/listers/flowcontrol/v1beta3/prioritylevelconfiguration_expansion.go b/listers/flowcontrol/v1beta3/prioritylevelconfiguration_expansion.go
index dc4114b39..f4a6c9093 100644
--- a/listers/flowcontrol/v1beta3/prioritylevelconfiguration_expansion.go
+++ b/listers/flowcontrol/v1beta3/prioritylevelconfiguration_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/imagepolicy/v1alpha1/expansion_generated.go b/listers/imagepolicy/v1alpha1/expansion_generated.go
new file mode 100644
index 000000000..eca451197
--- /dev/null
+++ b/listers/imagepolicy/v1alpha1/expansion_generated.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// ImageReviewClusterListerExpansion allows custom methods to be added to
+// ImageReviewClusterLister.
+type ImageReviewClusterListerExpansion interface{}
diff --git a/listers/imagepolicy/v1alpha1/imagereview.go b/listers/imagepolicy/v1alpha1/imagereview.go
new file mode 100644
index 000000000..a51caaa34
--- /dev/null
+++ b/listers/imagepolicy/v1alpha1/imagereview.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	imagepolicyv1alpha1 "k8s.io/api/imagepolicy/v1alpha1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersimagepolicyv1alpha1 "k8s.io/client-go/listers/imagepolicy/v1alpha1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ImageReviewClusterLister helps list ImageReviews across all workspaces,
+// or scope down to a ImageReviewLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ImageReviewClusterLister interface {
+	// List lists all ImageReviews in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*imagepolicyv1alpha1.ImageReview, err error)
+	// Cluster returns a lister that can list and get ImageReviews in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersimagepolicyv1alpha1.ImageReviewLister
+	ImageReviewClusterListerExpansion
+}
+
+// imageReviewClusterLister implements the ImageReviewClusterLister interface.
+type imageReviewClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*imagepolicyv1alpha1.ImageReview]
+}
+
+var _ ImageReviewClusterLister = new(imageReviewClusterLister)
+
+// NewImageReviewClusterLister returns a new ImageReviewClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewImageReviewClusterLister(indexer cache.Indexer) ImageReviewClusterLister {
+	return &imageReviewClusterLister{
+		kcplisters.NewCluster[*imagepolicyv1alpha1.ImageReview](indexer, imagepolicyv1alpha1.Resource("imagereview")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ImageReviews.
+func (l *imageReviewClusterLister) Cluster(clusterName logicalcluster.Name) listersimagepolicyv1alpha1.ImageReviewLister {
+	return &imageReviewLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// imageReviewLister can list all ImageReviews inside a workspace
+// or scope down to a listersimagepolicyv1alpha1.ImageReviewNamespaceLister for one namespace.
+type imageReviewLister struct {
+	kcplisters.ResourceIndexer[*imagepolicyv1alpha1.ImageReview]
+}
+
+var _ listersimagepolicyv1alpha1.ImageReviewLister = new(imageReviewLister)
+
+// NewImageReviewLister returns a new ImageReviewLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewImageReviewLister(indexer cache.Indexer) listersimagepolicyv1alpha1.ImageReviewLister {
+	return &imageReviewLister{
+		kcplisters.New[*imagepolicyv1alpha1.ImageReview](indexer, imagepolicyv1alpha1.Resource("imagereview")),
+	}
+}
+
+// imageReviewScopedLister can list all ImageReviews inside a workspace
+// or scope down to a listersimagepolicyv1alpha1.ImageReviewNamespaceLister.
+type imageReviewScopedLister struct {
+	kcplisters.ResourceIndexer[*imagepolicyv1alpha1.ImageReview]
+}
diff --git a/listers/networking/v1/expansion_generated.go b/listers/networking/v1/expansion_generated.go
new file mode 100644
index 000000000..2db38f5d6
--- /dev/null
+++ b/listers/networking/v1/expansion_generated.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
+
+// IPAddressClusterListerExpansion allows custom methods to be added to
+// IPAddressClusterLister.
+type IPAddressClusterListerExpansion interface{}
+
+// ServiceCIDRClusterListerExpansion allows custom methods to be added to
+// ServiceCIDRClusterLister.
+type ServiceCIDRClusterListerExpansion interface{}
diff --git a/listers/networking/v1/ingress.go b/listers/networking/v1/ingress.go
index 075d51ace..1b87752e3 100644
--- a/listers/networking/v1/ingress.go
+++ b/listers/networking/v1/ingress.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1 "k8s.io/api/networking/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	networkingv1listers "k8s.io/client-go/listers/networking/v1"
+	listersnetworkingv1 "k8s.io/client-go/listers/networking/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// IngressClusterLister can list Ingresses across all workspaces, or scope down to a IngressLister for one workspace.
+// IngressClusterLister helps list Ingresses across all workspaces,
+// or scope down to a IngressLister for one workspace.
 // All objects returned here must be treated as read-only.
 type IngressClusterLister interface {
 	// List lists all Ingresses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*networkingv1.Ingress, err error)
 	// Cluster returns a lister that can list and get Ingresses in one workspace.
-	Cluster(clusterName logicalcluster.Name) networkingv1listers.IngressLister
+	Cluster(clusterName logicalcluster.Name) listersnetworkingv1.IngressLister
 	IngressClusterListerExpansion
 }
 
+// ingressClusterLister implements the IngressClusterLister interface.
 type ingressClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*networkingv1.Ingress]
 }
 
+var _ IngressClusterLister = new(ingressClusterLister)
+
 // NewIngressClusterLister returns a new IngressClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewIngressClusterLister(indexer cache.Indexer) *ingressClusterLister {
-	return &ingressClusterLister{indexer: indexer}
-}
-
-// List lists all Ingresses in the indexer across all workspaces.
-func (s *ingressClusterLister) List(selector labels.Selector) (ret []*networkingv1.Ingress, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*networkingv1.Ingress))
-	})
-	return ret, err
+func NewIngressClusterLister(indexer cache.Indexer) IngressClusterLister {
+	return &ingressClusterLister{
+		kcplisters.NewCluster[*networkingv1.Ingress](indexer, networkingv1.Resource("ingress")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Ingresses.
-func (s *ingressClusterLister) Cluster(clusterName logicalcluster.Name) networkingv1listers.IngressLister {
-	return &ingressLister{indexer: s.indexer, clusterName: clusterName}
+func (l *ingressClusterLister) Cluster(clusterName logicalcluster.Name) listersnetworkingv1.IngressLister {
+	return &ingressLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// ingressLister implements the networkingv1listers.IngressLister interface.
+// ingressLister can list all Ingresses inside a workspace
+// or scope down to a listersnetworkingv1.IngressNamespaceLister for one namespace.
 type ingressLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*networkingv1.Ingress]
 }
 
-// List lists all Ingresses in the indexer for a workspace.
-func (s *ingressLister) List(selector labels.Selector) (ret []*networkingv1.Ingress, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*networkingv1.Ingress))
-	})
-	return ret, err
-}
+var _ listersnetworkingv1.IngressLister = new(ingressLister)
 
 // Ingresses returns an object that can list and get Ingresses in one namespace.
-func (s *ingressLister) Ingresses(namespace string) networkingv1listers.IngressNamespaceLister {
-	return &ingressNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *ingressLister) Ingresses(namespace string) listersnetworkingv1.IngressNamespaceLister {
+	return &ingressNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// ingressNamespaceLister implements the networkingv1listers.IngressNamespaceLister interface.
+// ingressNamespaceLister implements the listersnetworkingv1.IngressNamespaceLister
+// interface.
 type ingressNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*networkingv1.Ingress]
 }
 
-// List lists all Ingresses in the indexer for a given workspace and namespace.
-func (s *ingressNamespaceLister) List(selector labels.Selector) (ret []*networkingv1.Ingress, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*networkingv1.Ingress))
-	})
-	return ret, err
-}
+var _ listersnetworkingv1.IngressNamespaceLister = new(ingressNamespaceLister)
 
-// Get retrieves the Ingress from the indexer for a given workspace, namespace and name.
-func (s *ingressNamespaceLister) Get(name string) (*networkingv1.Ingress, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewIngressLister returns a new IngressLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewIngressLister(indexer cache.Indexer) listersnetworkingv1.IngressLister {
+	return &ingressLister{
+		kcplisters.New[*networkingv1.Ingress](indexer, networkingv1.Resource("ingress")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(networkingv1.Resource("ingresses"), name)
+}
+
+// ingressScopedLister can list all Ingresses inside a workspace
+// or scope down to a listersnetworkingv1.IngressNamespaceLister for one namespace.
+type ingressScopedLister struct {
+	kcplisters.ResourceIndexer[*networkingv1.Ingress]
+}
+
+// Ingresses returns an object that can list and get Ingresses in one namespace.
+func (l *ingressScopedLister) Ingresses(namespace string) listersnetworkingv1.IngressLister {
+	return &ingressLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*networkingv1.Ingress), nil
 }
diff --git a/listers/networking/v1/ingress_expansion.go b/listers/networking/v1/ingress_expansion.go
index a49d30393..358c6bbcb 100644
--- a/listers/networking/v1/ingress_expansion.go
+++ b/listers/networking/v1/ingress_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/networking/v1/ingressclass.go b/listers/networking/v1/ingressclass.go
index afc7250f0..f9913cfe4 100644
--- a/listers/networking/v1/ingressclass.go
+++ b/listers/networking/v1/ingressclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1 "k8s.io/api/networking/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	networkingv1listers "k8s.io/client-go/listers/networking/v1"
+	listersnetworkingv1 "k8s.io/client-go/listers/networking/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// IngressClassClusterLister can list IngressClasses across all workspaces, or scope down to a IngressClassLister for one workspace.
+// IngressClassClusterLister helps list IngressClasses across all workspaces,
+// or scope down to a IngressClassLister for one workspace.
 // All objects returned here must be treated as read-only.
 type IngressClassClusterLister interface {
 	// List lists all IngressClasses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*networkingv1.IngressClass, err error)
 	// Cluster returns a lister that can list and get IngressClasses in one workspace.
-	Cluster(clusterName logicalcluster.Name) networkingv1listers.IngressClassLister
+	Cluster(clusterName logicalcluster.Name) listersnetworkingv1.IngressClassLister
 	IngressClassClusterListerExpansion
 }
 
+// ingressClassClusterLister implements the IngressClassClusterLister interface.
 type ingressClassClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*networkingv1.IngressClass]
 }
 
+var _ IngressClassClusterLister = new(ingressClassClusterLister)
+
 // NewIngressClassClusterLister returns a new IngressClassClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewIngressClassClusterLister(indexer cache.Indexer) *ingressClassClusterLister {
-	return &ingressClassClusterLister{indexer: indexer}
-}
-
-// List lists all IngressClasses in the indexer across all workspaces.
-func (s *ingressClassClusterLister) List(selector labels.Selector) (ret []*networkingv1.IngressClass, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*networkingv1.IngressClass))
-	})
-	return ret, err
+func NewIngressClassClusterLister(indexer cache.Indexer) IngressClassClusterLister {
+	return &ingressClassClusterLister{
+		kcplisters.NewCluster[*networkingv1.IngressClass](indexer, networkingv1.Resource("ingressclass")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get IngressClasses.
-func (s *ingressClassClusterLister) Cluster(clusterName logicalcluster.Name) networkingv1listers.IngressClassLister {
-	return &ingressClassLister{indexer: s.indexer, clusterName: clusterName}
+func (l *ingressClassClusterLister) Cluster(clusterName logicalcluster.Name) listersnetworkingv1.IngressClassLister {
+	return &ingressClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// ingressClassLister implements the networkingv1listers.IngressClassLister interface.
+// ingressClassLister can list all IngressClasses inside a workspace
+// or scope down to a listersnetworkingv1.IngressClassNamespaceLister for one namespace.
 type ingressClassLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*networkingv1.IngressClass]
 }
 
-// List lists all IngressClasses in the indexer for a workspace.
-func (s *ingressClassLister) List(selector labels.Selector) (ret []*networkingv1.IngressClass, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*networkingv1.IngressClass))
-	})
-	return ret, err
-}
+var _ listersnetworkingv1.IngressClassLister = new(ingressClassLister)
 
-// Get retrieves the IngressClass from the indexer for a given workspace and name.
-func (s *ingressClassLister) Get(name string) (*networkingv1.IngressClass, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(networkingv1.Resource("ingressclasses"), name)
+// NewIngressClassLister returns a new IngressClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewIngressClassLister(indexer cache.Indexer) listersnetworkingv1.IngressClassLister {
+	return &ingressClassLister{
+		kcplisters.New[*networkingv1.IngressClass](indexer, networkingv1.Resource("ingressclass")),
 	}
-	return obj.(*networkingv1.IngressClass), nil
+}
+
+// ingressClassScopedLister can list all IngressClasses inside a workspace
+// or scope down to a listersnetworkingv1.IngressClassNamespaceLister.
+type ingressClassScopedLister struct {
+	kcplisters.ResourceIndexer[*networkingv1.IngressClass]
 }
diff --git a/listers/networking/v1/ingressclass_expansion.go b/listers/networking/v1/ingressclass_expansion.go
index bc79925f8..18ea025e7 100644
--- a/listers/networking/v1/ingressclass_expansion.go
+++ b/listers/networking/v1/ingressclass_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/networking/v1/ipaddress.go b/listers/networking/v1/ipaddress.go
new file mode 100644
index 000000000..2757e3c77
--- /dev/null
+++ b/listers/networking/v1/ipaddress.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	networkingv1 "k8s.io/api/networking/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersnetworkingv1 "k8s.io/client-go/listers/networking/v1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// IPAddressClusterLister helps list IPAddresses across all workspaces,
+// or scope down to a IPAddressLister for one workspace.
+// All objects returned here must be treated as read-only.
+type IPAddressClusterLister interface {
+	// List lists all IPAddresses in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*networkingv1.IPAddress, err error)
+	// Cluster returns a lister that can list and get IPAddresses in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersnetworkingv1.IPAddressLister
+	IPAddressClusterListerExpansion
+}
+
+// iPAddressClusterLister implements the IPAddressClusterLister interface.
+type iPAddressClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*networkingv1.IPAddress]
+}
+
+var _ IPAddressClusterLister = new(iPAddressClusterLister)
+
+// NewIPAddressClusterLister returns a new IPAddressClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewIPAddressClusterLister(indexer cache.Indexer) IPAddressClusterLister {
+	return &iPAddressClusterLister{
+		kcplisters.NewCluster[*networkingv1.IPAddress](indexer, networkingv1.Resource("ipaddress")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get IPAddresses.
+func (l *iPAddressClusterLister) Cluster(clusterName logicalcluster.Name) listersnetworkingv1.IPAddressLister {
+	return &iPAddressLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// iPAddressLister can list all IPAddresses inside a workspace
+// or scope down to a listersnetworkingv1.IPAddressNamespaceLister for one namespace.
+type iPAddressLister struct {
+	kcplisters.ResourceIndexer[*networkingv1.IPAddress]
+}
+
+var _ listersnetworkingv1.IPAddressLister = new(iPAddressLister)
+
+// NewIPAddressLister returns a new IPAddressLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewIPAddressLister(indexer cache.Indexer) listersnetworkingv1.IPAddressLister {
+	return &iPAddressLister{
+		kcplisters.New[*networkingv1.IPAddress](indexer, networkingv1.Resource("ipaddress")),
+	}
+}
+
+// iPAddressScopedLister can list all IPAddresses inside a workspace
+// or scope down to a listersnetworkingv1.IPAddressNamespaceLister.
+type iPAddressScopedLister struct {
+	kcplisters.ResourceIndexer[*networkingv1.IPAddress]
+}
diff --git a/listers/networking/v1/networkpolicy.go b/listers/networking/v1/networkpolicy.go
index 91bbbdf0b..e95501193 100644
--- a/listers/networking/v1/networkpolicy.go
+++ b/listers/networking/v1/networkpolicy.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1 "k8s.io/api/networking/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	networkingv1listers "k8s.io/client-go/listers/networking/v1"
+	listersnetworkingv1 "k8s.io/client-go/listers/networking/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// NetworkPolicyClusterLister can list NetworkPolicies across all workspaces, or scope down to a NetworkPolicyLister for one workspace.
+// NetworkPolicyClusterLister helps list NetworkPolicies across all workspaces,
+// or scope down to a NetworkPolicyLister for one workspace.
 // All objects returned here must be treated as read-only.
 type NetworkPolicyClusterLister interface {
 	// List lists all NetworkPolicies in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*networkingv1.NetworkPolicy, err error)
 	// Cluster returns a lister that can list and get NetworkPolicies in one workspace.
-	Cluster(clusterName logicalcluster.Name) networkingv1listers.NetworkPolicyLister
+	Cluster(clusterName logicalcluster.Name) listersnetworkingv1.NetworkPolicyLister
 	NetworkPolicyClusterListerExpansion
 }
 
+// networkPolicyClusterLister implements the NetworkPolicyClusterLister interface.
 type networkPolicyClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*networkingv1.NetworkPolicy]
 }
 
+var _ NetworkPolicyClusterLister = new(networkPolicyClusterLister)
+
 // NewNetworkPolicyClusterLister returns a new NetworkPolicyClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewNetworkPolicyClusterLister(indexer cache.Indexer) *networkPolicyClusterLister {
-	return &networkPolicyClusterLister{indexer: indexer}
-}
-
-// List lists all NetworkPolicies in the indexer across all workspaces.
-func (s *networkPolicyClusterLister) List(selector labels.Selector) (ret []*networkingv1.NetworkPolicy, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*networkingv1.NetworkPolicy))
-	})
-	return ret, err
+func NewNetworkPolicyClusterLister(indexer cache.Indexer) NetworkPolicyClusterLister {
+	return &networkPolicyClusterLister{
+		kcplisters.NewCluster[*networkingv1.NetworkPolicy](indexer, networkingv1.Resource("networkpolicy")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get NetworkPolicies.
-func (s *networkPolicyClusterLister) Cluster(clusterName logicalcluster.Name) networkingv1listers.NetworkPolicyLister {
-	return &networkPolicyLister{indexer: s.indexer, clusterName: clusterName}
+func (l *networkPolicyClusterLister) Cluster(clusterName logicalcluster.Name) listersnetworkingv1.NetworkPolicyLister {
+	return &networkPolicyLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// networkPolicyLister implements the networkingv1listers.NetworkPolicyLister interface.
+// networkPolicyLister can list all NetworkPolicies inside a workspace
+// or scope down to a listersnetworkingv1.NetworkPolicyNamespaceLister for one namespace.
 type networkPolicyLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*networkingv1.NetworkPolicy]
 }
 
-// List lists all NetworkPolicies in the indexer for a workspace.
-func (s *networkPolicyLister) List(selector labels.Selector) (ret []*networkingv1.NetworkPolicy, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*networkingv1.NetworkPolicy))
-	})
-	return ret, err
-}
+var _ listersnetworkingv1.NetworkPolicyLister = new(networkPolicyLister)
 
 // NetworkPolicies returns an object that can list and get NetworkPolicies in one namespace.
-func (s *networkPolicyLister) NetworkPolicies(namespace string) networkingv1listers.NetworkPolicyNamespaceLister {
-	return &networkPolicyNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *networkPolicyLister) NetworkPolicies(namespace string) listersnetworkingv1.NetworkPolicyNamespaceLister {
+	return &networkPolicyNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// networkPolicyNamespaceLister implements the networkingv1listers.NetworkPolicyNamespaceLister interface.
+// networkPolicyNamespaceLister implements the listersnetworkingv1.NetworkPolicyNamespaceLister
+// interface.
 type networkPolicyNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*networkingv1.NetworkPolicy]
 }
 
-// List lists all NetworkPolicies in the indexer for a given workspace and namespace.
-func (s *networkPolicyNamespaceLister) List(selector labels.Selector) (ret []*networkingv1.NetworkPolicy, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*networkingv1.NetworkPolicy))
-	})
-	return ret, err
-}
+var _ listersnetworkingv1.NetworkPolicyNamespaceLister = new(networkPolicyNamespaceLister)
 
-// Get retrieves the NetworkPolicy from the indexer for a given workspace, namespace and name.
-func (s *networkPolicyNamespaceLister) Get(name string) (*networkingv1.NetworkPolicy, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewNetworkPolicyLister returns a new NetworkPolicyLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewNetworkPolicyLister(indexer cache.Indexer) listersnetworkingv1.NetworkPolicyLister {
+	return &networkPolicyLister{
+		kcplisters.New[*networkingv1.NetworkPolicy](indexer, networkingv1.Resource("networkpolicy")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(networkingv1.Resource("networkpolicies"), name)
+}
+
+// networkPolicyScopedLister can list all NetworkPolicies inside a workspace
+// or scope down to a listersnetworkingv1.NetworkPolicyNamespaceLister for one namespace.
+type networkPolicyScopedLister struct {
+	kcplisters.ResourceIndexer[*networkingv1.NetworkPolicy]
+}
+
+// NetworkPolicies returns an object that can list and get NetworkPolicies in one namespace.
+func (l *networkPolicyScopedLister) NetworkPolicies(namespace string) listersnetworkingv1.NetworkPolicyLister {
+	return &networkPolicyLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*networkingv1.NetworkPolicy), nil
 }
diff --git a/listers/networking/v1/networkpolicy_expansion.go b/listers/networking/v1/networkpolicy_expansion.go
index 593162319..c2a0cf702 100644
--- a/listers/networking/v1/networkpolicy_expansion.go
+++ b/listers/networking/v1/networkpolicy_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/networking/v1/servicecidr.go b/listers/networking/v1/servicecidr.go
new file mode 100644
index 000000000..211d6210c
--- /dev/null
+++ b/listers/networking/v1/servicecidr.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	networkingv1 "k8s.io/api/networking/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersnetworkingv1 "k8s.io/client-go/listers/networking/v1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ServiceCIDRClusterLister helps list ServiceCIDRs across all workspaces,
+// or scope down to a ServiceCIDRLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ServiceCIDRClusterLister interface {
+	// List lists all ServiceCIDRs in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*networkingv1.ServiceCIDR, err error)
+	// Cluster returns a lister that can list and get ServiceCIDRs in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersnetworkingv1.ServiceCIDRLister
+	ServiceCIDRClusterListerExpansion
+}
+
+// serviceCIDRClusterLister implements the ServiceCIDRClusterLister interface.
+type serviceCIDRClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*networkingv1.ServiceCIDR]
+}
+
+var _ ServiceCIDRClusterLister = new(serviceCIDRClusterLister)
+
+// NewServiceCIDRClusterLister returns a new ServiceCIDRClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewServiceCIDRClusterLister(indexer cache.Indexer) ServiceCIDRClusterLister {
+	return &serviceCIDRClusterLister{
+		kcplisters.NewCluster[*networkingv1.ServiceCIDR](indexer, networkingv1.Resource("servicecidr")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ServiceCIDRs.
+func (l *serviceCIDRClusterLister) Cluster(clusterName logicalcluster.Name) listersnetworkingv1.ServiceCIDRLister {
+	return &serviceCIDRLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// serviceCIDRLister can list all ServiceCIDRs inside a workspace
+// or scope down to a listersnetworkingv1.ServiceCIDRNamespaceLister for one namespace.
+type serviceCIDRLister struct {
+	kcplisters.ResourceIndexer[*networkingv1.ServiceCIDR]
+}
+
+var _ listersnetworkingv1.ServiceCIDRLister = new(serviceCIDRLister)
+
+// NewServiceCIDRLister returns a new ServiceCIDRLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewServiceCIDRLister(indexer cache.Indexer) listersnetworkingv1.ServiceCIDRLister {
+	return &serviceCIDRLister{
+		kcplisters.New[*networkingv1.ServiceCIDR](indexer, networkingv1.Resource("servicecidr")),
+	}
+}
+
+// serviceCIDRScopedLister can list all ServiceCIDRs inside a workspace
+// or scope down to a listersnetworkingv1.ServiceCIDRNamespaceLister.
+type serviceCIDRScopedLister struct {
+	kcplisters.ResourceIndexer[*networkingv1.ServiceCIDR]
+}
diff --git a/listers/networking/v1alpha1/clustercidr.go b/listers/networking/v1alpha1/clustercidr.go
deleted file mode 100644
index ef9fa963f..000000000
--- a/listers/networking/v1alpha1/clustercidr.go
+++ /dev/null
@@ -1,97 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	networkingv1alpha1 "k8s.io/api/networking/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	networkingv1alpha1listers "k8s.io/client-go/listers/networking/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-)
-
-// ClusterCIDRClusterLister can list ClusterCIDRs across all workspaces, or scope down to a ClusterCIDRLister for one workspace.
-// All objects returned here must be treated as read-only.
-type ClusterCIDRClusterLister interface {
-	// List lists all ClusterCIDRs in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*networkingv1alpha1.ClusterCIDR, err error)
-	// Cluster returns a lister that can list and get ClusterCIDRs in one workspace.
-	Cluster(clusterName logicalcluster.Name) networkingv1alpha1listers.ClusterCIDRLister
-	ClusterCIDRClusterListerExpansion
-}
-
-type clusterCIDRClusterLister struct {
-	indexer cache.Indexer
-}
-
-// NewClusterCIDRClusterLister returns a new ClusterCIDRClusterLister.
-// We assume that the indexer:
-// - is fed by a cross-workspace LIST+WATCH
-// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
-// - has the kcpcache.ClusterIndex as an index
-func NewClusterCIDRClusterLister(indexer cache.Indexer) *clusterCIDRClusterLister {
-	return &clusterCIDRClusterLister{indexer: indexer}
-}
-
-// List lists all ClusterCIDRs in the indexer across all workspaces.
-func (s *clusterCIDRClusterLister) List(selector labels.Selector) (ret []*networkingv1alpha1.ClusterCIDR, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*networkingv1alpha1.ClusterCIDR))
-	})
-	return ret, err
-}
-
-// Cluster scopes the lister to one workspace, allowing users to list and get ClusterCIDRs.
-func (s *clusterCIDRClusterLister) Cluster(clusterName logicalcluster.Name) networkingv1alpha1listers.ClusterCIDRLister {
-	return &clusterCIDRLister{indexer: s.indexer, clusterName: clusterName}
-}
-
-// clusterCIDRLister implements the networkingv1alpha1listers.ClusterCIDRLister interface.
-type clusterCIDRLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-}
-
-// List lists all ClusterCIDRs in the indexer for a workspace.
-func (s *clusterCIDRLister) List(selector labels.Selector) (ret []*networkingv1alpha1.ClusterCIDR, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*networkingv1alpha1.ClusterCIDR))
-	})
-	return ret, err
-}
-
-// Get retrieves the ClusterCIDR from the indexer for a given workspace and name.
-func (s *clusterCIDRLister) Get(name string) (*networkingv1alpha1.ClusterCIDR, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(networkingv1alpha1.Resource("clustercidrs"), name)
-	}
-	return obj.(*networkingv1alpha1.ClusterCIDR), nil
-}
diff --git a/listers/networking/v1alpha1/expansion_generated.go b/listers/networking/v1alpha1/expansion_generated.go
new file mode 100644
index 000000000..3b8521c00
--- /dev/null
+++ b/listers/networking/v1alpha1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
diff --git a/listers/networking/v1alpha1/ipaddress.go b/listers/networking/v1alpha1/ipaddress.go
new file mode 100644
index 000000000..357e93551
--- /dev/null
+++ b/listers/networking/v1alpha1/ipaddress.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	networkingv1alpha1 "k8s.io/api/networking/v1alpha1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersnetworkingv1alpha1 "k8s.io/client-go/listers/networking/v1alpha1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// IPAddressClusterLister helps list IPAddresses across all workspaces,
+// or scope down to a IPAddressLister for one workspace.
+// All objects returned here must be treated as read-only.
+type IPAddressClusterLister interface {
+	// List lists all IPAddresses in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*networkingv1alpha1.IPAddress, err error)
+	// Cluster returns a lister that can list and get IPAddresses in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersnetworkingv1alpha1.IPAddressLister
+	IPAddressClusterListerExpansion
+}
+
+// iPAddressClusterLister implements the IPAddressClusterLister interface.
+type iPAddressClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*networkingv1alpha1.IPAddress]
+}
+
+var _ IPAddressClusterLister = new(iPAddressClusterLister)
+
+// NewIPAddressClusterLister returns a new IPAddressClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewIPAddressClusterLister(indexer cache.Indexer) IPAddressClusterLister {
+	return &iPAddressClusterLister{
+		kcplisters.NewCluster[*networkingv1alpha1.IPAddress](indexer, networkingv1alpha1.Resource("ipaddress")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get IPAddresses.
+func (l *iPAddressClusterLister) Cluster(clusterName logicalcluster.Name) listersnetworkingv1alpha1.IPAddressLister {
+	return &iPAddressLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// iPAddressLister can list all IPAddresses inside a workspace
+// or scope down to a listersnetworkingv1alpha1.IPAddressNamespaceLister for one namespace.
+type iPAddressLister struct {
+	kcplisters.ResourceIndexer[*networkingv1alpha1.IPAddress]
+}
+
+var _ listersnetworkingv1alpha1.IPAddressLister = new(iPAddressLister)
+
+// NewIPAddressLister returns a new IPAddressLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewIPAddressLister(indexer cache.Indexer) listersnetworkingv1alpha1.IPAddressLister {
+	return &iPAddressLister{
+		kcplisters.New[*networkingv1alpha1.IPAddress](indexer, networkingv1alpha1.Resource("ipaddress")),
+	}
+}
+
+// iPAddressScopedLister can list all IPAddresses inside a workspace
+// or scope down to a listersnetworkingv1alpha1.IPAddressNamespaceLister.
+type iPAddressScopedLister struct {
+	kcplisters.ResourceIndexer[*networkingv1alpha1.IPAddress]
+}
diff --git a/listers/networking/v1alpha1/ipaddress_expansion.go b/listers/networking/v1alpha1/ipaddress_expansion.go
new file mode 100644
index 000000000..c97c40707
--- /dev/null
+++ b/listers/networking/v1alpha1/ipaddress_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1alpha1
+
+// IPAddressClusterListerExpansion allows custom methods to be added to IPAddressClusterLister.
+type IPAddressClusterListerExpansion interface{}
diff --git a/listers/networking/v1alpha1/servicecidr.go b/listers/networking/v1alpha1/servicecidr.go
new file mode 100644
index 000000000..5b1115855
--- /dev/null
+++ b/listers/networking/v1alpha1/servicecidr.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	networkingv1alpha1 "k8s.io/api/networking/v1alpha1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersnetworkingv1alpha1 "k8s.io/client-go/listers/networking/v1alpha1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ServiceCIDRClusterLister helps list ServiceCIDRs across all workspaces,
+// or scope down to a ServiceCIDRLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ServiceCIDRClusterLister interface {
+	// List lists all ServiceCIDRs in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*networkingv1alpha1.ServiceCIDR, err error)
+	// Cluster returns a lister that can list and get ServiceCIDRs in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersnetworkingv1alpha1.ServiceCIDRLister
+	ServiceCIDRClusterListerExpansion
+}
+
+// serviceCIDRClusterLister implements the ServiceCIDRClusterLister interface.
+type serviceCIDRClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*networkingv1alpha1.ServiceCIDR]
+}
+
+var _ ServiceCIDRClusterLister = new(serviceCIDRClusterLister)
+
+// NewServiceCIDRClusterLister returns a new ServiceCIDRClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewServiceCIDRClusterLister(indexer cache.Indexer) ServiceCIDRClusterLister {
+	return &serviceCIDRClusterLister{
+		kcplisters.NewCluster[*networkingv1alpha1.ServiceCIDR](indexer, networkingv1alpha1.Resource("servicecidr")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ServiceCIDRs.
+func (l *serviceCIDRClusterLister) Cluster(clusterName logicalcluster.Name) listersnetworkingv1alpha1.ServiceCIDRLister {
+	return &serviceCIDRLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// serviceCIDRLister can list all ServiceCIDRs inside a workspace
+// or scope down to a listersnetworkingv1alpha1.ServiceCIDRNamespaceLister for one namespace.
+type serviceCIDRLister struct {
+	kcplisters.ResourceIndexer[*networkingv1alpha1.ServiceCIDR]
+}
+
+var _ listersnetworkingv1alpha1.ServiceCIDRLister = new(serviceCIDRLister)
+
+// NewServiceCIDRLister returns a new ServiceCIDRLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewServiceCIDRLister(indexer cache.Indexer) listersnetworkingv1alpha1.ServiceCIDRLister {
+	return &serviceCIDRLister{
+		kcplisters.New[*networkingv1alpha1.ServiceCIDR](indexer, networkingv1alpha1.Resource("servicecidr")),
+	}
+}
+
+// serviceCIDRScopedLister can list all ServiceCIDRs inside a workspace
+// or scope down to a listersnetworkingv1alpha1.ServiceCIDRNamespaceLister.
+type serviceCIDRScopedLister struct {
+	kcplisters.ResourceIndexer[*networkingv1alpha1.ServiceCIDR]
+}
diff --git a/listers/networking/v1alpha1/servicecidr_expansion.go b/listers/networking/v1alpha1/servicecidr_expansion.go
new file mode 100644
index 000000000..2d504c619
--- /dev/null
+++ b/listers/networking/v1alpha1/servicecidr_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1alpha1
+
+// ServiceCIDRClusterListerExpansion allows custom methods to be added to ServiceCIDRClusterLister.
+type ServiceCIDRClusterListerExpansion interface{}
diff --git a/listers/networking/v1beta1/expansion_generated.go b/listers/networking/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/networking/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/networking/v1beta1/ingress.go b/listers/networking/v1beta1/ingress.go
index 4b6c38cd6..f6783f25b 100644
--- a/listers/networking/v1beta1/ingress.go
+++ b/listers/networking/v1beta1/ingress.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1beta1 "k8s.io/api/networking/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	networkingv1beta1listers "k8s.io/client-go/listers/networking/v1beta1"
+	listersnetworkingv1beta1 "k8s.io/client-go/listers/networking/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// IngressClusterLister can list Ingresses across all workspaces, or scope down to a IngressLister for one workspace.
+// IngressClusterLister helps list Ingresses across all workspaces,
+// or scope down to a IngressLister for one workspace.
 // All objects returned here must be treated as read-only.
 type IngressClusterLister interface {
 	// List lists all Ingresses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*networkingv1beta1.Ingress, err error)
 	// Cluster returns a lister that can list and get Ingresses in one workspace.
-	Cluster(clusterName logicalcluster.Name) networkingv1beta1listers.IngressLister
+	Cluster(clusterName logicalcluster.Name) listersnetworkingv1beta1.IngressLister
 	IngressClusterListerExpansion
 }
 
+// ingressClusterLister implements the IngressClusterLister interface.
 type ingressClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*networkingv1beta1.Ingress]
 }
 
+var _ IngressClusterLister = new(ingressClusterLister)
+
 // NewIngressClusterLister returns a new IngressClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewIngressClusterLister(indexer cache.Indexer) *ingressClusterLister {
-	return &ingressClusterLister{indexer: indexer}
-}
-
-// List lists all Ingresses in the indexer across all workspaces.
-func (s *ingressClusterLister) List(selector labels.Selector) (ret []*networkingv1beta1.Ingress, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*networkingv1beta1.Ingress))
-	})
-	return ret, err
+func NewIngressClusterLister(indexer cache.Indexer) IngressClusterLister {
+	return &ingressClusterLister{
+		kcplisters.NewCluster[*networkingv1beta1.Ingress](indexer, networkingv1beta1.Resource("ingress")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Ingresses.
-func (s *ingressClusterLister) Cluster(clusterName logicalcluster.Name) networkingv1beta1listers.IngressLister {
-	return &ingressLister{indexer: s.indexer, clusterName: clusterName}
+func (l *ingressClusterLister) Cluster(clusterName logicalcluster.Name) listersnetworkingv1beta1.IngressLister {
+	return &ingressLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// ingressLister implements the networkingv1beta1listers.IngressLister interface.
+// ingressLister can list all Ingresses inside a workspace
+// or scope down to a listersnetworkingv1beta1.IngressNamespaceLister for one namespace.
 type ingressLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*networkingv1beta1.Ingress]
 }
 
-// List lists all Ingresses in the indexer for a workspace.
-func (s *ingressLister) List(selector labels.Selector) (ret []*networkingv1beta1.Ingress, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*networkingv1beta1.Ingress))
-	})
-	return ret, err
-}
+var _ listersnetworkingv1beta1.IngressLister = new(ingressLister)
 
 // Ingresses returns an object that can list and get Ingresses in one namespace.
-func (s *ingressLister) Ingresses(namespace string) networkingv1beta1listers.IngressNamespaceLister {
-	return &ingressNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *ingressLister) Ingresses(namespace string) listersnetworkingv1beta1.IngressNamespaceLister {
+	return &ingressNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// ingressNamespaceLister implements the networkingv1beta1listers.IngressNamespaceLister interface.
+// ingressNamespaceLister implements the listersnetworkingv1beta1.IngressNamespaceLister
+// interface.
 type ingressNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*networkingv1beta1.Ingress]
 }
 
-// List lists all Ingresses in the indexer for a given workspace and namespace.
-func (s *ingressNamespaceLister) List(selector labels.Selector) (ret []*networkingv1beta1.Ingress, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*networkingv1beta1.Ingress))
-	})
-	return ret, err
-}
+var _ listersnetworkingv1beta1.IngressNamespaceLister = new(ingressNamespaceLister)
 
-// Get retrieves the Ingress from the indexer for a given workspace, namespace and name.
-func (s *ingressNamespaceLister) Get(name string) (*networkingv1beta1.Ingress, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewIngressLister returns a new IngressLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewIngressLister(indexer cache.Indexer) listersnetworkingv1beta1.IngressLister {
+	return &ingressLister{
+		kcplisters.New[*networkingv1beta1.Ingress](indexer, networkingv1beta1.Resource("ingress")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(networkingv1beta1.Resource("ingresses"), name)
+}
+
+// ingressScopedLister can list all Ingresses inside a workspace
+// or scope down to a listersnetworkingv1beta1.IngressNamespaceLister for one namespace.
+type ingressScopedLister struct {
+	kcplisters.ResourceIndexer[*networkingv1beta1.Ingress]
+}
+
+// Ingresses returns an object that can list and get Ingresses in one namespace.
+func (l *ingressScopedLister) Ingresses(namespace string) listersnetworkingv1beta1.IngressLister {
+	return &ingressLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*networkingv1beta1.Ingress), nil
 }
diff --git a/listers/networking/v1beta1/ingress_expansion.go b/listers/networking/v1beta1/ingress_expansion.go
index 4f130cdf8..d81ed6bcc 100644
--- a/listers/networking/v1beta1/ingress_expansion.go
+++ b/listers/networking/v1beta1/ingress_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/networking/v1beta1/ingressclass.go b/listers/networking/v1beta1/ingressclass.go
index fbbc86f69..526807a68 100644
--- a/listers/networking/v1beta1/ingressclass.go
+++ b/listers/networking/v1beta1/ingressclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	networkingv1beta1 "k8s.io/api/networking/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	networkingv1beta1listers "k8s.io/client-go/listers/networking/v1beta1"
+	listersnetworkingv1beta1 "k8s.io/client-go/listers/networking/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// IngressClassClusterLister can list IngressClasses across all workspaces, or scope down to a IngressClassLister for one workspace.
+// IngressClassClusterLister helps list IngressClasses across all workspaces,
+// or scope down to a IngressClassLister for one workspace.
 // All objects returned here must be treated as read-only.
 type IngressClassClusterLister interface {
 	// List lists all IngressClasses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*networkingv1beta1.IngressClass, err error)
 	// Cluster returns a lister that can list and get IngressClasses in one workspace.
-	Cluster(clusterName logicalcluster.Name) networkingv1beta1listers.IngressClassLister
+	Cluster(clusterName logicalcluster.Name) listersnetworkingv1beta1.IngressClassLister
 	IngressClassClusterListerExpansion
 }
 
+// ingressClassClusterLister implements the IngressClassClusterLister interface.
 type ingressClassClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*networkingv1beta1.IngressClass]
 }
 
+var _ IngressClassClusterLister = new(ingressClassClusterLister)
+
 // NewIngressClassClusterLister returns a new IngressClassClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewIngressClassClusterLister(indexer cache.Indexer) *ingressClassClusterLister {
-	return &ingressClassClusterLister{indexer: indexer}
-}
-
-// List lists all IngressClasses in the indexer across all workspaces.
-func (s *ingressClassClusterLister) List(selector labels.Selector) (ret []*networkingv1beta1.IngressClass, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*networkingv1beta1.IngressClass))
-	})
-	return ret, err
+func NewIngressClassClusterLister(indexer cache.Indexer) IngressClassClusterLister {
+	return &ingressClassClusterLister{
+		kcplisters.NewCluster[*networkingv1beta1.IngressClass](indexer, networkingv1beta1.Resource("ingressclass")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get IngressClasses.
-func (s *ingressClassClusterLister) Cluster(clusterName logicalcluster.Name) networkingv1beta1listers.IngressClassLister {
-	return &ingressClassLister{indexer: s.indexer, clusterName: clusterName}
+func (l *ingressClassClusterLister) Cluster(clusterName logicalcluster.Name) listersnetworkingv1beta1.IngressClassLister {
+	return &ingressClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// ingressClassLister implements the networkingv1beta1listers.IngressClassLister interface.
+// ingressClassLister can list all IngressClasses inside a workspace
+// or scope down to a listersnetworkingv1beta1.IngressClassNamespaceLister for one namespace.
 type ingressClassLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*networkingv1beta1.IngressClass]
 }
 
-// List lists all IngressClasses in the indexer for a workspace.
-func (s *ingressClassLister) List(selector labels.Selector) (ret []*networkingv1beta1.IngressClass, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*networkingv1beta1.IngressClass))
-	})
-	return ret, err
-}
+var _ listersnetworkingv1beta1.IngressClassLister = new(ingressClassLister)
 
-// Get retrieves the IngressClass from the indexer for a given workspace and name.
-func (s *ingressClassLister) Get(name string) (*networkingv1beta1.IngressClass, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(networkingv1beta1.Resource("ingressclasses"), name)
+// NewIngressClassLister returns a new IngressClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewIngressClassLister(indexer cache.Indexer) listersnetworkingv1beta1.IngressClassLister {
+	return &ingressClassLister{
+		kcplisters.New[*networkingv1beta1.IngressClass](indexer, networkingv1beta1.Resource("ingressclass")),
 	}
-	return obj.(*networkingv1beta1.IngressClass), nil
+}
+
+// ingressClassScopedLister can list all IngressClasses inside a workspace
+// or scope down to a listersnetworkingv1beta1.IngressClassNamespaceLister.
+type ingressClassScopedLister struct {
+	kcplisters.ResourceIndexer[*networkingv1beta1.IngressClass]
 }
diff --git a/listers/networking/v1beta1/ingressclass_expansion.go b/listers/networking/v1beta1/ingressclass_expansion.go
index c0ab6ad6f..0ac483f43 100644
--- a/listers/networking/v1beta1/ingressclass_expansion.go
+++ b/listers/networking/v1beta1/ingressclass_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/networking/v1beta1/ipaddress.go b/listers/networking/v1beta1/ipaddress.go
new file mode 100644
index 000000000..0afdaff90
--- /dev/null
+++ b/listers/networking/v1beta1/ipaddress.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	networkingv1beta1 "k8s.io/api/networking/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersnetworkingv1beta1 "k8s.io/client-go/listers/networking/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// IPAddressClusterLister helps list IPAddresses across all workspaces,
+// or scope down to a IPAddressLister for one workspace.
+// All objects returned here must be treated as read-only.
+type IPAddressClusterLister interface {
+	// List lists all IPAddresses in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*networkingv1beta1.IPAddress, err error)
+	// Cluster returns a lister that can list and get IPAddresses in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersnetworkingv1beta1.IPAddressLister
+	IPAddressClusterListerExpansion
+}
+
+// iPAddressClusterLister implements the IPAddressClusterLister interface.
+type iPAddressClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*networkingv1beta1.IPAddress]
+}
+
+var _ IPAddressClusterLister = new(iPAddressClusterLister)
+
+// NewIPAddressClusterLister returns a new IPAddressClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewIPAddressClusterLister(indexer cache.Indexer) IPAddressClusterLister {
+	return &iPAddressClusterLister{
+		kcplisters.NewCluster[*networkingv1beta1.IPAddress](indexer, networkingv1beta1.Resource("ipaddress")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get IPAddresses.
+func (l *iPAddressClusterLister) Cluster(clusterName logicalcluster.Name) listersnetworkingv1beta1.IPAddressLister {
+	return &iPAddressLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// iPAddressLister can list all IPAddresses inside a workspace
+// or scope down to a listersnetworkingv1beta1.IPAddressNamespaceLister for one namespace.
+type iPAddressLister struct {
+	kcplisters.ResourceIndexer[*networkingv1beta1.IPAddress]
+}
+
+var _ listersnetworkingv1beta1.IPAddressLister = new(iPAddressLister)
+
+// NewIPAddressLister returns a new IPAddressLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewIPAddressLister(indexer cache.Indexer) listersnetworkingv1beta1.IPAddressLister {
+	return &iPAddressLister{
+		kcplisters.New[*networkingv1beta1.IPAddress](indexer, networkingv1beta1.Resource("ipaddress")),
+	}
+}
+
+// iPAddressScopedLister can list all IPAddresses inside a workspace
+// or scope down to a listersnetworkingv1beta1.IPAddressNamespaceLister.
+type iPAddressScopedLister struct {
+	kcplisters.ResourceIndexer[*networkingv1beta1.IPAddress]
+}
diff --git a/listers/networking/v1beta1/ipaddress_expansion.go b/listers/networking/v1beta1/ipaddress_expansion.go
new file mode 100644
index 000000000..ad0016d09
--- /dev/null
+++ b/listers/networking/v1beta1/ipaddress_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1beta1
+
+// IPAddressClusterListerExpansion allows custom methods to be added to IPAddressClusterLister.
+type IPAddressClusterListerExpansion interface{}
diff --git a/listers/networking/v1beta1/servicecidr.go b/listers/networking/v1beta1/servicecidr.go
new file mode 100644
index 000000000..00d7a884a
--- /dev/null
+++ b/listers/networking/v1beta1/servicecidr.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	networkingv1beta1 "k8s.io/api/networking/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersnetworkingv1beta1 "k8s.io/client-go/listers/networking/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ServiceCIDRClusterLister helps list ServiceCIDRs across all workspaces,
+// or scope down to a ServiceCIDRLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ServiceCIDRClusterLister interface {
+	// List lists all ServiceCIDRs in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*networkingv1beta1.ServiceCIDR, err error)
+	// Cluster returns a lister that can list and get ServiceCIDRs in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersnetworkingv1beta1.ServiceCIDRLister
+	ServiceCIDRClusterListerExpansion
+}
+
+// serviceCIDRClusterLister implements the ServiceCIDRClusterLister interface.
+type serviceCIDRClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*networkingv1beta1.ServiceCIDR]
+}
+
+var _ ServiceCIDRClusterLister = new(serviceCIDRClusterLister)
+
+// NewServiceCIDRClusterLister returns a new ServiceCIDRClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewServiceCIDRClusterLister(indexer cache.Indexer) ServiceCIDRClusterLister {
+	return &serviceCIDRClusterLister{
+		kcplisters.NewCluster[*networkingv1beta1.ServiceCIDR](indexer, networkingv1beta1.Resource("servicecidr")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ServiceCIDRs.
+func (l *serviceCIDRClusterLister) Cluster(clusterName logicalcluster.Name) listersnetworkingv1beta1.ServiceCIDRLister {
+	return &serviceCIDRLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// serviceCIDRLister can list all ServiceCIDRs inside a workspace
+// or scope down to a listersnetworkingv1beta1.ServiceCIDRNamespaceLister for one namespace.
+type serviceCIDRLister struct {
+	kcplisters.ResourceIndexer[*networkingv1beta1.ServiceCIDR]
+}
+
+var _ listersnetworkingv1beta1.ServiceCIDRLister = new(serviceCIDRLister)
+
+// NewServiceCIDRLister returns a new ServiceCIDRLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewServiceCIDRLister(indexer cache.Indexer) listersnetworkingv1beta1.ServiceCIDRLister {
+	return &serviceCIDRLister{
+		kcplisters.New[*networkingv1beta1.ServiceCIDR](indexer, networkingv1beta1.Resource("servicecidr")),
+	}
+}
+
+// serviceCIDRScopedLister can list all ServiceCIDRs inside a workspace
+// or scope down to a listersnetworkingv1beta1.ServiceCIDRNamespaceLister.
+type serviceCIDRScopedLister struct {
+	kcplisters.ResourceIndexer[*networkingv1beta1.ServiceCIDR]
+}
diff --git a/listers/networking/v1beta1/servicecidr_expansion.go b/listers/networking/v1beta1/servicecidr_expansion.go
new file mode 100644
index 000000000..b14065b30
--- /dev/null
+++ b/listers/networking/v1beta1/servicecidr_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1beta1
+
+// ServiceCIDRClusterListerExpansion allows custom methods to be added to ServiceCIDRClusterLister.
+type ServiceCIDRClusterListerExpansion interface{}
diff --git a/listers/node/v1/expansion_generated.go b/listers/node/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/node/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/node/v1/runtimeclass.go b/listers/node/v1/runtimeclass.go
index ac4a56ce4..72b543a81 100644
--- a/listers/node/v1/runtimeclass.go
+++ b/listers/node/v1/runtimeclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	nodev1 "k8s.io/api/node/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	nodev1listers "k8s.io/client-go/listers/node/v1"
+	listersnodev1 "k8s.io/client-go/listers/node/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// RuntimeClassClusterLister can list RuntimeClasses across all workspaces, or scope down to a RuntimeClassLister for one workspace.
+// RuntimeClassClusterLister helps list RuntimeClasses across all workspaces,
+// or scope down to a RuntimeClassLister for one workspace.
 // All objects returned here must be treated as read-only.
 type RuntimeClassClusterLister interface {
 	// List lists all RuntimeClasses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*nodev1.RuntimeClass, err error)
 	// Cluster returns a lister that can list and get RuntimeClasses in one workspace.
-	Cluster(clusterName logicalcluster.Name) nodev1listers.RuntimeClassLister
+	Cluster(clusterName logicalcluster.Name) listersnodev1.RuntimeClassLister
 	RuntimeClassClusterListerExpansion
 }
 
+// runtimeClassClusterLister implements the RuntimeClassClusterLister interface.
 type runtimeClassClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*nodev1.RuntimeClass]
 }
 
+var _ RuntimeClassClusterLister = new(runtimeClassClusterLister)
+
 // NewRuntimeClassClusterLister returns a new RuntimeClassClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewRuntimeClassClusterLister(indexer cache.Indexer) *runtimeClassClusterLister {
-	return &runtimeClassClusterLister{indexer: indexer}
-}
-
-// List lists all RuntimeClasses in the indexer across all workspaces.
-func (s *runtimeClassClusterLister) List(selector labels.Selector) (ret []*nodev1.RuntimeClass, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*nodev1.RuntimeClass))
-	})
-	return ret, err
+func NewRuntimeClassClusterLister(indexer cache.Indexer) RuntimeClassClusterLister {
+	return &runtimeClassClusterLister{
+		kcplisters.NewCluster[*nodev1.RuntimeClass](indexer, nodev1.Resource("runtimeclass")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get RuntimeClasses.
-func (s *runtimeClassClusterLister) Cluster(clusterName logicalcluster.Name) nodev1listers.RuntimeClassLister {
-	return &runtimeClassLister{indexer: s.indexer, clusterName: clusterName}
+func (l *runtimeClassClusterLister) Cluster(clusterName logicalcluster.Name) listersnodev1.RuntimeClassLister {
+	return &runtimeClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// runtimeClassLister implements the nodev1listers.RuntimeClassLister interface.
+// runtimeClassLister can list all RuntimeClasses inside a workspace
+// or scope down to a listersnodev1.RuntimeClassNamespaceLister for one namespace.
 type runtimeClassLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*nodev1.RuntimeClass]
 }
 
-// List lists all RuntimeClasses in the indexer for a workspace.
-func (s *runtimeClassLister) List(selector labels.Selector) (ret []*nodev1.RuntimeClass, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*nodev1.RuntimeClass))
-	})
-	return ret, err
-}
+var _ listersnodev1.RuntimeClassLister = new(runtimeClassLister)
 
-// Get retrieves the RuntimeClass from the indexer for a given workspace and name.
-func (s *runtimeClassLister) Get(name string) (*nodev1.RuntimeClass, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(nodev1.Resource("runtimeclasses"), name)
+// NewRuntimeClassLister returns a new RuntimeClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewRuntimeClassLister(indexer cache.Indexer) listersnodev1.RuntimeClassLister {
+	return &runtimeClassLister{
+		kcplisters.New[*nodev1.RuntimeClass](indexer, nodev1.Resource("runtimeclass")),
 	}
-	return obj.(*nodev1.RuntimeClass), nil
+}
+
+// runtimeClassScopedLister can list all RuntimeClasses inside a workspace
+// or scope down to a listersnodev1.RuntimeClassNamespaceLister.
+type runtimeClassScopedLister struct {
+	kcplisters.ResourceIndexer[*nodev1.RuntimeClass]
 }
diff --git a/listers/node/v1/runtimeclass_expansion.go b/listers/node/v1/runtimeclass_expansion.go
index dc580f2e8..119137cef 100644
--- a/listers/node/v1/runtimeclass_expansion.go
+++ b/listers/node/v1/runtimeclass_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/node/v1alpha1/expansion_generated.go b/listers/node/v1alpha1/expansion_generated.go
new file mode 100644
index 000000000..3b8521c00
--- /dev/null
+++ b/listers/node/v1alpha1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
diff --git a/listers/node/v1alpha1/runtimeclass.go b/listers/node/v1alpha1/runtimeclass.go
index f9fa16020..13bf2995a 100644
--- a/listers/node/v1alpha1/runtimeclass.go
+++ b/listers/node/v1alpha1/runtimeclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	nodev1alpha1 "k8s.io/api/node/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	nodev1alpha1listers "k8s.io/client-go/listers/node/v1alpha1"
+	listersnodev1alpha1 "k8s.io/client-go/listers/node/v1alpha1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// RuntimeClassClusterLister can list RuntimeClasses across all workspaces, or scope down to a RuntimeClassLister for one workspace.
+// RuntimeClassClusterLister helps list RuntimeClasses across all workspaces,
+// or scope down to a RuntimeClassLister for one workspace.
 // All objects returned here must be treated as read-only.
 type RuntimeClassClusterLister interface {
 	// List lists all RuntimeClasses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*nodev1alpha1.RuntimeClass, err error)
 	// Cluster returns a lister that can list and get RuntimeClasses in one workspace.
-	Cluster(clusterName logicalcluster.Name) nodev1alpha1listers.RuntimeClassLister
+	Cluster(clusterName logicalcluster.Name) listersnodev1alpha1.RuntimeClassLister
 	RuntimeClassClusterListerExpansion
 }
 
+// runtimeClassClusterLister implements the RuntimeClassClusterLister interface.
 type runtimeClassClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*nodev1alpha1.RuntimeClass]
 }
 
+var _ RuntimeClassClusterLister = new(runtimeClassClusterLister)
+
 // NewRuntimeClassClusterLister returns a new RuntimeClassClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewRuntimeClassClusterLister(indexer cache.Indexer) *runtimeClassClusterLister {
-	return &runtimeClassClusterLister{indexer: indexer}
-}
-
-// List lists all RuntimeClasses in the indexer across all workspaces.
-func (s *runtimeClassClusterLister) List(selector labels.Selector) (ret []*nodev1alpha1.RuntimeClass, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*nodev1alpha1.RuntimeClass))
-	})
-	return ret, err
+func NewRuntimeClassClusterLister(indexer cache.Indexer) RuntimeClassClusterLister {
+	return &runtimeClassClusterLister{
+		kcplisters.NewCluster[*nodev1alpha1.RuntimeClass](indexer, nodev1alpha1.Resource("runtimeclass")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get RuntimeClasses.
-func (s *runtimeClassClusterLister) Cluster(clusterName logicalcluster.Name) nodev1alpha1listers.RuntimeClassLister {
-	return &runtimeClassLister{indexer: s.indexer, clusterName: clusterName}
+func (l *runtimeClassClusterLister) Cluster(clusterName logicalcluster.Name) listersnodev1alpha1.RuntimeClassLister {
+	return &runtimeClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// runtimeClassLister implements the nodev1alpha1listers.RuntimeClassLister interface.
+// runtimeClassLister can list all RuntimeClasses inside a workspace
+// or scope down to a listersnodev1alpha1.RuntimeClassNamespaceLister for one namespace.
 type runtimeClassLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*nodev1alpha1.RuntimeClass]
 }
 
-// List lists all RuntimeClasses in the indexer for a workspace.
-func (s *runtimeClassLister) List(selector labels.Selector) (ret []*nodev1alpha1.RuntimeClass, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*nodev1alpha1.RuntimeClass))
-	})
-	return ret, err
-}
+var _ listersnodev1alpha1.RuntimeClassLister = new(runtimeClassLister)
 
-// Get retrieves the RuntimeClass from the indexer for a given workspace and name.
-func (s *runtimeClassLister) Get(name string) (*nodev1alpha1.RuntimeClass, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(nodev1alpha1.Resource("runtimeclasses"), name)
+// NewRuntimeClassLister returns a new RuntimeClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewRuntimeClassLister(indexer cache.Indexer) listersnodev1alpha1.RuntimeClassLister {
+	return &runtimeClassLister{
+		kcplisters.New[*nodev1alpha1.RuntimeClass](indexer, nodev1alpha1.Resource("runtimeclass")),
 	}
-	return obj.(*nodev1alpha1.RuntimeClass), nil
+}
+
+// runtimeClassScopedLister can list all RuntimeClasses inside a workspace
+// or scope down to a listersnodev1alpha1.RuntimeClassNamespaceLister.
+type runtimeClassScopedLister struct {
+	kcplisters.ResourceIndexer[*nodev1alpha1.RuntimeClass]
 }
diff --git a/listers/node/v1alpha1/runtimeclass_expansion.go b/listers/node/v1alpha1/runtimeclass_expansion.go
index 50f1bc0f8..b325c0850 100644
--- a/listers/node/v1alpha1/runtimeclass_expansion.go
+++ b/listers/node/v1alpha1/runtimeclass_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/node/v1beta1/expansion_generated.go b/listers/node/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/node/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/node/v1beta1/runtimeclass.go b/listers/node/v1beta1/runtimeclass.go
index 981e0693c..a48fdcef5 100644
--- a/listers/node/v1beta1/runtimeclass.go
+++ b/listers/node/v1beta1/runtimeclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	nodev1beta1 "k8s.io/api/node/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	nodev1beta1listers "k8s.io/client-go/listers/node/v1beta1"
+	listersnodev1beta1 "k8s.io/client-go/listers/node/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// RuntimeClassClusterLister can list RuntimeClasses across all workspaces, or scope down to a RuntimeClassLister for one workspace.
+// RuntimeClassClusterLister helps list RuntimeClasses across all workspaces,
+// or scope down to a RuntimeClassLister for one workspace.
 // All objects returned here must be treated as read-only.
 type RuntimeClassClusterLister interface {
 	// List lists all RuntimeClasses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*nodev1beta1.RuntimeClass, err error)
 	// Cluster returns a lister that can list and get RuntimeClasses in one workspace.
-	Cluster(clusterName logicalcluster.Name) nodev1beta1listers.RuntimeClassLister
+	Cluster(clusterName logicalcluster.Name) listersnodev1beta1.RuntimeClassLister
 	RuntimeClassClusterListerExpansion
 }
 
+// runtimeClassClusterLister implements the RuntimeClassClusterLister interface.
 type runtimeClassClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*nodev1beta1.RuntimeClass]
 }
 
+var _ RuntimeClassClusterLister = new(runtimeClassClusterLister)
+
 // NewRuntimeClassClusterLister returns a new RuntimeClassClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewRuntimeClassClusterLister(indexer cache.Indexer) *runtimeClassClusterLister {
-	return &runtimeClassClusterLister{indexer: indexer}
-}
-
-// List lists all RuntimeClasses in the indexer across all workspaces.
-func (s *runtimeClassClusterLister) List(selector labels.Selector) (ret []*nodev1beta1.RuntimeClass, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*nodev1beta1.RuntimeClass))
-	})
-	return ret, err
+func NewRuntimeClassClusterLister(indexer cache.Indexer) RuntimeClassClusterLister {
+	return &runtimeClassClusterLister{
+		kcplisters.NewCluster[*nodev1beta1.RuntimeClass](indexer, nodev1beta1.Resource("runtimeclass")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get RuntimeClasses.
-func (s *runtimeClassClusterLister) Cluster(clusterName logicalcluster.Name) nodev1beta1listers.RuntimeClassLister {
-	return &runtimeClassLister{indexer: s.indexer, clusterName: clusterName}
+func (l *runtimeClassClusterLister) Cluster(clusterName logicalcluster.Name) listersnodev1beta1.RuntimeClassLister {
+	return &runtimeClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// runtimeClassLister implements the nodev1beta1listers.RuntimeClassLister interface.
+// runtimeClassLister can list all RuntimeClasses inside a workspace
+// or scope down to a listersnodev1beta1.RuntimeClassNamespaceLister for one namespace.
 type runtimeClassLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*nodev1beta1.RuntimeClass]
 }
 
-// List lists all RuntimeClasses in the indexer for a workspace.
-func (s *runtimeClassLister) List(selector labels.Selector) (ret []*nodev1beta1.RuntimeClass, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*nodev1beta1.RuntimeClass))
-	})
-	return ret, err
-}
+var _ listersnodev1beta1.RuntimeClassLister = new(runtimeClassLister)
 
-// Get retrieves the RuntimeClass from the indexer for a given workspace and name.
-func (s *runtimeClassLister) Get(name string) (*nodev1beta1.RuntimeClass, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(nodev1beta1.Resource("runtimeclasses"), name)
+// NewRuntimeClassLister returns a new RuntimeClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewRuntimeClassLister(indexer cache.Indexer) listersnodev1beta1.RuntimeClassLister {
+	return &runtimeClassLister{
+		kcplisters.New[*nodev1beta1.RuntimeClass](indexer, nodev1beta1.Resource("runtimeclass")),
 	}
-	return obj.(*nodev1beta1.RuntimeClass), nil
+}
+
+// runtimeClassScopedLister can list all RuntimeClasses inside a workspace
+// or scope down to a listersnodev1beta1.RuntimeClassNamespaceLister.
+type runtimeClassScopedLister struct {
+	kcplisters.ResourceIndexer[*nodev1beta1.RuntimeClass]
 }
diff --git a/listers/node/v1beta1/runtimeclass_expansion.go b/listers/node/v1beta1/runtimeclass_expansion.go
index c4617b616..de6dea995 100644
--- a/listers/node/v1beta1/runtimeclass_expansion.go
+++ b/listers/node/v1beta1/runtimeclass_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/policy/v1/eviction.go b/listers/policy/v1/eviction.go
new file mode 100644
index 000000000..544538903
--- /dev/null
+++ b/listers/policy/v1/eviction.go
@@ -0,0 +1,115 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	policyv1 "k8s.io/api/policy/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	listerspolicyv1 "k8s.io/client-go/listers/policy/v1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// EvictionClusterLister helps list Evictions across all workspaces,
+// or scope down to a EvictionLister for one workspace.
+// All objects returned here must be treated as read-only.
+type EvictionClusterLister interface {
+	// List lists all Evictions in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*policyv1.Eviction, err error)
+	// Cluster returns a lister that can list and get Evictions in one workspace.
+	Cluster(clusterName logicalcluster.Name) listerspolicyv1.EvictionLister
+	EvictionClusterListerExpansion
+}
+
+// evictionClusterLister implements the EvictionClusterLister interface.
+type evictionClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*policyv1.Eviction]
+}
+
+var _ EvictionClusterLister = new(evictionClusterLister)
+
+// NewEvictionClusterLister returns a new EvictionClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewEvictionClusterLister(indexer cache.Indexer) EvictionClusterLister {
+	return &evictionClusterLister{
+		kcplisters.NewCluster[*policyv1.Eviction](indexer, policyv1.Resource("eviction")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get Evictions.
+func (l *evictionClusterLister) Cluster(clusterName logicalcluster.Name) listerspolicyv1.EvictionLister {
+	return &evictionLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// evictionLister can list all Evictions inside a workspace
+// or scope down to a listerspolicyv1.EvictionNamespaceLister for one namespace.
+type evictionLister struct {
+	kcplisters.ResourceIndexer[*policyv1.Eviction]
+}
+
+var _ listerspolicyv1.EvictionLister = new(evictionLister)
+
+// Evictions returns an object that can list and get Evictions in one namespace.
+func (l *evictionLister) Evictions(namespace string) listerspolicyv1.EvictionNamespaceLister {
+	return &evictionNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
+
+// evictionNamespaceLister implements the listerspolicyv1.EvictionNamespaceLister
+// interface.
+type evictionNamespaceLister struct {
+	kcplisters.ResourceIndexer[*policyv1.Eviction]
+}
+
+var _ listerspolicyv1.EvictionNamespaceLister = new(evictionNamespaceLister)
+
+// NewEvictionLister returns a new EvictionLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewEvictionLister(indexer cache.Indexer) listerspolicyv1.EvictionLister {
+	return &evictionLister{
+		kcplisters.New[*policyv1.Eviction](indexer, policyv1.Resource("eviction")),
+	}
+}
+
+// evictionScopedLister can list all Evictions inside a workspace
+// or scope down to a listerspolicyv1.EvictionNamespaceLister for one namespace.
+type evictionScopedLister struct {
+	kcplisters.ResourceIndexer[*policyv1.Eviction]
+}
+
+// Evictions returns an object that can list and get Evictions in one namespace.
+func (l *evictionScopedLister) Evictions(namespace string) listerspolicyv1.EvictionLister {
+	return &evictionLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
diff --git a/listers/policy/v1/expansion_generated.go b/listers/policy/v1/expansion_generated.go
new file mode 100644
index 000000000..4bc71b259
--- /dev/null
+++ b/listers/policy/v1/expansion_generated.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
+
+// EvictionClusterListerExpansion allows custom methods to be added to
+// EvictionClusterLister.
+type EvictionClusterListerExpansion interface{}
diff --git a/listers/policy/v1/poddisruptionbudget.go b/listers/policy/v1/poddisruptionbudget.go
index 3bf72a0af..aa6611890 100644
--- a/listers/policy/v1/poddisruptionbudget.go
+++ b/listers/policy/v1/poddisruptionbudget.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	policyv1 "k8s.io/api/policy/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	policyv1listers "k8s.io/client-go/listers/policy/v1"
+	listerspolicyv1 "k8s.io/client-go/listers/policy/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// PodDisruptionBudgetClusterLister can list PodDisruptionBudgets across all workspaces, or scope down to a PodDisruptionBudgetLister for one workspace.
+// PodDisruptionBudgetClusterLister helps list PodDisruptionBudgets across all workspaces,
+// or scope down to a PodDisruptionBudgetLister for one workspace.
 // All objects returned here must be treated as read-only.
 type PodDisruptionBudgetClusterLister interface {
 	// List lists all PodDisruptionBudgets in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*policyv1.PodDisruptionBudget, err error)
 	// Cluster returns a lister that can list and get PodDisruptionBudgets in one workspace.
-	Cluster(clusterName logicalcluster.Name) policyv1listers.PodDisruptionBudgetLister
+	Cluster(clusterName logicalcluster.Name) listerspolicyv1.PodDisruptionBudgetLister
 	PodDisruptionBudgetClusterListerExpansion
 }
 
+// podDisruptionBudgetClusterLister implements the PodDisruptionBudgetClusterLister interface.
 type podDisruptionBudgetClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*policyv1.PodDisruptionBudget]
 }
 
+var _ PodDisruptionBudgetClusterLister = new(podDisruptionBudgetClusterLister)
+
 // NewPodDisruptionBudgetClusterLister returns a new PodDisruptionBudgetClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewPodDisruptionBudgetClusterLister(indexer cache.Indexer) *podDisruptionBudgetClusterLister {
-	return &podDisruptionBudgetClusterLister{indexer: indexer}
-}
-
-// List lists all PodDisruptionBudgets in the indexer across all workspaces.
-func (s *podDisruptionBudgetClusterLister) List(selector labels.Selector) (ret []*policyv1.PodDisruptionBudget, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*policyv1.PodDisruptionBudget))
-	})
-	return ret, err
+func NewPodDisruptionBudgetClusterLister(indexer cache.Indexer) PodDisruptionBudgetClusterLister {
+	return &podDisruptionBudgetClusterLister{
+		kcplisters.NewCluster[*policyv1.PodDisruptionBudget](indexer, policyv1.Resource("poddisruptionbudget")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get PodDisruptionBudgets.
-func (s *podDisruptionBudgetClusterLister) Cluster(clusterName logicalcluster.Name) policyv1listers.PodDisruptionBudgetLister {
-	return &podDisruptionBudgetLister{indexer: s.indexer, clusterName: clusterName}
+func (l *podDisruptionBudgetClusterLister) Cluster(clusterName logicalcluster.Name) listerspolicyv1.PodDisruptionBudgetLister {
+	return &podDisruptionBudgetLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// podDisruptionBudgetLister implements the policyv1listers.PodDisruptionBudgetLister interface.
+// podDisruptionBudgetLister can list all PodDisruptionBudgets inside a workspace
+// or scope down to a listerspolicyv1.PodDisruptionBudgetNamespaceLister for one namespace.
 type podDisruptionBudgetLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*policyv1.PodDisruptionBudget]
 }
 
-// List lists all PodDisruptionBudgets in the indexer for a workspace.
-func (s *podDisruptionBudgetLister) List(selector labels.Selector) (ret []*policyv1.PodDisruptionBudget, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*policyv1.PodDisruptionBudget))
-	})
-	return ret, err
-}
+var _ listerspolicyv1.PodDisruptionBudgetLister = new(podDisruptionBudgetLister)
 
 // PodDisruptionBudgets returns an object that can list and get PodDisruptionBudgets in one namespace.
-func (s *podDisruptionBudgetLister) PodDisruptionBudgets(namespace string) policyv1listers.PodDisruptionBudgetNamespaceLister {
-	return &podDisruptionBudgetNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *podDisruptionBudgetLister) PodDisruptionBudgets(namespace string) listerspolicyv1.PodDisruptionBudgetNamespaceLister {
+	return &podDisruptionBudgetNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// podDisruptionBudgetNamespaceLister implements the policyv1listers.PodDisruptionBudgetNamespaceLister interface.
+// podDisruptionBudgetNamespaceLister implements the listerspolicyv1.PodDisruptionBudgetNamespaceLister
+// interface.
 type podDisruptionBudgetNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*policyv1.PodDisruptionBudget]
 }
 
-// List lists all PodDisruptionBudgets in the indexer for a given workspace and namespace.
-func (s *podDisruptionBudgetNamespaceLister) List(selector labels.Selector) (ret []*policyv1.PodDisruptionBudget, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*policyv1.PodDisruptionBudget))
-	})
-	return ret, err
-}
+var _ listerspolicyv1.PodDisruptionBudgetNamespaceLister = new(podDisruptionBudgetNamespaceLister)
 
-// Get retrieves the PodDisruptionBudget from the indexer for a given workspace, namespace and name.
-func (s *podDisruptionBudgetNamespaceLister) Get(name string) (*policyv1.PodDisruptionBudget, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewPodDisruptionBudgetLister returns a new PodDisruptionBudgetLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewPodDisruptionBudgetLister(indexer cache.Indexer) listerspolicyv1.PodDisruptionBudgetLister {
+	return &podDisruptionBudgetLister{
+		kcplisters.New[*policyv1.PodDisruptionBudget](indexer, policyv1.Resource("poddisruptionbudget")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(policyv1.Resource("poddisruptionbudgets"), name)
+}
+
+// podDisruptionBudgetScopedLister can list all PodDisruptionBudgets inside a workspace
+// or scope down to a listerspolicyv1.PodDisruptionBudgetNamespaceLister for one namespace.
+type podDisruptionBudgetScopedLister struct {
+	kcplisters.ResourceIndexer[*policyv1.PodDisruptionBudget]
+}
+
+// PodDisruptionBudgets returns an object that can list and get PodDisruptionBudgets in one namespace.
+func (l *podDisruptionBudgetScopedLister) PodDisruptionBudgets(namespace string) listerspolicyv1.PodDisruptionBudgetLister {
+	return &podDisruptionBudgetLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*policyv1.PodDisruptionBudget), nil
 }
diff --git a/listers/policy/v1/poddisruptionbudget_expansion.go b/listers/policy/v1/poddisruptionbudget_expansion.go
index c947b7f70..af730cd07 100644
--- a/listers/policy/v1/poddisruptionbudget_expansion.go
+++ b/listers/policy/v1/poddisruptionbudget_expansion.go
@@ -19,7 +19,7 @@ package v1
 import (
 	"fmt"
 
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	policy "k8s.io/api/policy/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
diff --git a/listers/policy/v1beta1/eviction.go b/listers/policy/v1beta1/eviction.go
new file mode 100644
index 000000000..db99454e5
--- /dev/null
+++ b/listers/policy/v1beta1/eviction.go
@@ -0,0 +1,115 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	policyv1beta1 "k8s.io/api/policy/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	listerspolicyv1beta1 "k8s.io/client-go/listers/policy/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// EvictionClusterLister helps list Evictions across all workspaces,
+// or scope down to a EvictionLister for one workspace.
+// All objects returned here must be treated as read-only.
+type EvictionClusterLister interface {
+	// List lists all Evictions in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*policyv1beta1.Eviction, err error)
+	// Cluster returns a lister that can list and get Evictions in one workspace.
+	Cluster(clusterName logicalcluster.Name) listerspolicyv1beta1.EvictionLister
+	EvictionClusterListerExpansion
+}
+
+// evictionClusterLister implements the EvictionClusterLister interface.
+type evictionClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*policyv1beta1.Eviction]
+}
+
+var _ EvictionClusterLister = new(evictionClusterLister)
+
+// NewEvictionClusterLister returns a new EvictionClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewEvictionClusterLister(indexer cache.Indexer) EvictionClusterLister {
+	return &evictionClusterLister{
+		kcplisters.NewCluster[*policyv1beta1.Eviction](indexer, policyv1beta1.Resource("eviction")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get Evictions.
+func (l *evictionClusterLister) Cluster(clusterName logicalcluster.Name) listerspolicyv1beta1.EvictionLister {
+	return &evictionLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// evictionLister can list all Evictions inside a workspace
+// or scope down to a listerspolicyv1beta1.EvictionNamespaceLister for one namespace.
+type evictionLister struct {
+	kcplisters.ResourceIndexer[*policyv1beta1.Eviction]
+}
+
+var _ listerspolicyv1beta1.EvictionLister = new(evictionLister)
+
+// Evictions returns an object that can list and get Evictions in one namespace.
+func (l *evictionLister) Evictions(namespace string) listerspolicyv1beta1.EvictionNamespaceLister {
+	return &evictionNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
+
+// evictionNamespaceLister implements the listerspolicyv1beta1.EvictionNamespaceLister
+// interface.
+type evictionNamespaceLister struct {
+	kcplisters.ResourceIndexer[*policyv1beta1.Eviction]
+}
+
+var _ listerspolicyv1beta1.EvictionNamespaceLister = new(evictionNamespaceLister)
+
+// NewEvictionLister returns a new EvictionLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewEvictionLister(indexer cache.Indexer) listerspolicyv1beta1.EvictionLister {
+	return &evictionLister{
+		kcplisters.New[*policyv1beta1.Eviction](indexer, policyv1beta1.Resource("eviction")),
+	}
+}
+
+// evictionScopedLister can list all Evictions inside a workspace
+// or scope down to a listerspolicyv1beta1.EvictionNamespaceLister for one namespace.
+type evictionScopedLister struct {
+	kcplisters.ResourceIndexer[*policyv1beta1.Eviction]
+}
+
+// Evictions returns an object that can list and get Evictions in one namespace.
+func (l *evictionScopedLister) Evictions(namespace string) listerspolicyv1beta1.EvictionLister {
+	return &evictionLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
diff --git a/listers/policy/v1beta1/expansion_generated.go b/listers/policy/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..d3f5cc7fe
--- /dev/null
+++ b/listers/policy/v1beta1/expansion_generated.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+// EvictionClusterListerExpansion allows custom methods to be added to
+// EvictionClusterLister.
+type EvictionClusterListerExpansion interface{}
diff --git a/listers/policy/v1beta1/poddisruptionbudget.go b/listers/policy/v1beta1/poddisruptionbudget.go
index 8fa2be8fd..fa822e006 100644
--- a/listers/policy/v1beta1/poddisruptionbudget.go
+++ b/listers/policy/v1beta1/poddisruptionbudget.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	policyv1beta1 "k8s.io/api/policy/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	policyv1beta1listers "k8s.io/client-go/listers/policy/v1beta1"
+	listerspolicyv1beta1 "k8s.io/client-go/listers/policy/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// PodDisruptionBudgetClusterLister can list PodDisruptionBudgets across all workspaces, or scope down to a PodDisruptionBudgetLister for one workspace.
+// PodDisruptionBudgetClusterLister helps list PodDisruptionBudgets across all workspaces,
+// or scope down to a PodDisruptionBudgetLister for one workspace.
 // All objects returned here must be treated as read-only.
 type PodDisruptionBudgetClusterLister interface {
 	// List lists all PodDisruptionBudgets in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*policyv1beta1.PodDisruptionBudget, err error)
 	// Cluster returns a lister that can list and get PodDisruptionBudgets in one workspace.
-	Cluster(clusterName logicalcluster.Name) policyv1beta1listers.PodDisruptionBudgetLister
+	Cluster(clusterName logicalcluster.Name) listerspolicyv1beta1.PodDisruptionBudgetLister
 	PodDisruptionBudgetClusterListerExpansion
 }
 
+// podDisruptionBudgetClusterLister implements the PodDisruptionBudgetClusterLister interface.
 type podDisruptionBudgetClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*policyv1beta1.PodDisruptionBudget]
 }
 
+var _ PodDisruptionBudgetClusterLister = new(podDisruptionBudgetClusterLister)
+
 // NewPodDisruptionBudgetClusterLister returns a new PodDisruptionBudgetClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewPodDisruptionBudgetClusterLister(indexer cache.Indexer) *podDisruptionBudgetClusterLister {
-	return &podDisruptionBudgetClusterLister{indexer: indexer}
-}
-
-// List lists all PodDisruptionBudgets in the indexer across all workspaces.
-func (s *podDisruptionBudgetClusterLister) List(selector labels.Selector) (ret []*policyv1beta1.PodDisruptionBudget, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*policyv1beta1.PodDisruptionBudget))
-	})
-	return ret, err
+func NewPodDisruptionBudgetClusterLister(indexer cache.Indexer) PodDisruptionBudgetClusterLister {
+	return &podDisruptionBudgetClusterLister{
+		kcplisters.NewCluster[*policyv1beta1.PodDisruptionBudget](indexer, policyv1beta1.Resource("poddisruptionbudget")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get PodDisruptionBudgets.
-func (s *podDisruptionBudgetClusterLister) Cluster(clusterName logicalcluster.Name) policyv1beta1listers.PodDisruptionBudgetLister {
-	return &podDisruptionBudgetLister{indexer: s.indexer, clusterName: clusterName}
+func (l *podDisruptionBudgetClusterLister) Cluster(clusterName logicalcluster.Name) listerspolicyv1beta1.PodDisruptionBudgetLister {
+	return &podDisruptionBudgetLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// podDisruptionBudgetLister implements the policyv1beta1listers.PodDisruptionBudgetLister interface.
+// podDisruptionBudgetLister can list all PodDisruptionBudgets inside a workspace
+// or scope down to a listerspolicyv1beta1.PodDisruptionBudgetNamespaceLister for one namespace.
 type podDisruptionBudgetLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*policyv1beta1.PodDisruptionBudget]
 }
 
-// List lists all PodDisruptionBudgets in the indexer for a workspace.
-func (s *podDisruptionBudgetLister) List(selector labels.Selector) (ret []*policyv1beta1.PodDisruptionBudget, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*policyv1beta1.PodDisruptionBudget))
-	})
-	return ret, err
-}
+var _ listerspolicyv1beta1.PodDisruptionBudgetLister = new(podDisruptionBudgetLister)
 
 // PodDisruptionBudgets returns an object that can list and get PodDisruptionBudgets in one namespace.
-func (s *podDisruptionBudgetLister) PodDisruptionBudgets(namespace string) policyv1beta1listers.PodDisruptionBudgetNamespaceLister {
-	return &podDisruptionBudgetNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *podDisruptionBudgetLister) PodDisruptionBudgets(namespace string) listerspolicyv1beta1.PodDisruptionBudgetNamespaceLister {
+	return &podDisruptionBudgetNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// podDisruptionBudgetNamespaceLister implements the policyv1beta1listers.PodDisruptionBudgetNamespaceLister interface.
+// podDisruptionBudgetNamespaceLister implements the listerspolicyv1beta1.PodDisruptionBudgetNamespaceLister
+// interface.
 type podDisruptionBudgetNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*policyv1beta1.PodDisruptionBudget]
 }
 
-// List lists all PodDisruptionBudgets in the indexer for a given workspace and namespace.
-func (s *podDisruptionBudgetNamespaceLister) List(selector labels.Selector) (ret []*policyv1beta1.PodDisruptionBudget, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*policyv1beta1.PodDisruptionBudget))
-	})
-	return ret, err
-}
+var _ listerspolicyv1beta1.PodDisruptionBudgetNamespaceLister = new(podDisruptionBudgetNamespaceLister)
 
-// Get retrieves the PodDisruptionBudget from the indexer for a given workspace, namespace and name.
-func (s *podDisruptionBudgetNamespaceLister) Get(name string) (*policyv1beta1.PodDisruptionBudget, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewPodDisruptionBudgetLister returns a new PodDisruptionBudgetLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewPodDisruptionBudgetLister(indexer cache.Indexer) listerspolicyv1beta1.PodDisruptionBudgetLister {
+	return &podDisruptionBudgetLister{
+		kcplisters.New[*policyv1beta1.PodDisruptionBudget](indexer, policyv1beta1.Resource("poddisruptionbudget")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(policyv1beta1.Resource("poddisruptionbudgets"), name)
+}
+
+// podDisruptionBudgetScopedLister can list all PodDisruptionBudgets inside a workspace
+// or scope down to a listerspolicyv1beta1.PodDisruptionBudgetNamespaceLister for one namespace.
+type podDisruptionBudgetScopedLister struct {
+	kcplisters.ResourceIndexer[*policyv1beta1.PodDisruptionBudget]
+}
+
+// PodDisruptionBudgets returns an object that can list and get PodDisruptionBudgets in one namespace.
+func (l *podDisruptionBudgetScopedLister) PodDisruptionBudgets(namespace string) listerspolicyv1beta1.PodDisruptionBudgetLister {
+	return &podDisruptionBudgetLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*policyv1beta1.PodDisruptionBudget), nil
 }
diff --git a/listers/policy/v1beta1/poddisruptionbudget_expansion.go b/listers/policy/v1beta1/poddisruptionbudget_expansion.go
index 38f4e08ae..86f85d84c 100644
--- a/listers/policy/v1beta1/poddisruptionbudget_expansion.go
+++ b/listers/policy/v1beta1/poddisruptionbudget_expansion.go
@@ -19,7 +19,7 @@ package v1beta1
 import (
 	"fmt"
 
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	policy "k8s.io/api/policy/v1beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
diff --git a/listers/policy/v1beta1/podsecuritypolicy.go b/listers/policy/v1beta1/podsecuritypolicy.go
deleted file mode 100644
index a1c8097b2..000000000
--- a/listers/policy/v1beta1/podsecuritypolicy.go
+++ /dev/null
@@ -1,97 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1beta1
-
-import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	policyv1beta1 "k8s.io/api/policy/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	policyv1beta1listers "k8s.io/client-go/listers/policy/v1beta1"
-	"k8s.io/client-go/tools/cache"
-)
-
-// PodSecurityPolicyClusterLister can list PodSecurityPolicies across all workspaces, or scope down to a PodSecurityPolicyLister for one workspace.
-// All objects returned here must be treated as read-only.
-type PodSecurityPolicyClusterLister interface {
-	// List lists all PodSecurityPolicies in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*policyv1beta1.PodSecurityPolicy, err error)
-	// Cluster returns a lister that can list and get PodSecurityPolicies in one workspace.
-	Cluster(clusterName logicalcluster.Name) policyv1beta1listers.PodSecurityPolicyLister
-	PodSecurityPolicyClusterListerExpansion
-}
-
-type podSecurityPolicyClusterLister struct {
-	indexer cache.Indexer
-}
-
-// NewPodSecurityPolicyClusterLister returns a new PodSecurityPolicyClusterLister.
-// We assume that the indexer:
-// - is fed by a cross-workspace LIST+WATCH
-// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
-// - has the kcpcache.ClusterIndex as an index
-func NewPodSecurityPolicyClusterLister(indexer cache.Indexer) *podSecurityPolicyClusterLister {
-	return &podSecurityPolicyClusterLister{indexer: indexer}
-}
-
-// List lists all PodSecurityPolicies in the indexer across all workspaces.
-func (s *podSecurityPolicyClusterLister) List(selector labels.Selector) (ret []*policyv1beta1.PodSecurityPolicy, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*policyv1beta1.PodSecurityPolicy))
-	})
-	return ret, err
-}
-
-// Cluster scopes the lister to one workspace, allowing users to list and get PodSecurityPolicies.
-func (s *podSecurityPolicyClusterLister) Cluster(clusterName logicalcluster.Name) policyv1beta1listers.PodSecurityPolicyLister {
-	return &podSecurityPolicyLister{indexer: s.indexer, clusterName: clusterName}
-}
-
-// podSecurityPolicyLister implements the policyv1beta1listers.PodSecurityPolicyLister interface.
-type podSecurityPolicyLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-}
-
-// List lists all PodSecurityPolicies in the indexer for a workspace.
-func (s *podSecurityPolicyLister) List(selector labels.Selector) (ret []*policyv1beta1.PodSecurityPolicy, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*policyv1beta1.PodSecurityPolicy))
-	})
-	return ret, err
-}
-
-// Get retrieves the PodSecurityPolicy from the indexer for a given workspace and name.
-func (s *podSecurityPolicyLister) Get(name string) (*policyv1beta1.PodSecurityPolicy, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(policyv1beta1.Resource("podsecuritypolicies"), name)
-	}
-	return obj.(*policyv1beta1.PodSecurityPolicy), nil
-}
diff --git a/listers/rbac/v1/clusterrole.go b/listers/rbac/v1/clusterrole.go
index cfd842e21..dfdf2ab0d 100644
--- a/listers/rbac/v1/clusterrole.go
+++ b/listers/rbac/v1/clusterrole.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1 "k8s.io/api/rbac/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	rbacv1listers "k8s.io/client-go/listers/rbac/v1"
+	listersrbacv1 "k8s.io/client-go/listers/rbac/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ClusterRoleClusterLister can list ClusterRoles across all workspaces, or scope down to a ClusterRoleLister for one workspace.
+// ClusterRoleClusterLister helps list ClusterRoles across all workspaces,
+// or scope down to a ClusterRoleLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ClusterRoleClusterLister interface {
 	// List lists all ClusterRoles in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*rbacv1.ClusterRole, err error)
 	// Cluster returns a lister that can list and get ClusterRoles in one workspace.
-	Cluster(clusterName logicalcluster.Name) rbacv1listers.ClusterRoleLister
+	Cluster(clusterName logicalcluster.Name) listersrbacv1.ClusterRoleLister
 	ClusterRoleClusterListerExpansion
 }
 
+// clusterRoleClusterLister implements the ClusterRoleClusterLister interface.
 type clusterRoleClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*rbacv1.ClusterRole]
 }
 
+var _ ClusterRoleClusterLister = new(clusterRoleClusterLister)
+
 // NewClusterRoleClusterLister returns a new ClusterRoleClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewClusterRoleClusterLister(indexer cache.Indexer) *clusterRoleClusterLister {
-	return &clusterRoleClusterLister{indexer: indexer}
-}
-
-// List lists all ClusterRoles in the indexer across all workspaces.
-func (s *clusterRoleClusterLister) List(selector labels.Selector) (ret []*rbacv1.ClusterRole, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*rbacv1.ClusterRole))
-	})
-	return ret, err
+func NewClusterRoleClusterLister(indexer cache.Indexer) ClusterRoleClusterLister {
+	return &clusterRoleClusterLister{
+		kcplisters.NewCluster[*rbacv1.ClusterRole](indexer, rbacv1.Resource("clusterrole")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ClusterRoles.
-func (s *clusterRoleClusterLister) Cluster(clusterName logicalcluster.Name) rbacv1listers.ClusterRoleLister {
-	return &clusterRoleLister{indexer: s.indexer, clusterName: clusterName}
+func (l *clusterRoleClusterLister) Cluster(clusterName logicalcluster.Name) listersrbacv1.ClusterRoleLister {
+	return &clusterRoleLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// clusterRoleLister implements the rbacv1listers.ClusterRoleLister interface.
+// clusterRoleLister can list all ClusterRoles inside a workspace
+// or scope down to a listersrbacv1.ClusterRoleNamespaceLister for one namespace.
 type clusterRoleLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*rbacv1.ClusterRole]
 }
 
-// List lists all ClusterRoles in the indexer for a workspace.
-func (s *clusterRoleLister) List(selector labels.Selector) (ret []*rbacv1.ClusterRole, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1.ClusterRole))
-	})
-	return ret, err
-}
+var _ listersrbacv1.ClusterRoleLister = new(clusterRoleLister)
 
-// Get retrieves the ClusterRole from the indexer for a given workspace and name.
-func (s *clusterRoleLister) Get(name string) (*rbacv1.ClusterRole, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(rbacv1.Resource("clusterroles"), name)
+// NewClusterRoleLister returns a new ClusterRoleLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewClusterRoleLister(indexer cache.Indexer) listersrbacv1.ClusterRoleLister {
+	return &clusterRoleLister{
+		kcplisters.New[*rbacv1.ClusterRole](indexer, rbacv1.Resource("clusterrole")),
 	}
-	return obj.(*rbacv1.ClusterRole), nil
+}
+
+// clusterRoleScopedLister can list all ClusterRoles inside a workspace
+// or scope down to a listersrbacv1.ClusterRoleNamespaceLister.
+type clusterRoleScopedLister struct {
+	kcplisters.ResourceIndexer[*rbacv1.ClusterRole]
 }
diff --git a/listers/rbac/v1/clusterrole_expansion.go b/listers/rbac/v1/clusterrole_expansion.go
index bd22d482a..5a2da830b 100644
--- a/listers/rbac/v1/clusterrole_expansion.go
+++ b/listers/rbac/v1/clusterrole_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/rbac/v1/clusterrolebinding.go b/listers/rbac/v1/clusterrolebinding.go
index 9df6729e6..e70dea799 100644
--- a/listers/rbac/v1/clusterrolebinding.go
+++ b/listers/rbac/v1/clusterrolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1 "k8s.io/api/rbac/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	rbacv1listers "k8s.io/client-go/listers/rbac/v1"
+	listersrbacv1 "k8s.io/client-go/listers/rbac/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ClusterRoleBindingClusterLister can list ClusterRoleBindings across all workspaces, or scope down to a ClusterRoleBindingLister for one workspace.
+// ClusterRoleBindingClusterLister helps list ClusterRoleBindings across all workspaces,
+// or scope down to a ClusterRoleBindingLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ClusterRoleBindingClusterLister interface {
 	// List lists all ClusterRoleBindings in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*rbacv1.ClusterRoleBinding, err error)
 	// Cluster returns a lister that can list and get ClusterRoleBindings in one workspace.
-	Cluster(clusterName logicalcluster.Name) rbacv1listers.ClusterRoleBindingLister
+	Cluster(clusterName logicalcluster.Name) listersrbacv1.ClusterRoleBindingLister
 	ClusterRoleBindingClusterListerExpansion
 }
 
+// clusterRoleBindingClusterLister implements the ClusterRoleBindingClusterLister interface.
 type clusterRoleBindingClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*rbacv1.ClusterRoleBinding]
 }
 
+var _ ClusterRoleBindingClusterLister = new(clusterRoleBindingClusterLister)
+
 // NewClusterRoleBindingClusterLister returns a new ClusterRoleBindingClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewClusterRoleBindingClusterLister(indexer cache.Indexer) *clusterRoleBindingClusterLister {
-	return &clusterRoleBindingClusterLister{indexer: indexer}
-}
-
-// List lists all ClusterRoleBindings in the indexer across all workspaces.
-func (s *clusterRoleBindingClusterLister) List(selector labels.Selector) (ret []*rbacv1.ClusterRoleBinding, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*rbacv1.ClusterRoleBinding))
-	})
-	return ret, err
+func NewClusterRoleBindingClusterLister(indexer cache.Indexer) ClusterRoleBindingClusterLister {
+	return &clusterRoleBindingClusterLister{
+		kcplisters.NewCluster[*rbacv1.ClusterRoleBinding](indexer, rbacv1.Resource("clusterrolebinding")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ClusterRoleBindings.
-func (s *clusterRoleBindingClusterLister) Cluster(clusterName logicalcluster.Name) rbacv1listers.ClusterRoleBindingLister {
-	return &clusterRoleBindingLister{indexer: s.indexer, clusterName: clusterName}
+func (l *clusterRoleBindingClusterLister) Cluster(clusterName logicalcluster.Name) listersrbacv1.ClusterRoleBindingLister {
+	return &clusterRoleBindingLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// clusterRoleBindingLister implements the rbacv1listers.ClusterRoleBindingLister interface.
+// clusterRoleBindingLister can list all ClusterRoleBindings inside a workspace
+// or scope down to a listersrbacv1.ClusterRoleBindingNamespaceLister for one namespace.
 type clusterRoleBindingLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*rbacv1.ClusterRoleBinding]
 }
 
-// List lists all ClusterRoleBindings in the indexer for a workspace.
-func (s *clusterRoleBindingLister) List(selector labels.Selector) (ret []*rbacv1.ClusterRoleBinding, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1.ClusterRoleBinding))
-	})
-	return ret, err
-}
+var _ listersrbacv1.ClusterRoleBindingLister = new(clusterRoleBindingLister)
 
-// Get retrieves the ClusterRoleBinding from the indexer for a given workspace and name.
-func (s *clusterRoleBindingLister) Get(name string) (*rbacv1.ClusterRoleBinding, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(rbacv1.Resource("clusterrolebindings"), name)
+// NewClusterRoleBindingLister returns a new ClusterRoleBindingLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewClusterRoleBindingLister(indexer cache.Indexer) listersrbacv1.ClusterRoleBindingLister {
+	return &clusterRoleBindingLister{
+		kcplisters.New[*rbacv1.ClusterRoleBinding](indexer, rbacv1.Resource("clusterrolebinding")),
 	}
-	return obj.(*rbacv1.ClusterRoleBinding), nil
+}
+
+// clusterRoleBindingScopedLister can list all ClusterRoleBindings inside a workspace
+// or scope down to a listersrbacv1.ClusterRoleBindingNamespaceLister.
+type clusterRoleBindingScopedLister struct {
+	kcplisters.ResourceIndexer[*rbacv1.ClusterRoleBinding]
 }
diff --git a/listers/rbac/v1/clusterrolebinding_expansion.go b/listers/rbac/v1/clusterrolebinding_expansion.go
index 7a1db9139..3a95b4d11 100644
--- a/listers/rbac/v1/clusterrolebinding_expansion.go
+++ b/listers/rbac/v1/clusterrolebinding_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/rbac/v1/expansion_generated.go b/listers/rbac/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/rbac/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/rbac/v1/role.go b/listers/rbac/v1/role.go
index 8192fab4b..50bca0462 100644
--- a/listers/rbac/v1/role.go
+++ b/listers/rbac/v1/role.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1 "k8s.io/api/rbac/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	rbacv1listers "k8s.io/client-go/listers/rbac/v1"
+	listersrbacv1 "k8s.io/client-go/listers/rbac/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// RoleClusterLister can list Roles across all workspaces, or scope down to a RoleLister for one workspace.
+// RoleClusterLister helps list Roles across all workspaces,
+// or scope down to a RoleLister for one workspace.
 // All objects returned here must be treated as read-only.
 type RoleClusterLister interface {
 	// List lists all Roles in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*rbacv1.Role, err error)
 	// Cluster returns a lister that can list and get Roles in one workspace.
-	Cluster(clusterName logicalcluster.Name) rbacv1listers.RoleLister
+	Cluster(clusterName logicalcluster.Name) listersrbacv1.RoleLister
 	RoleClusterListerExpansion
 }
 
+// roleClusterLister implements the RoleClusterLister interface.
 type roleClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*rbacv1.Role]
 }
 
+var _ RoleClusterLister = new(roleClusterLister)
+
 // NewRoleClusterLister returns a new RoleClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewRoleClusterLister(indexer cache.Indexer) *roleClusterLister {
-	return &roleClusterLister{indexer: indexer}
-}
-
-// List lists all Roles in the indexer across all workspaces.
-func (s *roleClusterLister) List(selector labels.Selector) (ret []*rbacv1.Role, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*rbacv1.Role))
-	})
-	return ret, err
+func NewRoleClusterLister(indexer cache.Indexer) RoleClusterLister {
+	return &roleClusterLister{
+		kcplisters.NewCluster[*rbacv1.Role](indexer, rbacv1.Resource("role")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Roles.
-func (s *roleClusterLister) Cluster(clusterName logicalcluster.Name) rbacv1listers.RoleLister {
-	return &roleLister{indexer: s.indexer, clusterName: clusterName}
+func (l *roleClusterLister) Cluster(clusterName logicalcluster.Name) listersrbacv1.RoleLister {
+	return &roleLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// roleLister implements the rbacv1listers.RoleLister interface.
+// roleLister can list all Roles inside a workspace
+// or scope down to a listersrbacv1.RoleNamespaceLister for one namespace.
 type roleLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*rbacv1.Role]
 }
 
-// List lists all Roles in the indexer for a workspace.
-func (s *roleLister) List(selector labels.Selector) (ret []*rbacv1.Role, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1.Role))
-	})
-	return ret, err
-}
+var _ listersrbacv1.RoleLister = new(roleLister)
 
 // Roles returns an object that can list and get Roles in one namespace.
-func (s *roleLister) Roles(namespace string) rbacv1listers.RoleNamespaceLister {
-	return &roleNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *roleLister) Roles(namespace string) listersrbacv1.RoleNamespaceLister {
+	return &roleNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// roleNamespaceLister implements the rbacv1listers.RoleNamespaceLister interface.
+// roleNamespaceLister implements the listersrbacv1.RoleNamespaceLister
+// interface.
 type roleNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*rbacv1.Role]
 }
 
-// List lists all Roles in the indexer for a given workspace and namespace.
-func (s *roleNamespaceLister) List(selector labels.Selector) (ret []*rbacv1.Role, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1.Role))
-	})
-	return ret, err
-}
+var _ listersrbacv1.RoleNamespaceLister = new(roleNamespaceLister)
 
-// Get retrieves the Role from the indexer for a given workspace, namespace and name.
-func (s *roleNamespaceLister) Get(name string) (*rbacv1.Role, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewRoleLister returns a new RoleLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewRoleLister(indexer cache.Indexer) listersrbacv1.RoleLister {
+	return &roleLister{
+		kcplisters.New[*rbacv1.Role](indexer, rbacv1.Resource("role")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(rbacv1.Resource("roles"), name)
+}
+
+// roleScopedLister can list all Roles inside a workspace
+// or scope down to a listersrbacv1.RoleNamespaceLister for one namespace.
+type roleScopedLister struct {
+	kcplisters.ResourceIndexer[*rbacv1.Role]
+}
+
+// Roles returns an object that can list and get Roles in one namespace.
+func (l *roleScopedLister) Roles(namespace string) listersrbacv1.RoleLister {
+	return &roleLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*rbacv1.Role), nil
 }
diff --git a/listers/rbac/v1/role_expansion.go b/listers/rbac/v1/role_expansion.go
index c1c0e9d5b..6175fd52e 100644
--- a/listers/rbac/v1/role_expansion.go
+++ b/listers/rbac/v1/role_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/rbac/v1/rolebinding.go b/listers/rbac/v1/rolebinding.go
index 1411cb9e2..6c4b2d53c 100644
--- a/listers/rbac/v1/rolebinding.go
+++ b/listers/rbac/v1/rolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1 "k8s.io/api/rbac/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	rbacv1listers "k8s.io/client-go/listers/rbac/v1"
+	listersrbacv1 "k8s.io/client-go/listers/rbac/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// RoleBindingClusterLister can list RoleBindings across all workspaces, or scope down to a RoleBindingLister for one workspace.
+// RoleBindingClusterLister helps list RoleBindings across all workspaces,
+// or scope down to a RoleBindingLister for one workspace.
 // All objects returned here must be treated as read-only.
 type RoleBindingClusterLister interface {
 	// List lists all RoleBindings in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*rbacv1.RoleBinding, err error)
 	// Cluster returns a lister that can list and get RoleBindings in one workspace.
-	Cluster(clusterName logicalcluster.Name) rbacv1listers.RoleBindingLister
+	Cluster(clusterName logicalcluster.Name) listersrbacv1.RoleBindingLister
 	RoleBindingClusterListerExpansion
 }
 
+// roleBindingClusterLister implements the RoleBindingClusterLister interface.
 type roleBindingClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*rbacv1.RoleBinding]
 }
 
+var _ RoleBindingClusterLister = new(roleBindingClusterLister)
+
 // NewRoleBindingClusterLister returns a new RoleBindingClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewRoleBindingClusterLister(indexer cache.Indexer) *roleBindingClusterLister {
-	return &roleBindingClusterLister{indexer: indexer}
-}
-
-// List lists all RoleBindings in the indexer across all workspaces.
-func (s *roleBindingClusterLister) List(selector labels.Selector) (ret []*rbacv1.RoleBinding, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*rbacv1.RoleBinding))
-	})
-	return ret, err
+func NewRoleBindingClusterLister(indexer cache.Indexer) RoleBindingClusterLister {
+	return &roleBindingClusterLister{
+		kcplisters.NewCluster[*rbacv1.RoleBinding](indexer, rbacv1.Resource("rolebinding")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get RoleBindings.
-func (s *roleBindingClusterLister) Cluster(clusterName logicalcluster.Name) rbacv1listers.RoleBindingLister {
-	return &roleBindingLister{indexer: s.indexer, clusterName: clusterName}
+func (l *roleBindingClusterLister) Cluster(clusterName logicalcluster.Name) listersrbacv1.RoleBindingLister {
+	return &roleBindingLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// roleBindingLister implements the rbacv1listers.RoleBindingLister interface.
+// roleBindingLister can list all RoleBindings inside a workspace
+// or scope down to a listersrbacv1.RoleBindingNamespaceLister for one namespace.
 type roleBindingLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*rbacv1.RoleBinding]
 }
 
-// List lists all RoleBindings in the indexer for a workspace.
-func (s *roleBindingLister) List(selector labels.Selector) (ret []*rbacv1.RoleBinding, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1.RoleBinding))
-	})
-	return ret, err
-}
+var _ listersrbacv1.RoleBindingLister = new(roleBindingLister)
 
 // RoleBindings returns an object that can list and get RoleBindings in one namespace.
-func (s *roleBindingLister) RoleBindings(namespace string) rbacv1listers.RoleBindingNamespaceLister {
-	return &roleBindingNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *roleBindingLister) RoleBindings(namespace string) listersrbacv1.RoleBindingNamespaceLister {
+	return &roleBindingNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// roleBindingNamespaceLister implements the rbacv1listers.RoleBindingNamespaceLister interface.
+// roleBindingNamespaceLister implements the listersrbacv1.RoleBindingNamespaceLister
+// interface.
 type roleBindingNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*rbacv1.RoleBinding]
 }
 
-// List lists all RoleBindings in the indexer for a given workspace and namespace.
-func (s *roleBindingNamespaceLister) List(selector labels.Selector) (ret []*rbacv1.RoleBinding, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1.RoleBinding))
-	})
-	return ret, err
-}
+var _ listersrbacv1.RoleBindingNamespaceLister = new(roleBindingNamespaceLister)
 
-// Get retrieves the RoleBinding from the indexer for a given workspace, namespace and name.
-func (s *roleBindingNamespaceLister) Get(name string) (*rbacv1.RoleBinding, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewRoleBindingLister returns a new RoleBindingLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewRoleBindingLister(indexer cache.Indexer) listersrbacv1.RoleBindingLister {
+	return &roleBindingLister{
+		kcplisters.New[*rbacv1.RoleBinding](indexer, rbacv1.Resource("rolebinding")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(rbacv1.Resource("rolebindings"), name)
+}
+
+// roleBindingScopedLister can list all RoleBindings inside a workspace
+// or scope down to a listersrbacv1.RoleBindingNamespaceLister for one namespace.
+type roleBindingScopedLister struct {
+	kcplisters.ResourceIndexer[*rbacv1.RoleBinding]
+}
+
+// RoleBindings returns an object that can list and get RoleBindings in one namespace.
+func (l *roleBindingScopedLister) RoleBindings(namespace string) listersrbacv1.RoleBindingLister {
+	return &roleBindingLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*rbacv1.RoleBinding), nil
 }
diff --git a/listers/rbac/v1/rolebinding_expansion.go b/listers/rbac/v1/rolebinding_expansion.go
index 84d93c840..480753a98 100644
--- a/listers/rbac/v1/rolebinding_expansion.go
+++ b/listers/rbac/v1/rolebinding_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/rbac/v1alpha1/clusterrole.go b/listers/rbac/v1alpha1/clusterrole.go
index c380e29c5..b9b02da2d 100644
--- a/listers/rbac/v1alpha1/clusterrole.go
+++ b/listers/rbac/v1alpha1/clusterrole.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	rbacv1alpha1listers "k8s.io/client-go/listers/rbac/v1alpha1"
+	listersrbacv1alpha1 "k8s.io/client-go/listers/rbac/v1alpha1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ClusterRoleClusterLister can list ClusterRoles across all workspaces, or scope down to a ClusterRoleLister for one workspace.
+// ClusterRoleClusterLister helps list ClusterRoles across all workspaces,
+// or scope down to a ClusterRoleLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ClusterRoleClusterLister interface {
 	// List lists all ClusterRoles in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*rbacv1alpha1.ClusterRole, err error)
 	// Cluster returns a lister that can list and get ClusterRoles in one workspace.
-	Cluster(clusterName logicalcluster.Name) rbacv1alpha1listers.ClusterRoleLister
+	Cluster(clusterName logicalcluster.Name) listersrbacv1alpha1.ClusterRoleLister
 	ClusterRoleClusterListerExpansion
 }
 
+// clusterRoleClusterLister implements the ClusterRoleClusterLister interface.
 type clusterRoleClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*rbacv1alpha1.ClusterRole]
 }
 
+var _ ClusterRoleClusterLister = new(clusterRoleClusterLister)
+
 // NewClusterRoleClusterLister returns a new ClusterRoleClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewClusterRoleClusterLister(indexer cache.Indexer) *clusterRoleClusterLister {
-	return &clusterRoleClusterLister{indexer: indexer}
-}
-
-// List lists all ClusterRoles in the indexer across all workspaces.
-func (s *clusterRoleClusterLister) List(selector labels.Selector) (ret []*rbacv1alpha1.ClusterRole, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*rbacv1alpha1.ClusterRole))
-	})
-	return ret, err
+func NewClusterRoleClusterLister(indexer cache.Indexer) ClusterRoleClusterLister {
+	return &clusterRoleClusterLister{
+		kcplisters.NewCluster[*rbacv1alpha1.ClusterRole](indexer, rbacv1alpha1.Resource("clusterrole")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ClusterRoles.
-func (s *clusterRoleClusterLister) Cluster(clusterName logicalcluster.Name) rbacv1alpha1listers.ClusterRoleLister {
-	return &clusterRoleLister{indexer: s.indexer, clusterName: clusterName}
+func (l *clusterRoleClusterLister) Cluster(clusterName logicalcluster.Name) listersrbacv1alpha1.ClusterRoleLister {
+	return &clusterRoleLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// clusterRoleLister implements the rbacv1alpha1listers.ClusterRoleLister interface.
+// clusterRoleLister can list all ClusterRoles inside a workspace
+// or scope down to a listersrbacv1alpha1.ClusterRoleNamespaceLister for one namespace.
 type clusterRoleLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*rbacv1alpha1.ClusterRole]
 }
 
-// List lists all ClusterRoles in the indexer for a workspace.
-func (s *clusterRoleLister) List(selector labels.Selector) (ret []*rbacv1alpha1.ClusterRole, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1alpha1.ClusterRole))
-	})
-	return ret, err
-}
+var _ listersrbacv1alpha1.ClusterRoleLister = new(clusterRoleLister)
 
-// Get retrieves the ClusterRole from the indexer for a given workspace and name.
-func (s *clusterRoleLister) Get(name string) (*rbacv1alpha1.ClusterRole, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(rbacv1alpha1.Resource("clusterroles"), name)
+// NewClusterRoleLister returns a new ClusterRoleLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewClusterRoleLister(indexer cache.Indexer) listersrbacv1alpha1.ClusterRoleLister {
+	return &clusterRoleLister{
+		kcplisters.New[*rbacv1alpha1.ClusterRole](indexer, rbacv1alpha1.Resource("clusterrole")),
 	}
-	return obj.(*rbacv1alpha1.ClusterRole), nil
+}
+
+// clusterRoleScopedLister can list all ClusterRoles inside a workspace
+// or scope down to a listersrbacv1alpha1.ClusterRoleNamespaceLister.
+type clusterRoleScopedLister struct {
+	kcplisters.ResourceIndexer[*rbacv1alpha1.ClusterRole]
 }
diff --git a/listers/rbac/v1alpha1/clusterrole_expansion.go b/listers/rbac/v1alpha1/clusterrole_expansion.go
index 9bcbe1e43..26b2940b4 100644
--- a/listers/rbac/v1alpha1/clusterrole_expansion.go
+++ b/listers/rbac/v1alpha1/clusterrole_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/rbac/v1alpha1/clusterrolebinding.go b/listers/rbac/v1alpha1/clusterrolebinding.go
index 50b1ee8fd..22ab96512 100644
--- a/listers/rbac/v1alpha1/clusterrolebinding.go
+++ b/listers/rbac/v1alpha1/clusterrolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	rbacv1alpha1listers "k8s.io/client-go/listers/rbac/v1alpha1"
+	listersrbacv1alpha1 "k8s.io/client-go/listers/rbac/v1alpha1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ClusterRoleBindingClusterLister can list ClusterRoleBindings across all workspaces, or scope down to a ClusterRoleBindingLister for one workspace.
+// ClusterRoleBindingClusterLister helps list ClusterRoleBindings across all workspaces,
+// or scope down to a ClusterRoleBindingLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ClusterRoleBindingClusterLister interface {
 	// List lists all ClusterRoleBindings in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*rbacv1alpha1.ClusterRoleBinding, err error)
 	// Cluster returns a lister that can list and get ClusterRoleBindings in one workspace.
-	Cluster(clusterName logicalcluster.Name) rbacv1alpha1listers.ClusterRoleBindingLister
+	Cluster(clusterName logicalcluster.Name) listersrbacv1alpha1.ClusterRoleBindingLister
 	ClusterRoleBindingClusterListerExpansion
 }
 
+// clusterRoleBindingClusterLister implements the ClusterRoleBindingClusterLister interface.
 type clusterRoleBindingClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*rbacv1alpha1.ClusterRoleBinding]
 }
 
+var _ ClusterRoleBindingClusterLister = new(clusterRoleBindingClusterLister)
+
 // NewClusterRoleBindingClusterLister returns a new ClusterRoleBindingClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewClusterRoleBindingClusterLister(indexer cache.Indexer) *clusterRoleBindingClusterLister {
-	return &clusterRoleBindingClusterLister{indexer: indexer}
-}
-
-// List lists all ClusterRoleBindings in the indexer across all workspaces.
-func (s *clusterRoleBindingClusterLister) List(selector labels.Selector) (ret []*rbacv1alpha1.ClusterRoleBinding, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*rbacv1alpha1.ClusterRoleBinding))
-	})
-	return ret, err
+func NewClusterRoleBindingClusterLister(indexer cache.Indexer) ClusterRoleBindingClusterLister {
+	return &clusterRoleBindingClusterLister{
+		kcplisters.NewCluster[*rbacv1alpha1.ClusterRoleBinding](indexer, rbacv1alpha1.Resource("clusterrolebinding")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ClusterRoleBindings.
-func (s *clusterRoleBindingClusterLister) Cluster(clusterName logicalcluster.Name) rbacv1alpha1listers.ClusterRoleBindingLister {
-	return &clusterRoleBindingLister{indexer: s.indexer, clusterName: clusterName}
+func (l *clusterRoleBindingClusterLister) Cluster(clusterName logicalcluster.Name) listersrbacv1alpha1.ClusterRoleBindingLister {
+	return &clusterRoleBindingLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// clusterRoleBindingLister implements the rbacv1alpha1listers.ClusterRoleBindingLister interface.
+// clusterRoleBindingLister can list all ClusterRoleBindings inside a workspace
+// or scope down to a listersrbacv1alpha1.ClusterRoleBindingNamespaceLister for one namespace.
 type clusterRoleBindingLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*rbacv1alpha1.ClusterRoleBinding]
 }
 
-// List lists all ClusterRoleBindings in the indexer for a workspace.
-func (s *clusterRoleBindingLister) List(selector labels.Selector) (ret []*rbacv1alpha1.ClusterRoleBinding, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1alpha1.ClusterRoleBinding))
-	})
-	return ret, err
-}
+var _ listersrbacv1alpha1.ClusterRoleBindingLister = new(clusterRoleBindingLister)
 
-// Get retrieves the ClusterRoleBinding from the indexer for a given workspace and name.
-func (s *clusterRoleBindingLister) Get(name string) (*rbacv1alpha1.ClusterRoleBinding, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(rbacv1alpha1.Resource("clusterrolebindings"), name)
+// NewClusterRoleBindingLister returns a new ClusterRoleBindingLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewClusterRoleBindingLister(indexer cache.Indexer) listersrbacv1alpha1.ClusterRoleBindingLister {
+	return &clusterRoleBindingLister{
+		kcplisters.New[*rbacv1alpha1.ClusterRoleBinding](indexer, rbacv1alpha1.Resource("clusterrolebinding")),
 	}
-	return obj.(*rbacv1alpha1.ClusterRoleBinding), nil
+}
+
+// clusterRoleBindingScopedLister can list all ClusterRoleBindings inside a workspace
+// or scope down to a listersrbacv1alpha1.ClusterRoleBindingNamespaceLister.
+type clusterRoleBindingScopedLister struct {
+	kcplisters.ResourceIndexer[*rbacv1alpha1.ClusterRoleBinding]
 }
diff --git a/listers/rbac/v1alpha1/clusterrolebinding_expansion.go b/listers/rbac/v1alpha1/clusterrolebinding_expansion.go
index 6f1748539..0f6d21e61 100644
--- a/listers/rbac/v1alpha1/clusterrolebinding_expansion.go
+++ b/listers/rbac/v1alpha1/clusterrolebinding_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/rbac/v1alpha1/expansion_generated.go b/listers/rbac/v1alpha1/expansion_generated.go
new file mode 100644
index 000000000..3b8521c00
--- /dev/null
+++ b/listers/rbac/v1alpha1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
diff --git a/listers/rbac/v1alpha1/role.go b/listers/rbac/v1alpha1/role.go
index f34335e26..a482c985e 100644
--- a/listers/rbac/v1alpha1/role.go
+++ b/listers/rbac/v1alpha1/role.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	rbacv1alpha1listers "k8s.io/client-go/listers/rbac/v1alpha1"
+	listersrbacv1alpha1 "k8s.io/client-go/listers/rbac/v1alpha1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// RoleClusterLister can list Roles across all workspaces, or scope down to a RoleLister for one workspace.
+// RoleClusterLister helps list Roles across all workspaces,
+// or scope down to a RoleLister for one workspace.
 // All objects returned here must be treated as read-only.
 type RoleClusterLister interface {
 	// List lists all Roles in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*rbacv1alpha1.Role, err error)
 	// Cluster returns a lister that can list and get Roles in one workspace.
-	Cluster(clusterName logicalcluster.Name) rbacv1alpha1listers.RoleLister
+	Cluster(clusterName logicalcluster.Name) listersrbacv1alpha1.RoleLister
 	RoleClusterListerExpansion
 }
 
+// roleClusterLister implements the RoleClusterLister interface.
 type roleClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*rbacv1alpha1.Role]
 }
 
+var _ RoleClusterLister = new(roleClusterLister)
+
 // NewRoleClusterLister returns a new RoleClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewRoleClusterLister(indexer cache.Indexer) *roleClusterLister {
-	return &roleClusterLister{indexer: indexer}
-}
-
-// List lists all Roles in the indexer across all workspaces.
-func (s *roleClusterLister) List(selector labels.Selector) (ret []*rbacv1alpha1.Role, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*rbacv1alpha1.Role))
-	})
-	return ret, err
+func NewRoleClusterLister(indexer cache.Indexer) RoleClusterLister {
+	return &roleClusterLister{
+		kcplisters.NewCluster[*rbacv1alpha1.Role](indexer, rbacv1alpha1.Resource("role")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Roles.
-func (s *roleClusterLister) Cluster(clusterName logicalcluster.Name) rbacv1alpha1listers.RoleLister {
-	return &roleLister{indexer: s.indexer, clusterName: clusterName}
+func (l *roleClusterLister) Cluster(clusterName logicalcluster.Name) listersrbacv1alpha1.RoleLister {
+	return &roleLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// roleLister implements the rbacv1alpha1listers.RoleLister interface.
+// roleLister can list all Roles inside a workspace
+// or scope down to a listersrbacv1alpha1.RoleNamespaceLister for one namespace.
 type roleLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*rbacv1alpha1.Role]
 }
 
-// List lists all Roles in the indexer for a workspace.
-func (s *roleLister) List(selector labels.Selector) (ret []*rbacv1alpha1.Role, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1alpha1.Role))
-	})
-	return ret, err
-}
+var _ listersrbacv1alpha1.RoleLister = new(roleLister)
 
 // Roles returns an object that can list and get Roles in one namespace.
-func (s *roleLister) Roles(namespace string) rbacv1alpha1listers.RoleNamespaceLister {
-	return &roleNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *roleLister) Roles(namespace string) listersrbacv1alpha1.RoleNamespaceLister {
+	return &roleNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// roleNamespaceLister implements the rbacv1alpha1listers.RoleNamespaceLister interface.
+// roleNamespaceLister implements the listersrbacv1alpha1.RoleNamespaceLister
+// interface.
 type roleNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*rbacv1alpha1.Role]
 }
 
-// List lists all Roles in the indexer for a given workspace and namespace.
-func (s *roleNamespaceLister) List(selector labels.Selector) (ret []*rbacv1alpha1.Role, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1alpha1.Role))
-	})
-	return ret, err
-}
+var _ listersrbacv1alpha1.RoleNamespaceLister = new(roleNamespaceLister)
 
-// Get retrieves the Role from the indexer for a given workspace, namespace and name.
-func (s *roleNamespaceLister) Get(name string) (*rbacv1alpha1.Role, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewRoleLister returns a new RoleLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewRoleLister(indexer cache.Indexer) listersrbacv1alpha1.RoleLister {
+	return &roleLister{
+		kcplisters.New[*rbacv1alpha1.Role](indexer, rbacv1alpha1.Resource("role")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(rbacv1alpha1.Resource("roles"), name)
+}
+
+// roleScopedLister can list all Roles inside a workspace
+// or scope down to a listersrbacv1alpha1.RoleNamespaceLister for one namespace.
+type roleScopedLister struct {
+	kcplisters.ResourceIndexer[*rbacv1alpha1.Role]
+}
+
+// Roles returns an object that can list and get Roles in one namespace.
+func (l *roleScopedLister) Roles(namespace string) listersrbacv1alpha1.RoleLister {
+	return &roleLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*rbacv1alpha1.Role), nil
 }
diff --git a/listers/rbac/v1alpha1/role_expansion.go b/listers/rbac/v1alpha1/role_expansion.go
index 178b21fc8..f84ead668 100644
--- a/listers/rbac/v1alpha1/role_expansion.go
+++ b/listers/rbac/v1alpha1/role_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/rbac/v1alpha1/rolebinding.go b/listers/rbac/v1alpha1/rolebinding.go
index a464766cf..edd127c9c 100644
--- a/listers/rbac/v1alpha1/rolebinding.go
+++ b/listers/rbac/v1alpha1/rolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	rbacv1alpha1listers "k8s.io/client-go/listers/rbac/v1alpha1"
+	listersrbacv1alpha1 "k8s.io/client-go/listers/rbac/v1alpha1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// RoleBindingClusterLister can list RoleBindings across all workspaces, or scope down to a RoleBindingLister for one workspace.
+// RoleBindingClusterLister helps list RoleBindings across all workspaces,
+// or scope down to a RoleBindingLister for one workspace.
 // All objects returned here must be treated as read-only.
 type RoleBindingClusterLister interface {
 	// List lists all RoleBindings in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*rbacv1alpha1.RoleBinding, err error)
 	// Cluster returns a lister that can list and get RoleBindings in one workspace.
-	Cluster(clusterName logicalcluster.Name) rbacv1alpha1listers.RoleBindingLister
+	Cluster(clusterName logicalcluster.Name) listersrbacv1alpha1.RoleBindingLister
 	RoleBindingClusterListerExpansion
 }
 
+// roleBindingClusterLister implements the RoleBindingClusterLister interface.
 type roleBindingClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*rbacv1alpha1.RoleBinding]
 }
 
+var _ RoleBindingClusterLister = new(roleBindingClusterLister)
+
 // NewRoleBindingClusterLister returns a new RoleBindingClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewRoleBindingClusterLister(indexer cache.Indexer) *roleBindingClusterLister {
-	return &roleBindingClusterLister{indexer: indexer}
-}
-
-// List lists all RoleBindings in the indexer across all workspaces.
-func (s *roleBindingClusterLister) List(selector labels.Selector) (ret []*rbacv1alpha1.RoleBinding, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*rbacv1alpha1.RoleBinding))
-	})
-	return ret, err
+func NewRoleBindingClusterLister(indexer cache.Indexer) RoleBindingClusterLister {
+	return &roleBindingClusterLister{
+		kcplisters.NewCluster[*rbacv1alpha1.RoleBinding](indexer, rbacv1alpha1.Resource("rolebinding")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get RoleBindings.
-func (s *roleBindingClusterLister) Cluster(clusterName logicalcluster.Name) rbacv1alpha1listers.RoleBindingLister {
-	return &roleBindingLister{indexer: s.indexer, clusterName: clusterName}
+func (l *roleBindingClusterLister) Cluster(clusterName logicalcluster.Name) listersrbacv1alpha1.RoleBindingLister {
+	return &roleBindingLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// roleBindingLister implements the rbacv1alpha1listers.RoleBindingLister interface.
+// roleBindingLister can list all RoleBindings inside a workspace
+// or scope down to a listersrbacv1alpha1.RoleBindingNamespaceLister for one namespace.
 type roleBindingLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*rbacv1alpha1.RoleBinding]
 }
 
-// List lists all RoleBindings in the indexer for a workspace.
-func (s *roleBindingLister) List(selector labels.Selector) (ret []*rbacv1alpha1.RoleBinding, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1alpha1.RoleBinding))
-	})
-	return ret, err
-}
+var _ listersrbacv1alpha1.RoleBindingLister = new(roleBindingLister)
 
 // RoleBindings returns an object that can list and get RoleBindings in one namespace.
-func (s *roleBindingLister) RoleBindings(namespace string) rbacv1alpha1listers.RoleBindingNamespaceLister {
-	return &roleBindingNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *roleBindingLister) RoleBindings(namespace string) listersrbacv1alpha1.RoleBindingNamespaceLister {
+	return &roleBindingNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// roleBindingNamespaceLister implements the rbacv1alpha1listers.RoleBindingNamespaceLister interface.
+// roleBindingNamespaceLister implements the listersrbacv1alpha1.RoleBindingNamespaceLister
+// interface.
 type roleBindingNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*rbacv1alpha1.RoleBinding]
 }
 
-// List lists all RoleBindings in the indexer for a given workspace and namespace.
-func (s *roleBindingNamespaceLister) List(selector labels.Selector) (ret []*rbacv1alpha1.RoleBinding, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1alpha1.RoleBinding))
-	})
-	return ret, err
-}
+var _ listersrbacv1alpha1.RoleBindingNamespaceLister = new(roleBindingNamespaceLister)
 
-// Get retrieves the RoleBinding from the indexer for a given workspace, namespace and name.
-func (s *roleBindingNamespaceLister) Get(name string) (*rbacv1alpha1.RoleBinding, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewRoleBindingLister returns a new RoleBindingLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewRoleBindingLister(indexer cache.Indexer) listersrbacv1alpha1.RoleBindingLister {
+	return &roleBindingLister{
+		kcplisters.New[*rbacv1alpha1.RoleBinding](indexer, rbacv1alpha1.Resource("rolebinding")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(rbacv1alpha1.Resource("rolebindings"), name)
+}
+
+// roleBindingScopedLister can list all RoleBindings inside a workspace
+// or scope down to a listersrbacv1alpha1.RoleBindingNamespaceLister for one namespace.
+type roleBindingScopedLister struct {
+	kcplisters.ResourceIndexer[*rbacv1alpha1.RoleBinding]
+}
+
+// RoleBindings returns an object that can list and get RoleBindings in one namespace.
+func (l *roleBindingScopedLister) RoleBindings(namespace string) listersrbacv1alpha1.RoleBindingLister {
+	return &roleBindingLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*rbacv1alpha1.RoleBinding), nil
 }
diff --git a/listers/rbac/v1alpha1/rolebinding_expansion.go b/listers/rbac/v1alpha1/rolebinding_expansion.go
index 3b62f279b..723cf9224 100644
--- a/listers/rbac/v1alpha1/rolebinding_expansion.go
+++ b/listers/rbac/v1alpha1/rolebinding_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/rbac/v1beta1/clusterrole.go b/listers/rbac/v1beta1/clusterrole.go
index d3a3c0d76..4c6f98dac 100644
--- a/listers/rbac/v1beta1/clusterrole.go
+++ b/listers/rbac/v1beta1/clusterrole.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	rbacv1beta1listers "k8s.io/client-go/listers/rbac/v1beta1"
+	listersrbacv1beta1 "k8s.io/client-go/listers/rbac/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ClusterRoleClusterLister can list ClusterRoles across all workspaces, or scope down to a ClusterRoleLister for one workspace.
+// ClusterRoleClusterLister helps list ClusterRoles across all workspaces,
+// or scope down to a ClusterRoleLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ClusterRoleClusterLister interface {
 	// List lists all ClusterRoles in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*rbacv1beta1.ClusterRole, err error)
 	// Cluster returns a lister that can list and get ClusterRoles in one workspace.
-	Cluster(clusterName logicalcluster.Name) rbacv1beta1listers.ClusterRoleLister
+	Cluster(clusterName logicalcluster.Name) listersrbacv1beta1.ClusterRoleLister
 	ClusterRoleClusterListerExpansion
 }
 
+// clusterRoleClusterLister implements the ClusterRoleClusterLister interface.
 type clusterRoleClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*rbacv1beta1.ClusterRole]
 }
 
+var _ ClusterRoleClusterLister = new(clusterRoleClusterLister)
+
 // NewClusterRoleClusterLister returns a new ClusterRoleClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewClusterRoleClusterLister(indexer cache.Indexer) *clusterRoleClusterLister {
-	return &clusterRoleClusterLister{indexer: indexer}
-}
-
-// List lists all ClusterRoles in the indexer across all workspaces.
-func (s *clusterRoleClusterLister) List(selector labels.Selector) (ret []*rbacv1beta1.ClusterRole, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*rbacv1beta1.ClusterRole))
-	})
-	return ret, err
+func NewClusterRoleClusterLister(indexer cache.Indexer) ClusterRoleClusterLister {
+	return &clusterRoleClusterLister{
+		kcplisters.NewCluster[*rbacv1beta1.ClusterRole](indexer, rbacv1beta1.Resource("clusterrole")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ClusterRoles.
-func (s *clusterRoleClusterLister) Cluster(clusterName logicalcluster.Name) rbacv1beta1listers.ClusterRoleLister {
-	return &clusterRoleLister{indexer: s.indexer, clusterName: clusterName}
+func (l *clusterRoleClusterLister) Cluster(clusterName logicalcluster.Name) listersrbacv1beta1.ClusterRoleLister {
+	return &clusterRoleLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// clusterRoleLister implements the rbacv1beta1listers.ClusterRoleLister interface.
+// clusterRoleLister can list all ClusterRoles inside a workspace
+// or scope down to a listersrbacv1beta1.ClusterRoleNamespaceLister for one namespace.
 type clusterRoleLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*rbacv1beta1.ClusterRole]
 }
 
-// List lists all ClusterRoles in the indexer for a workspace.
-func (s *clusterRoleLister) List(selector labels.Selector) (ret []*rbacv1beta1.ClusterRole, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1beta1.ClusterRole))
-	})
-	return ret, err
-}
+var _ listersrbacv1beta1.ClusterRoleLister = new(clusterRoleLister)
 
-// Get retrieves the ClusterRole from the indexer for a given workspace and name.
-func (s *clusterRoleLister) Get(name string) (*rbacv1beta1.ClusterRole, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(rbacv1beta1.Resource("clusterroles"), name)
+// NewClusterRoleLister returns a new ClusterRoleLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewClusterRoleLister(indexer cache.Indexer) listersrbacv1beta1.ClusterRoleLister {
+	return &clusterRoleLister{
+		kcplisters.New[*rbacv1beta1.ClusterRole](indexer, rbacv1beta1.Resource("clusterrole")),
 	}
-	return obj.(*rbacv1beta1.ClusterRole), nil
+}
+
+// clusterRoleScopedLister can list all ClusterRoles inside a workspace
+// or scope down to a listersrbacv1beta1.ClusterRoleNamespaceLister.
+type clusterRoleScopedLister struct {
+	kcplisters.ResourceIndexer[*rbacv1beta1.ClusterRole]
 }
diff --git a/listers/rbac/v1beta1/clusterrole_expansion.go b/listers/rbac/v1beta1/clusterrole_expansion.go
index 327e32253..c39dd4f1d 100644
--- a/listers/rbac/v1beta1/clusterrole_expansion.go
+++ b/listers/rbac/v1beta1/clusterrole_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/rbac/v1beta1/clusterrolebinding.go b/listers/rbac/v1beta1/clusterrolebinding.go
index f56bb392b..4799e33f8 100644
--- a/listers/rbac/v1beta1/clusterrolebinding.go
+++ b/listers/rbac/v1beta1/clusterrolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	rbacv1beta1listers "k8s.io/client-go/listers/rbac/v1beta1"
+	listersrbacv1beta1 "k8s.io/client-go/listers/rbac/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// ClusterRoleBindingClusterLister can list ClusterRoleBindings across all workspaces, or scope down to a ClusterRoleBindingLister for one workspace.
+// ClusterRoleBindingClusterLister helps list ClusterRoleBindings across all workspaces,
+// or scope down to a ClusterRoleBindingLister for one workspace.
 // All objects returned here must be treated as read-only.
 type ClusterRoleBindingClusterLister interface {
 	// List lists all ClusterRoleBindings in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*rbacv1beta1.ClusterRoleBinding, err error)
 	// Cluster returns a lister that can list and get ClusterRoleBindings in one workspace.
-	Cluster(clusterName logicalcluster.Name) rbacv1beta1listers.ClusterRoleBindingLister
+	Cluster(clusterName logicalcluster.Name) listersrbacv1beta1.ClusterRoleBindingLister
 	ClusterRoleBindingClusterListerExpansion
 }
 
+// clusterRoleBindingClusterLister implements the ClusterRoleBindingClusterLister interface.
 type clusterRoleBindingClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*rbacv1beta1.ClusterRoleBinding]
 }
 
+var _ ClusterRoleBindingClusterLister = new(clusterRoleBindingClusterLister)
+
 // NewClusterRoleBindingClusterLister returns a new ClusterRoleBindingClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewClusterRoleBindingClusterLister(indexer cache.Indexer) *clusterRoleBindingClusterLister {
-	return &clusterRoleBindingClusterLister{indexer: indexer}
-}
-
-// List lists all ClusterRoleBindings in the indexer across all workspaces.
-func (s *clusterRoleBindingClusterLister) List(selector labels.Selector) (ret []*rbacv1beta1.ClusterRoleBinding, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*rbacv1beta1.ClusterRoleBinding))
-	})
-	return ret, err
+func NewClusterRoleBindingClusterLister(indexer cache.Indexer) ClusterRoleBindingClusterLister {
+	return &clusterRoleBindingClusterLister{
+		kcplisters.NewCluster[*rbacv1beta1.ClusterRoleBinding](indexer, rbacv1beta1.Resource("clusterrolebinding")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get ClusterRoleBindings.
-func (s *clusterRoleBindingClusterLister) Cluster(clusterName logicalcluster.Name) rbacv1beta1listers.ClusterRoleBindingLister {
-	return &clusterRoleBindingLister{indexer: s.indexer, clusterName: clusterName}
+func (l *clusterRoleBindingClusterLister) Cluster(clusterName logicalcluster.Name) listersrbacv1beta1.ClusterRoleBindingLister {
+	return &clusterRoleBindingLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// clusterRoleBindingLister implements the rbacv1beta1listers.ClusterRoleBindingLister interface.
+// clusterRoleBindingLister can list all ClusterRoleBindings inside a workspace
+// or scope down to a listersrbacv1beta1.ClusterRoleBindingNamespaceLister for one namespace.
 type clusterRoleBindingLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*rbacv1beta1.ClusterRoleBinding]
 }
 
-// List lists all ClusterRoleBindings in the indexer for a workspace.
-func (s *clusterRoleBindingLister) List(selector labels.Selector) (ret []*rbacv1beta1.ClusterRoleBinding, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1beta1.ClusterRoleBinding))
-	})
-	return ret, err
-}
+var _ listersrbacv1beta1.ClusterRoleBindingLister = new(clusterRoleBindingLister)
 
-// Get retrieves the ClusterRoleBinding from the indexer for a given workspace and name.
-func (s *clusterRoleBindingLister) Get(name string) (*rbacv1beta1.ClusterRoleBinding, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(rbacv1beta1.Resource("clusterrolebindings"), name)
+// NewClusterRoleBindingLister returns a new ClusterRoleBindingLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewClusterRoleBindingLister(indexer cache.Indexer) listersrbacv1beta1.ClusterRoleBindingLister {
+	return &clusterRoleBindingLister{
+		kcplisters.New[*rbacv1beta1.ClusterRoleBinding](indexer, rbacv1beta1.Resource("clusterrolebinding")),
 	}
-	return obj.(*rbacv1beta1.ClusterRoleBinding), nil
+}
+
+// clusterRoleBindingScopedLister can list all ClusterRoleBindings inside a workspace
+// or scope down to a listersrbacv1beta1.ClusterRoleBindingNamespaceLister.
+type clusterRoleBindingScopedLister struct {
+	kcplisters.ResourceIndexer[*rbacv1beta1.ClusterRoleBinding]
 }
diff --git a/listers/rbac/v1beta1/clusterrolebinding_expansion.go b/listers/rbac/v1beta1/clusterrolebinding_expansion.go
index 19d0054a7..610e39d06 100644
--- a/listers/rbac/v1beta1/clusterrolebinding_expansion.go
+++ b/listers/rbac/v1beta1/clusterrolebinding_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/rbac/v1beta1/expansion_generated.go b/listers/rbac/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/rbac/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/rbac/v1beta1/role.go b/listers/rbac/v1beta1/role.go
index 1f9ff1a18..874b9d837 100644
--- a/listers/rbac/v1beta1/role.go
+++ b/listers/rbac/v1beta1/role.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	rbacv1beta1listers "k8s.io/client-go/listers/rbac/v1beta1"
+	listersrbacv1beta1 "k8s.io/client-go/listers/rbac/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// RoleClusterLister can list Roles across all workspaces, or scope down to a RoleLister for one workspace.
+// RoleClusterLister helps list Roles across all workspaces,
+// or scope down to a RoleLister for one workspace.
 // All objects returned here must be treated as read-only.
 type RoleClusterLister interface {
 	// List lists all Roles in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*rbacv1beta1.Role, err error)
 	// Cluster returns a lister that can list and get Roles in one workspace.
-	Cluster(clusterName logicalcluster.Name) rbacv1beta1listers.RoleLister
+	Cluster(clusterName logicalcluster.Name) listersrbacv1beta1.RoleLister
 	RoleClusterListerExpansion
 }
 
+// roleClusterLister implements the RoleClusterLister interface.
 type roleClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*rbacv1beta1.Role]
 }
 
+var _ RoleClusterLister = new(roleClusterLister)
+
 // NewRoleClusterLister returns a new RoleClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewRoleClusterLister(indexer cache.Indexer) *roleClusterLister {
-	return &roleClusterLister{indexer: indexer}
-}
-
-// List lists all Roles in the indexer across all workspaces.
-func (s *roleClusterLister) List(selector labels.Selector) (ret []*rbacv1beta1.Role, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*rbacv1beta1.Role))
-	})
-	return ret, err
+func NewRoleClusterLister(indexer cache.Indexer) RoleClusterLister {
+	return &roleClusterLister{
+		kcplisters.NewCluster[*rbacv1beta1.Role](indexer, rbacv1beta1.Resource("role")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get Roles.
-func (s *roleClusterLister) Cluster(clusterName logicalcluster.Name) rbacv1beta1listers.RoleLister {
-	return &roleLister{indexer: s.indexer, clusterName: clusterName}
+func (l *roleClusterLister) Cluster(clusterName logicalcluster.Name) listersrbacv1beta1.RoleLister {
+	return &roleLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// roleLister implements the rbacv1beta1listers.RoleLister interface.
+// roleLister can list all Roles inside a workspace
+// or scope down to a listersrbacv1beta1.RoleNamespaceLister for one namespace.
 type roleLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*rbacv1beta1.Role]
 }
 
-// List lists all Roles in the indexer for a workspace.
-func (s *roleLister) List(selector labels.Selector) (ret []*rbacv1beta1.Role, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1beta1.Role))
-	})
-	return ret, err
-}
+var _ listersrbacv1beta1.RoleLister = new(roleLister)
 
 // Roles returns an object that can list and get Roles in one namespace.
-func (s *roleLister) Roles(namespace string) rbacv1beta1listers.RoleNamespaceLister {
-	return &roleNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *roleLister) Roles(namespace string) listersrbacv1beta1.RoleNamespaceLister {
+	return &roleNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// roleNamespaceLister implements the rbacv1beta1listers.RoleNamespaceLister interface.
+// roleNamespaceLister implements the listersrbacv1beta1.RoleNamespaceLister
+// interface.
 type roleNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*rbacv1beta1.Role]
 }
 
-// List lists all Roles in the indexer for a given workspace and namespace.
-func (s *roleNamespaceLister) List(selector labels.Selector) (ret []*rbacv1beta1.Role, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1beta1.Role))
-	})
-	return ret, err
-}
+var _ listersrbacv1beta1.RoleNamespaceLister = new(roleNamespaceLister)
 
-// Get retrieves the Role from the indexer for a given workspace, namespace and name.
-func (s *roleNamespaceLister) Get(name string) (*rbacv1beta1.Role, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewRoleLister returns a new RoleLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewRoleLister(indexer cache.Indexer) listersrbacv1beta1.RoleLister {
+	return &roleLister{
+		kcplisters.New[*rbacv1beta1.Role](indexer, rbacv1beta1.Resource("role")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(rbacv1beta1.Resource("roles"), name)
+}
+
+// roleScopedLister can list all Roles inside a workspace
+// or scope down to a listersrbacv1beta1.RoleNamespaceLister for one namespace.
+type roleScopedLister struct {
+	kcplisters.ResourceIndexer[*rbacv1beta1.Role]
+}
+
+// Roles returns an object that can list and get Roles in one namespace.
+func (l *roleScopedLister) Roles(namespace string) listersrbacv1beta1.RoleLister {
+	return &roleLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*rbacv1beta1.Role), nil
 }
diff --git a/listers/rbac/v1beta1/role_expansion.go b/listers/rbac/v1beta1/role_expansion.go
index 4084bb8a6..f6520eaf8 100644
--- a/listers/rbac/v1beta1/role_expansion.go
+++ b/listers/rbac/v1beta1/role_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/rbac/v1beta1/rolebinding.go b/listers/rbac/v1beta1/rolebinding.go
index 563ad9c62..7036ff4d6 100644
--- a/listers/rbac/v1beta1/rolebinding.go
+++ b/listers/rbac/v1beta1/rolebinding.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	rbacv1beta1 "k8s.io/api/rbac/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	rbacv1beta1listers "k8s.io/client-go/listers/rbac/v1beta1"
+	listersrbacv1beta1 "k8s.io/client-go/listers/rbac/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// RoleBindingClusterLister can list RoleBindings across all workspaces, or scope down to a RoleBindingLister for one workspace.
+// RoleBindingClusterLister helps list RoleBindings across all workspaces,
+// or scope down to a RoleBindingLister for one workspace.
 // All objects returned here must be treated as read-only.
 type RoleBindingClusterLister interface {
 	// List lists all RoleBindings in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*rbacv1beta1.RoleBinding, err error)
 	// Cluster returns a lister that can list and get RoleBindings in one workspace.
-	Cluster(clusterName logicalcluster.Name) rbacv1beta1listers.RoleBindingLister
+	Cluster(clusterName logicalcluster.Name) listersrbacv1beta1.RoleBindingLister
 	RoleBindingClusterListerExpansion
 }
 
+// roleBindingClusterLister implements the RoleBindingClusterLister interface.
 type roleBindingClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*rbacv1beta1.RoleBinding]
 }
 
+var _ RoleBindingClusterLister = new(roleBindingClusterLister)
+
 // NewRoleBindingClusterLister returns a new RoleBindingClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewRoleBindingClusterLister(indexer cache.Indexer) *roleBindingClusterLister {
-	return &roleBindingClusterLister{indexer: indexer}
-}
-
-// List lists all RoleBindings in the indexer across all workspaces.
-func (s *roleBindingClusterLister) List(selector labels.Selector) (ret []*rbacv1beta1.RoleBinding, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*rbacv1beta1.RoleBinding))
-	})
-	return ret, err
+func NewRoleBindingClusterLister(indexer cache.Indexer) RoleBindingClusterLister {
+	return &roleBindingClusterLister{
+		kcplisters.NewCluster[*rbacv1beta1.RoleBinding](indexer, rbacv1beta1.Resource("rolebinding")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get RoleBindings.
-func (s *roleBindingClusterLister) Cluster(clusterName logicalcluster.Name) rbacv1beta1listers.RoleBindingLister {
-	return &roleBindingLister{indexer: s.indexer, clusterName: clusterName}
+func (l *roleBindingClusterLister) Cluster(clusterName logicalcluster.Name) listersrbacv1beta1.RoleBindingLister {
+	return &roleBindingLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// roleBindingLister implements the rbacv1beta1listers.RoleBindingLister interface.
+// roleBindingLister can list all RoleBindings inside a workspace
+// or scope down to a listersrbacv1beta1.RoleBindingNamespaceLister for one namespace.
 type roleBindingLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*rbacv1beta1.RoleBinding]
 }
 
-// List lists all RoleBindings in the indexer for a workspace.
-func (s *roleBindingLister) List(selector labels.Selector) (ret []*rbacv1beta1.RoleBinding, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1beta1.RoleBinding))
-	})
-	return ret, err
-}
+var _ listersrbacv1beta1.RoleBindingLister = new(roleBindingLister)
 
 // RoleBindings returns an object that can list and get RoleBindings in one namespace.
-func (s *roleBindingLister) RoleBindings(namespace string) rbacv1beta1listers.RoleBindingNamespaceLister {
-	return &roleBindingNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *roleBindingLister) RoleBindings(namespace string) listersrbacv1beta1.RoleBindingNamespaceLister {
+	return &roleBindingNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// roleBindingNamespaceLister implements the rbacv1beta1listers.RoleBindingNamespaceLister interface.
+// roleBindingNamespaceLister implements the listersrbacv1beta1.RoleBindingNamespaceLister
+// interface.
 type roleBindingNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*rbacv1beta1.RoleBinding]
 }
 
-// List lists all RoleBindings in the indexer for a given workspace and namespace.
-func (s *roleBindingNamespaceLister) List(selector labels.Selector) (ret []*rbacv1beta1.RoleBinding, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*rbacv1beta1.RoleBinding))
-	})
-	return ret, err
-}
+var _ listersrbacv1beta1.RoleBindingNamespaceLister = new(roleBindingNamespaceLister)
 
-// Get retrieves the RoleBinding from the indexer for a given workspace, namespace and name.
-func (s *roleBindingNamespaceLister) Get(name string) (*rbacv1beta1.RoleBinding, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewRoleBindingLister returns a new RoleBindingLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewRoleBindingLister(indexer cache.Indexer) listersrbacv1beta1.RoleBindingLister {
+	return &roleBindingLister{
+		kcplisters.New[*rbacv1beta1.RoleBinding](indexer, rbacv1beta1.Resource("rolebinding")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(rbacv1beta1.Resource("rolebindings"), name)
+}
+
+// roleBindingScopedLister can list all RoleBindings inside a workspace
+// or scope down to a listersrbacv1beta1.RoleBindingNamespaceLister for one namespace.
+type roleBindingScopedLister struct {
+	kcplisters.ResourceIndexer[*rbacv1beta1.RoleBinding]
+}
+
+// RoleBindings returns an object that can list and get RoleBindings in one namespace.
+func (l *roleBindingScopedLister) RoleBindings(namespace string) listersrbacv1beta1.RoleBindingLister {
+	return &roleBindingLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*rbacv1beta1.RoleBinding), nil
 }
diff --git a/listers/rbac/v1beta1/rolebinding_expansion.go b/listers/rbac/v1beta1/rolebinding_expansion.go
index deeabe7f3..6b9499d23 100644
--- a/listers/rbac/v1beta1/rolebinding_expansion.go
+++ b/listers/rbac/v1beta1/rolebinding_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/resource/v1alpha1/podscheduling.go b/listers/resource/v1alpha1/podscheduling.go
deleted file mode 100644
index 294bbb42d..000000000
--- a/listers/resource/v1alpha1/podscheduling.go
+++ /dev/null
@@ -1,118 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	resourcev1alpha1listers "k8s.io/client-go/listers/resource/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-)
-
-// PodSchedulingClusterLister can list PodSchedulings across all workspaces, or scope down to a PodSchedulingLister for one workspace.
-// All objects returned here must be treated as read-only.
-type PodSchedulingClusterLister interface {
-	// List lists all PodSchedulings in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*resourcev1alpha1.PodScheduling, err error)
-	// Cluster returns a lister that can list and get PodSchedulings in one workspace.
-	Cluster(clusterName logicalcluster.Name) resourcev1alpha1listers.PodSchedulingLister
-	PodSchedulingClusterListerExpansion
-}
-
-type podSchedulingClusterLister struct {
-	indexer cache.Indexer
-}
-
-// NewPodSchedulingClusterLister returns a new PodSchedulingClusterLister.
-// We assume that the indexer:
-// - is fed by a cross-workspace LIST+WATCH
-// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
-// - has the kcpcache.ClusterIndex as an index
-// - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewPodSchedulingClusterLister(indexer cache.Indexer) *podSchedulingClusterLister {
-	return &podSchedulingClusterLister{indexer: indexer}
-}
-
-// List lists all PodSchedulings in the indexer across all workspaces.
-func (s *podSchedulingClusterLister) List(selector labels.Selector) (ret []*resourcev1alpha1.PodScheduling, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*resourcev1alpha1.PodScheduling))
-	})
-	return ret, err
-}
-
-// Cluster scopes the lister to one workspace, allowing users to list and get PodSchedulings.
-func (s *podSchedulingClusterLister) Cluster(clusterName logicalcluster.Name) resourcev1alpha1listers.PodSchedulingLister {
-	return &podSchedulingLister{indexer: s.indexer, clusterName: clusterName}
-}
-
-// podSchedulingLister implements the resourcev1alpha1listers.PodSchedulingLister interface.
-type podSchedulingLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-}
-
-// List lists all PodSchedulings in the indexer for a workspace.
-func (s *podSchedulingLister) List(selector labels.Selector) (ret []*resourcev1alpha1.PodScheduling, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*resourcev1alpha1.PodScheduling))
-	})
-	return ret, err
-}
-
-// PodSchedulings returns an object that can list and get PodSchedulings in one namespace.
-func (s *podSchedulingLister) PodSchedulings(namespace string) resourcev1alpha1listers.PodSchedulingNamespaceLister {
-	return &podSchedulingNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
-}
-
-// podSchedulingNamespaceLister implements the resourcev1alpha1listers.PodSchedulingNamespaceLister interface.
-type podSchedulingNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
-}
-
-// List lists all PodSchedulings in the indexer for a given workspace and namespace.
-func (s *podSchedulingNamespaceLister) List(selector labels.Selector) (ret []*resourcev1alpha1.PodScheduling, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*resourcev1alpha1.PodScheduling))
-	})
-	return ret, err
-}
-
-// Get retrieves the PodScheduling from the indexer for a given workspace, namespace and name.
-func (s *podSchedulingNamespaceLister) Get(name string) (*resourcev1alpha1.PodScheduling, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(resourcev1alpha1.Resource("podschedulings"), name)
-	}
-	return obj.(*resourcev1alpha1.PodScheduling), nil
-}
diff --git a/listers/resource/v1alpha1/resourceclaim.go b/listers/resource/v1alpha1/resourceclaim.go
deleted file mode 100644
index 1c40eee32..000000000
--- a/listers/resource/v1alpha1/resourceclaim.go
+++ /dev/null
@@ -1,118 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	resourcev1alpha1listers "k8s.io/client-go/listers/resource/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-)
-
-// ResourceClaimClusterLister can list ResourceClaims across all workspaces, or scope down to a ResourceClaimLister for one workspace.
-// All objects returned here must be treated as read-only.
-type ResourceClaimClusterLister interface {
-	// List lists all ResourceClaims in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*resourcev1alpha1.ResourceClaim, err error)
-	// Cluster returns a lister that can list and get ResourceClaims in one workspace.
-	Cluster(clusterName logicalcluster.Name) resourcev1alpha1listers.ResourceClaimLister
-	ResourceClaimClusterListerExpansion
-}
-
-type resourceClaimClusterLister struct {
-	indexer cache.Indexer
-}
-
-// NewResourceClaimClusterLister returns a new ResourceClaimClusterLister.
-// We assume that the indexer:
-// - is fed by a cross-workspace LIST+WATCH
-// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
-// - has the kcpcache.ClusterIndex as an index
-// - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewResourceClaimClusterLister(indexer cache.Indexer) *resourceClaimClusterLister {
-	return &resourceClaimClusterLister{indexer: indexer}
-}
-
-// List lists all ResourceClaims in the indexer across all workspaces.
-func (s *resourceClaimClusterLister) List(selector labels.Selector) (ret []*resourcev1alpha1.ResourceClaim, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*resourcev1alpha1.ResourceClaim))
-	})
-	return ret, err
-}
-
-// Cluster scopes the lister to one workspace, allowing users to list and get ResourceClaims.
-func (s *resourceClaimClusterLister) Cluster(clusterName logicalcluster.Name) resourcev1alpha1listers.ResourceClaimLister {
-	return &resourceClaimLister{indexer: s.indexer, clusterName: clusterName}
-}
-
-// resourceClaimLister implements the resourcev1alpha1listers.ResourceClaimLister interface.
-type resourceClaimLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-}
-
-// List lists all ResourceClaims in the indexer for a workspace.
-func (s *resourceClaimLister) List(selector labels.Selector) (ret []*resourcev1alpha1.ResourceClaim, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*resourcev1alpha1.ResourceClaim))
-	})
-	return ret, err
-}
-
-// ResourceClaims returns an object that can list and get ResourceClaims in one namespace.
-func (s *resourceClaimLister) ResourceClaims(namespace string) resourcev1alpha1listers.ResourceClaimNamespaceLister {
-	return &resourceClaimNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
-}
-
-// resourceClaimNamespaceLister implements the resourcev1alpha1listers.ResourceClaimNamespaceLister interface.
-type resourceClaimNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
-}
-
-// List lists all ResourceClaims in the indexer for a given workspace and namespace.
-func (s *resourceClaimNamespaceLister) List(selector labels.Selector) (ret []*resourcev1alpha1.ResourceClaim, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*resourcev1alpha1.ResourceClaim))
-	})
-	return ret, err
-}
-
-// Get retrieves the ResourceClaim from the indexer for a given workspace, namespace and name.
-func (s *resourceClaimNamespaceLister) Get(name string) (*resourcev1alpha1.ResourceClaim, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(resourcev1alpha1.Resource("resourceclaims"), name)
-	}
-	return obj.(*resourcev1alpha1.ResourceClaim), nil
-}
diff --git a/listers/resource/v1alpha1/resourceclaimtemplate.go b/listers/resource/v1alpha1/resourceclaimtemplate.go
deleted file mode 100644
index 116403003..000000000
--- a/listers/resource/v1alpha1/resourceclaimtemplate.go
+++ /dev/null
@@ -1,118 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	resourcev1alpha1listers "k8s.io/client-go/listers/resource/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-)
-
-// ResourceClaimTemplateClusterLister can list ResourceClaimTemplates across all workspaces, or scope down to a ResourceClaimTemplateLister for one workspace.
-// All objects returned here must be treated as read-only.
-type ResourceClaimTemplateClusterLister interface {
-	// List lists all ResourceClaimTemplates in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*resourcev1alpha1.ResourceClaimTemplate, err error)
-	// Cluster returns a lister that can list and get ResourceClaimTemplates in one workspace.
-	Cluster(clusterName logicalcluster.Name) resourcev1alpha1listers.ResourceClaimTemplateLister
-	ResourceClaimTemplateClusterListerExpansion
-}
-
-type resourceClaimTemplateClusterLister struct {
-	indexer cache.Indexer
-}
-
-// NewResourceClaimTemplateClusterLister returns a new ResourceClaimTemplateClusterLister.
-// We assume that the indexer:
-// - is fed by a cross-workspace LIST+WATCH
-// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
-// - has the kcpcache.ClusterIndex as an index
-// - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewResourceClaimTemplateClusterLister(indexer cache.Indexer) *resourceClaimTemplateClusterLister {
-	return &resourceClaimTemplateClusterLister{indexer: indexer}
-}
-
-// List lists all ResourceClaimTemplates in the indexer across all workspaces.
-func (s *resourceClaimTemplateClusterLister) List(selector labels.Selector) (ret []*resourcev1alpha1.ResourceClaimTemplate, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*resourcev1alpha1.ResourceClaimTemplate))
-	})
-	return ret, err
-}
-
-// Cluster scopes the lister to one workspace, allowing users to list and get ResourceClaimTemplates.
-func (s *resourceClaimTemplateClusterLister) Cluster(clusterName logicalcluster.Name) resourcev1alpha1listers.ResourceClaimTemplateLister {
-	return &resourceClaimTemplateLister{indexer: s.indexer, clusterName: clusterName}
-}
-
-// resourceClaimTemplateLister implements the resourcev1alpha1listers.ResourceClaimTemplateLister interface.
-type resourceClaimTemplateLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-}
-
-// List lists all ResourceClaimTemplates in the indexer for a workspace.
-func (s *resourceClaimTemplateLister) List(selector labels.Selector) (ret []*resourcev1alpha1.ResourceClaimTemplate, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*resourcev1alpha1.ResourceClaimTemplate))
-	})
-	return ret, err
-}
-
-// ResourceClaimTemplates returns an object that can list and get ResourceClaimTemplates in one namespace.
-func (s *resourceClaimTemplateLister) ResourceClaimTemplates(namespace string) resourcev1alpha1listers.ResourceClaimTemplateNamespaceLister {
-	return &resourceClaimTemplateNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
-}
-
-// resourceClaimTemplateNamespaceLister implements the resourcev1alpha1listers.ResourceClaimTemplateNamespaceLister interface.
-type resourceClaimTemplateNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
-}
-
-// List lists all ResourceClaimTemplates in the indexer for a given workspace and namespace.
-func (s *resourceClaimTemplateNamespaceLister) List(selector labels.Selector) (ret []*resourcev1alpha1.ResourceClaimTemplate, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*resourcev1alpha1.ResourceClaimTemplate))
-	})
-	return ret, err
-}
-
-// Get retrieves the ResourceClaimTemplate from the indexer for a given workspace, namespace and name.
-func (s *resourceClaimTemplateNamespaceLister) Get(name string) (*resourcev1alpha1.ResourceClaimTemplate, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(resourcev1alpha1.Resource("resourceclaimtemplates"), name)
-	}
-	return obj.(*resourcev1alpha1.ResourceClaimTemplate), nil
-}
diff --git a/listers/resource/v1alpha1/resourceclass.go b/listers/resource/v1alpha1/resourceclass.go
deleted file mode 100644
index 22ff6a415..000000000
--- a/listers/resource/v1alpha1/resourceclass.go
+++ /dev/null
@@ -1,97 +0,0 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
-/*
-Copyright The KCP Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by kcp code-generator. DO NOT EDIT.
-
-package v1alpha1
-
-import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
-	resourcev1alpha1 "k8s.io/api/resource/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	resourcev1alpha1listers "k8s.io/client-go/listers/resource/v1alpha1"
-	"k8s.io/client-go/tools/cache"
-)
-
-// ResourceClassClusterLister can list ResourceClasses across all workspaces, or scope down to a ResourceClassLister for one workspace.
-// All objects returned here must be treated as read-only.
-type ResourceClassClusterLister interface {
-	// List lists all ResourceClasses in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*resourcev1alpha1.ResourceClass, err error)
-	// Cluster returns a lister that can list and get ResourceClasses in one workspace.
-	Cluster(clusterName logicalcluster.Name) resourcev1alpha1listers.ResourceClassLister
-	ResourceClassClusterListerExpansion
-}
-
-type resourceClassClusterLister struct {
-	indexer cache.Indexer
-}
-
-// NewResourceClassClusterLister returns a new ResourceClassClusterLister.
-// We assume that the indexer:
-// - is fed by a cross-workspace LIST+WATCH
-// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
-// - has the kcpcache.ClusterIndex as an index
-func NewResourceClassClusterLister(indexer cache.Indexer) *resourceClassClusterLister {
-	return &resourceClassClusterLister{indexer: indexer}
-}
-
-// List lists all ResourceClasses in the indexer across all workspaces.
-func (s *resourceClassClusterLister) List(selector labels.Selector) (ret []*resourcev1alpha1.ResourceClass, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*resourcev1alpha1.ResourceClass))
-	})
-	return ret, err
-}
-
-// Cluster scopes the lister to one workspace, allowing users to list and get ResourceClasses.
-func (s *resourceClassClusterLister) Cluster(clusterName logicalcluster.Name) resourcev1alpha1listers.ResourceClassLister {
-	return &resourceClassLister{indexer: s.indexer, clusterName: clusterName}
-}
-
-// resourceClassLister implements the resourcev1alpha1listers.ResourceClassLister interface.
-type resourceClassLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-}
-
-// List lists all ResourceClasses in the indexer for a workspace.
-func (s *resourceClassLister) List(selector labels.Selector) (ret []*resourcev1alpha1.ResourceClass, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*resourcev1alpha1.ResourceClass))
-	})
-	return ret, err
-}
-
-// Get retrieves the ResourceClass from the indexer for a given workspace and name.
-func (s *resourceClassLister) Get(name string) (*resourcev1alpha1.ResourceClass, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(resourcev1alpha1.Resource("resourceclasses"), name)
-	}
-	return obj.(*resourcev1alpha1.ResourceClass), nil
-}
diff --git a/listers/resource/v1alpha3/deviceclass.go b/listers/resource/v1alpha3/deviceclass.go
new file mode 100644
index 000000000..363077821
--- /dev/null
+++ b/listers/resource/v1alpha3/deviceclass.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1alpha3 "k8s.io/client-go/listers/resource/v1alpha3"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// DeviceClassClusterLister helps list DeviceClasses across all workspaces,
+// or scope down to a DeviceClassLister for one workspace.
+// All objects returned here must be treated as read-only.
+type DeviceClassClusterLister interface {
+	// List lists all DeviceClasses in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1alpha3.DeviceClass, err error)
+	// Cluster returns a lister that can list and get DeviceClasses in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1alpha3.DeviceClassLister
+	DeviceClassClusterListerExpansion
+}
+
+// deviceClassClusterLister implements the DeviceClassClusterLister interface.
+type deviceClassClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1alpha3.DeviceClass]
+}
+
+var _ DeviceClassClusterLister = new(deviceClassClusterLister)
+
+// NewDeviceClassClusterLister returns a new DeviceClassClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewDeviceClassClusterLister(indexer cache.Indexer) DeviceClassClusterLister {
+	return &deviceClassClusterLister{
+		kcplisters.NewCluster[*resourcev1alpha3.DeviceClass](indexer, resourcev1alpha3.Resource("deviceclass")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get DeviceClasses.
+func (l *deviceClassClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1alpha3.DeviceClassLister {
+	return &deviceClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// deviceClassLister can list all DeviceClasses inside a workspace
+// or scope down to a listersresourcev1alpha3.DeviceClassNamespaceLister for one namespace.
+type deviceClassLister struct {
+	kcplisters.ResourceIndexer[*resourcev1alpha3.DeviceClass]
+}
+
+var _ listersresourcev1alpha3.DeviceClassLister = new(deviceClassLister)
+
+// NewDeviceClassLister returns a new DeviceClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewDeviceClassLister(indexer cache.Indexer) listersresourcev1alpha3.DeviceClassLister {
+	return &deviceClassLister{
+		kcplisters.New[*resourcev1alpha3.DeviceClass](indexer, resourcev1alpha3.Resource("deviceclass")),
+	}
+}
+
+// deviceClassScopedLister can list all DeviceClasses inside a workspace
+// or scope down to a listersresourcev1alpha3.DeviceClassNamespaceLister.
+type deviceClassScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1alpha3.DeviceClass]
+}
diff --git a/listers/resource/v1alpha3/deviceclass_expansion.go b/listers/resource/v1alpha3/deviceclass_expansion.go
new file mode 100644
index 000000000..366780cf9
--- /dev/null
+++ b/listers/resource/v1alpha3/deviceclass_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1alpha3
+
+// DeviceClassClusterListerExpansion allows custom methods to be added to DeviceClassClusterLister.
+type DeviceClassClusterListerExpansion interface{}
diff --git a/listers/resource/v1alpha3/devicetaintrule.go b/listers/resource/v1alpha3/devicetaintrule.go
new file mode 100644
index 000000000..a298bbea6
--- /dev/null
+++ b/listers/resource/v1alpha3/devicetaintrule.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1alpha3 "k8s.io/client-go/listers/resource/v1alpha3"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// DeviceTaintRuleClusterLister helps list DeviceTaintRules across all workspaces,
+// or scope down to a DeviceTaintRuleLister for one workspace.
+// All objects returned here must be treated as read-only.
+type DeviceTaintRuleClusterLister interface {
+	// List lists all DeviceTaintRules in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1alpha3.DeviceTaintRule, err error)
+	// Cluster returns a lister that can list and get DeviceTaintRules in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1alpha3.DeviceTaintRuleLister
+	DeviceTaintRuleClusterListerExpansion
+}
+
+// deviceTaintRuleClusterLister implements the DeviceTaintRuleClusterLister interface.
+type deviceTaintRuleClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1alpha3.DeviceTaintRule]
+}
+
+var _ DeviceTaintRuleClusterLister = new(deviceTaintRuleClusterLister)
+
+// NewDeviceTaintRuleClusterLister returns a new DeviceTaintRuleClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewDeviceTaintRuleClusterLister(indexer cache.Indexer) DeviceTaintRuleClusterLister {
+	return &deviceTaintRuleClusterLister{
+		kcplisters.NewCluster[*resourcev1alpha3.DeviceTaintRule](indexer, resourcev1alpha3.Resource("devicetaintrule")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get DeviceTaintRules.
+func (l *deviceTaintRuleClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1alpha3.DeviceTaintRuleLister {
+	return &deviceTaintRuleLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// deviceTaintRuleLister can list all DeviceTaintRules inside a workspace
+// or scope down to a listersresourcev1alpha3.DeviceTaintRuleNamespaceLister for one namespace.
+type deviceTaintRuleLister struct {
+	kcplisters.ResourceIndexer[*resourcev1alpha3.DeviceTaintRule]
+}
+
+var _ listersresourcev1alpha3.DeviceTaintRuleLister = new(deviceTaintRuleLister)
+
+// NewDeviceTaintRuleLister returns a new DeviceTaintRuleLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewDeviceTaintRuleLister(indexer cache.Indexer) listersresourcev1alpha3.DeviceTaintRuleLister {
+	return &deviceTaintRuleLister{
+		kcplisters.New[*resourcev1alpha3.DeviceTaintRule](indexer, resourcev1alpha3.Resource("devicetaintrule")),
+	}
+}
+
+// deviceTaintRuleScopedLister can list all DeviceTaintRules inside a workspace
+// or scope down to a listersresourcev1alpha3.DeviceTaintRuleNamespaceLister.
+type deviceTaintRuleScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1alpha3.DeviceTaintRule]
+}
diff --git a/listers/resource/v1alpha3/expansion_generated.go b/listers/resource/v1alpha3/expansion_generated.go
new file mode 100644
index 000000000..1a19071a0
--- /dev/null
+++ b/listers/resource/v1alpha3/expansion_generated.go
@@ -0,0 +1,23 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+// DeviceTaintRuleClusterListerExpansion allows custom methods to be added to
+// DeviceTaintRuleClusterLister.
+type DeviceTaintRuleClusterListerExpansion interface{}
diff --git a/listers/resource/v1alpha3/resourceclaim.go b/listers/resource/v1alpha3/resourceclaim.go
new file mode 100644
index 000000000..b360d5153
--- /dev/null
+++ b/listers/resource/v1alpha3/resourceclaim.go
@@ -0,0 +1,115 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1alpha3 "k8s.io/client-go/listers/resource/v1alpha3"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimClusterLister helps list ResourceClaims across all workspaces,
+// or scope down to a ResourceClaimLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ResourceClaimClusterLister interface {
+	// List lists all ResourceClaims in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1alpha3.ResourceClaim, err error)
+	// Cluster returns a lister that can list and get ResourceClaims in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1alpha3.ResourceClaimLister
+	ResourceClaimClusterListerExpansion
+}
+
+// resourceClaimClusterLister implements the ResourceClaimClusterLister interface.
+type resourceClaimClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1alpha3.ResourceClaim]
+}
+
+var _ ResourceClaimClusterLister = new(resourceClaimClusterLister)
+
+// NewResourceClaimClusterLister returns a new ResourceClaimClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceClaimClusterLister(indexer cache.Indexer) ResourceClaimClusterLister {
+	return &resourceClaimClusterLister{
+		kcplisters.NewCluster[*resourcev1alpha3.ResourceClaim](indexer, resourcev1alpha3.Resource("resourceclaim")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ResourceClaims.
+func (l *resourceClaimClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1alpha3.ResourceClaimLister {
+	return &resourceClaimLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// resourceClaimLister can list all ResourceClaims inside a workspace
+// or scope down to a listersresourcev1alpha3.ResourceClaimNamespaceLister for one namespace.
+type resourceClaimLister struct {
+	kcplisters.ResourceIndexer[*resourcev1alpha3.ResourceClaim]
+}
+
+var _ listersresourcev1alpha3.ResourceClaimLister = new(resourceClaimLister)
+
+// ResourceClaims returns an object that can list and get ResourceClaims in one namespace.
+func (l *resourceClaimLister) ResourceClaims(namespace string) listersresourcev1alpha3.ResourceClaimNamespaceLister {
+	return &resourceClaimNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
+
+// resourceClaimNamespaceLister implements the listersresourcev1alpha3.ResourceClaimNamespaceLister
+// interface.
+type resourceClaimNamespaceLister struct {
+	kcplisters.ResourceIndexer[*resourcev1alpha3.ResourceClaim]
+}
+
+var _ listersresourcev1alpha3.ResourceClaimNamespaceLister = new(resourceClaimNamespaceLister)
+
+// NewResourceClaimLister returns a new ResourceClaimLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceClaimLister(indexer cache.Indexer) listersresourcev1alpha3.ResourceClaimLister {
+	return &resourceClaimLister{
+		kcplisters.New[*resourcev1alpha3.ResourceClaim](indexer, resourcev1alpha3.Resource("resourceclaim")),
+	}
+}
+
+// resourceClaimScopedLister can list all ResourceClaims inside a workspace
+// or scope down to a listersresourcev1alpha3.ResourceClaimNamespaceLister for one namespace.
+type resourceClaimScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1alpha3.ResourceClaim]
+}
+
+// ResourceClaims returns an object that can list and get ResourceClaims in one namespace.
+func (l *resourceClaimScopedLister) ResourceClaims(namespace string) listersresourcev1alpha3.ResourceClaimLister {
+	return &resourceClaimLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
diff --git a/listers/resource/v1alpha1/resourceclaim_expansion.go b/listers/resource/v1alpha3/resourceclaim_expansion.go
similarity index 90%
rename from listers/resource/v1alpha1/resourceclaim_expansion.go
rename to listers/resource/v1alpha3/resourceclaim_expansion.go
index bf6dc00ef..28141932b 100644
--- a/listers/resource/v1alpha1/resourceclaim_expansion.go
+++ b/listers/resource/v1alpha3/resourceclaim_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
@@ -19,7 +16,7 @@ limitations under the License.
 
 // Code generated by kcp code-generator. DO NOT EDIT.
 
-package v1alpha1
+package v1alpha3
 
 // ResourceClaimClusterListerExpansion allows custom methods to be added to ResourceClaimClusterLister.
 type ResourceClaimClusterListerExpansion interface{}
diff --git a/listers/resource/v1alpha3/resourceclaimtemplate.go b/listers/resource/v1alpha3/resourceclaimtemplate.go
new file mode 100644
index 000000000..bf36e0039
--- /dev/null
+++ b/listers/resource/v1alpha3/resourceclaimtemplate.go
@@ -0,0 +1,115 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1alpha3 "k8s.io/client-go/listers/resource/v1alpha3"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimTemplateClusterLister helps list ResourceClaimTemplates across all workspaces,
+// or scope down to a ResourceClaimTemplateLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ResourceClaimTemplateClusterLister interface {
+	// List lists all ResourceClaimTemplates in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1alpha3.ResourceClaimTemplate, err error)
+	// Cluster returns a lister that can list and get ResourceClaimTemplates in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1alpha3.ResourceClaimTemplateLister
+	ResourceClaimTemplateClusterListerExpansion
+}
+
+// resourceClaimTemplateClusterLister implements the ResourceClaimTemplateClusterLister interface.
+type resourceClaimTemplateClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1alpha3.ResourceClaimTemplate]
+}
+
+var _ ResourceClaimTemplateClusterLister = new(resourceClaimTemplateClusterLister)
+
+// NewResourceClaimTemplateClusterLister returns a new ResourceClaimTemplateClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceClaimTemplateClusterLister(indexer cache.Indexer) ResourceClaimTemplateClusterLister {
+	return &resourceClaimTemplateClusterLister{
+		kcplisters.NewCluster[*resourcev1alpha3.ResourceClaimTemplate](indexer, resourcev1alpha3.Resource("resourceclaimtemplate")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ResourceClaimTemplates.
+func (l *resourceClaimTemplateClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1alpha3.ResourceClaimTemplateLister {
+	return &resourceClaimTemplateLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// resourceClaimTemplateLister can list all ResourceClaimTemplates inside a workspace
+// or scope down to a listersresourcev1alpha3.ResourceClaimTemplateNamespaceLister for one namespace.
+type resourceClaimTemplateLister struct {
+	kcplisters.ResourceIndexer[*resourcev1alpha3.ResourceClaimTemplate]
+}
+
+var _ listersresourcev1alpha3.ResourceClaimTemplateLister = new(resourceClaimTemplateLister)
+
+// ResourceClaimTemplates returns an object that can list and get ResourceClaimTemplates in one namespace.
+func (l *resourceClaimTemplateLister) ResourceClaimTemplates(namespace string) listersresourcev1alpha3.ResourceClaimTemplateNamespaceLister {
+	return &resourceClaimTemplateNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
+
+// resourceClaimTemplateNamespaceLister implements the listersresourcev1alpha3.ResourceClaimTemplateNamespaceLister
+// interface.
+type resourceClaimTemplateNamespaceLister struct {
+	kcplisters.ResourceIndexer[*resourcev1alpha3.ResourceClaimTemplate]
+}
+
+var _ listersresourcev1alpha3.ResourceClaimTemplateNamespaceLister = new(resourceClaimTemplateNamespaceLister)
+
+// NewResourceClaimTemplateLister returns a new ResourceClaimTemplateLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceClaimTemplateLister(indexer cache.Indexer) listersresourcev1alpha3.ResourceClaimTemplateLister {
+	return &resourceClaimTemplateLister{
+		kcplisters.New[*resourcev1alpha3.ResourceClaimTemplate](indexer, resourcev1alpha3.Resource("resourceclaimtemplate")),
+	}
+}
+
+// resourceClaimTemplateScopedLister can list all ResourceClaimTemplates inside a workspace
+// or scope down to a listersresourcev1alpha3.ResourceClaimTemplateNamespaceLister for one namespace.
+type resourceClaimTemplateScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1alpha3.ResourceClaimTemplate]
+}
+
+// ResourceClaimTemplates returns an object that can list and get ResourceClaimTemplates in one namespace.
+func (l *resourceClaimTemplateScopedLister) ResourceClaimTemplates(namespace string) listersresourcev1alpha3.ResourceClaimTemplateLister {
+	return &resourceClaimTemplateLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
diff --git a/listers/resource/v1alpha1/resourceclaimtemplate_expansion.go b/listers/resource/v1alpha3/resourceclaimtemplate_expansion.go
similarity index 90%
rename from listers/resource/v1alpha1/resourceclaimtemplate_expansion.go
rename to listers/resource/v1alpha3/resourceclaimtemplate_expansion.go
index 80a017882..646543e51 100644
--- a/listers/resource/v1alpha1/resourceclaimtemplate_expansion.go
+++ b/listers/resource/v1alpha3/resourceclaimtemplate_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
@@ -19,7 +16,7 @@ limitations under the License.
 
 // Code generated by kcp code-generator. DO NOT EDIT.
 
-package v1alpha1
+package v1alpha3
 
 // ResourceClaimTemplateClusterListerExpansion allows custom methods to be added to ResourceClaimTemplateClusterLister.
 type ResourceClaimTemplateClusterListerExpansion interface{}
diff --git a/listers/resource/v1alpha3/resourceslice.go b/listers/resource/v1alpha3/resourceslice.go
new file mode 100644
index 000000000..49af13bde
--- /dev/null
+++ b/listers/resource/v1alpha3/resourceslice.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha3
+
+import (
+	resourcev1alpha3 "k8s.io/api/resource/v1alpha3"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1alpha3 "k8s.io/client-go/listers/resource/v1alpha3"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceSliceClusterLister helps list ResourceSlices across all workspaces,
+// or scope down to a ResourceSliceLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ResourceSliceClusterLister interface {
+	// List lists all ResourceSlices in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1alpha3.ResourceSlice, err error)
+	// Cluster returns a lister that can list and get ResourceSlices in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1alpha3.ResourceSliceLister
+	ResourceSliceClusterListerExpansion
+}
+
+// resourceSliceClusterLister implements the ResourceSliceClusterLister interface.
+type resourceSliceClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1alpha3.ResourceSlice]
+}
+
+var _ ResourceSliceClusterLister = new(resourceSliceClusterLister)
+
+// NewResourceSliceClusterLister returns a new ResourceSliceClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewResourceSliceClusterLister(indexer cache.Indexer) ResourceSliceClusterLister {
+	return &resourceSliceClusterLister{
+		kcplisters.NewCluster[*resourcev1alpha3.ResourceSlice](indexer, resourcev1alpha3.Resource("resourceslice")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ResourceSlices.
+func (l *resourceSliceClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1alpha3.ResourceSliceLister {
+	return &resourceSliceLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// resourceSliceLister can list all ResourceSlices inside a workspace
+// or scope down to a listersresourcev1alpha3.ResourceSliceNamespaceLister for one namespace.
+type resourceSliceLister struct {
+	kcplisters.ResourceIndexer[*resourcev1alpha3.ResourceSlice]
+}
+
+var _ listersresourcev1alpha3.ResourceSliceLister = new(resourceSliceLister)
+
+// NewResourceSliceLister returns a new ResourceSliceLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewResourceSliceLister(indexer cache.Indexer) listersresourcev1alpha3.ResourceSliceLister {
+	return &resourceSliceLister{
+		kcplisters.New[*resourcev1alpha3.ResourceSlice](indexer, resourcev1alpha3.Resource("resourceslice")),
+	}
+}
+
+// resourceSliceScopedLister can list all ResourceSlices inside a workspace
+// or scope down to a listersresourcev1alpha3.ResourceSliceNamespaceLister.
+type resourceSliceScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1alpha3.ResourceSlice]
+}
diff --git a/listers/resource/v1alpha3/resourceslice_expansion.go b/listers/resource/v1alpha3/resourceslice_expansion.go
new file mode 100644
index 000000000..54c0b83d1
--- /dev/null
+++ b/listers/resource/v1alpha3/resourceslice_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1alpha3
+
+// ResourceSliceClusterListerExpansion allows custom methods to be added to ResourceSliceClusterLister.
+type ResourceSliceClusterListerExpansion interface{}
diff --git a/listers/resource/v1beta1/deviceclass.go b/listers/resource/v1beta1/deviceclass.go
new file mode 100644
index 000000000..f51fec862
--- /dev/null
+++ b/listers/resource/v1beta1/deviceclass.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1beta1 "k8s.io/client-go/listers/resource/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// DeviceClassClusterLister helps list DeviceClasses across all workspaces,
+// or scope down to a DeviceClassLister for one workspace.
+// All objects returned here must be treated as read-only.
+type DeviceClassClusterLister interface {
+	// List lists all DeviceClasses in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1beta1.DeviceClass, err error)
+	// Cluster returns a lister that can list and get DeviceClasses in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1beta1.DeviceClassLister
+	DeviceClassClusterListerExpansion
+}
+
+// deviceClassClusterLister implements the DeviceClassClusterLister interface.
+type deviceClassClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1beta1.DeviceClass]
+}
+
+var _ DeviceClassClusterLister = new(deviceClassClusterLister)
+
+// NewDeviceClassClusterLister returns a new DeviceClassClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewDeviceClassClusterLister(indexer cache.Indexer) DeviceClassClusterLister {
+	return &deviceClassClusterLister{
+		kcplisters.NewCluster[*resourcev1beta1.DeviceClass](indexer, resourcev1beta1.Resource("deviceclass")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get DeviceClasses.
+func (l *deviceClassClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1beta1.DeviceClassLister {
+	return &deviceClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// deviceClassLister can list all DeviceClasses inside a workspace
+// or scope down to a listersresourcev1beta1.DeviceClassNamespaceLister for one namespace.
+type deviceClassLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta1.DeviceClass]
+}
+
+var _ listersresourcev1beta1.DeviceClassLister = new(deviceClassLister)
+
+// NewDeviceClassLister returns a new DeviceClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewDeviceClassLister(indexer cache.Indexer) listersresourcev1beta1.DeviceClassLister {
+	return &deviceClassLister{
+		kcplisters.New[*resourcev1beta1.DeviceClass](indexer, resourcev1beta1.Resource("deviceclass")),
+	}
+}
+
+// deviceClassScopedLister can list all DeviceClasses inside a workspace
+// or scope down to a listersresourcev1beta1.DeviceClassNamespaceLister.
+type deviceClassScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta1.DeviceClass]
+}
diff --git a/listers/resource/v1beta1/deviceclass_expansion.go b/listers/resource/v1beta1/deviceclass_expansion.go
new file mode 100644
index 000000000..372f52e99
--- /dev/null
+++ b/listers/resource/v1beta1/deviceclass_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1beta1
+
+// DeviceClassClusterListerExpansion allows custom methods to be added to DeviceClassClusterLister.
+type DeviceClassClusterListerExpansion interface{}
diff --git a/listers/resource/v1beta1/expansion_generated.go b/listers/resource/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/resource/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/resource/v1beta1/resourceclaim.go b/listers/resource/v1beta1/resourceclaim.go
new file mode 100644
index 000000000..d0875551a
--- /dev/null
+++ b/listers/resource/v1beta1/resourceclaim.go
@@ -0,0 +1,115 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1beta1 "k8s.io/client-go/listers/resource/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimClusterLister helps list ResourceClaims across all workspaces,
+// or scope down to a ResourceClaimLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ResourceClaimClusterLister interface {
+	// List lists all ResourceClaims in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1beta1.ResourceClaim, err error)
+	// Cluster returns a lister that can list and get ResourceClaims in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1beta1.ResourceClaimLister
+	ResourceClaimClusterListerExpansion
+}
+
+// resourceClaimClusterLister implements the ResourceClaimClusterLister interface.
+type resourceClaimClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1beta1.ResourceClaim]
+}
+
+var _ ResourceClaimClusterLister = new(resourceClaimClusterLister)
+
+// NewResourceClaimClusterLister returns a new ResourceClaimClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceClaimClusterLister(indexer cache.Indexer) ResourceClaimClusterLister {
+	return &resourceClaimClusterLister{
+		kcplisters.NewCluster[*resourcev1beta1.ResourceClaim](indexer, resourcev1beta1.Resource("resourceclaim")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ResourceClaims.
+func (l *resourceClaimClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1beta1.ResourceClaimLister {
+	return &resourceClaimLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// resourceClaimLister can list all ResourceClaims inside a workspace
+// or scope down to a listersresourcev1beta1.ResourceClaimNamespaceLister for one namespace.
+type resourceClaimLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta1.ResourceClaim]
+}
+
+var _ listersresourcev1beta1.ResourceClaimLister = new(resourceClaimLister)
+
+// ResourceClaims returns an object that can list and get ResourceClaims in one namespace.
+func (l *resourceClaimLister) ResourceClaims(namespace string) listersresourcev1beta1.ResourceClaimNamespaceLister {
+	return &resourceClaimNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
+
+// resourceClaimNamespaceLister implements the listersresourcev1beta1.ResourceClaimNamespaceLister
+// interface.
+type resourceClaimNamespaceLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta1.ResourceClaim]
+}
+
+var _ listersresourcev1beta1.ResourceClaimNamespaceLister = new(resourceClaimNamespaceLister)
+
+// NewResourceClaimLister returns a new ResourceClaimLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceClaimLister(indexer cache.Indexer) listersresourcev1beta1.ResourceClaimLister {
+	return &resourceClaimLister{
+		kcplisters.New[*resourcev1beta1.ResourceClaim](indexer, resourcev1beta1.Resource("resourceclaim")),
+	}
+}
+
+// resourceClaimScopedLister can list all ResourceClaims inside a workspace
+// or scope down to a listersresourcev1beta1.ResourceClaimNamespaceLister for one namespace.
+type resourceClaimScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta1.ResourceClaim]
+}
+
+// ResourceClaims returns an object that can list and get ResourceClaims in one namespace.
+func (l *resourceClaimScopedLister) ResourceClaims(namespace string) listersresourcev1beta1.ResourceClaimLister {
+	return &resourceClaimLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
diff --git a/listers/resource/v1beta1/resourceclaim_expansion.go b/listers/resource/v1beta1/resourceclaim_expansion.go
new file mode 100644
index 000000000..7a1649e1b
--- /dev/null
+++ b/listers/resource/v1beta1/resourceclaim_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1beta1
+
+// ResourceClaimClusterListerExpansion allows custom methods to be added to ResourceClaimClusterLister.
+type ResourceClaimClusterListerExpansion interface{}
diff --git a/listers/resource/v1beta1/resourceclaimtemplate.go b/listers/resource/v1beta1/resourceclaimtemplate.go
new file mode 100644
index 000000000..073fa3354
--- /dev/null
+++ b/listers/resource/v1beta1/resourceclaimtemplate.go
@@ -0,0 +1,115 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1beta1 "k8s.io/client-go/listers/resource/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimTemplateClusterLister helps list ResourceClaimTemplates across all workspaces,
+// or scope down to a ResourceClaimTemplateLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ResourceClaimTemplateClusterLister interface {
+	// List lists all ResourceClaimTemplates in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1beta1.ResourceClaimTemplate, err error)
+	// Cluster returns a lister that can list and get ResourceClaimTemplates in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1beta1.ResourceClaimTemplateLister
+	ResourceClaimTemplateClusterListerExpansion
+}
+
+// resourceClaimTemplateClusterLister implements the ResourceClaimTemplateClusterLister interface.
+type resourceClaimTemplateClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1beta1.ResourceClaimTemplate]
+}
+
+var _ ResourceClaimTemplateClusterLister = new(resourceClaimTemplateClusterLister)
+
+// NewResourceClaimTemplateClusterLister returns a new ResourceClaimTemplateClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceClaimTemplateClusterLister(indexer cache.Indexer) ResourceClaimTemplateClusterLister {
+	return &resourceClaimTemplateClusterLister{
+		kcplisters.NewCluster[*resourcev1beta1.ResourceClaimTemplate](indexer, resourcev1beta1.Resource("resourceclaimtemplate")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ResourceClaimTemplates.
+func (l *resourceClaimTemplateClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1beta1.ResourceClaimTemplateLister {
+	return &resourceClaimTemplateLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// resourceClaimTemplateLister can list all ResourceClaimTemplates inside a workspace
+// or scope down to a listersresourcev1beta1.ResourceClaimTemplateNamespaceLister for one namespace.
+type resourceClaimTemplateLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta1.ResourceClaimTemplate]
+}
+
+var _ listersresourcev1beta1.ResourceClaimTemplateLister = new(resourceClaimTemplateLister)
+
+// ResourceClaimTemplates returns an object that can list and get ResourceClaimTemplates in one namespace.
+func (l *resourceClaimTemplateLister) ResourceClaimTemplates(namespace string) listersresourcev1beta1.ResourceClaimTemplateNamespaceLister {
+	return &resourceClaimTemplateNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
+
+// resourceClaimTemplateNamespaceLister implements the listersresourcev1beta1.ResourceClaimTemplateNamespaceLister
+// interface.
+type resourceClaimTemplateNamespaceLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta1.ResourceClaimTemplate]
+}
+
+var _ listersresourcev1beta1.ResourceClaimTemplateNamespaceLister = new(resourceClaimTemplateNamespaceLister)
+
+// NewResourceClaimTemplateLister returns a new ResourceClaimTemplateLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceClaimTemplateLister(indexer cache.Indexer) listersresourcev1beta1.ResourceClaimTemplateLister {
+	return &resourceClaimTemplateLister{
+		kcplisters.New[*resourcev1beta1.ResourceClaimTemplate](indexer, resourcev1beta1.Resource("resourceclaimtemplate")),
+	}
+}
+
+// resourceClaimTemplateScopedLister can list all ResourceClaimTemplates inside a workspace
+// or scope down to a listersresourcev1beta1.ResourceClaimTemplateNamespaceLister for one namespace.
+type resourceClaimTemplateScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta1.ResourceClaimTemplate]
+}
+
+// ResourceClaimTemplates returns an object that can list and get ResourceClaimTemplates in one namespace.
+func (l *resourceClaimTemplateScopedLister) ResourceClaimTemplates(namespace string) listersresourcev1beta1.ResourceClaimTemplateLister {
+	return &resourceClaimTemplateLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
diff --git a/listers/resource/v1beta1/resourceclaimtemplate_expansion.go b/listers/resource/v1beta1/resourceclaimtemplate_expansion.go
new file mode 100644
index 000000000..6ae346cae
--- /dev/null
+++ b/listers/resource/v1beta1/resourceclaimtemplate_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1beta1
+
+// ResourceClaimTemplateClusterListerExpansion allows custom methods to be added to ResourceClaimTemplateClusterLister.
+type ResourceClaimTemplateClusterListerExpansion interface{}
diff --git a/listers/resource/v1beta1/resourceslice.go b/listers/resource/v1beta1/resourceslice.go
new file mode 100644
index 000000000..38611ea8d
--- /dev/null
+++ b/listers/resource/v1beta1/resourceslice.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	resourcev1beta1 "k8s.io/api/resource/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1beta1 "k8s.io/client-go/listers/resource/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceSliceClusterLister helps list ResourceSlices across all workspaces,
+// or scope down to a ResourceSliceLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ResourceSliceClusterLister interface {
+	// List lists all ResourceSlices in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1beta1.ResourceSlice, err error)
+	// Cluster returns a lister that can list and get ResourceSlices in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1beta1.ResourceSliceLister
+	ResourceSliceClusterListerExpansion
+}
+
+// resourceSliceClusterLister implements the ResourceSliceClusterLister interface.
+type resourceSliceClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1beta1.ResourceSlice]
+}
+
+var _ ResourceSliceClusterLister = new(resourceSliceClusterLister)
+
+// NewResourceSliceClusterLister returns a new ResourceSliceClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewResourceSliceClusterLister(indexer cache.Indexer) ResourceSliceClusterLister {
+	return &resourceSliceClusterLister{
+		kcplisters.NewCluster[*resourcev1beta1.ResourceSlice](indexer, resourcev1beta1.Resource("resourceslice")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ResourceSlices.
+func (l *resourceSliceClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1beta1.ResourceSliceLister {
+	return &resourceSliceLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// resourceSliceLister can list all ResourceSlices inside a workspace
+// or scope down to a listersresourcev1beta1.ResourceSliceNamespaceLister for one namespace.
+type resourceSliceLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta1.ResourceSlice]
+}
+
+var _ listersresourcev1beta1.ResourceSliceLister = new(resourceSliceLister)
+
+// NewResourceSliceLister returns a new ResourceSliceLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewResourceSliceLister(indexer cache.Indexer) listersresourcev1beta1.ResourceSliceLister {
+	return &resourceSliceLister{
+		kcplisters.New[*resourcev1beta1.ResourceSlice](indexer, resourcev1beta1.Resource("resourceslice")),
+	}
+}
+
+// resourceSliceScopedLister can list all ResourceSlices inside a workspace
+// or scope down to a listersresourcev1beta1.ResourceSliceNamespaceLister.
+type resourceSliceScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta1.ResourceSlice]
+}
diff --git a/listers/resource/v1beta1/resourceslice_expansion.go b/listers/resource/v1beta1/resourceslice_expansion.go
new file mode 100644
index 000000000..f0b1fd962
--- /dev/null
+++ b/listers/resource/v1beta1/resourceslice_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1beta1
+
+// ResourceSliceClusterListerExpansion allows custom methods to be added to ResourceSliceClusterLister.
+type ResourceSliceClusterListerExpansion interface{}
diff --git a/listers/resource/v1beta2/deviceclass.go b/listers/resource/v1beta2/deviceclass.go
new file mode 100644
index 000000000..95c6e14ee
--- /dev/null
+++ b/listers/resource/v1beta2/deviceclass.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1beta2 "k8s.io/client-go/listers/resource/v1beta2"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// DeviceClassClusterLister helps list DeviceClasses across all workspaces,
+// or scope down to a DeviceClassLister for one workspace.
+// All objects returned here must be treated as read-only.
+type DeviceClassClusterLister interface {
+	// List lists all DeviceClasses in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1beta2.DeviceClass, err error)
+	// Cluster returns a lister that can list and get DeviceClasses in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1beta2.DeviceClassLister
+	DeviceClassClusterListerExpansion
+}
+
+// deviceClassClusterLister implements the DeviceClassClusterLister interface.
+type deviceClassClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1beta2.DeviceClass]
+}
+
+var _ DeviceClassClusterLister = new(deviceClassClusterLister)
+
+// NewDeviceClassClusterLister returns a new DeviceClassClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewDeviceClassClusterLister(indexer cache.Indexer) DeviceClassClusterLister {
+	return &deviceClassClusterLister{
+		kcplisters.NewCluster[*resourcev1beta2.DeviceClass](indexer, resourcev1beta2.Resource("deviceclass")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get DeviceClasses.
+func (l *deviceClassClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1beta2.DeviceClassLister {
+	return &deviceClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// deviceClassLister can list all DeviceClasses inside a workspace
+// or scope down to a listersresourcev1beta2.DeviceClassNamespaceLister for one namespace.
+type deviceClassLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta2.DeviceClass]
+}
+
+var _ listersresourcev1beta2.DeviceClassLister = new(deviceClassLister)
+
+// NewDeviceClassLister returns a new DeviceClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewDeviceClassLister(indexer cache.Indexer) listersresourcev1beta2.DeviceClassLister {
+	return &deviceClassLister{
+		kcplisters.New[*resourcev1beta2.DeviceClass](indexer, resourcev1beta2.Resource("deviceclass")),
+	}
+}
+
+// deviceClassScopedLister can list all DeviceClasses inside a workspace
+// or scope down to a listersresourcev1beta2.DeviceClassNamespaceLister.
+type deviceClassScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta2.DeviceClass]
+}
diff --git a/listers/resource/v1beta2/expansion_generated.go b/listers/resource/v1beta2/expansion_generated.go
new file mode 100644
index 000000000..0e48274ac
--- /dev/null
+++ b/listers/resource/v1beta2/expansion_generated.go
@@ -0,0 +1,35 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta2
+
+// DeviceClassClusterListerExpansion allows custom methods to be added to
+// DeviceClassClusterLister.
+type DeviceClassClusterListerExpansion interface{}
+
+// ResourceClaimClusterListerExpansion allows custom methods to be added to
+// ResourceClaimClusterLister.
+type ResourceClaimClusterListerExpansion interface{}
+
+// ResourceClaimTemplateClusterListerExpansion allows custom methods to be added to
+// ResourceClaimTemplateClusterLister.
+type ResourceClaimTemplateClusterListerExpansion interface{}
+
+// ResourceSliceClusterListerExpansion allows custom methods to be added to
+// ResourceSliceClusterLister.
+type ResourceSliceClusterListerExpansion interface{}
diff --git a/listers/resource/v1beta2/resourceclaim.go b/listers/resource/v1beta2/resourceclaim.go
new file mode 100644
index 000000000..a8d5a1f52
--- /dev/null
+++ b/listers/resource/v1beta2/resourceclaim.go
@@ -0,0 +1,115 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1beta2 "k8s.io/client-go/listers/resource/v1beta2"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimClusterLister helps list ResourceClaims across all workspaces,
+// or scope down to a ResourceClaimLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ResourceClaimClusterLister interface {
+	// List lists all ResourceClaims in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1beta2.ResourceClaim, err error)
+	// Cluster returns a lister that can list and get ResourceClaims in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1beta2.ResourceClaimLister
+	ResourceClaimClusterListerExpansion
+}
+
+// resourceClaimClusterLister implements the ResourceClaimClusterLister interface.
+type resourceClaimClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1beta2.ResourceClaim]
+}
+
+var _ ResourceClaimClusterLister = new(resourceClaimClusterLister)
+
+// NewResourceClaimClusterLister returns a new ResourceClaimClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceClaimClusterLister(indexer cache.Indexer) ResourceClaimClusterLister {
+	return &resourceClaimClusterLister{
+		kcplisters.NewCluster[*resourcev1beta2.ResourceClaim](indexer, resourcev1beta2.Resource("resourceclaim")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ResourceClaims.
+func (l *resourceClaimClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1beta2.ResourceClaimLister {
+	return &resourceClaimLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// resourceClaimLister can list all ResourceClaims inside a workspace
+// or scope down to a listersresourcev1beta2.ResourceClaimNamespaceLister for one namespace.
+type resourceClaimLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta2.ResourceClaim]
+}
+
+var _ listersresourcev1beta2.ResourceClaimLister = new(resourceClaimLister)
+
+// ResourceClaims returns an object that can list and get ResourceClaims in one namespace.
+func (l *resourceClaimLister) ResourceClaims(namespace string) listersresourcev1beta2.ResourceClaimNamespaceLister {
+	return &resourceClaimNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
+
+// resourceClaimNamespaceLister implements the listersresourcev1beta2.ResourceClaimNamespaceLister
+// interface.
+type resourceClaimNamespaceLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta2.ResourceClaim]
+}
+
+var _ listersresourcev1beta2.ResourceClaimNamespaceLister = new(resourceClaimNamespaceLister)
+
+// NewResourceClaimLister returns a new ResourceClaimLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceClaimLister(indexer cache.Indexer) listersresourcev1beta2.ResourceClaimLister {
+	return &resourceClaimLister{
+		kcplisters.New[*resourcev1beta2.ResourceClaim](indexer, resourcev1beta2.Resource("resourceclaim")),
+	}
+}
+
+// resourceClaimScopedLister can list all ResourceClaims inside a workspace
+// or scope down to a listersresourcev1beta2.ResourceClaimNamespaceLister for one namespace.
+type resourceClaimScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta2.ResourceClaim]
+}
+
+// ResourceClaims returns an object that can list and get ResourceClaims in one namespace.
+func (l *resourceClaimScopedLister) ResourceClaims(namespace string) listersresourcev1beta2.ResourceClaimLister {
+	return &resourceClaimLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
diff --git a/listers/resource/v1beta2/resourceclaimtemplate.go b/listers/resource/v1beta2/resourceclaimtemplate.go
new file mode 100644
index 000000000..0beda8952
--- /dev/null
+++ b/listers/resource/v1beta2/resourceclaimtemplate.go
@@ -0,0 +1,115 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1beta2 "k8s.io/client-go/listers/resource/v1beta2"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceClaimTemplateClusterLister helps list ResourceClaimTemplates across all workspaces,
+// or scope down to a ResourceClaimTemplateLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ResourceClaimTemplateClusterLister interface {
+	// List lists all ResourceClaimTemplates in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1beta2.ResourceClaimTemplate, err error)
+	// Cluster returns a lister that can list and get ResourceClaimTemplates in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1beta2.ResourceClaimTemplateLister
+	ResourceClaimTemplateClusterListerExpansion
+}
+
+// resourceClaimTemplateClusterLister implements the ResourceClaimTemplateClusterLister interface.
+type resourceClaimTemplateClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1beta2.ResourceClaimTemplate]
+}
+
+var _ ResourceClaimTemplateClusterLister = new(resourceClaimTemplateClusterLister)
+
+// NewResourceClaimTemplateClusterLister returns a new ResourceClaimTemplateClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceClaimTemplateClusterLister(indexer cache.Indexer) ResourceClaimTemplateClusterLister {
+	return &resourceClaimTemplateClusterLister{
+		kcplisters.NewCluster[*resourcev1beta2.ResourceClaimTemplate](indexer, resourcev1beta2.Resource("resourceclaimtemplate")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ResourceClaimTemplates.
+func (l *resourceClaimTemplateClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1beta2.ResourceClaimTemplateLister {
+	return &resourceClaimTemplateLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// resourceClaimTemplateLister can list all ResourceClaimTemplates inside a workspace
+// or scope down to a listersresourcev1beta2.ResourceClaimTemplateNamespaceLister for one namespace.
+type resourceClaimTemplateLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta2.ResourceClaimTemplate]
+}
+
+var _ listersresourcev1beta2.ResourceClaimTemplateLister = new(resourceClaimTemplateLister)
+
+// ResourceClaimTemplates returns an object that can list and get ResourceClaimTemplates in one namespace.
+func (l *resourceClaimTemplateLister) ResourceClaimTemplates(namespace string) listersresourcev1beta2.ResourceClaimTemplateNamespaceLister {
+	return &resourceClaimTemplateNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
+
+// resourceClaimTemplateNamespaceLister implements the listersresourcev1beta2.ResourceClaimTemplateNamespaceLister
+// interface.
+type resourceClaimTemplateNamespaceLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta2.ResourceClaimTemplate]
+}
+
+var _ listersresourcev1beta2.ResourceClaimTemplateNamespaceLister = new(resourceClaimTemplateNamespaceLister)
+
+// NewResourceClaimTemplateLister returns a new ResourceClaimTemplateLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewResourceClaimTemplateLister(indexer cache.Indexer) listersresourcev1beta2.ResourceClaimTemplateLister {
+	return &resourceClaimTemplateLister{
+		kcplisters.New[*resourcev1beta2.ResourceClaimTemplate](indexer, resourcev1beta2.Resource("resourceclaimtemplate")),
+	}
+}
+
+// resourceClaimTemplateScopedLister can list all ResourceClaimTemplates inside a workspace
+// or scope down to a listersresourcev1beta2.ResourceClaimTemplateNamespaceLister for one namespace.
+type resourceClaimTemplateScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta2.ResourceClaimTemplate]
+}
+
+// ResourceClaimTemplates returns an object that can list and get ResourceClaimTemplates in one namespace.
+func (l *resourceClaimTemplateScopedLister) ResourceClaimTemplates(namespace string) listersresourcev1beta2.ResourceClaimTemplateLister {
+	return &resourceClaimTemplateLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
+}
diff --git a/listers/resource/v1beta2/resourceslice.go b/listers/resource/v1beta2/resourceslice.go
new file mode 100644
index 000000000..b16b15492
--- /dev/null
+++ b/listers/resource/v1beta2/resourceslice.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta2
+
+import (
+	resourcev1beta2 "k8s.io/api/resource/v1beta2"
+	"k8s.io/apimachinery/pkg/labels"
+	listersresourcev1beta2 "k8s.io/client-go/listers/resource/v1beta2"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceSliceClusterLister helps list ResourceSlices across all workspaces,
+// or scope down to a ResourceSliceLister for one workspace.
+// All objects returned here must be treated as read-only.
+type ResourceSliceClusterLister interface {
+	// List lists all ResourceSlices in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*resourcev1beta2.ResourceSlice, err error)
+	// Cluster returns a lister that can list and get ResourceSlices in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersresourcev1beta2.ResourceSliceLister
+	ResourceSliceClusterListerExpansion
+}
+
+// resourceSliceClusterLister implements the ResourceSliceClusterLister interface.
+type resourceSliceClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*resourcev1beta2.ResourceSlice]
+}
+
+var _ ResourceSliceClusterLister = new(resourceSliceClusterLister)
+
+// NewResourceSliceClusterLister returns a new ResourceSliceClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewResourceSliceClusterLister(indexer cache.Indexer) ResourceSliceClusterLister {
+	return &resourceSliceClusterLister{
+		kcplisters.NewCluster[*resourcev1beta2.ResourceSlice](indexer, resourcev1beta2.Resource("resourceslice")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get ResourceSlices.
+func (l *resourceSliceClusterLister) Cluster(clusterName logicalcluster.Name) listersresourcev1beta2.ResourceSliceLister {
+	return &resourceSliceLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// resourceSliceLister can list all ResourceSlices inside a workspace
+// or scope down to a listersresourcev1beta2.ResourceSliceNamespaceLister for one namespace.
+type resourceSliceLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta2.ResourceSlice]
+}
+
+var _ listersresourcev1beta2.ResourceSliceLister = new(resourceSliceLister)
+
+// NewResourceSliceLister returns a new ResourceSliceLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewResourceSliceLister(indexer cache.Indexer) listersresourcev1beta2.ResourceSliceLister {
+	return &resourceSliceLister{
+		kcplisters.New[*resourcev1beta2.ResourceSlice](indexer, resourcev1beta2.Resource("resourceslice")),
+	}
+}
+
+// resourceSliceScopedLister can list all ResourceSlices inside a workspace
+// or scope down to a listersresourcev1beta2.ResourceSliceNamespaceLister.
+type resourceSliceScopedLister struct {
+	kcplisters.ResourceIndexer[*resourcev1beta2.ResourceSlice]
+}
diff --git a/listers/scheduling/v1/expansion_generated.go b/listers/scheduling/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/scheduling/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/scheduling/v1/priorityclass.go b/listers/scheduling/v1/priorityclass.go
index d897bba35..795b17b7c 100644
--- a/listers/scheduling/v1/priorityclass.go
+++ b/listers/scheduling/v1/priorityclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	schedulingv1 "k8s.io/api/scheduling/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	schedulingv1listers "k8s.io/client-go/listers/scheduling/v1"
+	listersschedulingv1 "k8s.io/client-go/listers/scheduling/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// PriorityClassClusterLister can list PriorityClasses across all workspaces, or scope down to a PriorityClassLister for one workspace.
+// PriorityClassClusterLister helps list PriorityClasses across all workspaces,
+// or scope down to a PriorityClassLister for one workspace.
 // All objects returned here must be treated as read-only.
 type PriorityClassClusterLister interface {
 	// List lists all PriorityClasses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*schedulingv1.PriorityClass, err error)
 	// Cluster returns a lister that can list and get PriorityClasses in one workspace.
-	Cluster(clusterName logicalcluster.Name) schedulingv1listers.PriorityClassLister
+	Cluster(clusterName logicalcluster.Name) listersschedulingv1.PriorityClassLister
 	PriorityClassClusterListerExpansion
 }
 
+// priorityClassClusterLister implements the PriorityClassClusterLister interface.
 type priorityClassClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*schedulingv1.PriorityClass]
 }
 
+var _ PriorityClassClusterLister = new(priorityClassClusterLister)
+
 // NewPriorityClassClusterLister returns a new PriorityClassClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewPriorityClassClusterLister(indexer cache.Indexer) *priorityClassClusterLister {
-	return &priorityClassClusterLister{indexer: indexer}
-}
-
-// List lists all PriorityClasses in the indexer across all workspaces.
-func (s *priorityClassClusterLister) List(selector labels.Selector) (ret []*schedulingv1.PriorityClass, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*schedulingv1.PriorityClass))
-	})
-	return ret, err
+func NewPriorityClassClusterLister(indexer cache.Indexer) PriorityClassClusterLister {
+	return &priorityClassClusterLister{
+		kcplisters.NewCluster[*schedulingv1.PriorityClass](indexer, schedulingv1.Resource("priorityclass")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get PriorityClasses.
-func (s *priorityClassClusterLister) Cluster(clusterName logicalcluster.Name) schedulingv1listers.PriorityClassLister {
-	return &priorityClassLister{indexer: s.indexer, clusterName: clusterName}
+func (l *priorityClassClusterLister) Cluster(clusterName logicalcluster.Name) listersschedulingv1.PriorityClassLister {
+	return &priorityClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// priorityClassLister implements the schedulingv1listers.PriorityClassLister interface.
+// priorityClassLister can list all PriorityClasses inside a workspace
+// or scope down to a listersschedulingv1.PriorityClassNamespaceLister for one namespace.
 type priorityClassLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*schedulingv1.PriorityClass]
 }
 
-// List lists all PriorityClasses in the indexer for a workspace.
-func (s *priorityClassLister) List(selector labels.Selector) (ret []*schedulingv1.PriorityClass, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*schedulingv1.PriorityClass))
-	})
-	return ret, err
-}
+var _ listersschedulingv1.PriorityClassLister = new(priorityClassLister)
 
-// Get retrieves the PriorityClass from the indexer for a given workspace and name.
-func (s *priorityClassLister) Get(name string) (*schedulingv1.PriorityClass, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(schedulingv1.Resource("priorityclasses"), name)
+// NewPriorityClassLister returns a new PriorityClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewPriorityClassLister(indexer cache.Indexer) listersschedulingv1.PriorityClassLister {
+	return &priorityClassLister{
+		kcplisters.New[*schedulingv1.PriorityClass](indexer, schedulingv1.Resource("priorityclass")),
 	}
-	return obj.(*schedulingv1.PriorityClass), nil
+}
+
+// priorityClassScopedLister can list all PriorityClasses inside a workspace
+// or scope down to a listersschedulingv1.PriorityClassNamespaceLister.
+type priorityClassScopedLister struct {
+	kcplisters.ResourceIndexer[*schedulingv1.PriorityClass]
 }
diff --git a/listers/scheduling/v1/priorityclass_expansion.go b/listers/scheduling/v1/priorityclass_expansion.go
index f4fa35e7d..aae4d68c6 100644
--- a/listers/scheduling/v1/priorityclass_expansion.go
+++ b/listers/scheduling/v1/priorityclass_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/scheduling/v1alpha1/expansion_generated.go b/listers/scheduling/v1alpha1/expansion_generated.go
new file mode 100644
index 000000000..3b8521c00
--- /dev/null
+++ b/listers/scheduling/v1alpha1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
diff --git a/listers/scheduling/v1alpha1/priorityclass.go b/listers/scheduling/v1alpha1/priorityclass.go
index 1655b22b3..54330b803 100644
--- a/listers/scheduling/v1alpha1/priorityclass.go
+++ b/listers/scheduling/v1alpha1/priorityclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	schedulingv1alpha1 "k8s.io/api/scheduling/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	schedulingv1alpha1listers "k8s.io/client-go/listers/scheduling/v1alpha1"
+	listersschedulingv1alpha1 "k8s.io/client-go/listers/scheduling/v1alpha1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// PriorityClassClusterLister can list PriorityClasses across all workspaces, or scope down to a PriorityClassLister for one workspace.
+// PriorityClassClusterLister helps list PriorityClasses across all workspaces,
+// or scope down to a PriorityClassLister for one workspace.
 // All objects returned here must be treated as read-only.
 type PriorityClassClusterLister interface {
 	// List lists all PriorityClasses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*schedulingv1alpha1.PriorityClass, err error)
 	// Cluster returns a lister that can list and get PriorityClasses in one workspace.
-	Cluster(clusterName logicalcluster.Name) schedulingv1alpha1listers.PriorityClassLister
+	Cluster(clusterName logicalcluster.Name) listersschedulingv1alpha1.PriorityClassLister
 	PriorityClassClusterListerExpansion
 }
 
+// priorityClassClusterLister implements the PriorityClassClusterLister interface.
 type priorityClassClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*schedulingv1alpha1.PriorityClass]
 }
 
+var _ PriorityClassClusterLister = new(priorityClassClusterLister)
+
 // NewPriorityClassClusterLister returns a new PriorityClassClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewPriorityClassClusterLister(indexer cache.Indexer) *priorityClassClusterLister {
-	return &priorityClassClusterLister{indexer: indexer}
-}
-
-// List lists all PriorityClasses in the indexer across all workspaces.
-func (s *priorityClassClusterLister) List(selector labels.Selector) (ret []*schedulingv1alpha1.PriorityClass, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*schedulingv1alpha1.PriorityClass))
-	})
-	return ret, err
+func NewPriorityClassClusterLister(indexer cache.Indexer) PriorityClassClusterLister {
+	return &priorityClassClusterLister{
+		kcplisters.NewCluster[*schedulingv1alpha1.PriorityClass](indexer, schedulingv1alpha1.Resource("priorityclass")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get PriorityClasses.
-func (s *priorityClassClusterLister) Cluster(clusterName logicalcluster.Name) schedulingv1alpha1listers.PriorityClassLister {
-	return &priorityClassLister{indexer: s.indexer, clusterName: clusterName}
+func (l *priorityClassClusterLister) Cluster(clusterName logicalcluster.Name) listersschedulingv1alpha1.PriorityClassLister {
+	return &priorityClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// priorityClassLister implements the schedulingv1alpha1listers.PriorityClassLister interface.
+// priorityClassLister can list all PriorityClasses inside a workspace
+// or scope down to a listersschedulingv1alpha1.PriorityClassNamespaceLister for one namespace.
 type priorityClassLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*schedulingv1alpha1.PriorityClass]
 }
 
-// List lists all PriorityClasses in the indexer for a workspace.
-func (s *priorityClassLister) List(selector labels.Selector) (ret []*schedulingv1alpha1.PriorityClass, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*schedulingv1alpha1.PriorityClass))
-	})
-	return ret, err
-}
+var _ listersschedulingv1alpha1.PriorityClassLister = new(priorityClassLister)
 
-// Get retrieves the PriorityClass from the indexer for a given workspace and name.
-func (s *priorityClassLister) Get(name string) (*schedulingv1alpha1.PriorityClass, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(schedulingv1alpha1.Resource("priorityclasses"), name)
+// NewPriorityClassLister returns a new PriorityClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewPriorityClassLister(indexer cache.Indexer) listersschedulingv1alpha1.PriorityClassLister {
+	return &priorityClassLister{
+		kcplisters.New[*schedulingv1alpha1.PriorityClass](indexer, schedulingv1alpha1.Resource("priorityclass")),
 	}
-	return obj.(*schedulingv1alpha1.PriorityClass), nil
+}
+
+// priorityClassScopedLister can list all PriorityClasses inside a workspace
+// or scope down to a listersschedulingv1alpha1.PriorityClassNamespaceLister.
+type priorityClassScopedLister struct {
+	kcplisters.ResourceIndexer[*schedulingv1alpha1.PriorityClass]
 }
diff --git a/listers/scheduling/v1alpha1/priorityclass_expansion.go b/listers/scheduling/v1alpha1/priorityclass_expansion.go
index 5306a9f39..5cd814dec 100644
--- a/listers/scheduling/v1alpha1/priorityclass_expansion.go
+++ b/listers/scheduling/v1alpha1/priorityclass_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/scheduling/v1beta1/expansion_generated.go b/listers/scheduling/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/scheduling/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/scheduling/v1beta1/priorityclass.go b/listers/scheduling/v1beta1/priorityclass.go
index b74749050..5afa32cbf 100644
--- a/listers/scheduling/v1beta1/priorityclass.go
+++ b/listers/scheduling/v1beta1/priorityclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	schedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	schedulingv1beta1listers "k8s.io/client-go/listers/scheduling/v1beta1"
+	listersschedulingv1beta1 "k8s.io/client-go/listers/scheduling/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// PriorityClassClusterLister can list PriorityClasses across all workspaces, or scope down to a PriorityClassLister for one workspace.
+// PriorityClassClusterLister helps list PriorityClasses across all workspaces,
+// or scope down to a PriorityClassLister for one workspace.
 // All objects returned here must be treated as read-only.
 type PriorityClassClusterLister interface {
 	// List lists all PriorityClasses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*schedulingv1beta1.PriorityClass, err error)
 	// Cluster returns a lister that can list and get PriorityClasses in one workspace.
-	Cluster(clusterName logicalcluster.Name) schedulingv1beta1listers.PriorityClassLister
+	Cluster(clusterName logicalcluster.Name) listersschedulingv1beta1.PriorityClassLister
 	PriorityClassClusterListerExpansion
 }
 
+// priorityClassClusterLister implements the PriorityClassClusterLister interface.
 type priorityClassClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*schedulingv1beta1.PriorityClass]
 }
 
+var _ PriorityClassClusterLister = new(priorityClassClusterLister)
+
 // NewPriorityClassClusterLister returns a new PriorityClassClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewPriorityClassClusterLister(indexer cache.Indexer) *priorityClassClusterLister {
-	return &priorityClassClusterLister{indexer: indexer}
-}
-
-// List lists all PriorityClasses in the indexer across all workspaces.
-func (s *priorityClassClusterLister) List(selector labels.Selector) (ret []*schedulingv1beta1.PriorityClass, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*schedulingv1beta1.PriorityClass))
-	})
-	return ret, err
+func NewPriorityClassClusterLister(indexer cache.Indexer) PriorityClassClusterLister {
+	return &priorityClassClusterLister{
+		kcplisters.NewCluster[*schedulingv1beta1.PriorityClass](indexer, schedulingv1beta1.Resource("priorityclass")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get PriorityClasses.
-func (s *priorityClassClusterLister) Cluster(clusterName logicalcluster.Name) schedulingv1beta1listers.PriorityClassLister {
-	return &priorityClassLister{indexer: s.indexer, clusterName: clusterName}
+func (l *priorityClassClusterLister) Cluster(clusterName logicalcluster.Name) listersschedulingv1beta1.PriorityClassLister {
+	return &priorityClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// priorityClassLister implements the schedulingv1beta1listers.PriorityClassLister interface.
+// priorityClassLister can list all PriorityClasses inside a workspace
+// or scope down to a listersschedulingv1beta1.PriorityClassNamespaceLister for one namespace.
 type priorityClassLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*schedulingv1beta1.PriorityClass]
 }
 
-// List lists all PriorityClasses in the indexer for a workspace.
-func (s *priorityClassLister) List(selector labels.Selector) (ret []*schedulingv1beta1.PriorityClass, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*schedulingv1beta1.PriorityClass))
-	})
-	return ret, err
-}
+var _ listersschedulingv1beta1.PriorityClassLister = new(priorityClassLister)
 
-// Get retrieves the PriorityClass from the indexer for a given workspace and name.
-func (s *priorityClassLister) Get(name string) (*schedulingv1beta1.PriorityClass, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(schedulingv1beta1.Resource("priorityclasses"), name)
+// NewPriorityClassLister returns a new PriorityClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewPriorityClassLister(indexer cache.Indexer) listersschedulingv1beta1.PriorityClassLister {
+	return &priorityClassLister{
+		kcplisters.New[*schedulingv1beta1.PriorityClass](indexer, schedulingv1beta1.Resource("priorityclass")),
 	}
-	return obj.(*schedulingv1beta1.PriorityClass), nil
+}
+
+// priorityClassScopedLister can list all PriorityClasses inside a workspace
+// or scope down to a listersschedulingv1beta1.PriorityClassNamespaceLister.
+type priorityClassScopedLister struct {
+	kcplisters.ResourceIndexer[*schedulingv1beta1.PriorityClass]
 }
diff --git a/listers/scheduling/v1beta1/priorityclass_expansion.go b/listers/scheduling/v1beta1/priorityclass_expansion.go
index 934611db6..a4222853e 100644
--- a/listers/scheduling/v1beta1/priorityclass_expansion.go
+++ b/listers/scheduling/v1beta1/priorityclass_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1/csidriver.go b/listers/storage/v1/csidriver.go
index 4952c9102..c2d1d1e2f 100644
--- a/listers/storage/v1/csidriver.go
+++ b/listers/storage/v1/csidriver.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1 "k8s.io/api/storage/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	storagev1listers "k8s.io/client-go/listers/storage/v1"
+	listersstoragev1 "k8s.io/client-go/listers/storage/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// CSIDriverClusterLister can list CSIDrivers across all workspaces, or scope down to a CSIDriverLister for one workspace.
+// CSIDriverClusterLister helps list CSIDrivers across all workspaces,
+// or scope down to a CSIDriverLister for one workspace.
 // All objects returned here must be treated as read-only.
 type CSIDriverClusterLister interface {
 	// List lists all CSIDrivers in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*storagev1.CSIDriver, err error)
 	// Cluster returns a lister that can list and get CSIDrivers in one workspace.
-	Cluster(clusterName logicalcluster.Name) storagev1listers.CSIDriverLister
+	Cluster(clusterName logicalcluster.Name) listersstoragev1.CSIDriverLister
 	CSIDriverClusterListerExpansion
 }
 
+// cSIDriverClusterLister implements the CSIDriverClusterLister interface.
 type cSIDriverClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*storagev1.CSIDriver]
 }
 
+var _ CSIDriverClusterLister = new(cSIDriverClusterLister)
+
 // NewCSIDriverClusterLister returns a new CSIDriverClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewCSIDriverClusterLister(indexer cache.Indexer) *cSIDriverClusterLister {
-	return &cSIDriverClusterLister{indexer: indexer}
-}
-
-// List lists all CSIDrivers in the indexer across all workspaces.
-func (s *cSIDriverClusterLister) List(selector labels.Selector) (ret []*storagev1.CSIDriver, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*storagev1.CSIDriver))
-	})
-	return ret, err
+func NewCSIDriverClusterLister(indexer cache.Indexer) CSIDriverClusterLister {
+	return &cSIDriverClusterLister{
+		kcplisters.NewCluster[*storagev1.CSIDriver](indexer, storagev1.Resource("csidriver")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get CSIDrivers.
-func (s *cSIDriverClusterLister) Cluster(clusterName logicalcluster.Name) storagev1listers.CSIDriverLister {
-	return &cSIDriverLister{indexer: s.indexer, clusterName: clusterName}
+func (l *cSIDriverClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1.CSIDriverLister {
+	return &cSIDriverLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// cSIDriverLister implements the storagev1listers.CSIDriverLister interface.
+// cSIDriverLister can list all CSIDrivers inside a workspace
+// or scope down to a listersstoragev1.CSIDriverNamespaceLister for one namespace.
 type cSIDriverLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*storagev1.CSIDriver]
 }
 
-// List lists all CSIDrivers in the indexer for a workspace.
-func (s *cSIDriverLister) List(selector labels.Selector) (ret []*storagev1.CSIDriver, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1.CSIDriver))
-	})
-	return ret, err
-}
+var _ listersstoragev1.CSIDriverLister = new(cSIDriverLister)
 
-// Get retrieves the CSIDriver from the indexer for a given workspace and name.
-func (s *cSIDriverLister) Get(name string) (*storagev1.CSIDriver, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(storagev1.Resource("csidrivers"), name)
+// NewCSIDriverLister returns a new CSIDriverLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewCSIDriverLister(indexer cache.Indexer) listersstoragev1.CSIDriverLister {
+	return &cSIDriverLister{
+		kcplisters.New[*storagev1.CSIDriver](indexer, storagev1.Resource("csidriver")),
 	}
-	return obj.(*storagev1.CSIDriver), nil
+}
+
+// cSIDriverScopedLister can list all CSIDrivers inside a workspace
+// or scope down to a listersstoragev1.CSIDriverNamespaceLister.
+type cSIDriverScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1.CSIDriver]
 }
diff --git a/listers/storage/v1/csidriver_expansion.go b/listers/storage/v1/csidriver_expansion.go
index cf198daf0..4ccefa009 100644
--- a/listers/storage/v1/csidriver_expansion.go
+++ b/listers/storage/v1/csidriver_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1/csinode.go b/listers/storage/v1/csinode.go
index 7e8d65b30..bc44020a2 100644
--- a/listers/storage/v1/csinode.go
+++ b/listers/storage/v1/csinode.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1 "k8s.io/api/storage/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	storagev1listers "k8s.io/client-go/listers/storage/v1"
+	listersstoragev1 "k8s.io/client-go/listers/storage/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// CSINodeClusterLister can list CSINodes across all workspaces, or scope down to a CSINodeLister for one workspace.
+// CSINodeClusterLister helps list CSINodes across all workspaces,
+// or scope down to a CSINodeLister for one workspace.
 // All objects returned here must be treated as read-only.
 type CSINodeClusterLister interface {
 	// List lists all CSINodes in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*storagev1.CSINode, err error)
 	// Cluster returns a lister that can list and get CSINodes in one workspace.
-	Cluster(clusterName logicalcluster.Name) storagev1listers.CSINodeLister
+	Cluster(clusterName logicalcluster.Name) listersstoragev1.CSINodeLister
 	CSINodeClusterListerExpansion
 }
 
+// cSINodeClusterLister implements the CSINodeClusterLister interface.
 type cSINodeClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*storagev1.CSINode]
 }
 
+var _ CSINodeClusterLister = new(cSINodeClusterLister)
+
 // NewCSINodeClusterLister returns a new CSINodeClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewCSINodeClusterLister(indexer cache.Indexer) *cSINodeClusterLister {
-	return &cSINodeClusterLister{indexer: indexer}
-}
-
-// List lists all CSINodes in the indexer across all workspaces.
-func (s *cSINodeClusterLister) List(selector labels.Selector) (ret []*storagev1.CSINode, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*storagev1.CSINode))
-	})
-	return ret, err
+func NewCSINodeClusterLister(indexer cache.Indexer) CSINodeClusterLister {
+	return &cSINodeClusterLister{
+		kcplisters.NewCluster[*storagev1.CSINode](indexer, storagev1.Resource("csinode")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get CSINodes.
-func (s *cSINodeClusterLister) Cluster(clusterName logicalcluster.Name) storagev1listers.CSINodeLister {
-	return &cSINodeLister{indexer: s.indexer, clusterName: clusterName}
+func (l *cSINodeClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1.CSINodeLister {
+	return &cSINodeLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// cSINodeLister implements the storagev1listers.CSINodeLister interface.
+// cSINodeLister can list all CSINodes inside a workspace
+// or scope down to a listersstoragev1.CSINodeNamespaceLister for one namespace.
 type cSINodeLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*storagev1.CSINode]
 }
 
-// List lists all CSINodes in the indexer for a workspace.
-func (s *cSINodeLister) List(selector labels.Selector) (ret []*storagev1.CSINode, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1.CSINode))
-	})
-	return ret, err
-}
+var _ listersstoragev1.CSINodeLister = new(cSINodeLister)
 
-// Get retrieves the CSINode from the indexer for a given workspace and name.
-func (s *cSINodeLister) Get(name string) (*storagev1.CSINode, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(storagev1.Resource("csinodes"), name)
+// NewCSINodeLister returns a new CSINodeLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewCSINodeLister(indexer cache.Indexer) listersstoragev1.CSINodeLister {
+	return &cSINodeLister{
+		kcplisters.New[*storagev1.CSINode](indexer, storagev1.Resource("csinode")),
 	}
-	return obj.(*storagev1.CSINode), nil
+}
+
+// cSINodeScopedLister can list all CSINodes inside a workspace
+// or scope down to a listersstoragev1.CSINodeNamespaceLister.
+type cSINodeScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1.CSINode]
 }
diff --git a/listers/storage/v1/csinode_expansion.go b/listers/storage/v1/csinode_expansion.go
index 1d0fc861a..7071e2a88 100644
--- a/listers/storage/v1/csinode_expansion.go
+++ b/listers/storage/v1/csinode_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1/csistoragecapacity.go b/listers/storage/v1/csistoragecapacity.go
index a31964d6d..a7c26521f 100644
--- a/listers/storage/v1/csistoragecapacity.go
+++ b/listers/storage/v1/csistoragecapacity.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1 "k8s.io/api/storage/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	storagev1listers "k8s.io/client-go/listers/storage/v1"
+	listersstoragev1 "k8s.io/client-go/listers/storage/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// CSIStorageCapacityClusterLister can list CSIStorageCapacities across all workspaces, or scope down to a CSIStorageCapacityLister for one workspace.
+// CSIStorageCapacityClusterLister helps list CSIStorageCapacities across all workspaces,
+// or scope down to a CSIStorageCapacityLister for one workspace.
 // All objects returned here must be treated as read-only.
 type CSIStorageCapacityClusterLister interface {
 	// List lists all CSIStorageCapacities in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*storagev1.CSIStorageCapacity, err error)
 	// Cluster returns a lister that can list and get CSIStorageCapacities in one workspace.
-	Cluster(clusterName logicalcluster.Name) storagev1listers.CSIStorageCapacityLister
+	Cluster(clusterName logicalcluster.Name) listersstoragev1.CSIStorageCapacityLister
 	CSIStorageCapacityClusterListerExpansion
 }
 
+// cSIStorageCapacityClusterLister implements the CSIStorageCapacityClusterLister interface.
 type cSIStorageCapacityClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*storagev1.CSIStorageCapacity]
 }
 
+var _ CSIStorageCapacityClusterLister = new(cSIStorageCapacityClusterLister)
+
 // NewCSIStorageCapacityClusterLister returns a new CSIStorageCapacityClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewCSIStorageCapacityClusterLister(indexer cache.Indexer) *cSIStorageCapacityClusterLister {
-	return &cSIStorageCapacityClusterLister{indexer: indexer}
-}
-
-// List lists all CSIStorageCapacities in the indexer across all workspaces.
-func (s *cSIStorageCapacityClusterLister) List(selector labels.Selector) (ret []*storagev1.CSIStorageCapacity, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*storagev1.CSIStorageCapacity))
-	})
-	return ret, err
+func NewCSIStorageCapacityClusterLister(indexer cache.Indexer) CSIStorageCapacityClusterLister {
+	return &cSIStorageCapacityClusterLister{
+		kcplisters.NewCluster[*storagev1.CSIStorageCapacity](indexer, storagev1.Resource("csistoragecapacity")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get CSIStorageCapacities.
-func (s *cSIStorageCapacityClusterLister) Cluster(clusterName logicalcluster.Name) storagev1listers.CSIStorageCapacityLister {
-	return &cSIStorageCapacityLister{indexer: s.indexer, clusterName: clusterName}
+func (l *cSIStorageCapacityClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1.CSIStorageCapacityLister {
+	return &cSIStorageCapacityLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// cSIStorageCapacityLister implements the storagev1listers.CSIStorageCapacityLister interface.
+// cSIStorageCapacityLister can list all CSIStorageCapacities inside a workspace
+// or scope down to a listersstoragev1.CSIStorageCapacityNamespaceLister for one namespace.
 type cSIStorageCapacityLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*storagev1.CSIStorageCapacity]
 }
 
-// List lists all CSIStorageCapacities in the indexer for a workspace.
-func (s *cSIStorageCapacityLister) List(selector labels.Selector) (ret []*storagev1.CSIStorageCapacity, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1.CSIStorageCapacity))
-	})
-	return ret, err
-}
+var _ listersstoragev1.CSIStorageCapacityLister = new(cSIStorageCapacityLister)
 
 // CSIStorageCapacities returns an object that can list and get CSIStorageCapacities in one namespace.
-func (s *cSIStorageCapacityLister) CSIStorageCapacities(namespace string) storagev1listers.CSIStorageCapacityNamespaceLister {
-	return &cSIStorageCapacityNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *cSIStorageCapacityLister) CSIStorageCapacities(namespace string) listersstoragev1.CSIStorageCapacityNamespaceLister {
+	return &cSIStorageCapacityNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// cSIStorageCapacityNamespaceLister implements the storagev1listers.CSIStorageCapacityNamespaceLister interface.
+// cSIStorageCapacityNamespaceLister implements the listersstoragev1.CSIStorageCapacityNamespaceLister
+// interface.
 type cSIStorageCapacityNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*storagev1.CSIStorageCapacity]
 }
 
-// List lists all CSIStorageCapacities in the indexer for a given workspace and namespace.
-func (s *cSIStorageCapacityNamespaceLister) List(selector labels.Selector) (ret []*storagev1.CSIStorageCapacity, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1.CSIStorageCapacity))
-	})
-	return ret, err
-}
+var _ listersstoragev1.CSIStorageCapacityNamespaceLister = new(cSIStorageCapacityNamespaceLister)
 
-// Get retrieves the CSIStorageCapacity from the indexer for a given workspace, namespace and name.
-func (s *cSIStorageCapacityNamespaceLister) Get(name string) (*storagev1.CSIStorageCapacity, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewCSIStorageCapacityLister returns a new CSIStorageCapacityLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewCSIStorageCapacityLister(indexer cache.Indexer) listersstoragev1.CSIStorageCapacityLister {
+	return &cSIStorageCapacityLister{
+		kcplisters.New[*storagev1.CSIStorageCapacity](indexer, storagev1.Resource("csistoragecapacity")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(storagev1.Resource("csistoragecapacities"), name)
+}
+
+// cSIStorageCapacityScopedLister can list all CSIStorageCapacities inside a workspace
+// or scope down to a listersstoragev1.CSIStorageCapacityNamespaceLister for one namespace.
+type cSIStorageCapacityScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1.CSIStorageCapacity]
+}
+
+// CSIStorageCapacities returns an object that can list and get CSIStorageCapacities in one namespace.
+func (l *cSIStorageCapacityScopedLister) CSIStorageCapacities(namespace string) listersstoragev1.CSIStorageCapacityLister {
+	return &cSIStorageCapacityLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*storagev1.CSIStorageCapacity), nil
 }
diff --git a/listers/storage/v1/csistoragecapacity_expansion.go b/listers/storage/v1/csistoragecapacity_expansion.go
index f12e835eb..68afd44ad 100644
--- a/listers/storage/v1/csistoragecapacity_expansion.go
+++ b/listers/storage/v1/csistoragecapacity_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1/expansion_generated.go b/listers/storage/v1/expansion_generated.go
new file mode 100644
index 000000000..b6a0c6377
--- /dev/null
+++ b/listers/storage/v1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1
diff --git a/listers/storage/v1/storageclass.go b/listers/storage/v1/storageclass.go
index edd84c994..6b970db1f 100644
--- a/listers/storage/v1/storageclass.go
+++ b/listers/storage/v1/storageclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1 "k8s.io/api/storage/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	storagev1listers "k8s.io/client-go/listers/storage/v1"
+	listersstoragev1 "k8s.io/client-go/listers/storage/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// StorageClassClusterLister can list StorageClasses across all workspaces, or scope down to a StorageClassLister for one workspace.
+// StorageClassClusterLister helps list StorageClasses across all workspaces,
+// or scope down to a StorageClassLister for one workspace.
 // All objects returned here must be treated as read-only.
 type StorageClassClusterLister interface {
 	// List lists all StorageClasses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*storagev1.StorageClass, err error)
 	// Cluster returns a lister that can list and get StorageClasses in one workspace.
-	Cluster(clusterName logicalcluster.Name) storagev1listers.StorageClassLister
+	Cluster(clusterName logicalcluster.Name) listersstoragev1.StorageClassLister
 	StorageClassClusterListerExpansion
 }
 
+// storageClassClusterLister implements the StorageClassClusterLister interface.
 type storageClassClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*storagev1.StorageClass]
 }
 
+var _ StorageClassClusterLister = new(storageClassClusterLister)
+
 // NewStorageClassClusterLister returns a new StorageClassClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewStorageClassClusterLister(indexer cache.Indexer) *storageClassClusterLister {
-	return &storageClassClusterLister{indexer: indexer}
-}
-
-// List lists all StorageClasses in the indexer across all workspaces.
-func (s *storageClassClusterLister) List(selector labels.Selector) (ret []*storagev1.StorageClass, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*storagev1.StorageClass))
-	})
-	return ret, err
+func NewStorageClassClusterLister(indexer cache.Indexer) StorageClassClusterLister {
+	return &storageClassClusterLister{
+		kcplisters.NewCluster[*storagev1.StorageClass](indexer, storagev1.Resource("storageclass")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get StorageClasses.
-func (s *storageClassClusterLister) Cluster(clusterName logicalcluster.Name) storagev1listers.StorageClassLister {
-	return &storageClassLister{indexer: s.indexer, clusterName: clusterName}
+func (l *storageClassClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1.StorageClassLister {
+	return &storageClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// storageClassLister implements the storagev1listers.StorageClassLister interface.
+// storageClassLister can list all StorageClasses inside a workspace
+// or scope down to a listersstoragev1.StorageClassNamespaceLister for one namespace.
 type storageClassLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*storagev1.StorageClass]
 }
 
-// List lists all StorageClasses in the indexer for a workspace.
-func (s *storageClassLister) List(selector labels.Selector) (ret []*storagev1.StorageClass, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1.StorageClass))
-	})
-	return ret, err
-}
+var _ listersstoragev1.StorageClassLister = new(storageClassLister)
 
-// Get retrieves the StorageClass from the indexer for a given workspace and name.
-func (s *storageClassLister) Get(name string) (*storagev1.StorageClass, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(storagev1.Resource("storageclasses"), name)
+// NewStorageClassLister returns a new StorageClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewStorageClassLister(indexer cache.Indexer) listersstoragev1.StorageClassLister {
+	return &storageClassLister{
+		kcplisters.New[*storagev1.StorageClass](indexer, storagev1.Resource("storageclass")),
 	}
-	return obj.(*storagev1.StorageClass), nil
+}
+
+// storageClassScopedLister can list all StorageClasses inside a workspace
+// or scope down to a listersstoragev1.StorageClassNamespaceLister.
+type storageClassScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1.StorageClass]
 }
diff --git a/listers/storage/v1/storageclass_expansion.go b/listers/storage/v1/storageclass_expansion.go
index 2d8414c1a..736fc4442 100644
--- a/listers/storage/v1/storageclass_expansion.go
+++ b/listers/storage/v1/storageclass_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1/volumeattachment.go b/listers/storage/v1/volumeattachment.go
index c0e8d13e8..1bb3bb137 100644
--- a/listers/storage/v1/volumeattachment.go
+++ b/listers/storage/v1/volumeattachment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1 "k8s.io/api/storage/v1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	storagev1listers "k8s.io/client-go/listers/storage/v1"
+	listersstoragev1 "k8s.io/client-go/listers/storage/v1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// VolumeAttachmentClusterLister can list VolumeAttachments across all workspaces, or scope down to a VolumeAttachmentLister for one workspace.
+// VolumeAttachmentClusterLister helps list VolumeAttachments across all workspaces,
+// or scope down to a VolumeAttachmentLister for one workspace.
 // All objects returned here must be treated as read-only.
 type VolumeAttachmentClusterLister interface {
 	// List lists all VolumeAttachments in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*storagev1.VolumeAttachment, err error)
 	// Cluster returns a lister that can list and get VolumeAttachments in one workspace.
-	Cluster(clusterName logicalcluster.Name) storagev1listers.VolumeAttachmentLister
+	Cluster(clusterName logicalcluster.Name) listersstoragev1.VolumeAttachmentLister
 	VolumeAttachmentClusterListerExpansion
 }
 
+// volumeAttachmentClusterLister implements the VolumeAttachmentClusterLister interface.
 type volumeAttachmentClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*storagev1.VolumeAttachment]
 }
 
+var _ VolumeAttachmentClusterLister = new(volumeAttachmentClusterLister)
+
 // NewVolumeAttachmentClusterLister returns a new VolumeAttachmentClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewVolumeAttachmentClusterLister(indexer cache.Indexer) *volumeAttachmentClusterLister {
-	return &volumeAttachmentClusterLister{indexer: indexer}
-}
-
-// List lists all VolumeAttachments in the indexer across all workspaces.
-func (s *volumeAttachmentClusterLister) List(selector labels.Selector) (ret []*storagev1.VolumeAttachment, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*storagev1.VolumeAttachment))
-	})
-	return ret, err
+func NewVolumeAttachmentClusterLister(indexer cache.Indexer) VolumeAttachmentClusterLister {
+	return &volumeAttachmentClusterLister{
+		kcplisters.NewCluster[*storagev1.VolumeAttachment](indexer, storagev1.Resource("volumeattachment")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get VolumeAttachments.
-func (s *volumeAttachmentClusterLister) Cluster(clusterName logicalcluster.Name) storagev1listers.VolumeAttachmentLister {
-	return &volumeAttachmentLister{indexer: s.indexer, clusterName: clusterName}
+func (l *volumeAttachmentClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1.VolumeAttachmentLister {
+	return &volumeAttachmentLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// volumeAttachmentLister implements the storagev1listers.VolumeAttachmentLister interface.
+// volumeAttachmentLister can list all VolumeAttachments inside a workspace
+// or scope down to a listersstoragev1.VolumeAttachmentNamespaceLister for one namespace.
 type volumeAttachmentLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*storagev1.VolumeAttachment]
 }
 
-// List lists all VolumeAttachments in the indexer for a workspace.
-func (s *volumeAttachmentLister) List(selector labels.Selector) (ret []*storagev1.VolumeAttachment, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1.VolumeAttachment))
-	})
-	return ret, err
-}
+var _ listersstoragev1.VolumeAttachmentLister = new(volumeAttachmentLister)
 
-// Get retrieves the VolumeAttachment from the indexer for a given workspace and name.
-func (s *volumeAttachmentLister) Get(name string) (*storagev1.VolumeAttachment, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(storagev1.Resource("volumeattachments"), name)
+// NewVolumeAttachmentLister returns a new VolumeAttachmentLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewVolumeAttachmentLister(indexer cache.Indexer) listersstoragev1.VolumeAttachmentLister {
+	return &volumeAttachmentLister{
+		kcplisters.New[*storagev1.VolumeAttachment](indexer, storagev1.Resource("volumeattachment")),
 	}
-	return obj.(*storagev1.VolumeAttachment), nil
+}
+
+// volumeAttachmentScopedLister can list all VolumeAttachments inside a workspace
+// or scope down to a listersstoragev1.VolumeAttachmentNamespaceLister.
+type volumeAttachmentScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1.VolumeAttachment]
 }
diff --git a/listers/storage/v1/volumeattachment_expansion.go b/listers/storage/v1/volumeattachment_expansion.go
index 50f9b263f..26f5ae008 100644
--- a/listers/storage/v1/volumeattachment_expansion.go
+++ b/listers/storage/v1/volumeattachment_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1alpha1/csistoragecapacity.go b/listers/storage/v1alpha1/csistoragecapacity.go
index 6a2c0c365..df22ca693 100644
--- a/listers/storage/v1alpha1/csistoragecapacity.go
+++ b/listers/storage/v1alpha1/csistoragecapacity.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	storagev1alpha1listers "k8s.io/client-go/listers/storage/v1alpha1"
+	listersstoragev1alpha1 "k8s.io/client-go/listers/storage/v1alpha1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// CSIStorageCapacityClusterLister can list CSIStorageCapacities across all workspaces, or scope down to a CSIStorageCapacityLister for one workspace.
+// CSIStorageCapacityClusterLister helps list CSIStorageCapacities across all workspaces,
+// or scope down to a CSIStorageCapacityLister for one workspace.
 // All objects returned here must be treated as read-only.
 type CSIStorageCapacityClusterLister interface {
 	// List lists all CSIStorageCapacities in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*storagev1alpha1.CSIStorageCapacity, err error)
 	// Cluster returns a lister that can list and get CSIStorageCapacities in one workspace.
-	Cluster(clusterName logicalcluster.Name) storagev1alpha1listers.CSIStorageCapacityLister
+	Cluster(clusterName logicalcluster.Name) listersstoragev1alpha1.CSIStorageCapacityLister
 	CSIStorageCapacityClusterListerExpansion
 }
 
+// cSIStorageCapacityClusterLister implements the CSIStorageCapacityClusterLister interface.
 type cSIStorageCapacityClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*storagev1alpha1.CSIStorageCapacity]
 }
 
+var _ CSIStorageCapacityClusterLister = new(cSIStorageCapacityClusterLister)
+
 // NewCSIStorageCapacityClusterLister returns a new CSIStorageCapacityClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewCSIStorageCapacityClusterLister(indexer cache.Indexer) *cSIStorageCapacityClusterLister {
-	return &cSIStorageCapacityClusterLister{indexer: indexer}
-}
-
-// List lists all CSIStorageCapacities in the indexer across all workspaces.
-func (s *cSIStorageCapacityClusterLister) List(selector labels.Selector) (ret []*storagev1alpha1.CSIStorageCapacity, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*storagev1alpha1.CSIStorageCapacity))
-	})
-	return ret, err
+func NewCSIStorageCapacityClusterLister(indexer cache.Indexer) CSIStorageCapacityClusterLister {
+	return &cSIStorageCapacityClusterLister{
+		kcplisters.NewCluster[*storagev1alpha1.CSIStorageCapacity](indexer, storagev1alpha1.Resource("csistoragecapacity")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get CSIStorageCapacities.
-func (s *cSIStorageCapacityClusterLister) Cluster(clusterName logicalcluster.Name) storagev1alpha1listers.CSIStorageCapacityLister {
-	return &cSIStorageCapacityLister{indexer: s.indexer, clusterName: clusterName}
+func (l *cSIStorageCapacityClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1alpha1.CSIStorageCapacityLister {
+	return &cSIStorageCapacityLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// cSIStorageCapacityLister implements the storagev1alpha1listers.CSIStorageCapacityLister interface.
+// cSIStorageCapacityLister can list all CSIStorageCapacities inside a workspace
+// or scope down to a listersstoragev1alpha1.CSIStorageCapacityNamespaceLister for one namespace.
 type cSIStorageCapacityLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*storagev1alpha1.CSIStorageCapacity]
 }
 
-// List lists all CSIStorageCapacities in the indexer for a workspace.
-func (s *cSIStorageCapacityLister) List(selector labels.Selector) (ret []*storagev1alpha1.CSIStorageCapacity, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1alpha1.CSIStorageCapacity))
-	})
-	return ret, err
-}
+var _ listersstoragev1alpha1.CSIStorageCapacityLister = new(cSIStorageCapacityLister)
 
 // CSIStorageCapacities returns an object that can list and get CSIStorageCapacities in one namespace.
-func (s *cSIStorageCapacityLister) CSIStorageCapacities(namespace string) storagev1alpha1listers.CSIStorageCapacityNamespaceLister {
-	return &cSIStorageCapacityNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *cSIStorageCapacityLister) CSIStorageCapacities(namespace string) listersstoragev1alpha1.CSIStorageCapacityNamespaceLister {
+	return &cSIStorageCapacityNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// cSIStorageCapacityNamespaceLister implements the storagev1alpha1listers.CSIStorageCapacityNamespaceLister interface.
+// cSIStorageCapacityNamespaceLister implements the listersstoragev1alpha1.CSIStorageCapacityNamespaceLister
+// interface.
 type cSIStorageCapacityNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*storagev1alpha1.CSIStorageCapacity]
 }
 
-// List lists all CSIStorageCapacities in the indexer for a given workspace and namespace.
-func (s *cSIStorageCapacityNamespaceLister) List(selector labels.Selector) (ret []*storagev1alpha1.CSIStorageCapacity, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1alpha1.CSIStorageCapacity))
-	})
-	return ret, err
-}
+var _ listersstoragev1alpha1.CSIStorageCapacityNamespaceLister = new(cSIStorageCapacityNamespaceLister)
 
-// Get retrieves the CSIStorageCapacity from the indexer for a given workspace, namespace and name.
-func (s *cSIStorageCapacityNamespaceLister) Get(name string) (*storagev1alpha1.CSIStorageCapacity, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewCSIStorageCapacityLister returns a new CSIStorageCapacityLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewCSIStorageCapacityLister(indexer cache.Indexer) listersstoragev1alpha1.CSIStorageCapacityLister {
+	return &cSIStorageCapacityLister{
+		kcplisters.New[*storagev1alpha1.CSIStorageCapacity](indexer, storagev1alpha1.Resource("csistoragecapacity")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(storagev1alpha1.Resource("csistoragecapacities"), name)
+}
+
+// cSIStorageCapacityScopedLister can list all CSIStorageCapacities inside a workspace
+// or scope down to a listersstoragev1alpha1.CSIStorageCapacityNamespaceLister for one namespace.
+type cSIStorageCapacityScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1alpha1.CSIStorageCapacity]
+}
+
+// CSIStorageCapacities returns an object that can list and get CSIStorageCapacities in one namespace.
+func (l *cSIStorageCapacityScopedLister) CSIStorageCapacities(namespace string) listersstoragev1alpha1.CSIStorageCapacityLister {
+	return &cSIStorageCapacityLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*storagev1alpha1.CSIStorageCapacity), nil
 }
diff --git a/listers/storage/v1alpha1/csistoragecapacity_expansion.go b/listers/storage/v1alpha1/csistoragecapacity_expansion.go
index 44d25078f..bc76f6e4b 100644
--- a/listers/storage/v1alpha1/csistoragecapacity_expansion.go
+++ b/listers/storage/v1alpha1/csistoragecapacity_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1alpha1/expansion_generated.go b/listers/storage/v1alpha1/expansion_generated.go
new file mode 100644
index 000000000..3b8521c00
--- /dev/null
+++ b/listers/storage/v1alpha1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
diff --git a/listers/storage/v1alpha1/volumeattachment.go b/listers/storage/v1alpha1/volumeattachment.go
index e626c5cf6..48763e1aa 100644
--- a/listers/storage/v1alpha1/volumeattachment.go
+++ b/listers/storage/v1alpha1/volumeattachment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1alpha1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	storagev1alpha1listers "k8s.io/client-go/listers/storage/v1alpha1"
+	listersstoragev1alpha1 "k8s.io/client-go/listers/storage/v1alpha1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// VolumeAttachmentClusterLister can list VolumeAttachments across all workspaces, or scope down to a VolumeAttachmentLister for one workspace.
+// VolumeAttachmentClusterLister helps list VolumeAttachments across all workspaces,
+// or scope down to a VolumeAttachmentLister for one workspace.
 // All objects returned here must be treated as read-only.
 type VolumeAttachmentClusterLister interface {
 	// List lists all VolumeAttachments in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*storagev1alpha1.VolumeAttachment, err error)
 	// Cluster returns a lister that can list and get VolumeAttachments in one workspace.
-	Cluster(clusterName logicalcluster.Name) storagev1alpha1listers.VolumeAttachmentLister
+	Cluster(clusterName logicalcluster.Name) listersstoragev1alpha1.VolumeAttachmentLister
 	VolumeAttachmentClusterListerExpansion
 }
 
+// volumeAttachmentClusterLister implements the VolumeAttachmentClusterLister interface.
 type volumeAttachmentClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*storagev1alpha1.VolumeAttachment]
 }
 
+var _ VolumeAttachmentClusterLister = new(volumeAttachmentClusterLister)
+
 // NewVolumeAttachmentClusterLister returns a new VolumeAttachmentClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewVolumeAttachmentClusterLister(indexer cache.Indexer) *volumeAttachmentClusterLister {
-	return &volumeAttachmentClusterLister{indexer: indexer}
-}
-
-// List lists all VolumeAttachments in the indexer across all workspaces.
-func (s *volumeAttachmentClusterLister) List(selector labels.Selector) (ret []*storagev1alpha1.VolumeAttachment, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*storagev1alpha1.VolumeAttachment))
-	})
-	return ret, err
+func NewVolumeAttachmentClusterLister(indexer cache.Indexer) VolumeAttachmentClusterLister {
+	return &volumeAttachmentClusterLister{
+		kcplisters.NewCluster[*storagev1alpha1.VolumeAttachment](indexer, storagev1alpha1.Resource("volumeattachment")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get VolumeAttachments.
-func (s *volumeAttachmentClusterLister) Cluster(clusterName logicalcluster.Name) storagev1alpha1listers.VolumeAttachmentLister {
-	return &volumeAttachmentLister{indexer: s.indexer, clusterName: clusterName}
+func (l *volumeAttachmentClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1alpha1.VolumeAttachmentLister {
+	return &volumeAttachmentLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// volumeAttachmentLister implements the storagev1alpha1listers.VolumeAttachmentLister interface.
+// volumeAttachmentLister can list all VolumeAttachments inside a workspace
+// or scope down to a listersstoragev1alpha1.VolumeAttachmentNamespaceLister for one namespace.
 type volumeAttachmentLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*storagev1alpha1.VolumeAttachment]
 }
 
-// List lists all VolumeAttachments in the indexer for a workspace.
-func (s *volumeAttachmentLister) List(selector labels.Selector) (ret []*storagev1alpha1.VolumeAttachment, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1alpha1.VolumeAttachment))
-	})
-	return ret, err
-}
+var _ listersstoragev1alpha1.VolumeAttachmentLister = new(volumeAttachmentLister)
 
-// Get retrieves the VolumeAttachment from the indexer for a given workspace and name.
-func (s *volumeAttachmentLister) Get(name string) (*storagev1alpha1.VolumeAttachment, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(storagev1alpha1.Resource("volumeattachments"), name)
+// NewVolumeAttachmentLister returns a new VolumeAttachmentLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewVolumeAttachmentLister(indexer cache.Indexer) listersstoragev1alpha1.VolumeAttachmentLister {
+	return &volumeAttachmentLister{
+		kcplisters.New[*storagev1alpha1.VolumeAttachment](indexer, storagev1alpha1.Resource("volumeattachment")),
 	}
-	return obj.(*storagev1alpha1.VolumeAttachment), nil
+}
+
+// volumeAttachmentScopedLister can list all VolumeAttachments inside a workspace
+// or scope down to a listersstoragev1alpha1.VolumeAttachmentNamespaceLister.
+type volumeAttachmentScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1alpha1.VolumeAttachment]
 }
diff --git a/listers/storage/v1alpha1/volumeattachment_expansion.go b/listers/storage/v1alpha1/volumeattachment_expansion.go
index b91ad6142..15c559246 100644
--- a/listers/storage/v1alpha1/volumeattachment_expansion.go
+++ b/listers/storage/v1alpha1/volumeattachment_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1alpha1/volumeattributesclass.go b/listers/storage/v1alpha1/volumeattributesclass.go
new file mode 100644
index 000000000..ee045baf5
--- /dev/null
+++ b/listers/storage/v1alpha1/volumeattributesclass.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	storagev1alpha1 "k8s.io/api/storage/v1alpha1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersstoragev1alpha1 "k8s.io/client-go/listers/storage/v1alpha1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// VolumeAttributesClassClusterLister helps list VolumeAttributesClasses across all workspaces,
+// or scope down to a VolumeAttributesClassLister for one workspace.
+// All objects returned here must be treated as read-only.
+type VolumeAttributesClassClusterLister interface {
+	// List lists all VolumeAttributesClasses in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*storagev1alpha1.VolumeAttributesClass, err error)
+	// Cluster returns a lister that can list and get VolumeAttributesClasses in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersstoragev1alpha1.VolumeAttributesClassLister
+	VolumeAttributesClassClusterListerExpansion
+}
+
+// volumeAttributesClassClusterLister implements the VolumeAttributesClassClusterLister interface.
+type volumeAttributesClassClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*storagev1alpha1.VolumeAttributesClass]
+}
+
+var _ VolumeAttributesClassClusterLister = new(volumeAttributesClassClusterLister)
+
+// NewVolumeAttributesClassClusterLister returns a new VolumeAttributesClassClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewVolumeAttributesClassClusterLister(indexer cache.Indexer) VolumeAttributesClassClusterLister {
+	return &volumeAttributesClassClusterLister{
+		kcplisters.NewCluster[*storagev1alpha1.VolumeAttributesClass](indexer, storagev1alpha1.Resource("volumeattributesclass")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get VolumeAttributesClasses.
+func (l *volumeAttributesClassClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1alpha1.VolumeAttributesClassLister {
+	return &volumeAttributesClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// volumeAttributesClassLister can list all VolumeAttributesClasses inside a workspace
+// or scope down to a listersstoragev1alpha1.VolumeAttributesClassNamespaceLister for one namespace.
+type volumeAttributesClassLister struct {
+	kcplisters.ResourceIndexer[*storagev1alpha1.VolumeAttributesClass]
+}
+
+var _ listersstoragev1alpha1.VolumeAttributesClassLister = new(volumeAttributesClassLister)
+
+// NewVolumeAttributesClassLister returns a new VolumeAttributesClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewVolumeAttributesClassLister(indexer cache.Indexer) listersstoragev1alpha1.VolumeAttributesClassLister {
+	return &volumeAttributesClassLister{
+		kcplisters.New[*storagev1alpha1.VolumeAttributesClass](indexer, storagev1alpha1.Resource("volumeattributesclass")),
+	}
+}
+
+// volumeAttributesClassScopedLister can list all VolumeAttributesClasses inside a workspace
+// or scope down to a listersstoragev1alpha1.VolumeAttributesClassNamespaceLister.
+type volumeAttributesClassScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1alpha1.VolumeAttributesClass]
+}
diff --git a/listers/storage/v1alpha1/volumeattributesclass_expansion.go b/listers/storage/v1alpha1/volumeattributesclass_expansion.go
new file mode 100644
index 000000000..8feb26f2c
--- /dev/null
+++ b/listers/storage/v1alpha1/volumeattributesclass_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1alpha1
+
+// VolumeAttributesClassClusterListerExpansion allows custom methods to be added to VolumeAttributesClassClusterLister.
+type VolumeAttributesClassClusterListerExpansion interface{}
diff --git a/listers/storage/v1beta1/csidriver.go b/listers/storage/v1beta1/csidriver.go
index 29030971a..928174205 100644
--- a/listers/storage/v1beta1/csidriver.go
+++ b/listers/storage/v1beta1/csidriver.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	storagev1beta1listers "k8s.io/client-go/listers/storage/v1beta1"
+	listersstoragev1beta1 "k8s.io/client-go/listers/storage/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// CSIDriverClusterLister can list CSIDrivers across all workspaces, or scope down to a CSIDriverLister for one workspace.
+// CSIDriverClusterLister helps list CSIDrivers across all workspaces,
+// or scope down to a CSIDriverLister for one workspace.
 // All objects returned here must be treated as read-only.
 type CSIDriverClusterLister interface {
 	// List lists all CSIDrivers in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*storagev1beta1.CSIDriver, err error)
 	// Cluster returns a lister that can list and get CSIDrivers in one workspace.
-	Cluster(clusterName logicalcluster.Name) storagev1beta1listers.CSIDriverLister
+	Cluster(clusterName logicalcluster.Name) listersstoragev1beta1.CSIDriverLister
 	CSIDriverClusterListerExpansion
 }
 
+// cSIDriverClusterLister implements the CSIDriverClusterLister interface.
 type cSIDriverClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*storagev1beta1.CSIDriver]
 }
 
+var _ CSIDriverClusterLister = new(cSIDriverClusterLister)
+
 // NewCSIDriverClusterLister returns a new CSIDriverClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewCSIDriverClusterLister(indexer cache.Indexer) *cSIDriverClusterLister {
-	return &cSIDriverClusterLister{indexer: indexer}
-}
-
-// List lists all CSIDrivers in the indexer across all workspaces.
-func (s *cSIDriverClusterLister) List(selector labels.Selector) (ret []*storagev1beta1.CSIDriver, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*storagev1beta1.CSIDriver))
-	})
-	return ret, err
+func NewCSIDriverClusterLister(indexer cache.Indexer) CSIDriverClusterLister {
+	return &cSIDriverClusterLister{
+		kcplisters.NewCluster[*storagev1beta1.CSIDriver](indexer, storagev1beta1.Resource("csidriver")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get CSIDrivers.
-func (s *cSIDriverClusterLister) Cluster(clusterName logicalcluster.Name) storagev1beta1listers.CSIDriverLister {
-	return &cSIDriverLister{indexer: s.indexer, clusterName: clusterName}
+func (l *cSIDriverClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1beta1.CSIDriverLister {
+	return &cSIDriverLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// cSIDriverLister implements the storagev1beta1listers.CSIDriverLister interface.
+// cSIDriverLister can list all CSIDrivers inside a workspace
+// or scope down to a listersstoragev1beta1.CSIDriverNamespaceLister for one namespace.
 type cSIDriverLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*storagev1beta1.CSIDriver]
 }
 
-// List lists all CSIDrivers in the indexer for a workspace.
-func (s *cSIDriverLister) List(selector labels.Selector) (ret []*storagev1beta1.CSIDriver, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1beta1.CSIDriver))
-	})
-	return ret, err
-}
+var _ listersstoragev1beta1.CSIDriverLister = new(cSIDriverLister)
 
-// Get retrieves the CSIDriver from the indexer for a given workspace and name.
-func (s *cSIDriverLister) Get(name string) (*storagev1beta1.CSIDriver, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(storagev1beta1.Resource("csidrivers"), name)
+// NewCSIDriverLister returns a new CSIDriverLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewCSIDriverLister(indexer cache.Indexer) listersstoragev1beta1.CSIDriverLister {
+	return &cSIDriverLister{
+		kcplisters.New[*storagev1beta1.CSIDriver](indexer, storagev1beta1.Resource("csidriver")),
 	}
-	return obj.(*storagev1beta1.CSIDriver), nil
+}
+
+// cSIDriverScopedLister can list all CSIDrivers inside a workspace
+// or scope down to a listersstoragev1beta1.CSIDriverNamespaceLister.
+type cSIDriverScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1beta1.CSIDriver]
 }
diff --git a/listers/storage/v1beta1/csidriver_expansion.go b/listers/storage/v1beta1/csidriver_expansion.go
index 228c7b274..858f59289 100644
--- a/listers/storage/v1beta1/csidriver_expansion.go
+++ b/listers/storage/v1beta1/csidriver_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1beta1/csinode.go b/listers/storage/v1beta1/csinode.go
index 72ebf53de..fa8407da1 100644
--- a/listers/storage/v1beta1/csinode.go
+++ b/listers/storage/v1beta1/csinode.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	storagev1beta1listers "k8s.io/client-go/listers/storage/v1beta1"
+	listersstoragev1beta1 "k8s.io/client-go/listers/storage/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// CSINodeClusterLister can list CSINodes across all workspaces, or scope down to a CSINodeLister for one workspace.
+// CSINodeClusterLister helps list CSINodes across all workspaces,
+// or scope down to a CSINodeLister for one workspace.
 // All objects returned here must be treated as read-only.
 type CSINodeClusterLister interface {
 	// List lists all CSINodes in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*storagev1beta1.CSINode, err error)
 	// Cluster returns a lister that can list and get CSINodes in one workspace.
-	Cluster(clusterName logicalcluster.Name) storagev1beta1listers.CSINodeLister
+	Cluster(clusterName logicalcluster.Name) listersstoragev1beta1.CSINodeLister
 	CSINodeClusterListerExpansion
 }
 
+// cSINodeClusterLister implements the CSINodeClusterLister interface.
 type cSINodeClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*storagev1beta1.CSINode]
 }
 
+var _ CSINodeClusterLister = new(cSINodeClusterLister)
+
 // NewCSINodeClusterLister returns a new CSINodeClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewCSINodeClusterLister(indexer cache.Indexer) *cSINodeClusterLister {
-	return &cSINodeClusterLister{indexer: indexer}
-}
-
-// List lists all CSINodes in the indexer across all workspaces.
-func (s *cSINodeClusterLister) List(selector labels.Selector) (ret []*storagev1beta1.CSINode, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*storagev1beta1.CSINode))
-	})
-	return ret, err
+func NewCSINodeClusterLister(indexer cache.Indexer) CSINodeClusterLister {
+	return &cSINodeClusterLister{
+		kcplisters.NewCluster[*storagev1beta1.CSINode](indexer, storagev1beta1.Resource("csinode")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get CSINodes.
-func (s *cSINodeClusterLister) Cluster(clusterName logicalcluster.Name) storagev1beta1listers.CSINodeLister {
-	return &cSINodeLister{indexer: s.indexer, clusterName: clusterName}
+func (l *cSINodeClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1beta1.CSINodeLister {
+	return &cSINodeLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// cSINodeLister implements the storagev1beta1listers.CSINodeLister interface.
+// cSINodeLister can list all CSINodes inside a workspace
+// or scope down to a listersstoragev1beta1.CSINodeNamespaceLister for one namespace.
 type cSINodeLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*storagev1beta1.CSINode]
 }
 
-// List lists all CSINodes in the indexer for a workspace.
-func (s *cSINodeLister) List(selector labels.Selector) (ret []*storagev1beta1.CSINode, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1beta1.CSINode))
-	})
-	return ret, err
-}
+var _ listersstoragev1beta1.CSINodeLister = new(cSINodeLister)
 
-// Get retrieves the CSINode from the indexer for a given workspace and name.
-func (s *cSINodeLister) Get(name string) (*storagev1beta1.CSINode, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(storagev1beta1.Resource("csinodes"), name)
+// NewCSINodeLister returns a new CSINodeLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewCSINodeLister(indexer cache.Indexer) listersstoragev1beta1.CSINodeLister {
+	return &cSINodeLister{
+		kcplisters.New[*storagev1beta1.CSINode](indexer, storagev1beta1.Resource("csinode")),
 	}
-	return obj.(*storagev1beta1.CSINode), nil
+}
+
+// cSINodeScopedLister can list all CSINodes inside a workspace
+// or scope down to a listersstoragev1beta1.CSINodeNamespaceLister.
+type cSINodeScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1beta1.CSINode]
 }
diff --git a/listers/storage/v1beta1/csinode_expansion.go b/listers/storage/v1beta1/csinode_expansion.go
index 97e83410a..c5f4e4bbf 100644
--- a/listers/storage/v1beta1/csinode_expansion.go
+++ b/listers/storage/v1beta1/csinode_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1beta1/csistoragecapacity.go b/listers/storage/v1beta1/csistoragecapacity.go
index 0c5915745..cdac3c725 100644
--- a/listers/storage/v1beta1/csistoragecapacity.go
+++ b/listers/storage/v1beta1/csistoragecapacity.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,102 +14,102 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	storagev1beta1listers "k8s.io/client-go/listers/storage/v1beta1"
+	listersstoragev1beta1 "k8s.io/client-go/listers/storage/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// CSIStorageCapacityClusterLister can list CSIStorageCapacities across all workspaces, or scope down to a CSIStorageCapacityLister for one workspace.
+// CSIStorageCapacityClusterLister helps list CSIStorageCapacities across all workspaces,
+// or scope down to a CSIStorageCapacityLister for one workspace.
 // All objects returned here must be treated as read-only.
 type CSIStorageCapacityClusterLister interface {
 	// List lists all CSIStorageCapacities in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*storagev1beta1.CSIStorageCapacity, err error)
 	// Cluster returns a lister that can list and get CSIStorageCapacities in one workspace.
-	Cluster(clusterName logicalcluster.Name) storagev1beta1listers.CSIStorageCapacityLister
+	Cluster(clusterName logicalcluster.Name) listersstoragev1beta1.CSIStorageCapacityLister
 	CSIStorageCapacityClusterListerExpansion
 }
 
+// cSIStorageCapacityClusterLister implements the CSIStorageCapacityClusterLister interface.
 type cSIStorageCapacityClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*storagev1beta1.CSIStorageCapacity]
 }
 
+var _ CSIStorageCapacityClusterLister = new(cSIStorageCapacityClusterLister)
+
 // NewCSIStorageCapacityClusterLister returns a new CSIStorageCapacityClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
 // - has the kcpcache.ClusterAndNamespaceIndex as an index
-func NewCSIStorageCapacityClusterLister(indexer cache.Indexer) *cSIStorageCapacityClusterLister {
-	return &cSIStorageCapacityClusterLister{indexer: indexer}
-}
-
-// List lists all CSIStorageCapacities in the indexer across all workspaces.
-func (s *cSIStorageCapacityClusterLister) List(selector labels.Selector) (ret []*storagev1beta1.CSIStorageCapacity, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*storagev1beta1.CSIStorageCapacity))
-	})
-	return ret, err
+func NewCSIStorageCapacityClusterLister(indexer cache.Indexer) CSIStorageCapacityClusterLister {
+	return &cSIStorageCapacityClusterLister{
+		kcplisters.NewCluster[*storagev1beta1.CSIStorageCapacity](indexer, storagev1beta1.Resource("csistoragecapacity")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get CSIStorageCapacities.
-func (s *cSIStorageCapacityClusterLister) Cluster(clusterName logicalcluster.Name) storagev1beta1listers.CSIStorageCapacityLister {
-	return &cSIStorageCapacityLister{indexer: s.indexer, clusterName: clusterName}
+func (l *cSIStorageCapacityClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1beta1.CSIStorageCapacityLister {
+	return &cSIStorageCapacityLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// cSIStorageCapacityLister implements the storagev1beta1listers.CSIStorageCapacityLister interface.
+// cSIStorageCapacityLister can list all CSIStorageCapacities inside a workspace
+// or scope down to a listersstoragev1beta1.CSIStorageCapacityNamespaceLister for one namespace.
 type cSIStorageCapacityLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*storagev1beta1.CSIStorageCapacity]
 }
 
-// List lists all CSIStorageCapacities in the indexer for a workspace.
-func (s *cSIStorageCapacityLister) List(selector labels.Selector) (ret []*storagev1beta1.CSIStorageCapacity, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1beta1.CSIStorageCapacity))
-	})
-	return ret, err
-}
+var _ listersstoragev1beta1.CSIStorageCapacityLister = new(cSIStorageCapacityLister)
 
 // CSIStorageCapacities returns an object that can list and get CSIStorageCapacities in one namespace.
-func (s *cSIStorageCapacityLister) CSIStorageCapacities(namespace string) storagev1beta1listers.CSIStorageCapacityNamespaceLister {
-	return &cSIStorageCapacityNamespaceLister{indexer: s.indexer, clusterName: s.clusterName, namespace: namespace}
+func (l *cSIStorageCapacityLister) CSIStorageCapacities(namespace string) listersstoragev1beta1.CSIStorageCapacityNamespaceLister {
+	return &cSIStorageCapacityNamespaceLister{
+		l.ResourceIndexer.WithNamespace(namespace),
+	}
 }
 
-// cSIStorageCapacityNamespaceLister implements the storagev1beta1listers.CSIStorageCapacityNamespaceLister interface.
+// cSIStorageCapacityNamespaceLister implements the listersstoragev1beta1.CSIStorageCapacityNamespaceLister
+// interface.
 type cSIStorageCapacityNamespaceLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
-	namespace   string
+	kcplisters.ResourceIndexer[*storagev1beta1.CSIStorageCapacity]
 }
 
-// List lists all CSIStorageCapacities in the indexer for a given workspace and namespace.
-func (s *cSIStorageCapacityNamespaceLister) List(selector labels.Selector) (ret []*storagev1beta1.CSIStorageCapacity, err error) {
-	err = kcpcache.ListAllByClusterAndNamespace(s.indexer, s.clusterName, s.namespace, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1beta1.CSIStorageCapacity))
-	})
-	return ret, err
-}
+var _ listersstoragev1beta1.CSIStorageCapacityNamespaceLister = new(cSIStorageCapacityNamespaceLister)
 
-// Get retrieves the CSIStorageCapacity from the indexer for a given workspace, namespace and name.
-func (s *cSIStorageCapacityNamespaceLister) Get(name string) (*storagev1beta1.CSIStorageCapacity, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), s.namespace, name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
+// NewCSIStorageCapacityLister returns a new CSIStorageCapacityLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+// - has the kcpcache.ClusterAndNamespaceIndex as an index
+func NewCSIStorageCapacityLister(indexer cache.Indexer) listersstoragev1beta1.CSIStorageCapacityLister {
+	return &cSIStorageCapacityLister{
+		kcplisters.New[*storagev1beta1.CSIStorageCapacity](indexer, storagev1beta1.Resource("csistoragecapacity")),
 	}
-	if !exists {
-		return nil, errors.NewNotFound(storagev1beta1.Resource("csistoragecapacities"), name)
+}
+
+// cSIStorageCapacityScopedLister can list all CSIStorageCapacities inside a workspace
+// or scope down to a listersstoragev1beta1.CSIStorageCapacityNamespaceLister for one namespace.
+type cSIStorageCapacityScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1beta1.CSIStorageCapacity]
+}
+
+// CSIStorageCapacities returns an object that can list and get CSIStorageCapacities in one namespace.
+func (l *cSIStorageCapacityScopedLister) CSIStorageCapacities(namespace string) listersstoragev1beta1.CSIStorageCapacityLister {
+	return &cSIStorageCapacityLister{
+		l.ResourceIndexer.WithNamespace(namespace),
 	}
-	return obj.(*storagev1beta1.CSIStorageCapacity), nil
 }
diff --git a/listers/storage/v1beta1/csistoragecapacity_expansion.go b/listers/storage/v1beta1/csistoragecapacity_expansion.go
index 82fc7075a..2695d3fdc 100644
--- a/listers/storage/v1beta1/csistoragecapacity_expansion.go
+++ b/listers/storage/v1beta1/csistoragecapacity_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1beta1/expansion_generated.go b/listers/storage/v1beta1/expansion_generated.go
new file mode 100644
index 000000000..23cac805b
--- /dev/null
+++ b/listers/storage/v1beta1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
diff --git a/listers/storage/v1beta1/storageclass.go b/listers/storage/v1beta1/storageclass.go
index bbb257eed..1fcc00fd0 100644
--- a/listers/storage/v1beta1/storageclass.go
+++ b/listers/storage/v1beta1/storageclass.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	storagev1beta1listers "k8s.io/client-go/listers/storage/v1beta1"
+	listersstoragev1beta1 "k8s.io/client-go/listers/storage/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// StorageClassClusterLister can list StorageClasses across all workspaces, or scope down to a StorageClassLister for one workspace.
+// StorageClassClusterLister helps list StorageClasses across all workspaces,
+// or scope down to a StorageClassLister for one workspace.
 // All objects returned here must be treated as read-only.
 type StorageClassClusterLister interface {
 	// List lists all StorageClasses in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*storagev1beta1.StorageClass, err error)
 	// Cluster returns a lister that can list and get StorageClasses in one workspace.
-	Cluster(clusterName logicalcluster.Name) storagev1beta1listers.StorageClassLister
+	Cluster(clusterName logicalcluster.Name) listersstoragev1beta1.StorageClassLister
 	StorageClassClusterListerExpansion
 }
 
+// storageClassClusterLister implements the StorageClassClusterLister interface.
 type storageClassClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*storagev1beta1.StorageClass]
 }
 
+var _ StorageClassClusterLister = new(storageClassClusterLister)
+
 // NewStorageClassClusterLister returns a new StorageClassClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewStorageClassClusterLister(indexer cache.Indexer) *storageClassClusterLister {
-	return &storageClassClusterLister{indexer: indexer}
-}
-
-// List lists all StorageClasses in the indexer across all workspaces.
-func (s *storageClassClusterLister) List(selector labels.Selector) (ret []*storagev1beta1.StorageClass, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*storagev1beta1.StorageClass))
-	})
-	return ret, err
+func NewStorageClassClusterLister(indexer cache.Indexer) StorageClassClusterLister {
+	return &storageClassClusterLister{
+		kcplisters.NewCluster[*storagev1beta1.StorageClass](indexer, storagev1beta1.Resource("storageclass")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get StorageClasses.
-func (s *storageClassClusterLister) Cluster(clusterName logicalcluster.Name) storagev1beta1listers.StorageClassLister {
-	return &storageClassLister{indexer: s.indexer, clusterName: clusterName}
+func (l *storageClassClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1beta1.StorageClassLister {
+	return &storageClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// storageClassLister implements the storagev1beta1listers.StorageClassLister interface.
+// storageClassLister can list all StorageClasses inside a workspace
+// or scope down to a listersstoragev1beta1.StorageClassNamespaceLister for one namespace.
 type storageClassLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*storagev1beta1.StorageClass]
 }
 
-// List lists all StorageClasses in the indexer for a workspace.
-func (s *storageClassLister) List(selector labels.Selector) (ret []*storagev1beta1.StorageClass, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1beta1.StorageClass))
-	})
-	return ret, err
-}
+var _ listersstoragev1beta1.StorageClassLister = new(storageClassLister)
 
-// Get retrieves the StorageClass from the indexer for a given workspace and name.
-func (s *storageClassLister) Get(name string) (*storagev1beta1.StorageClass, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(storagev1beta1.Resource("storageclasses"), name)
+// NewStorageClassLister returns a new StorageClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewStorageClassLister(indexer cache.Indexer) listersstoragev1beta1.StorageClassLister {
+	return &storageClassLister{
+		kcplisters.New[*storagev1beta1.StorageClass](indexer, storagev1beta1.Resource("storageclass")),
 	}
-	return obj.(*storagev1beta1.StorageClass), nil
+}
+
+// storageClassScopedLister can list all StorageClasses inside a workspace
+// or scope down to a listersstoragev1beta1.StorageClassNamespaceLister.
+type storageClassScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1beta1.StorageClass]
 }
diff --git a/listers/storage/v1beta1/storageclass_expansion.go b/listers/storage/v1beta1/storageclass_expansion.go
index 9ab464b00..07e942a18 100644
--- a/listers/storage/v1beta1/storageclass_expansion.go
+++ b/listers/storage/v1beta1/storageclass_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1beta1/volumeattachment.go b/listers/storage/v1beta1/volumeattachment.go
index 6703e93ea..90561740b 100644
--- a/listers/storage/v1beta1/volumeattachment.go
+++ b/listers/storage/v1beta1/volumeattachment.go
@@ -1,8 +1,5 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
-Copyright The KCP Authors.
+Copyright 2025 The KCP Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -17,81 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// Code generated by kcp code-generator. DO NOT EDIT.
+// Code generated by cluster-lister-gen. DO NOT EDIT.
 
 package v1beta1
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	storagev1beta1 "k8s.io/api/storage/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/labels"
-	storagev1beta1listers "k8s.io/client-go/listers/storage/v1beta1"
+	listersstoragev1beta1 "k8s.io/client-go/listers/storage/v1beta1"
 	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
-// VolumeAttachmentClusterLister can list VolumeAttachments across all workspaces, or scope down to a VolumeAttachmentLister for one workspace.
+// VolumeAttachmentClusterLister helps list VolumeAttachments across all workspaces,
+// or scope down to a VolumeAttachmentLister for one workspace.
 // All objects returned here must be treated as read-only.
 type VolumeAttachmentClusterLister interface {
 	// List lists all VolumeAttachments in the indexer.
 	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*storagev1beta1.VolumeAttachment, err error)
 	// Cluster returns a lister that can list and get VolumeAttachments in one workspace.
-	Cluster(clusterName logicalcluster.Name) storagev1beta1listers.VolumeAttachmentLister
+	Cluster(clusterName logicalcluster.Name) listersstoragev1beta1.VolumeAttachmentLister
 	VolumeAttachmentClusterListerExpansion
 }
 
+// volumeAttachmentClusterLister implements the VolumeAttachmentClusterLister interface.
 type volumeAttachmentClusterLister struct {
-	indexer cache.Indexer
+	kcplisters.ResourceClusterIndexer[*storagev1beta1.VolumeAttachment]
 }
 
+var _ VolumeAttachmentClusterLister = new(volumeAttachmentClusterLister)
+
 // NewVolumeAttachmentClusterLister returns a new VolumeAttachmentClusterLister.
 // We assume that the indexer:
 // - is fed by a cross-workspace LIST+WATCH
 // - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
 // - has the kcpcache.ClusterIndex as an index
-func NewVolumeAttachmentClusterLister(indexer cache.Indexer) *volumeAttachmentClusterLister {
-	return &volumeAttachmentClusterLister{indexer: indexer}
-}
-
-// List lists all VolumeAttachments in the indexer across all workspaces.
-func (s *volumeAttachmentClusterLister) List(selector labels.Selector) (ret []*storagev1beta1.VolumeAttachment, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*storagev1beta1.VolumeAttachment))
-	})
-	return ret, err
+func NewVolumeAttachmentClusterLister(indexer cache.Indexer) VolumeAttachmentClusterLister {
+	return &volumeAttachmentClusterLister{
+		kcplisters.NewCluster[*storagev1beta1.VolumeAttachment](indexer, storagev1beta1.Resource("volumeattachment")),
+	}
 }
 
 // Cluster scopes the lister to one workspace, allowing users to list and get VolumeAttachments.
-func (s *volumeAttachmentClusterLister) Cluster(clusterName logicalcluster.Name) storagev1beta1listers.VolumeAttachmentLister {
-	return &volumeAttachmentLister{indexer: s.indexer, clusterName: clusterName}
+func (l *volumeAttachmentClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1beta1.VolumeAttachmentLister {
+	return &volumeAttachmentLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
 }
 
-// volumeAttachmentLister implements the storagev1beta1listers.VolumeAttachmentLister interface.
+// volumeAttachmentLister can list all VolumeAttachments inside a workspace
+// or scope down to a listersstoragev1beta1.VolumeAttachmentNamespaceLister for one namespace.
 type volumeAttachmentLister struct {
-	indexer     cache.Indexer
-	clusterName logicalcluster.Name
+	kcplisters.ResourceIndexer[*storagev1beta1.VolumeAttachment]
 }
 
-// List lists all VolumeAttachments in the indexer for a workspace.
-func (s *volumeAttachmentLister) List(selector labels.Selector) (ret []*storagev1beta1.VolumeAttachment, err error) {
-	err = kcpcache.ListAllByCluster(s.indexer, s.clusterName, selector, func(i interface{}) {
-		ret = append(ret, i.(*storagev1beta1.VolumeAttachment))
-	})
-	return ret, err
-}
+var _ listersstoragev1beta1.VolumeAttachmentLister = new(volumeAttachmentLister)
 
-// Get retrieves the VolumeAttachment from the indexer for a given workspace and name.
-func (s *volumeAttachmentLister) Get(name string) (*storagev1beta1.VolumeAttachment, error) {
-	key := kcpcache.ToClusterAwareKey(s.clusterName.String(), "", name)
-	obj, exists, err := s.indexer.GetByKey(key)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(storagev1beta1.Resource("volumeattachments"), name)
+// NewVolumeAttachmentLister returns a new VolumeAttachmentLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewVolumeAttachmentLister(indexer cache.Indexer) listersstoragev1beta1.VolumeAttachmentLister {
+	return &volumeAttachmentLister{
+		kcplisters.New[*storagev1beta1.VolumeAttachment](indexer, storagev1beta1.Resource("volumeattachment")),
 	}
-	return obj.(*storagev1beta1.VolumeAttachment), nil
+}
+
+// volumeAttachmentScopedLister can list all VolumeAttachments inside a workspace
+// or scope down to a listersstoragev1beta1.VolumeAttachmentNamespaceLister.
+type volumeAttachmentScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1beta1.VolumeAttachment]
 }
diff --git a/listers/storage/v1beta1/volumeattachment_expansion.go b/listers/storage/v1beta1/volumeattachment_expansion.go
index f0bac78ba..f4d8d8d8f 100644
--- a/listers/storage/v1beta1/volumeattachment_expansion.go
+++ b/listers/storage/v1beta1/volumeattachment_expansion.go
@@ -1,6 +1,3 @@
-//go:build !ignore_autogenerated
-// +build !ignore_autogenerated
-
 /*
 Copyright The KCP Authors.
 
diff --git a/listers/storage/v1beta1/volumeattributesclass.go b/listers/storage/v1beta1/volumeattributesclass.go
new file mode 100644
index 000000000..7740f213c
--- /dev/null
+++ b/listers/storage/v1beta1/volumeattributesclass.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	storagev1beta1 "k8s.io/api/storage/v1beta1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersstoragev1beta1 "k8s.io/client-go/listers/storage/v1beta1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// VolumeAttributesClassClusterLister helps list VolumeAttributesClasses across all workspaces,
+// or scope down to a VolumeAttributesClassLister for one workspace.
+// All objects returned here must be treated as read-only.
+type VolumeAttributesClassClusterLister interface {
+	// List lists all VolumeAttributesClasses in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*storagev1beta1.VolumeAttributesClass, err error)
+	// Cluster returns a lister that can list and get VolumeAttributesClasses in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersstoragev1beta1.VolumeAttributesClassLister
+	VolumeAttributesClassClusterListerExpansion
+}
+
+// volumeAttributesClassClusterLister implements the VolumeAttributesClassClusterLister interface.
+type volumeAttributesClassClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*storagev1beta1.VolumeAttributesClass]
+}
+
+var _ VolumeAttributesClassClusterLister = new(volumeAttributesClassClusterLister)
+
+// NewVolumeAttributesClassClusterLister returns a new VolumeAttributesClassClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewVolumeAttributesClassClusterLister(indexer cache.Indexer) VolumeAttributesClassClusterLister {
+	return &volumeAttributesClassClusterLister{
+		kcplisters.NewCluster[*storagev1beta1.VolumeAttributesClass](indexer, storagev1beta1.Resource("volumeattributesclass")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get VolumeAttributesClasses.
+func (l *volumeAttributesClassClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragev1beta1.VolumeAttributesClassLister {
+	return &volumeAttributesClassLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// volumeAttributesClassLister can list all VolumeAttributesClasses inside a workspace
+// or scope down to a listersstoragev1beta1.VolumeAttributesClassNamespaceLister for one namespace.
+type volumeAttributesClassLister struct {
+	kcplisters.ResourceIndexer[*storagev1beta1.VolumeAttributesClass]
+}
+
+var _ listersstoragev1beta1.VolumeAttributesClassLister = new(volumeAttributesClassLister)
+
+// NewVolumeAttributesClassLister returns a new VolumeAttributesClassLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewVolumeAttributesClassLister(indexer cache.Indexer) listersstoragev1beta1.VolumeAttributesClassLister {
+	return &volumeAttributesClassLister{
+		kcplisters.New[*storagev1beta1.VolumeAttributesClass](indexer, storagev1beta1.Resource("volumeattributesclass")),
+	}
+}
+
+// volumeAttributesClassScopedLister can list all VolumeAttributesClasses inside a workspace
+// or scope down to a listersstoragev1beta1.VolumeAttributesClassNamespaceLister.
+type volumeAttributesClassScopedLister struct {
+	kcplisters.ResourceIndexer[*storagev1beta1.VolumeAttributesClass]
+}
diff --git a/listers/storage/v1beta1/volumeattributesclass_expansion.go b/listers/storage/v1beta1/volumeattributesclass_expansion.go
new file mode 100644
index 000000000..31d9126f5
--- /dev/null
+++ b/listers/storage/v1beta1/volumeattributesclass_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1beta1
+
+// VolumeAttributesClassClusterListerExpansion allows custom methods to be added to VolumeAttributesClassClusterLister.
+type VolumeAttributesClassClusterListerExpansion interface{}
diff --git a/listers/storagemigration/v1alpha1/expansion_generated.go b/listers/storagemigration/v1alpha1/expansion_generated.go
new file mode 100644
index 000000000..3b8521c00
--- /dev/null
+++ b/listers/storagemigration/v1alpha1/expansion_generated.go
@@ -0,0 +1,19 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
diff --git a/listers/storagemigration/v1alpha1/storageversionmigration.go b/listers/storagemigration/v1alpha1/storageversionmigration.go
new file mode 100644
index 000000000..8bff1141d
--- /dev/null
+++ b/listers/storagemigration/v1alpha1/storageversionmigration.go
@@ -0,0 +1,91 @@
+/*
+Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by cluster-lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	storagemigrationv1alpha1 "k8s.io/api/storagemigration/v1alpha1"
+	"k8s.io/apimachinery/pkg/labels"
+	listersstoragemigrationv1alpha1 "k8s.io/client-go/listers/storagemigration/v1alpha1"
+	"k8s.io/client-go/tools/cache"
+
+	kcplisters "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/listers"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// StorageVersionMigrationClusterLister helps list StorageVersionMigrations across all workspaces,
+// or scope down to a StorageVersionMigrationLister for one workspace.
+// All objects returned here must be treated as read-only.
+type StorageVersionMigrationClusterLister interface {
+	// List lists all StorageVersionMigrations in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*storagemigrationv1alpha1.StorageVersionMigration, err error)
+	// Cluster returns a lister that can list and get StorageVersionMigrations in one workspace.
+	Cluster(clusterName logicalcluster.Name) listersstoragemigrationv1alpha1.StorageVersionMigrationLister
+	StorageVersionMigrationClusterListerExpansion
+}
+
+// storageVersionMigrationClusterLister implements the StorageVersionMigrationClusterLister interface.
+type storageVersionMigrationClusterLister struct {
+	kcplisters.ResourceClusterIndexer[*storagemigrationv1alpha1.StorageVersionMigration]
+}
+
+var _ StorageVersionMigrationClusterLister = new(storageVersionMigrationClusterLister)
+
+// NewStorageVersionMigrationClusterLister returns a new StorageVersionMigrationClusterLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewStorageVersionMigrationClusterLister(indexer cache.Indexer) StorageVersionMigrationClusterLister {
+	return &storageVersionMigrationClusterLister{
+		kcplisters.NewCluster[*storagemigrationv1alpha1.StorageVersionMigration](indexer, storagemigrationv1alpha1.Resource("storageversionmigration")),
+	}
+}
+
+// Cluster scopes the lister to one workspace, allowing users to list and get StorageVersionMigrations.
+func (l *storageVersionMigrationClusterLister) Cluster(clusterName logicalcluster.Name) listersstoragemigrationv1alpha1.StorageVersionMigrationLister {
+	return &storageVersionMigrationLister{
+		l.ResourceClusterIndexer.WithCluster(clusterName),
+	}
+}
+
+// storageVersionMigrationLister can list all StorageVersionMigrations inside a workspace
+// or scope down to a listersstoragemigrationv1alpha1.StorageVersionMigrationNamespaceLister for one namespace.
+type storageVersionMigrationLister struct {
+	kcplisters.ResourceIndexer[*storagemigrationv1alpha1.StorageVersionMigration]
+}
+
+var _ listersstoragemigrationv1alpha1.StorageVersionMigrationLister = new(storageVersionMigrationLister)
+
+// NewStorageVersionMigrationLister returns a new StorageVersionMigrationLister.
+// We assume that the indexer:
+// - is fed by a cross-workspace LIST+WATCH
+// - uses kcpcache.MetaClusterNamespaceKeyFunc as the key function
+// - has the kcpcache.ClusterIndex as an index
+func NewStorageVersionMigrationLister(indexer cache.Indexer) listersstoragemigrationv1alpha1.StorageVersionMigrationLister {
+	return &storageVersionMigrationLister{
+		kcplisters.New[*storagemigrationv1alpha1.StorageVersionMigration](indexer, storagemigrationv1alpha1.Resource("storageversionmigration")),
+	}
+}
+
+// storageVersionMigrationScopedLister can list all StorageVersionMigrations inside a workspace
+// or scope down to a listersstoragemigrationv1alpha1.StorageVersionMigrationNamespaceLister.
+type storageVersionMigrationScopedLister struct {
+	kcplisters.ResourceIndexer[*storagemigrationv1alpha1.StorageVersionMigration]
+}
diff --git a/listers/storagemigration/v1alpha1/storageversionmigration_expansion.go b/listers/storagemigration/v1alpha1/storageversionmigration_expansion.go
new file mode 100644
index 000000000..11468190f
--- /dev/null
+++ b/listers/storagemigration/v1alpha1/storageversionmigration_expansion.go
@@ -0,0 +1,22 @@
+/*
+Copyright The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by kcp code-generator. DO NOT EDIT.
+
+package v1alpha1
+
+// StorageVersionMigrationClusterListerExpansion allows custom methods to be added to StorageVersionMigrationClusterLister.
+type StorageVersionMigrationClusterListerExpansion interface{}
diff --git a/metadata/clientset.go b/metadata/clientset.go
index 0a1c56e63..d4724c129 100644
--- a/metadata/clientset.go
+++ b/metadata/clientset.go
@@ -21,15 +21,15 @@ import (
 	"fmt"
 	"net/http"
 
-	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/client-go/metadata"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/util/flowcontrol"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 var _ ClusterInterface = (*ClusterClientset)(nil)
diff --git a/metadata/interface.go b/metadata/interface.go
index 3f81515c8..c35c2f631 100644
--- a/metadata/interface.go
+++ b/metadata/interface.go
@@ -19,12 +19,12 @@ package metadata
 import (
 	"context"
 
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/client-go/metadata"
+
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 type ClusterInterface interface {
diff --git a/metadata/metadatainformer/informer.go b/metadata/metadatainformer/informer.go
index c685733c4..86551f971 100644
--- a/metadata/metadatainformer/informer.go
+++ b/metadata/metadatainformer/informer.go
@@ -21,10 +21,6 @@ import (
 	"sync"
 	"time"
 
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	thirdpartyinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -34,9 +30,12 @@ import (
 	"k8s.io/client-go/metadata/metadatainformer"
 	"k8s.io/client-go/tools/cache"
 
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	thirdpartyinformers "github.com/kcp-dev/apimachinery/v2/third_party/informers"
 	kcpinformers "github.com/kcp-dev/client-go/informers"
 	kcpmetadata "github.com/kcp-dev/client-go/metadata"
 	kcpmetadatalisters "github.com/kcp-dev/client-go/metadata/metadatalister"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // NewSharedInformerFactory constructs a new instance of sharedInformerFactory for all namespaces.
@@ -165,8 +164,12 @@ func (d *metadataClusterInformer) Lister() kcpcache.GenericClusterLister {
 }
 
 func (d *metadataClusterInformer) Cluster(clusterName logicalcluster.Name) upstreaminformers.GenericInformer {
+	return d.ClusterWithContext(context.Background(), clusterName)
+}
+
+func (d *metadataClusterInformer) ClusterWithContext(ctx context.Context, clusterName logicalcluster.Name) upstreaminformers.GenericInformer {
 	return &metadataInformer{
-		informer: d.Informer().Cluster(clusterName),
+		informer: d.Informer().ClusterWithContext(ctx, clusterName),
 		lister:   d.Lister().ByCluster(clusterName),
 	}
 }
diff --git a/metadata/metadatalister/interface.go b/metadata/metadatalister/interface.go
index 4d17f5bb7..f0f68fa33 100644
--- a/metadata/metadatalister/interface.go
+++ b/metadata/metadatalister/interface.go
@@ -17,11 +17,11 @@ limitations under the License.
 package metadatalister
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/client-go/metadata/metadatalister"
+
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // ClusterLister can list resources across all workspaces, or scope down to a Lister for one workspace.
diff --git a/metadata/metadatalister/lister.go b/metadata/metadatalister/lister.go
index 3d85aa975..532c6df4e 100644
--- a/metadata/metadatalister/lister.go
+++ b/metadata/metadatalister/lister.go
@@ -17,15 +17,15 @@ limitations under the License.
 package metadatalister
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/metadata/metadatalister"
 	"k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // New returns a new ClusterLister.
diff --git a/metadata/metadatalister/shim.go b/metadata/metadatalister/shim.go
index 2f980df71..faeafb1ec 100644
--- a/metadata/metadatalister/shim.go
+++ b/metadata/metadatalister/shim.go
@@ -17,13 +17,13 @@ limitations under the License.
 package metadatalister
 
 import (
-	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/metadata/metadatalister"
 	"k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // NewRuntimeObjectShim returns a new shim for ClusterLister.
diff --git a/scale/clientset.go b/scale/clientset.go
new file mode 100644
index 000000000..e1311b888
--- /dev/null
+++ b/scale/clientset.go
@@ -0,0 +1,118 @@
+/*
+Copyright 2022 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scale
+
+import (
+	"fmt"
+	"net/http"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/client-go/discovery"
+	"k8s.io/client-go/discovery/cached/memory"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/restmapper"
+	"k8s.io/client-go/scale"
+	"k8s.io/client-go/util/flowcontrol"
+
+	kcpclient "github.com/kcp-dev/apimachinery/v2/pkg/client"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+var (
+	scaleConverter = scale.NewScaleConverter()
+	codecs         = serializer.NewCodecFactory(scaleConverter.Scheme())
+)
+
+type ClusterClientset struct {
+	clientCache kcpclient.Cache[scale.ScalesGetter]
+}
+
+func (c ClusterClientset) Cluster(clusterPath logicalcluster.Path) scale.ScalesGetter {
+	return c.clientCache.ClusterOrDie(clusterPath)
+}
+
+var _ ClusterInterface = (*ClusterClientset)(nil)
+
+// NewForConfig creates a new ClusterClientset for the given config.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*ClusterClientset, error) {
+	configShallowCopy := *c
+
+	if configShallowCopy.UserAgent == "" {
+		configShallowCopy.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	// share the transport between all clients
+	httpClient, err := rest.HTTPClientFor(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+
+// NewForConfigAndClient creates a new ClusterClientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*ClusterClientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		if configShallowCopy.Burst <= 0 {
+			return nil, fmt.Errorf("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
+		}
+		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+
+	cache := kcpclient.NewCache(c, httpClient, &kcpclient.Constructor[scale.ScalesGetter]{
+		NewForConfigAndClient: func(cfg *rest.Config, client *http.Client) (scale.ScalesGetter, error) {
+			// so that the RESTClientFor doesn't complain
+			cfg.GroupVersion = &schema.GroupVersion{}
+			cfg.NegotiatedSerializer = codecs.WithoutConversion()
+			if len(cfg.UserAgent) == 0 {
+				cfg.UserAgent = rest.DefaultKubernetesUserAgent()
+			}
+			r, err := rest.RESTClientForConfigAndClient(cfg, httpClient)
+			if err != nil {
+				return nil, err
+			}
+			d, err := discovery.NewDiscoveryClientForConfigAndClient(cfg, httpClient)
+			if err != nil {
+				return nil, err
+			}
+			// TODO: Make the RESTMapper dynamic, or invalidate the cached one periodically
+			return scale.New(r, restmapper.NewDeferredDiscoveryRESTMapper(memory.NewMemCacheClient(d)), dynamic.LegacyAPIPathResolverFunc, scale.NewDiscoveryScaleKindResolver(d)), nil
+		},
+	})
+
+	return &ClusterClientset{clientCache: cache}, nil
+}
+
+// NewForConfigOrDie creates a new ClusterClientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *ClusterClientset {
+	cs, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return cs
+}
diff --git a/scale/interface.go b/scale/interface.go
new file mode 100644
index 000000000..69c3efead
--- /dev/null
+++ b/scale/interface.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2022 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scale
+
+import (
+	"k8s.io/client-go/scale"
+
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+type ClusterInterface interface {
+	Cluster(logicalcluster.Path) scale.ScalesGetter
+}
diff --git a/third_party/k8s.io/client-go/discovery/fake/discovery.go b/third_party/k8s.io/client-go/discovery/fake/discovery.go
index 09df9b46e..e27a71553 100644
--- a/third_party/k8s.io/client-go/discovery/fake/discovery.go
+++ b/third_party/k8s.io/client-go/discovery/fake/discovery.go
@@ -21,8 +21,7 @@ import (
 	"fmt"
 	"net/http"
 
-	openapi_v2 "github.com/google/gnostic/openapiv2"
-	"github.com/kcp-dev/logicalcluster/v3"
+	openapi_v2 "github.com/google/gnostic-models/openapiv2"
 
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -34,6 +33,7 @@ import (
 	restclient "k8s.io/client-go/rest"
 
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // FakeDiscovery implements discovery.DiscoveryInterface and sometimes calls kcptesting.Fake.Invoke with an action,
@@ -52,7 +52,9 @@ func (c *FakeDiscovery) ServerResourcesForGroupVersion(groupVersion string) (*me
 		Resource:    schema.GroupVersionResource{Resource: "resource"},
 		ClusterPath: c.ClusterPath,
 	}
-	c.Invokes(action, nil)
+	if _, err := c.Invokes(action, nil); err != nil {
+		return nil, err
+	}
 	for _, resourceList := range c.Resources[c.ClusterPath] {
 		if resourceList.GroupVersion == groupVersion {
 			return resourceList, nil
@@ -83,7 +85,9 @@ func (c *FakeDiscovery) ServerGroupsAndResources() ([]*metav1.APIGroup, []*metav
 		Resource:    schema.GroupVersionResource{Resource: "resource"},
 		ClusterPath: c.ClusterPath,
 	}
-	c.Invokes(action, nil)
+	if _, err = c.Invokes(action, nil); err != nil {
+		return nil, nil, err
+	}
 	return resultGroups, c.Resources[c.ClusterPath], nil
 }
 
@@ -107,7 +111,9 @@ func (c *FakeDiscovery) ServerGroups() (*metav1.APIGroupList, error) {
 		Resource:    schema.GroupVersionResource{Resource: "group"},
 		ClusterPath: c.ClusterPath,
 	}
-	c.Invokes(action, nil)
+	if _, err := c.Invokes(action, nil); err != nil {
+		return nil, err
+	}
 
 	groups := map[string]*metav1.APIGroup{}
 
@@ -149,7 +155,10 @@ func (c *FakeDiscovery) ServerVersion() (*version.Info, error) {
 	action.Verb = "get"
 	action.Resource = schema.GroupVersionResource{Resource: "version"}
 	action.ClusterPath = c.ClusterPath
-	c.Invokes(action, nil)
+	_, err := c.Invokes(action, nil)
+	if err != nil {
+		return nil, err
+	}
 
 	if c.FakedServerVersion != nil {
 		return c.FakedServerVersion, nil
diff --git a/third_party/k8s.io/client-go/dynamic/fake/simple.go b/third_party/k8s.io/client-go/dynamic/fake/simple.go
index 2bf613072..86ac8ff1f 100644
--- a/third_party/k8s.io/client-go/dynamic/fake/simple.go
+++ b/third_party/k8s.io/client-go/dynamic/fake/simple.go
@@ -22,8 +22,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -37,6 +35,7 @@ import (
 
 	kcpdynamic "github.com/kcp-dev/client-go/dynamic"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 func NewSimpleDynamicClient(scheme *runtime.Scheme, objects ...runtime.Object) *FakeDynamicClusterClientset {
@@ -551,19 +550,15 @@ func (c *dynamicResourceClient) Apply(ctx context.Context, name string, obj *uns
 	switch {
 	case len(c.namespace) == 0 && len(subresources) == 0:
 		uncastRet, err = c.client.Fake.
-			Invokes(kcptesting.NewRootPatchAction(c.resource, c.client.clusterPath, name, types.ApplyPatchType,
-				outBytes),
-				&metav1.Status{Status: "dynamic patch fail"})
+			Invokes(kcptesting.NewRootPatchAction(c.resource, c.client.clusterPath, name, types.ApplyPatchType, outBytes), &metav1.Status{Status: "dynamic patch fail"})
 
 	case len(c.namespace) == 0 && len(subresources) > 0:
 		uncastRet, err = c.client.Fake.
-			Invokes(kcptesting.NewRootPatchSubresourceAction(c.resource, c.client.clusterPath, name, types.ApplyPatchType, outBytes,
-				subresources...), &metav1.Status{Status: "dynamic patch fail"})
+			Invokes(kcptesting.NewRootPatchSubresourceAction(c.resource, c.client.clusterPath, name, types.ApplyPatchType, outBytes, subresources...), &metav1.Status{Status: "dynamic patch fail"})
 
 	case len(c.namespace) > 0 && len(subresources) == 0:
 		uncastRet, err = c.client.Fake.
-			Invokes(kcptesting.NewPatchAction(c.resource, c.client.clusterPath, c.namespace, name, types.ApplyPatchType, outBytes),
-				&metav1.Status{Status: "dynamic patch fail"})
+			Invokes(kcptesting.NewPatchAction(c.resource, c.client.clusterPath, c.namespace, name, types.ApplyPatchType, outBytes), &metav1.Status{Status: "dynamic patch fail"})
 
 	case len(c.namespace) > 0 && len(subresources) > 0:
 		uncastRet, err = c.client.Fake.
diff --git a/third_party/k8s.io/client-go/dynamic/scheme.go b/third_party/k8s.io/client-go/dynamic/scheme.go
index 980d3cb2c..c9b9fe22b 100644
--- a/third_party/k8s.io/client-go/dynamic/scheme.go
+++ b/third_party/k8s.io/client-go/dynamic/scheme.go
@@ -23,7 +23,9 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/runtime/serializer"
+	"k8s.io/apimachinery/pkg/runtime/serializer/cbor"
 	"k8s.io/apimachinery/pkg/runtime/serializer/json"
+	"k8s.io/client-go/features"
 )
 
 var watchScheme = runtime.NewScheme()
@@ -42,32 +44,50 @@ func init() {
 	metav1.AddToGroupVersion(deleteScheme, versionV1)
 }
 
-// basicNegotiatedSerializer is used to handle discovery and error handling serialization
-type basicNegotiatedSerializer struct{}
-
-func (s basicNegotiatedSerializer) SupportedMediaTypes() []runtime.SerializerInfo {
-	return []runtime.SerializerInfo{
+func newBasicNegotiatedSerializer() basicNegotiatedSerializer {
+	supportedMediaTypes := []runtime.SerializerInfo{
 		{
 			MediaType:        "application/json",
 			MediaTypeType:    "application",
 			MediaTypeSubType: "json",
 			EncodesAsText:    true,
-			Serializer:       json.NewSerializer(json.DefaultMetaFactory, unstructuredCreater{basicScheme}, unstructuredTyper{basicScheme}, false),
-			PrettySerializer: json.NewSerializer(json.DefaultMetaFactory, unstructuredCreater{basicScheme}, unstructuredTyper{basicScheme}, true),
+			Serializer:       json.NewSerializerWithOptions(json.DefaultMetaFactory, unstructuredCreater{basicScheme}, unstructuredTyper{basicScheme}, json.SerializerOptions{}),
+			PrettySerializer: json.NewSerializerWithOptions(json.DefaultMetaFactory, unstructuredCreater{basicScheme}, unstructuredTyper{basicScheme}, json.SerializerOptions{Pretty: true}),
 			StreamSerializer: &runtime.StreamSerializerInfo{
 				EncodesAsText: true,
-				Serializer:    json.NewSerializer(json.DefaultMetaFactory, basicScheme, basicScheme, false),
+				Serializer:    json.NewSerializerWithOptions(json.DefaultMetaFactory, basicScheme, basicScheme, json.SerializerOptions{}),
 				Framer:        json.Framer,
 			},
 		},
 	}
+	if features.FeatureGates().Enabled(features.ClientsAllowCBOR) {
+		supportedMediaTypes = append(supportedMediaTypes, runtime.SerializerInfo{
+			MediaType:        "application/cbor",
+			MediaTypeType:    "application",
+			MediaTypeSubType: "cbor",
+			Serializer:       cbor.NewSerializer(unstructuredCreater{basicScheme}, unstructuredTyper{basicScheme}),
+			StreamSerializer: &runtime.StreamSerializerInfo{
+				Serializer: cbor.NewSerializer(basicScheme, basicScheme, cbor.Transcode(false)),
+				Framer:     cbor.NewFramer(),
+			},
+		})
+	}
+	return basicNegotiatedSerializer{supportedMediaTypes: supportedMediaTypes}
+}
+
+type basicNegotiatedSerializer struct {
+	supportedMediaTypes []runtime.SerializerInfo
+}
+
+func (s basicNegotiatedSerializer) SupportedMediaTypes() []runtime.SerializerInfo {
+	return s.supportedMediaTypes
 }
 
 func (s basicNegotiatedSerializer) EncoderForVersion(encoder runtime.Encoder, gv runtime.GroupVersioner) runtime.Encoder {
 	return runtime.WithVersionEncoder{
 		Version:     gv,
 		Encoder:     encoder,
-		ObjectTyper: unstructuredTyper{basicScheme},
+		ObjectTyper: permissiveTyper{basicScheme},
 	}
 }
 
@@ -107,3 +127,25 @@ func (t unstructuredTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersio
 func (t unstructuredTyper) Recognizes(gvk schema.GroupVersionKind) bool {
 	return true
 }
+
+// The dynamic client has historically accepted Unstructured objects with missing or empty
+// apiVersion and/or kind as arguments to its write request methods. This typer will return the type
+// of a runtime.Unstructured with no error, even if the type is missing or empty.
+type permissiveTyper struct {
+	nested runtime.ObjectTyper
+}
+
+func (t permissiveTyper) ObjectKinds(obj runtime.Object) ([]schema.GroupVersionKind, bool, error) {
+	kinds, unversioned, err := t.nested.ObjectKinds(obj)
+	if err == nil {
+		return kinds, unversioned, nil
+	}
+	if _, ok := obj.(runtime.Unstructured); ok {
+		return []schema.GroupVersionKind{obj.GetObjectKind().GroupVersionKind()}, false, nil
+	}
+	return nil, false, err
+}
+
+func (t permissiveTyper) Recognizes(gvk schema.GroupVersionKind) bool {
+	return true
+}
diff --git a/third_party/k8s.io/client-go/dynamic/simple.go b/third_party/k8s.io/client-go/dynamic/simple.go
index 27f5e49e4..8330942b7 100644
--- a/third_party/k8s.io/client-go/dynamic/simple.go
+++ b/third_party/k8s.io/client-go/dynamic/simple.go
@@ -21,6 +21,7 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"time"
 
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -30,7 +31,12 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/watch"
 	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/features"
 	"k8s.io/client-go/rest"
+	"k8s.io/client-go/util/apply"
+	"k8s.io/client-go/util/consistencydetector"
+	"k8s.io/client-go/util/watchlist"
+	"k8s.io/klog/v2"
 )
 
 type DynamicClient struct {
@@ -43,9 +49,17 @@ var _ dynamic.Interface = &DynamicClient{}
 // appropriate dynamic client defaults set.
 func ConfigFor(inConfig *rest.Config) *rest.Config {
 	config := rest.CopyConfig(inConfig)
-	config.AcceptContentTypes = "application/json"
+
 	config.ContentType = "application/json"
-	config.NegotiatedSerializer = basicNegotiatedSerializer{} // this gets used for discovery and error handling types
+	config.AcceptContentTypes = "application/json"
+	if features.FeatureGates().Enabled(features.ClientsAllowCBOR) {
+		config.AcceptContentTypes = "application/json;q=0.9,application/cbor;q=1"
+		if features.FeatureGates().Enabled(features.ClientsPreferCBOR) {
+			config.ContentType = "application/cbor"
+		}
+	}
+
+	config.NegotiatedSerializer = newBasicNegotiatedSerializer()
 	if config.UserAgent == "" {
 		config.UserAgent = rest.DefaultKubernetesUserAgent()
 	}
@@ -84,11 +98,10 @@ func NewForConfig(inConfig *rest.Config) (dynamic.Interface, error) {
 // Note the http client provided takes precedence over the configured transport values.
 func NewForConfigAndClient(inConfig *rest.Config, h *http.Client) (dynamic.Interface, error) {
 	config := ConfigFor(inConfig)
-	// for serializing the options
-	config.GroupVersion = &schema.GroupVersion{}
+	config.GroupVersion = nil
 	config.APIPath = "/if-you-see-this-search-for-the-break"
 
-	restClient, err := rest.RESTClientForConfigAndClient(config, h)
+	restClient, err := rest.UnversionedRESTClientForConfigAndClient(config, h)
 	if err != nil {
 		return nil, err
 	}
@@ -112,10 +125,6 @@ func (c *dynamicResourceClient) Namespace(ns string) dynamic.ResourceInterface {
 }
 
 func (c *dynamicResourceClient) Create(ctx context.Context, obj *unstructured.Unstructured, opts metav1.CreateOptions, subresources ...string) (*unstructured.Unstructured, error) {
-	outBytes, err := runtime.Encode(unstructured.UnstructuredJSONScheme, obj)
-	if err != nil {
-		return nil, err
-	}
 	name := ""
 	if len(subresources) > 0 {
 		accessor, err := meta.Accessor(obj)
@@ -131,26 +140,17 @@ func (c *dynamicResourceClient) Create(ctx context.Context, obj *unstructured.Un
 		return nil, err
 	}
 
-	result := c.client.client.
+	var out unstructured.Unstructured
+	if err := c.client.client.
 		Post().
 		AbsPath(append(c.makeURLSegments(name), subresources...)...).
-		SetHeader("Content-Type", runtime.ContentTypeJSON).
-		Body(outBytes).
+		Body(obj).
 		SpecificallyVersionedParams(&opts, dynamicParameterCodec, versionV1).
-		Do(ctx)
-	if err := result.Error(); err != nil {
+		Do(ctx).Into(&out); err != nil {
 		return nil, err
 	}
 
-	retBytes, err := result.Raw()
-	if err != nil {
-		return nil, err
-	}
-	uncastObj, err := runtime.Decode(unstructured.UnstructuredJSONScheme, retBytes)
-	if err != nil {
-		return nil, err
-	}
-	return uncastObj.(*unstructured.Unstructured), nil
+	return &out, nil
 }
 
 func (c *dynamicResourceClient) Update(ctx context.Context, obj *unstructured.Unstructured, opts metav1.UpdateOptions, subresources ...string) (*unstructured.Unstructured, error) {
@@ -162,34 +162,21 @@ func (c *dynamicResourceClient) Update(ctx context.Context, obj *unstructured.Un
 	if len(name) == 0 {
 		return nil, fmt.Errorf("name is required")
 	}
-	outBytes, err := runtime.Encode(unstructured.UnstructuredJSONScheme, obj)
-	if err != nil {
-		return nil, err
-	}
 	if err := validateNamespaceWithOptionalName(c.namespace, name); err != nil {
 		return nil, err
 	}
 
-	result := c.client.client.
+	var out unstructured.Unstructured
+	if err := c.client.client.
 		Put().
 		AbsPath(append(c.makeURLSegments(name), subresources...)...).
-		SetHeader("Content-Type", runtime.ContentTypeJSON).
-		Body(outBytes).
+		Body(obj).
 		SpecificallyVersionedParams(&opts, dynamicParameterCodec, versionV1).
-		Do(ctx)
-	if err := result.Error(); err != nil {
+		Do(ctx).Into(&out); err != nil {
 		return nil, err
 	}
 
-	retBytes, err := result.Raw()
-	if err != nil {
-		return nil, err
-	}
-	uncastObj, err := runtime.Decode(unstructured.UnstructuredJSONScheme, retBytes)
-	if err != nil {
-		return nil, err
-	}
-	return uncastObj.(*unstructured.Unstructured), nil
+	return &out, nil
 }
 
 func (c *dynamicResourceClient) UpdateStatus(ctx context.Context, obj *unstructured.Unstructured, opts metav1.UpdateOptions) (*unstructured.Unstructured, error) {
@@ -204,31 +191,18 @@ func (c *dynamicResourceClient) UpdateStatus(ctx context.Context, obj *unstructu
 	if err := validateNamespaceWithOptionalName(c.namespace, name); err != nil {
 		return nil, err
 	}
-	outBytes, err := runtime.Encode(unstructured.UnstructuredJSONScheme, obj)
-	if err != nil {
-		return nil, err
-	}
 
-	result := c.client.client.
+	var out unstructured.Unstructured
+	if err := c.client.client.
 		Put().
 		AbsPath(append(c.makeURLSegments(name), "status")...).
-		SetHeader("Content-Type", runtime.ContentTypeJSON).
-		Body(outBytes).
+		Body(obj).
 		SpecificallyVersionedParams(&opts, dynamicParameterCodec, versionV1).
-		Do(ctx)
-	if err := result.Error(); err != nil {
+		Do(ctx).Into(&out); err != nil {
 		return nil, err
 	}
 
-	retBytes, err := result.Raw()
-	if err != nil {
-		return nil, err
-	}
-	uncastObj, err := runtime.Decode(unstructured.UnstructuredJSONScheme, retBytes)
-	if err != nil {
-		return nil, err
-	}
-	return uncastObj.(*unstructured.Unstructured), nil
+	return &out, nil
 }
 
 func (c *dynamicResourceClient) Delete(ctx context.Context, name string, opts metav1.DeleteOptions, subresources ...string) error {
@@ -243,6 +217,7 @@ func (c *dynamicResourceClient) RawDelete(ctx context.Context, name string, opts
 	if err := validateNamespaceWithOptionalName(c.namespace, name); err != nil {
 		return nil, -1, err
 	}
+
 	deleteOptionsByte, err := runtime.Encode(deleteOptionsCodec.LegacyCodec(schema.GroupVersion{Version: "v1"}), &opts)
 	if err != nil {
 		return nil, -1, err
@@ -252,14 +227,13 @@ func (c *dynamicResourceClient) RawDelete(ctx context.Context, name string, opts
 	result := c.client.client.
 		Delete().
 		AbsPath(append(c.makeURLSegments(name), subresources...)...).
-		SetHeader("Content-Type", runtime.ContentTypeJSON).
 		Body(deleteOptionsByte).
 		Do(ctx).
 		StatusCode(&statusCode)
-
 	if err := result.Error(); err != nil {
 		return nil, statusCode, err
 	}
+
 	data, readErr := result.Raw()
 	return data, statusCode, readErr
 }
@@ -273,6 +247,7 @@ func (c *dynamicResourceClient) RawDeleteCollection(ctx context.Context, opts me
 	if err := validateNamespaceWithOptionalName(c.namespace); err != nil {
 		return nil, -1, err
 	}
+
 	deleteOptionsByte, err := runtime.Encode(deleteOptionsCodec.LegacyCodec(schema.GroupVersion{Version: "v1"}), &opts)
 	if err != nil {
 		return nil, -1, err
@@ -282,7 +257,6 @@ func (c *dynamicResourceClient) RawDeleteCollection(ctx context.Context, opts me
 	result := c.client.client.
 		Delete().
 		AbsPath(c.makeURLSegments("")...).
-		SetHeader("Content-Type", runtime.ContentTypeJSON).
 		Body(deleteOptionsByte).
 		SpecificallyVersionedParams(&listOptions, dynamicParameterCodec, versionV1).
 		Do(ctx).
@@ -298,46 +272,72 @@ func (c *dynamicResourceClient) Get(ctx context.Context, name string, opts metav
 	if len(name) == 0 {
 		return nil, fmt.Errorf("name is required")
 	}
-	result := c.client.client.Get().AbsPath(append(c.makeURLSegments(name), subresources...)...).SpecificallyVersionedParams(&opts, dynamicParameterCodec, versionV1).Do(ctx)
-	if err := result.Error(); err != nil {
-		return nil, err
-	}
-	retBytes, err := result.Raw()
-	if err != nil {
+	if err := validateNamespaceWithOptionalName(c.namespace, name); err != nil {
 		return nil, err
 	}
-	uncastObj, err := runtime.Decode(unstructured.UnstructuredJSONScheme, retBytes)
-	if err != nil {
+	var out unstructured.Unstructured
+	if err := c.client.client.
+		Get().
+		AbsPath(append(c.makeURLSegments(name), subresources...)...).
+		SpecificallyVersionedParams(&opts, dynamicParameterCodec, versionV1).
+		Do(ctx).Into(&out); err != nil {
 		return nil, err
 	}
-	return uncastObj.(*unstructured.Unstructured), nil
+	return &out, nil
 }
 
 func (c *dynamicResourceClient) List(ctx context.Context, opts metav1.ListOptions) (*unstructured.UnstructuredList, error) {
-	if err := validateNamespaceWithOptionalName(c.namespace); err != nil {
-		return nil, err
+	if watchListOptions, hasWatchListOptionsPrepared, watchListOptionsErr := watchlist.PrepareWatchListOptionsFromListOptions(opts); watchListOptionsErr != nil {
+		klog.Warningf("Failed preparing watchlist options for %v, falling back to the standard LIST semantics, err = %v", c.resource, watchListOptionsErr)
+	} else if hasWatchListOptionsPrepared {
+		result, err := c.watchList(ctx, watchListOptions)
+		if err == nil {
+			consistencydetector.CheckWatchListFromCacheDataConsistencyIfRequested(ctx, fmt.Sprintf("watchlist request for %v", c.resource), c.list, opts, result)
+			return result, nil
+		}
+		klog.Warningf("The watchlist request for %v ended with an error, falling back to the standard LIST semantics, err = %v", c.resource, err)
 	}
-	result := c.client.client.Get().AbsPath(c.makeURLSegments("")...).SpecificallyVersionedParams(&opts, dynamicParameterCodec, versionV1).Do(ctx)
-	if err := result.Error(); err != nil {
-		return nil, err
+	result, err := c.list(ctx, opts)
+	if err == nil {
+		consistencydetector.CheckListFromCacheDataConsistencyIfRequested(ctx, fmt.Sprintf("list request for %v", c.resource), c.list, opts, result)
 	}
-	retBytes, err := result.Raw()
-	if err != nil {
+	return result, err
+}
+
+func (c *dynamicResourceClient) list(ctx context.Context, opts metav1.ListOptions) (*unstructured.UnstructuredList, error) {
+	if err := validateNamespaceWithOptionalName(c.namespace); err != nil {
 		return nil, err
 	}
-	uncastObj, err := runtime.Decode(unstructured.UnstructuredJSONScheme, retBytes)
-	if err != nil {
+	var out unstructured.UnstructuredList
+	if err := c.client.client.
+		Get().
+		AbsPath(c.makeURLSegments("")...).
+		SpecificallyVersionedParams(&opts, dynamicParameterCodec, versionV1).
+		Do(ctx).Into(&out); err != nil {
 		return nil, err
 	}
-	if list, ok := uncastObj.(*unstructured.UnstructuredList); ok {
-		return list, nil
-	}
+	return &out, nil
+}
 
-	list, err := uncastObj.(*unstructured.Unstructured).ToList()
-	if err != nil {
+// watchList establishes a watch stream with the server and returns an unstructured list.
+func (c *dynamicResourceClient) watchList(ctx context.Context, opts metav1.ListOptions) (*unstructured.UnstructuredList, error) {
+	if err := validateNamespaceWithOptionalName(c.namespace); err != nil {
 		return nil, err
 	}
-	return list, nil
+
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+
+	result := &unstructured.UnstructuredList{}
+	err := c.client.client.Get().AbsPath(c.makeURLSegments("")...).
+		SpecificallyVersionedParams(&opts, dynamicParameterCodec, versionV1).
+		Timeout(timeout).
+		WatchList(ctx).
+		Into(result)
+
+	return result, err
 }
 
 func (c *dynamicResourceClient) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
@@ -354,24 +354,19 @@ func (c *dynamicResourceClient) Patch(ctx context.Context, name string, pt types
 	if len(name) == 0 {
 		return nil, fmt.Errorf("name is required")
 	}
-	result := c.client.client.
+	if err := validateNamespaceWithOptionalName(c.namespace, name); err != nil {
+		return nil, err
+	}
+	var out unstructured.Unstructured
+	if err := c.client.client.
 		Patch(pt).
 		AbsPath(append(c.makeURLSegments(name), subresources...)...).
 		Body(data).
 		SpecificallyVersionedParams(&opts, dynamicParameterCodec, versionV1).
-		Do(ctx)
-	if err := result.Error(); err != nil {
-		return nil, err
-	}
-	retBytes, err := result.Raw()
-	if err != nil {
-		return nil, err
-	}
-	uncastObj, err := runtime.Decode(unstructured.UnstructuredJSONScheme, retBytes)
-	if err != nil {
+		Do(ctx).Into(&out); err != nil {
 		return nil, err
 	}
-	return uncastObj.(*unstructured.Unstructured), nil
+	return &out, nil
 }
 
 func (c *dynamicResourceClient) Apply(ctx context.Context, name string, obj *unstructured.Unstructured, opts metav1.ApplyOptions, subresources ...string) (*unstructured.Unstructured, error) {
@@ -381,10 +376,6 @@ func (c *dynamicResourceClient) Apply(ctx context.Context, name string, obj *uns
 	if err := validateNamespaceWithOptionalName(c.namespace, name); err != nil {
 		return nil, err
 	}
-	outBytes, err := runtime.Encode(unstructured.UnstructuredJSONScheme, obj)
-	if err != nil {
-		return nil, err
-	}
 	accessor, err := meta.Accessor(obj)
 	if err != nil {
 		return nil, err
@@ -392,29 +383,25 @@ func (c *dynamicResourceClient) Apply(ctx context.Context, name string, obj *uns
 	managedFields := accessor.GetManagedFields()
 	if len(managedFields) > 0 {
 		return nil, fmt.Errorf(`cannot apply an object with managed fields already set.
-               Use the client-go/applyconfigurations "UnstructructuredExtractor" to obtain the unstructured ApplyConfiguration for the given field manager that you can use/modify here to apply`)
+		Use the client-go/applyconfigurations "UnstructructuredExtractor" to obtain the unstructured ApplyConfiguration for the given field manager that you can use/modify here to apply`)
 	}
 	patchOpts := opts.ToPatchOptions()
 
-	result := c.client.client.
-		Patch(types.ApplyPatchType).
-		AbsPath(append(c.makeURLSegments(name), subresources...)...).
-		Body(outBytes).
-		SpecificallyVersionedParams(&patchOpts, dynamicParameterCodec, versionV1).
-		Do(ctx)
-	if err := result.Error(); err != nil {
-		return nil, err
-	}
-	retBytes, err := result.Raw()
+	request, err := apply.NewRequest(c.client.client, obj.Object)
 	if err != nil {
 		return nil, err
 	}
-	uncastObj, err := runtime.Decode(unstructured.UnstructuredJSONScheme, retBytes)
-	if err != nil {
+
+	var out unstructured.Unstructured
+	if err := request.
+		AbsPath(append(c.makeURLSegments(name), subresources...)...).
+		SpecificallyVersionedParams(&patchOpts, dynamicParameterCodec, versionV1).
+		Do(ctx).Into(&out); err != nil {
 		return nil, err
 	}
-	return uncastObj.(*unstructured.Unstructured), nil
+	return &out, nil
 }
+
 func (c *dynamicResourceClient) ApplyStatus(ctx context.Context, name string, obj *unstructured.Unstructured, opts metav1.ApplyOptions) (*unstructured.Unstructured, error) {
 	return c.Apply(ctx, name, obj, opts, "status")
 }
diff --git a/third_party/k8s.io/client-go/gentype/fake_cluster.go b/third_party/k8s.io/client-go/gentype/fake_cluster.go
new file mode 100644
index 000000000..7d8c0b979
--- /dev/null
+++ b/third_party/k8s.io/client-go/gentype/fake_cluster.go
@@ -0,0 +1,120 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gentype
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	watch "k8s.io/apimachinery/pkg/watch"
+
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// FakeClusterClient represents a fake cluster client
+type FakeClusterClient[T objectWithMeta] struct {
+	*kcptesting.Fake
+	resource  schema.GroupVersionResource
+	kind      schema.GroupVersionKind
+	newObject func() T
+}
+
+// FakeClusterClientWithList represents a fake cluster client with support for lists.
+type FakeClusterClientWithList[T objectWithMeta, L runtime.Object] struct {
+	*FakeClusterClient[T]
+	alsoFakeClusterLister[T, L]
+}
+
+// Helper types for composition
+type alsoFakeClusterLister[T objectWithMeta, L runtime.Object] struct {
+	client       *FakeClusterClient[T]
+	newList      func() L
+	copyListMeta func(L, L)
+	getItems     func(L) []T
+	setItems     func(L, []T)
+}
+
+// NewFakeClient constructs a fake client, namespaced or not, with no support for lists or apply.
+// Non-namespaced clients are constructed by passing an empty namespace ("").
+func NewFakeClusterClient[T objectWithMeta](
+	fake *kcptesting.Fake, resource schema.GroupVersionResource, kind schema.GroupVersionKind, emptyObjectCreator func() T,
+) *FakeClusterClient[T] {
+	return &FakeClusterClient[T]{fake, resource, kind, emptyObjectCreator}
+}
+
+// NewFakeClusterClientWithList constructs a namespaced client with support for lists.
+func NewFakeClusterClientWithList[T objectWithMeta, L runtime.Object](
+	fake *kcptesting.Fake, resource schema.GroupVersionResource, kind schema.GroupVersionKind, emptyObjectCreator func() T,
+	emptyListCreator func() L, listMetaCopier func(L, L), itemGetter func(L) []T, itemSetter func(L, []T),
+) *FakeClusterClientWithList[T, L] {
+	fakeClusterClient := NewFakeClusterClient[T](fake, resource, kind, emptyObjectCreator)
+	return &FakeClusterClientWithList[T, L]{
+		fakeClusterClient,
+		alsoFakeClusterLister[T, L]{fakeClusterClient, emptyListCreator, listMetaCopier, itemGetter, itemSetter},
+	}
+}
+
+// List takes label and field selectors, and returns the list of resources that match those selectors.
+func (l *alsoFakeClusterLister[T, L]) List(ctx context.Context, opts metav1.ListOptions) (result L, err error) {
+	emptyResult := l.newList()
+	obj, err := l.client.Fake.
+		Invokes(kcptesting.NewListAction(l.client.resource, l.client.kind, logicalcluster.Wildcard, metav1.NamespaceAll, opts), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+
+	label, _, _ := kcptesting.ExtractFromListOptions(opts)
+	if label == nil {
+		// Everything matches
+		return obj.(L), nil
+	}
+	list := l.newList()
+	l.copyListMeta(list, obj.(L))
+	var items []T
+	for _, item := range l.getItems(obj.(L)) {
+		itemMeta, err := meta.Accessor(item)
+		if err != nil {
+			// No ObjectMeta, nothing can match
+			continue
+		}
+		if label.Matches(labels.Set(itemMeta.GetLabels())) {
+			items = append(items, item)
+		}
+	}
+	l.setItems(list, items)
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested resources.
+func (c *FakeClusterClient[T]) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.Fake.
+		InvokesWatch(kcptesting.NewWatchAction(c.resource, logicalcluster.Wildcard, metav1.NamespaceAll, opts))
+}
+
+func (c *FakeClusterClient[T]) Kind() schema.GroupVersionKind {
+	return c.kind
+}
+
+func (c *FakeClusterClient[T]) Resource() schema.GroupVersionResource {
+	return c.resource
+}
diff --git a/third_party/k8s.io/client-go/gentype/fake_single.go b/third_party/k8s.io/client-go/gentype/fake_single.go
new file mode 100644
index 000000000..0c3dafbda
--- /dev/null
+++ b/third_party/k8s.io/client-go/gentype/fake_single.go
@@ -0,0 +1,304 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gentype
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+
+	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// FakeClient represents a fake client
+type FakeClient[T objectWithMeta] struct {
+	*kcptesting.Fake
+	cluster   logicalcluster.Path
+	ns        string
+	resource  schema.GroupVersionResource
+	kind      schema.GroupVersionKind
+	newObject func() T
+}
+
+// FakeClientWithList represents a fake client with support for lists.
+type FakeClientWithList[T objectWithMeta, L runtime.Object] struct {
+	*FakeClient[T]
+	alsoFakeLister[T, L]
+}
+
+// FakeClientWithApply represents a fake client with support for apply declarative configurations.
+type FakeClientWithApply[T objectWithMeta, C namedObject] struct {
+	*FakeClient[T]
+	alsoFakeApplier[T, C]
+}
+
+// FakeClientWithListAndApply represents a fake client with support for lists and apply declarative configurations.
+type FakeClientWithListAndApply[T objectWithMeta, L runtime.Object, C namedObject] struct {
+	*FakeClient[T]
+	alsoFakeLister[T, L]
+	alsoFakeApplier[T, C]
+}
+
+// Helper types for composition
+type alsoFakeLister[T objectWithMeta, L runtime.Object] struct {
+	client       *FakeClient[T]
+	newList      func() L
+	copyListMeta func(L, L)
+	getItems     func(L) []T
+	setItems     func(L, []T)
+}
+
+type alsoFakeApplier[T objectWithMeta, C namedObject] struct {
+	client *FakeClient[T]
+}
+
+// NewFakeClient constructs a fake client, namespaced or not, with no support for lists or apply.
+// Non-namespaced clients are constructed by passing an empty namespace ("").
+func NewFakeClient[T objectWithMeta](
+	fake *kcptesting.Fake, cluster logicalcluster.Path, namespace string, resource schema.GroupVersionResource, kind schema.GroupVersionKind, emptyObjectCreator func() T,
+) *FakeClient[T] {
+	return &FakeClient[T]{fake, cluster, namespace, resource, kind, emptyObjectCreator}
+}
+
+// NewFakeClientWithList constructs a namespaced client with support for lists.
+func NewFakeClientWithList[T objectWithMeta, L runtime.Object](
+	fake *kcptesting.Fake, cluster logicalcluster.Path, namespace string, resource schema.GroupVersionResource, kind schema.GroupVersionKind, emptyObjectCreator func() T,
+	emptyListCreator func() L, listMetaCopier func(L, L), itemGetter func(L) []T, itemSetter func(L, []T),
+) *FakeClientWithList[T, L] {
+	fakeClient := NewFakeClient[T](fake, cluster, namespace, resource, kind, emptyObjectCreator)
+	return &FakeClientWithList[T, L]{
+		fakeClient,
+		alsoFakeLister[T, L]{fakeClient, emptyListCreator, listMetaCopier, itemGetter, itemSetter},
+	}
+}
+
+// NewFakeClientWithApply constructs a namespaced client with support for apply declarative configurations.
+func NewFakeClientWithApply[T objectWithMeta, C namedObject](
+	fake *kcptesting.Fake, cluster logicalcluster.Path, namespace string, resource schema.GroupVersionResource, kind schema.GroupVersionKind, emptyObjectCreator func() T,
+) *FakeClientWithApply[T, C] {
+	fakeClient := NewFakeClient[T](fake, cluster, namespace, resource, kind, emptyObjectCreator)
+	return &FakeClientWithApply[T, C]{
+		fakeClient,
+		alsoFakeApplier[T, C]{fakeClient},
+	}
+}
+
+// NewFakeClientWithListAndApply constructs a client with support for lists and applying declarative configurations.
+func NewFakeClientWithListAndApply[T objectWithMeta, L runtime.Object, C namedObject](
+	fake *kcptesting.Fake, cluster logicalcluster.Path, namespace string, resource schema.GroupVersionResource, kind schema.GroupVersionKind, emptyObjectCreator func() T,
+	emptyListCreator func() L, listMetaCopier func(L, L), itemGetter func(L) []T, itemSetter func(L, []T),
+) *FakeClientWithListAndApply[T, L, C] {
+	fakeClient := NewFakeClient[T](fake, cluster, namespace, resource, kind, emptyObjectCreator)
+	return &FakeClientWithListAndApply[T, L, C]{
+		fakeClient,
+		alsoFakeLister[T, L]{fakeClient, emptyListCreator, listMetaCopier, itemGetter, itemSetter},
+		alsoFakeApplier[T, C]{fakeClient},
+	}
+}
+
+// Get takes name of a resource, and returns the corresponding object, and an error if there is any.
+func (c *FakeClient[T]) Get(ctx context.Context, name string, _ metav1.GetOptions) (T, error) {
+	emptyResult := c.newObject()
+
+	obj, err := c.Fake.Invokes(kcptesting.NewGetAction(c.resource, c.cluster, c.ns, name), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(T), err
+}
+
+func ToPointerSlice[T any](src []T) []*T {
+	if src == nil {
+		return nil
+	}
+	result := make([]*T, len(src))
+	for i := range src {
+		result[i] = &src[i]
+	}
+	return result
+}
+
+func FromPointerSlice[T any](src []*T) []T {
+	if src == nil {
+		return nil
+	}
+	result := make([]T, len(src))
+	for i := range src {
+		result[i] = *src[i]
+	}
+	return result
+}
+
+// List takes label and field selectors, and returns the list of resources that match those selectors.
+func (l *alsoFakeLister[T, L]) List(ctx context.Context, opts metav1.ListOptions) (result L, err error) {
+	emptyResult := l.newList()
+	obj, err := l.client.Fake.
+		Invokes(kcptesting.NewListAction(l.client.resource, l.client.kind, l.client.cluster, l.client.ns, opts), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+
+	label, _, _ := kcptesting.ExtractFromListOptions(opts)
+	if label == nil {
+		// Everything matches
+		return obj.(L), nil
+	}
+	list := l.newList()
+	l.copyListMeta(list, obj.(L))
+	var items []T
+	for _, item := range l.getItems(obj.(L)) {
+		itemMeta, err := meta.Accessor(item)
+		if err != nil {
+			// No ObjectMeta, nothing can match
+			continue
+		}
+		if label.Matches(labels.Set(itemMeta.GetLabels())) {
+			items = append(items, item)
+		}
+	}
+	l.setItems(list, items)
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested resources.
+func (c *FakeClient[T]) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
+	opts.Watch = true
+	return c.Fake.InvokesWatch(kcptesting.NewWatchAction(c.resource, c.cluster, c.ns, opts))
+}
+
+// Create takes the representation of a resource and creates it.  Returns the server's representation of the resource, and an error, if there is any.
+func (c *FakeClient[T]) Create(ctx context.Context, resource T, _ metav1.CreateOptions) (result T, err error) {
+	emptyResult := c.newObject()
+	obj, err := c.Fake.Invokes(kcptesting.NewCreateAction(c.resource, c.cluster, c.ns, resource), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(T), err
+}
+
+// Update takes the representation of a resource and updates it. Returns the server's representation of the resource, and an error, if there is any.
+func (c *FakeClient[T]) Update(ctx context.Context, resource T, _ metav1.UpdateOptions) (result T, err error) {
+	emptyResult := c.newObject()
+	obj, err := c.Fake.Invokes(kcptesting.NewUpdateAction(c.resource, c.cluster, c.ns, resource), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(T), err
+}
+
+// UpdateStatus updates the resource's status and returns the updated resource.
+func (c *FakeClient[T]) UpdateStatus(ctx context.Context, resource T, _ metav1.UpdateOptions) (result T, err error) {
+	emptyResult := c.newObject()
+	obj, err := c.Fake.
+		Invokes(kcptesting.NewUpdateSubresourceAction(c.resource, c.cluster, "status", c.ns, resource), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(T), err
+}
+
+// Delete deletes the resource matching the given name. Returns an error if one occurs.
+func (c *FakeClient[T]) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(kcptesting.NewDeleteActionWithOptions(c.resource, c.cluster, c.ns, name, opts), c.newObject())
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (l *alsoFakeLister[T, L]) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, _ metav1.ListOptions) error {
+	_, err := l.client.Fake.
+		Invokes(kcptesting.NewDeleteCollectionAction(l.client.resource, l.client.cluster, l.client.ns, opts), l.newList())
+	return err
+}
+
+// Patch applies the patch and returns the patched resource.
+func (c *FakeClient[T]) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, _ metav1.PatchOptions, subresources ...string) (result T, err error) {
+	emptyResult := c.newObject()
+	obj, err := c.Fake.
+		Invokes(kcptesting.NewPatchSubresourceAction(c.resource, c.cluster, c.ns, name, pt, data, subresources...), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(T), err
+}
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied resource.
+func (a *alsoFakeApplier[T, C]) Apply(ctx context.Context, configuration C, _ metav1.ApplyOptions) (result T, err error) {
+	if configuration == *new(C) {
+		return *new(T), fmt.Errorf("configuration provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(configuration)
+	if err != nil {
+		return *new(T), err
+	}
+	name := configuration.GetName()
+	if name == nil {
+		return *new(T), fmt.Errorf("configuration.Name must be provided to Apply")
+	}
+	emptyResult := a.client.newObject()
+	obj, err := a.client.Fake.
+		Invokes(kcptesting.NewPatchSubresourceAction(a.client.resource, a.client.cluster, a.client.ns, *name, types.ApplyPatchType, data), emptyResult)
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(T), err
+}
+
+// ApplyStatus applies the given apply declarative configuration to the resource's status and returns the updated resource.
+func (a *alsoFakeApplier[T, C]) ApplyStatus(ctx context.Context, configuration C, _ metav1.ApplyOptions) (result T, err error) {
+	if configuration == *new(C) {
+		return *new(T), fmt.Errorf("configuration provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(configuration)
+	if err != nil {
+		return *new(T), err
+	}
+	name := configuration.GetName()
+	if name == nil {
+		return *new(T), fmt.Errorf("configuration.Name must be provided to Apply")
+	}
+	emptyResult := a.client.newObject()
+	obj, err := a.client.Fake.
+		Invokes(kcptesting.NewPatchSubresourceAction(a.client.resource, a.client.cluster, a.client.ns, *name, types.ApplyPatchType, data, "status"), emptyResult)
+
+	if obj == nil {
+		return emptyResult, err
+	}
+	return obj.(T), err
+}
+
+func (c *FakeClient[T]) Namespace() string {
+	return c.ns
+}
+
+func (c *FakeClient[T]) Kind() schema.GroupVersionKind {
+	return c.kind
+}
+
+func (c *FakeClient[T]) Resource() schema.GroupVersionResource {
+	return c.resource
+}
diff --git a/third_party/k8s.io/client-go/gentype/type.go b/third_party/k8s.io/client-go/gentype/type.go
new file mode 100644
index 000000000..1a2400291
--- /dev/null
+++ b/third_party/k8s.io/client-go/gentype/type.go
@@ -0,0 +1,34 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package gentype
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// objectWithMeta matches objects implementing both runtime.Object and metav1.Object.
+type objectWithMeta interface {
+	runtime.Object
+	metav1.Object
+}
+
+// namedObject matches comparable objects implementing GetName(); it is intended for use with apply declarative configurations.
+type namedObject interface {
+	comparable
+	GetName() *string
+}
diff --git a/third_party/k8s.io/client-go/listers/generic_helpers.go b/third_party/k8s.io/client-go/listers/generic_helpers.go
new file mode 100644
index 000000000..139695c83
--- /dev/null
+++ b/third_party/k8s.io/client-go/listers/generic_helpers.go
@@ -0,0 +1,122 @@
+/*
+Copyright 2023 The Kubernetes Authors.
+Modifications Copyright 2025 The KCP Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package listers
+
+import (
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/tools/cache"
+
+	kcpcache "github.com/kcp-dev/apimachinery/v2/pkg/cache"
+	"github.com/kcp-dev/logicalcluster/v3"
+)
+
+// ResourceIndexer wraps an indexer, resource, and optional namespace for a given type.
+// This is intended for use by listers (generated by lister-gen) only.
+type ResourceClusterIndexer[T runtime.Object] struct {
+	indexer  cache.Indexer
+	resource schema.GroupResource
+}
+
+// NewCluster returns a new instance of a lister (resource indexer) wrapping the given indexer
+// and resource for the specified type.
+// This is intended for use by listers (generated by lister-gen) only.
+func NewCluster[T runtime.Object](indexer cache.Indexer, resource schema.GroupResource) ResourceClusterIndexer[T] {
+	return ResourceClusterIndexer[T]{indexer: indexer, resource: resource}
+}
+
+// List lists all resources in the indexer matching the given selector.
+func (l ResourceClusterIndexer[T]) List(selector labels.Selector) (ret []T, err error) {
+	err = cache.ListAll(l.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(T))
+	})
+	return ret, err
+}
+
+// WithCluster returns a ResourceIndexer with the specified cluster.
+func (l ResourceClusterIndexer[T]) WithCluster(cluster logicalcluster.Name) ResourceIndexer[T] {
+	ret := New[T](l.indexer, l.resource)
+	ret.cluster = cluster
+	return ret
+}
+
+// ResourceIndexer wraps an indexer, resource, and optional namespace for a given type.
+// This is intended for use by listers (generated by lister-gen) only.
+type ResourceIndexer[T runtime.Object] struct {
+	indexer   cache.Indexer
+	cluster   logicalcluster.Name
+	resource  schema.GroupResource
+	namespace string // empty for non-namespaced types
+}
+
+// New returns a new instance of a lister (resource indexer) wrapping the given indexer and resource for the specified type.
+// This is intended for use by listers (generated by lister-gen) only.
+func New[T runtime.Object](indexer cache.Indexer, resource schema.GroupResource) ResourceIndexer[T] {
+	return ResourceIndexer[T]{indexer: indexer, resource: resource}
+}
+
+// WithCluster returns a new copy of the ResourceIndexer with the
+// specified cluster.
+func (l ResourceIndexer[T]) WithCluster(cluster logicalcluster.Name) ResourceIndexer[T] {
+	return ResourceIndexer[T]{
+		indexer:   l.indexer,
+		cluster:   cluster,
+		resource:  l.resource,
+		namespace: l.namespace,
+	}
+}
+
+// WithNamespace returns a new copy of the ResourceIndexer with the
+// specified namespace.
+func (l ResourceIndexer[T]) WithNamespace(namespace string) ResourceIndexer[T] {
+	return ResourceIndexer[T]{
+		indexer:   l.indexer,
+		cluster:   l.cluster,
+		resource:  l.resource,
+		namespace: namespace,
+	}
+}
+
+// NewNamespaced returns a new instance of a namespaced lister (resource indexer) wrapping the given parent and namespace for the specified type.
+// This is intended for use by listers (generated by lister-gen) only.
+func NewNamespaced[T runtime.Object](parent ResourceIndexer[T], namespace string) ResourceIndexer[T] {
+	return ResourceIndexer[T]{indexer: parent.indexer, resource: parent.resource, namespace: namespace}
+}
+
+// List lists all resources in the indexer matching the given selector.
+func (l ResourceIndexer[T]) List(selector labels.Selector) (ret []T, err error) {
+	err = kcpcache.ListAllByClusterAndNamespace(l.indexer, l.cluster, l.namespace, selector, func(i interface{}) {
+		ret = append(ret, i.(T))
+	})
+	return ret, err
+}
+
+// Get retrieves the resource from the index for a given name.
+func (l ResourceIndexer[T]) Get(name string) (T, error) {
+	key := kcpcache.ToClusterAwareKey(l.cluster.String(), l.namespace, name)
+	obj, exists, err := l.indexer.GetByKey(key)
+	if err != nil {
+		return *new(T), err
+	}
+	if !exists {
+		return *new(T), errors.NewNotFound(l.resource, name)
+	}
+	return obj.(T), nil
+}
diff --git a/third_party/k8s.io/client-go/metadata/fake/simple.go b/third_party/k8s.io/client-go/metadata/fake/simple.go
index a2521df67..9c2790f1b 100644
--- a/third_party/k8s.io/client-go/metadata/fake/simple.go
+++ b/third_party/k8s.io/client-go/metadata/fake/simple.go
@@ -22,8 +22,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
@@ -36,6 +34,7 @@ import (
 
 	kcpmetadata "github.com/kcp-dev/client-go/metadata"
 	kcptesting "github.com/kcp-dev/client-go/third_party/k8s.io/client-go/testing"
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // MetadataClient assists in creating fake objects for use when testing, since metadata.Getter
diff --git a/third_party/k8s.io/client-go/testing/actions.go b/third_party/k8s.io/client-go/testing/actions.go
index 31d2785e0..98b181653 100644
--- a/third_party/k8s.io/client-go/testing/actions.go
+++ b/third_party/k8s.io/client-go/testing/actions.go
@@ -22,38 +22,56 @@ import (
 	"path"
 	"strings"
 
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
+// All NewRoot... functions return non-namespaced actions, and are equivalent to
+// calling the corresponding New... function with an empty namespace.
+// This is assumed by the fake client generator.
+
 func NewRootGetAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, name string) GetActionImpl {
+	return NewRootGetActionWithOptions(resource, clusterPath, name, metav1.GetOptions{})
+}
+
+func NewRootGetActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, name string, opts metav1.GetOptions) GetActionImpl {
 	action := GetActionImpl{}
 	action.Verb = "get"
 	action.Resource = resource
 	action.Name = name
 	action.ClusterPath = clusterPath
+	action.GetOptions = opts
 
 	return action
 }
 
 func NewGetAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace, name string) GetActionImpl {
+	return NewGetActionWithOptions(resource, clusterPath, namespace, name, metav1.GetOptions{})
+}
+
+func NewGetActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace, name string, opts metav1.GetOptions) GetActionImpl {
 	action := GetActionImpl{}
 	action.Verb = "get"
 	action.Resource = resource
 	action.Namespace = namespace
 	action.Name = name
 	action.ClusterPath = clusterPath
+	action.GetOptions = opts
 
 	return action
 }
 
 func NewGetSubresourceAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace, subresource, name string) GetActionImpl {
+	return NewGetSubresourceActionWithOptions(resource, clusterPath, namespace, subresource, name, metav1.GetOptions{})
+}
+
+func NewGetSubresourceActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace, subresource, name string, opts metav1.GetOptions) GetActionImpl {
 	action := GetActionImpl{}
 	action.Verb = "get"
 	action.Resource = resource
@@ -61,17 +79,23 @@ func NewGetSubresourceAction(resource schema.GroupVersionResource, clusterPath l
 	action.Namespace = namespace
 	action.Name = name
 	action.ClusterPath = clusterPath
+	action.GetOptions = opts
 
 	return action
 }
 
 func NewRootGetSubresourceAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, subresource, name string) GetActionImpl {
+	return NewRootGetSubresourceActionWithOptions(resource, clusterPath, subresource, name, metav1.GetOptions{})
+}
+
+func NewRootGetSubresourceActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, subresource, name string, opts metav1.GetOptions) GetActionImpl {
 	action := GetActionImpl{}
 	action.Verb = "get"
 	action.Resource = resource
 	action.Subresource = subresource
 	action.Name = name
 	action.ClusterPath = clusterPath
+	action.GetOptions = opts
 
 	return action
 }
@@ -84,6 +108,22 @@ func NewRootListAction(resource schema.GroupVersionResource, kind schema.GroupVe
 	action.Kind = kind
 	labelSelector, fieldSelector, _ := ExtractFromListOptions(opts)
 	action.ListRestrictions = ListRestrictions{labelSelector, fieldSelector}
+	action.ListOptions = metav1.ListOptions{LabelSelector: labelSelector.String(), FieldSelector: fieldSelector.String()}
+
+	return action
+}
+
+func NewRootListActionWithOptions(resource schema.GroupVersionResource, kind schema.GroupVersionKind, clusterPath logicalcluster.Path, opts metav1.ListOptions) ListActionImpl {
+	action := ListActionImpl{}
+	action.Verb = "list"
+	action.Resource = resource
+	action.ClusterPath = clusterPath
+	action.Kind = kind
+	action.ListOptions = opts
+
+	labelSelector, fieldSelector, _ := ExtractFromListOptions(opts)
+	action.ListRestrictions = ListRestrictions{labelSelector, fieldSelector}
+	action.ListOptions = metav1.ListOptions{LabelSelector: labelSelector.String(), FieldSelector: fieldSelector.String()}
 
 	return action
 }
@@ -95,6 +135,22 @@ func NewListAction(resource schema.GroupVersionResource, kind schema.GroupVersio
 	action.ClusterPath = clusterPath
 	action.Kind = kind
 	action.Namespace = namespace
+	labelSelector, fieldSelector, _ := ExtractFromListOptions(opts)
+	action.ListRestrictions = ListRestrictions{labelSelector, fieldSelector}
+	action.ListOptions = metav1.ListOptions{LabelSelector: labelSelector.String(), FieldSelector: fieldSelector.String()}
+
+	return action
+}
+
+func NewListActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, kind schema.GroupVersionKind, namespace string, opts metav1.ListOptions) ListActionImpl {
+	action := ListActionImpl{}
+	action.Verb = "list"
+	action.Resource = resource
+	action.ClusterPath = clusterPath
+	action.Kind = kind
+	action.Namespace = namespace
+	action.ListOptions = opts
+
 	labelSelector, fieldSelector, _ := ExtractFromListOptions(opts)
 	action.ListRestrictions = ListRestrictions{labelSelector, fieldSelector}
 
@@ -102,27 +158,41 @@ func NewListAction(resource schema.GroupVersionResource, kind schema.GroupVersio
 }
 
 func NewRootCreateAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, object runtime.Object) CreateActionImpl {
+	return NewRootCreateActionWithOptions(resource, clusterPath, object, metav1.CreateOptions{})
+}
+
+func NewRootCreateActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, object runtime.Object, opts metav1.CreateOptions) CreateActionImpl {
 	action := CreateActionImpl{}
 	action.Verb = "create"
 	action.Resource = resource
 	action.ClusterPath = clusterPath
 	action.Object = object
+	action.CreateOptions = opts
 
 	return action
 }
 
 func NewCreateAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace string, object runtime.Object) CreateActionImpl {
+	return NewCreateActionWithOptions(resource, clusterPath, namespace, object, metav1.CreateOptions{})
+}
+
+func NewCreateActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace string, object runtime.Object, opts metav1.CreateOptions) CreateActionImpl {
 	action := CreateActionImpl{}
 	action.Verb = "create"
 	action.Resource = resource
 	action.ClusterPath = clusterPath
 	action.Namespace = namespace
 	action.Object = object
+	action.CreateOptions = opts
 
 	return action
 }
 
 func NewRootCreateSubresourceAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, name, subresource string, object runtime.Object) CreateActionImpl {
+	return NewRootCreateSubresourceActionWithOptions(resource, clusterPath, name, subresource, object, metav1.CreateOptions{})
+}
+
+func NewRootCreateSubresourceActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, name, subresource string, object runtime.Object, opts metav1.CreateOptions) CreateActionImpl {
 	action := CreateActionImpl{}
 	action.Verb = "create"
 	action.Resource = resource
@@ -130,11 +200,16 @@ func NewRootCreateSubresourceAction(resource schema.GroupVersionResource, cluste
 	action.Name = name
 	action.ClusterPath = clusterPath
 	action.Object = object
+	action.CreateOptions = opts
 
 	return action
 }
 
 func NewCreateSubresourceAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, name, subresource, namespace string, object runtime.Object) CreateActionImpl {
+	return NewCreateSubresourceActionWithOptions(resource, clusterPath, name, subresource, namespace, object, metav1.CreateOptions{})
+}
+
+func NewCreateSubresourceActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, name, subresource, namespace string, object runtime.Object, opts metav1.CreateOptions) CreateActionImpl {
 	action := CreateActionImpl{}
 	action.Verb = "create"
 	action.Resource = resource
@@ -143,32 +218,47 @@ func NewCreateSubresourceAction(resource schema.GroupVersionResource, clusterPat
 	action.Name = name
 	action.ClusterPath = clusterPath
 	action.Object = object
+	action.CreateOptions = opts
 
 	return action
 }
 
 func NewRootUpdateAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, object runtime.Object) UpdateActionImpl {
+	return NewRootUpdateActionWithOptions(resource, clusterPath, object, metav1.UpdateOptions{})
+}
+
+func NewRootUpdateActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, object runtime.Object, opts metav1.UpdateOptions) UpdateActionImpl {
 	action := UpdateActionImpl{}
 	action.Verb = "update"
 	action.Resource = resource
 	action.ClusterPath = clusterPath
 	action.Object = object
+	action.UpdateOptions = opts
 
 	return action
 }
 
 func NewUpdateAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace string, object runtime.Object) UpdateActionImpl {
+	return NewUpdateActionWithOptions(resource, clusterPath, namespace, object, metav1.UpdateOptions{})
+}
+
+func NewUpdateActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace string, object runtime.Object, opts metav1.UpdateOptions) UpdateActionImpl {
 	action := UpdateActionImpl{}
 	action.Verb = "update"
 	action.Resource = resource
 	action.ClusterPath = clusterPath
 	action.Namespace = namespace
 	action.Object = object
+	action.UpdateOptions = opts
 
 	return action
 }
 
 func NewRootPatchAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, name string, pt types.PatchType, patch []byte) PatchActionImpl {
+	return NewRootPatchActionWithOptions(resource, clusterPath, name, pt, patch, metav1.PatchOptions{})
+}
+
+func NewRootPatchActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, name string, pt types.PatchType, patch []byte, opts metav1.PatchOptions) PatchActionImpl {
 	action := PatchActionImpl{}
 	action.Verb = "patch"
 	action.Resource = resource
@@ -176,11 +266,16 @@ func NewRootPatchAction(resource schema.GroupVersionResource, clusterPath logica
 	action.ClusterPath = clusterPath
 	action.PatchType = pt
 	action.Patch = patch
+	action.PatchOptions = opts
 
 	return action
 }
 
 func NewPatchAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace string, name string, pt types.PatchType, patch []byte) PatchActionImpl {
+	return NewPatchActionWithOptions(resource, clusterPath, namespace, name, pt, patch, metav1.PatchOptions{})
+}
+
+func NewPatchActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace string, name string, pt types.PatchType, patch []byte, opts metav1.PatchOptions) PatchActionImpl {
 	action := PatchActionImpl{}
 	action.Verb = "patch"
 	action.Resource = resource
@@ -189,11 +284,16 @@ func NewPatchAction(resource schema.GroupVersionResource, clusterPath logicalclu
 	action.ClusterPath = clusterPath
 	action.PatchType = pt
 	action.Patch = patch
+	action.PatchOptions = opts
 
 	return action
 }
 
 func NewRootPatchSubresourceAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, name string, pt types.PatchType, patch []byte, subresources ...string) PatchActionImpl {
+	return NewRootPatchSubresourceActionWithOptions(resource, clusterPath, name, pt, patch, metav1.PatchOptions{}, subresources...)
+}
+
+func NewRootPatchSubresourceActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, name string, pt types.PatchType, patch []byte, opts metav1.PatchOptions, subresources ...string) PatchActionImpl {
 	action := PatchActionImpl{}
 	action.Verb = "patch"
 	action.Resource = resource
@@ -202,11 +302,16 @@ func NewRootPatchSubresourceAction(resource schema.GroupVersionResource, cluster
 	action.ClusterPath = clusterPath
 	action.PatchType = pt
 	action.Patch = patch
+	action.PatchOptions = opts
 
 	return action
 }
 
 func NewPatchSubresourceAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace, name string, pt types.PatchType, patch []byte, subresources ...string) PatchActionImpl {
+	return NewPatchSubresourceActionWithOptions(resource, clusterPath, namespace, name, pt, patch, metav1.PatchOptions{}, subresources...)
+}
+
+func NewPatchSubresourceActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace, name string, pt types.PatchType, patch []byte, opts metav1.PatchOptions, subresources ...string) PatchActionImpl {
 	action := PatchActionImpl{}
 	action.Verb = "patch"
 	action.Resource = resource
@@ -216,21 +321,32 @@ func NewPatchSubresourceAction(resource schema.GroupVersionResource, clusterPath
 	action.ClusterPath = clusterPath
 	action.PatchType = pt
 	action.Patch = patch
+	action.PatchOptions = opts
 
 	return action
 }
 
 func NewRootUpdateSubresourceAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, subresource string, object runtime.Object) UpdateActionImpl {
+	return NewRootUpdateSubresourceActionWithOptions(resource, clusterPath, subresource, object, metav1.UpdateOptions{})
+}
+
+func NewRootUpdateSubresourceActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, subresource string, object runtime.Object, opts metav1.UpdateOptions) UpdateActionImpl {
 	action := UpdateActionImpl{}
 	action.Verb = "update"
 	action.Resource = resource
 	action.ClusterPath = clusterPath
 	action.Subresource = subresource
 	action.Object = object
+	action.UpdateOptions = opts
 
 	return action
 }
+
 func NewUpdateSubresourceAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, subresource string, namespace string, object runtime.Object) UpdateActionImpl {
+	return NewUpdateSubresourceActionWithOptions(resource, clusterPath, subresource, namespace, object, metav1.UpdateOptions{})
+}
+
+func NewUpdateSubresourceActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, subresource string, namespace string, object runtime.Object, opts metav1.UpdateOptions) UpdateActionImpl {
 	action := UpdateActionImpl{}
 	action.Verb = "update"
 	action.Resource = resource
@@ -238,6 +354,7 @@ func NewUpdateSubresourceAction(resource schema.GroupVersionResource, clusterPat
 	action.Subresource = subresource
 	action.Namespace = namespace
 	action.Object = object
+	action.UpdateOptions = opts
 
 	return action
 }
@@ -258,12 +375,17 @@ func NewRootDeleteActionWithOptions(resource schema.GroupVersionResource, cluste
 }
 
 func NewRootDeleteSubresourceAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, subresource string, name string) DeleteActionImpl {
+	return NewRootDeleteSubresourceActionWithOptions(resource, clusterPath, subresource, name, metav1.DeleteOptions{})
+}
+
+func NewRootDeleteSubresourceActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, subresource string, name string, opts metav1.DeleteOptions) DeleteActionImpl {
 	action := DeleteActionImpl{}
 	action.Verb = "delete"
 	action.Resource = resource
 	action.Subresource = subresource
 	action.Name = name
 	action.ClusterPath = clusterPath
+	action.DeleteOptions = opts
 
 	return action
 }
@@ -285,6 +407,10 @@ func NewDeleteActionWithOptions(resource schema.GroupVersionResource, clusterPat
 }
 
 func NewDeleteSubresourceAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, subresource, namespace, name string) DeleteActionImpl {
+	return NewDeleteSubresourceActionWithOptions(resource, clusterPath, subresource, namespace, name, metav1.DeleteOptions{})
+}
+
+func NewDeleteSubresourceActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, subresource, namespace, name string, opts metav1.DeleteOptions) DeleteActionImpl {
 	action := DeleteActionImpl{}
 	action.Verb = "delete"
 	action.Resource = resource
@@ -292,38 +418,62 @@ func NewDeleteSubresourceAction(resource schema.GroupVersionResource, clusterPat
 	action.Namespace = namespace
 	action.Name = name
 	action.ClusterPath = clusterPath
+	action.DeleteOptions = opts
 
 	return action
 }
 
 func NewRootDeleteCollectionAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, opts interface{}) DeleteCollectionActionImpl {
+	listOpts, _ := opts.(metav1.ListOptions)
+	return NewRootDeleteCollectionActionWithOptions(resource, clusterPath, metav1.DeleteOptions{}, listOpts)
+}
+
+func NewRootDeleteCollectionActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, deleteOpts metav1.DeleteOptions, listOpts metav1.ListOptions) DeleteCollectionActionImpl {
 	action := DeleteCollectionActionImpl{}
 	action.Verb = "delete-collection"
 	action.Resource = resource
 	action.ClusterPath = clusterPath
-	labelSelector, fieldSelector, _ := ExtractFromListOptions(opts)
+	action.DeleteOptions = deleteOpts
+	action.ListOptions = listOpts
+
+	labelSelector, fieldSelector, _ := ExtractFromListOptions(listOpts)
 	action.ListRestrictions = ListRestrictions{labelSelector, fieldSelector}
 
 	return action
 }
 
 func NewDeleteCollectionAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace string, opts interface{}) DeleteCollectionActionImpl {
+	listOpts, _ := opts.(metav1.ListOptions)
+	return NewDeleteCollectionActionWithOptions(resource, clusterPath, namespace, metav1.DeleteOptions{}, listOpts)
+}
+
+func NewDeleteCollectionActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace string, deleteOpts metav1.DeleteOptions, listOpts metav1.ListOptions) DeleteCollectionActionImpl {
 	action := DeleteCollectionActionImpl{}
 	action.Verb = "delete-collection"
 	action.Resource = resource
 	action.ClusterPath = clusterPath
 	action.Namespace = namespace
-	labelSelector, fieldSelector, _ := ExtractFromListOptions(opts)
+	action.DeleteOptions = deleteOpts
+	action.ListOptions = listOpts
+
+	labelSelector, fieldSelector, _ := ExtractFromListOptions(listOpts)
 	action.ListRestrictions = ListRestrictions{labelSelector, fieldSelector}
 
 	return action
 }
 
 func NewRootWatchAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, opts interface{}) WatchActionImpl {
+	listOpts, _ := opts.(metav1.ListOptions)
+	return NewRootWatchActionWithOptions(resource, clusterPath, listOpts)
+}
+
+func NewRootWatchActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, opts metav1.ListOptions) WatchActionImpl {
 	action := WatchActionImpl{}
 	action.Verb = "watch"
 	action.Resource = resource
 	action.ClusterPath = clusterPath
+	action.ListOptions = opts
+
 	labelSelector, fieldSelector, resourceVersion := ExtractFromListOptions(opts)
 	action.WatchRestrictions = WatchRestrictions{labelSelector, fieldSelector, resourceVersion}
 
@@ -356,11 +506,18 @@ func ExtractFromListOptions(opts interface{}) (labelSelector labels.Selector, fi
 }
 
 func NewWatchAction(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace string, opts interface{}) WatchActionImpl {
+	listOpts, _ := opts.(metav1.ListOptions)
+	return NewWatchActionWithOptions(resource, clusterPath, namespace, listOpts)
+}
+
+func NewWatchActionWithOptions(resource schema.GroupVersionResource, clusterPath logicalcluster.Path, namespace string, opts metav1.ListOptions) WatchActionImpl {
 	action := WatchActionImpl{}
 	action.Verb = "watch"
 	action.Resource = resource
 	action.ClusterPath = clusterPath
 	action.Namespace = namespace
+	action.ListOptions = opts
+
 	labelSelector, fieldSelector, resourceVersion := ExtractFromListOptions(opts)
 	action.WatchRestrictions = WatchRestrictions{labelSelector, fieldSelector, resourceVersion}
 
@@ -523,17 +680,23 @@ func (a GenericActionImpl) DeepCopy() Action {
 
 type GetActionImpl struct {
 	ActionImpl
-	Name string
+	Name       string
+	GetOptions metav1.GetOptions
 }
 
 func (a GetActionImpl) GetName() string {
 	return a.Name
 }
 
+func (a GetActionImpl) GetGetOptions() metav1.GetOptions {
+	return a.GetOptions
+}
+
 func (a GetActionImpl) DeepCopy() Action {
 	return GetActionImpl{
 		ActionImpl: a.ActionImpl.DeepCopy().(ActionImpl),
 		Name:       a.Name,
+		GetOptions: *a.GetOptions.DeepCopy(),
 	}
 }
 
@@ -542,12 +705,17 @@ type ListActionImpl struct {
 	Kind             schema.GroupVersionKind
 	Name             string
 	ListRestrictions ListRestrictions
+	ListOptions      metav1.ListOptions
 }
 
 func (a ListActionImpl) GetKind() schema.GroupVersionKind {
 	return a.Kind
 }
 
+func (a ListActionImpl) GetListOptions() metav1.ListOptions {
+	return a.ListOptions
+}
+
 func (a ListActionImpl) GetListRestrictions() ListRestrictions {
 	return a.ListRestrictions
 }
@@ -561,54 +729,72 @@ func (a ListActionImpl) DeepCopy() Action {
 			Labels: a.ListRestrictions.Labels.DeepCopySelector(),
 			Fields: a.ListRestrictions.Fields.DeepCopySelector(),
 		},
+		ListOptions: *a.ListOptions.DeepCopy(),
 	}
 }
 
 type CreateActionImpl struct {
 	ActionImpl
-	Name   string
-	Object runtime.Object
+	Name          string
+	Object        runtime.Object
+	CreateOptions metav1.CreateOptions
 }
 
 func (a CreateActionImpl) GetObject() runtime.Object {
 	return a.Object
 }
 
+func (a CreateActionImpl) GetCreateOptions() metav1.CreateOptions {
+	return a.CreateOptions
+}
+
 func (a CreateActionImpl) DeepCopy() Action {
 	return CreateActionImpl{
-		ActionImpl: a.ActionImpl.DeepCopy().(ActionImpl),
-		Name:       a.Name,
-		Object:     a.Object.DeepCopyObject(),
+		ActionImpl:    a.ActionImpl.DeepCopy().(ActionImpl),
+		Name:          a.Name,
+		Object:        a.Object.DeepCopyObject(),
+		CreateOptions: *a.CreateOptions.DeepCopy(),
 	}
 }
 
 type UpdateActionImpl struct {
 	ActionImpl
-	Object runtime.Object
+	Object        runtime.Object
+	UpdateOptions metav1.UpdateOptions
 }
 
 func (a UpdateActionImpl) GetObject() runtime.Object {
 	return a.Object
 }
 
+func (a UpdateActionImpl) GetUpdateOptions() metav1.UpdateOptions {
+	return a.UpdateOptions
+}
+
 func (a UpdateActionImpl) DeepCopy() Action {
 	return UpdateActionImpl{
-		ActionImpl: a.ActionImpl.DeepCopy().(ActionImpl),
-		Object:     a.Object.DeepCopyObject(),
+		ActionImpl:    a.ActionImpl.DeepCopy().(ActionImpl),
+		Object:        a.Object.DeepCopyObject(),
+		UpdateOptions: *a.UpdateOptions.DeepCopy(),
 	}
 }
 
 type PatchActionImpl struct {
 	ActionImpl
-	Name      string
-	PatchType types.PatchType
-	Patch     []byte
+	Name         string
+	PatchType    types.PatchType
+	Patch        []byte
+	PatchOptions metav1.PatchOptions
 }
 
 func (a PatchActionImpl) GetName() string {
 	return a.Name
 }
 
+func (a PatchActionImpl) GetPatchOptions() metav1.PatchOptions {
+	return a.PatchOptions
+}
+
 func (a PatchActionImpl) GetPatch() []byte {
 	return a.Patch
 }
@@ -621,10 +807,11 @@ func (a PatchActionImpl) DeepCopy() Action {
 	patch := make([]byte, len(a.Patch))
 	copy(patch, a.Patch)
 	return PatchActionImpl{
-		ActionImpl: a.ActionImpl.DeepCopy().(ActionImpl),
-		Name:       a.Name,
-		PatchType:  a.PatchType,
-		Patch:      patch,
+		ActionImpl:   a.ActionImpl.DeepCopy().(ActionImpl),
+		Name:         a.Name,
+		PatchType:    a.PatchType,
+		Patch:        patch,
+		PatchOptions: *a.PatchOptions.DeepCopy(),
 	}
 }
 
@@ -653,12 +840,22 @@ func (a DeleteActionImpl) DeepCopy() Action {
 type DeleteCollectionActionImpl struct {
 	ActionImpl
 	ListRestrictions ListRestrictions
+	DeleteOptions    metav1.DeleteOptions
+	ListOptions      metav1.ListOptions
 }
 
 func (a DeleteCollectionActionImpl) GetListRestrictions() ListRestrictions {
 	return a.ListRestrictions
 }
 
+func (a DeleteCollectionActionImpl) GetDeleteOptions() metav1.DeleteOptions {
+	return a.DeleteOptions
+}
+
+func (a DeleteCollectionActionImpl) GetListOptions() metav1.ListOptions {
+	return a.ListOptions
+}
+
 func (a DeleteCollectionActionImpl) DeepCopy() Action {
 	return DeleteCollectionActionImpl{
 		ActionImpl: a.ActionImpl.DeepCopy().(ActionImpl),
@@ -666,18 +863,25 @@ func (a DeleteCollectionActionImpl) DeepCopy() Action {
 			Labels: a.ListRestrictions.Labels.DeepCopySelector(),
 			Fields: a.ListRestrictions.Fields.DeepCopySelector(),
 		},
+		DeleteOptions: *a.DeleteOptions.DeepCopy(),
+		ListOptions:   *a.ListOptions.DeepCopy(),
 	}
 }
 
 type WatchActionImpl struct {
 	ActionImpl
 	WatchRestrictions WatchRestrictions
+	ListOptions       metav1.ListOptions
 }
 
 func (a WatchActionImpl) GetWatchRestrictions() WatchRestrictions {
 	return a.WatchRestrictions
 }
 
+func (a WatchActionImpl) GetListOptions() metav1.ListOptions {
+	return a.ListOptions
+}
+
 func (a WatchActionImpl) DeepCopy() Action {
 	return WatchActionImpl{
 		ActionImpl: a.ActionImpl.DeepCopy().(ActionImpl),
@@ -686,6 +890,7 @@ func (a WatchActionImpl) DeepCopy() Action {
 			Fields:          a.WatchRestrictions.Fields.DeepCopySelector(),
 			ResourceVersion: a.WatchRestrictions.ResourceVersion,
 		},
+		ListOptions: *a.ListOptions.DeepCopy(),
 	}
 }
 
diff --git a/third_party/k8s.io/client-go/testing/cluster_fake.go b/third_party/k8s.io/client-go/testing/cluster_fake.go
index 560bdf987..4df3d3ab6 100644
--- a/third_party/k8s.io/client-go/testing/cluster_fake.go
+++ b/third_party/k8s.io/client-go/testing/cluster_fake.go
@@ -17,11 +17,11 @@ limitations under the License.
 package testing
 
 import (
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/watch"
 	restclient "k8s.io/client-go/rest"
+
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 type GenericReactor[R any] interface {
diff --git a/third_party/k8s.io/client-go/testing/fake.go b/third_party/k8s.io/client-go/testing/fake.go
index 750da1b61..457f61c81 100644
--- a/third_party/k8s.io/client-go/testing/fake.go
+++ b/third_party/k8s.io/client-go/testing/fake.go
@@ -21,12 +21,12 @@ import (
 	"fmt"
 	"sync"
 
-	"github.com/kcp-dev/logicalcluster/v3"
-
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/watch"
 	restclient "k8s.io/client-go/rest"
+
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 // Fake implements client.Interface. Meant to be embedded into a struct to get
diff --git a/third_party/k8s.io/client-go/testing/fixture.go b/third_party/k8s.io/client-go/testing/fixture.go
index 42b61929a..694449984 100644
--- a/third_party/k8s.io/client-go/testing/fixture.go
+++ b/third_party/k8s.io/client-go/testing/fixture.go
@@ -24,19 +24,25 @@ import (
 	"strings"
 	"sync"
 
-	jsonpatch "github.com/evanphx/json-patch"
-	"github.com/kcp-dev/logicalcluster/v3"
+	jsonpatch "gopkg.in/evanphx/json-patch.v4"
+	"sigs.k8s.io/structured-merge-diff/v4/typed"
+	"sigs.k8s.io/yaml"
 
-	"k8s.io/apimachinery/pkg/api/errors"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/api/meta"
+	"k8s.io/apimachinery/pkg/api/meta/testrestmapper"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/json"
+	"k8s.io/apimachinery/pkg/util/managedfields"
 	"k8s.io/apimachinery/pkg/util/strategicpatch"
 	"k8s.io/apimachinery/pkg/watch"
 	restclient "k8s.io/client-go/rest"
+
+	"github.com/kcp-dev/logicalcluster/v3"
 )
 
 type ClusterNamespacedName struct {
@@ -68,31 +74,37 @@ type ObjectTracker interface {
 // fake calls to a server by returning objects based on their kind,
 // namespace and name.
 type ScopedObjectTracker interface {
-	// List retrieves all objects of a given kind in the given
-	// namespace. Only non-List kinds are accepted.
-	List(gvr schema.GroupVersionResource, gvk schema.GroupVersionKind, ns string) (runtime.Object, error)
-
-	// Watch watches objects from the tracker. Watch returns a channel
-	// which will push added / modified / deleted object.
-	Watch(gvr schema.GroupVersionResource, ns string) (watch.Interface, error)
-
 	// Add adds an object to the tracker. If object being added
 	// is a list, its items are added separately.
 	Add(obj runtime.Object) error
 
 	// Get retrieves the object by its kind, namespace and name.
-	Get(gvr schema.GroupVersionResource, ns, name string) (runtime.Object, error)
+	Get(gvr schema.GroupVersionResource, ns, name string, opts ...metav1.GetOptions) (runtime.Object, error)
 
 	// Create adds an object to the tracker in the specified namespace.
-	Create(gvr schema.GroupVersionResource, obj runtime.Object, ns string) error
+	Create(gvr schema.GroupVersionResource, obj runtime.Object, ns string, opts ...metav1.CreateOptions) error
 
 	// Update updates an existing object in the tracker in the specified namespace.
-	Update(gvr schema.GroupVersionResource, obj runtime.Object, ns string) error
+	Update(gvr schema.GroupVersionResource, obj runtime.Object, ns string, opts ...metav1.UpdateOptions) error
+
+	// Patch patches an existing object in the tracker in the specified namespace.
+	Patch(gvr schema.GroupVersionResource, obj runtime.Object, ns string, opts ...metav1.PatchOptions) error
+
+	// Apply applies an object in the tracker in the specified namespace.
+	Apply(gvr schema.GroupVersionResource, applyConfiguration runtime.Object, ns string, opts ...metav1.PatchOptions) error
+
+	// List retrieves all objects of a given kind in the given
+	// namespace. Only non-List kinds are accepted.
+	List(gvr schema.GroupVersionResource, gvk schema.GroupVersionKind, ns string, opts ...metav1.ListOptions) (runtime.Object, error)
 
 	// Delete deletes an existing object from the tracker. If object
 	// didn't exist in the tracker prior to deletion, Delete returns
 	// no error.
-	Delete(gvr schema.GroupVersionResource, ns, name string) error
+	Delete(gvr schema.GroupVersionResource, ns, name string, opts ...metav1.DeleteOptions) error
+
+	// Watch watches objects from the tracker. Watch returns a channel
+	// which will push added / modified / deleted object.
+	Watch(gvr schema.GroupVersionResource, ns string, opts ...metav1.ListOptions) (watch.Interface, error)
 }
 
 // ObjectScheme abstracts the implementation of common operations on objects.
@@ -103,140 +115,220 @@ type ObjectScheme interface {
 
 // ObjectReaction returns a ReactionFunc that applies core.Action to
 // the given tracker.
+//
+// If tracker also implements ManagedFieldObjectTracker, then managed fields
+// will be handled by the tracker and apply patch actions will be evaluated
+// using the field manager and will take field ownership into consideration.
+// Without a ManagedFieldObjectTracker, apply patch actions do not consider
+// field ownership.
+//
+// WARNING: There is no server side defaulting, validation, or conversion handled
+// by the fake client and subresources are not handled accurately (fields in the
+// root resource are not automatically updated when a scale resource is updated, for example).
 func ObjectReaction(tracker ObjectTracker) ReactionFunc {
+	reactor := objectTrackerReact{tracker: tracker}
 	return func(action Action) (bool, runtime.Object, error) {
-		ns := action.GetNamespace()
-		gvr := action.GetResource()
 		// Here and below we need to switch on implementation types,
 		// not on interfaces, as some interfaces are identical
 		// (e.g. UpdateAction and CreateAction), so if we use them,
 		// updates and creates end up matching the same case branch.
 		switch action := action.(type) {
-
 		case ListActionImpl:
 			var obj runtime.Object
 			var err error
 			switch action.GetCluster() {
 			case logicalcluster.Wildcard:
-				obj, err = tracker.List(gvr, action.GetKind(), ns)
+				obj, err = reactor.List(action)
 			default:
-				obj, err = tracker.Cluster(action.GetCluster()).List(gvr, action.GetKind(), ns)
+				obj, err = reactor.Cluster(action.GetCluster()).List(action)
 			}
 			return true, obj, err
-
 		case GetActionImpl:
-			obj, err := tracker.Cluster(action.GetCluster()).Get(gvr, ns, action.GetName())
+			obj, err := reactor.Cluster(action.GetCluster()).Get(action)
 			return true, obj, err
-
 		case CreateActionImpl:
-			objMeta, err := meta.Accessor(action.GetObject())
-			if err != nil {
-				return true, nil, err
-			}
-			if action.GetSubresource() == "" {
-				err = tracker.Cluster(action.GetCluster()).Create(gvr, action.GetObject(), ns)
-			} else {
-				oldObj, getOldObjErr := tracker.Cluster(action.GetCluster()).Get(gvr, ns, objMeta.GetName())
-				if getOldObjErr != nil {
-					return true, nil, getOldObjErr
-				}
-				// Check whether the existing historical object type is the same as the current operation object type that needs to be updated, and if it is the same, perform the update operation.
-				if reflect.TypeOf(oldObj) == reflect.TypeOf(action.GetObject()) {
-					// TODO: Currently we're handling subresource creation as an update
-					// on the enclosing resource. This works for some subresources but
-					// might not be generic enough.
-					err = tracker.Cluster(action.GetCluster()).Update(gvr, action.GetObject(), ns)
-				} else {
-					// If the historical object type is different from the current object type, need to make sure we return the object submitted,don't persist the submitted object in the tracker.
-					return true, action.GetObject(), nil
-				}
-			}
-			if err != nil {
-				return true, nil, err
-			}
-			obj, err := tracker.Cluster(action.GetCluster()).Get(gvr, ns, objMeta.GetName())
+			obj, err := reactor.Cluster(action.GetCluster()).Create(action)
 			return true, obj, err
-
 		case UpdateActionImpl:
-			objMeta, err := meta.Accessor(action.GetObject())
-			if err != nil {
-				return true, nil, err
-			}
-			err = tracker.Cluster(action.GetCluster()).Update(gvr, action.GetObject(), ns)
-			if err != nil {
-				return true, nil, err
-			}
-			obj, err := tracker.Cluster(action.GetCluster()).Get(gvr, ns, objMeta.GetName())
+			obj, err := reactor.Cluster(action.GetCluster()).Update(action)
 			return true, obj, err
-
 		case DeleteActionImpl:
-			err := tracker.Cluster(action.GetCluster()).Delete(gvr, ns, action.GetName())
-			if err != nil {
-				return true, nil, err
-			}
-			return true, nil, nil
-
+			obj, err := reactor.Cluster(action.GetCluster()).Delete(action)
+			return true, obj, err
 		case PatchActionImpl:
-			obj, err := tracker.Cluster(action.GetCluster()).Get(gvr, ns, action.GetName())
-			if err != nil {
-				return true, nil, err
+			if action.GetPatchType() == types.ApplyPatchType {
+				obj, err := reactor.Cluster(action.GetCluster()).Apply(action)
+				return true, obj, err
 			}
+			obj, err := reactor.Cluster(action.GetCluster()).Patch(action)
+			return true, obj, err
+		default:
+			return false, nil, fmt.Errorf("no reaction implemented for %s", action)
+		}
+	}
+}
 
-			old, err := json.Marshal(obj)
-			if err != nil {
-				return true, nil, err
-			}
+type objectTrackerReact struct {
+	tracker ObjectTracker
+}
 
-			// reset the object in preparation to unmarshal, since unmarshal does not guarantee that fields
-			// in obj that are removed by patch are cleared
-			value := reflect.ValueOf(obj)
-			value.Elem().Set(reflect.New(value.Type().Elem()).Elem())
-
-			switch action.GetPatchType() {
-			case types.JSONPatchType:
-				patch, err := jsonpatch.DecodePatch(action.GetPatch())
-				if err != nil {
-					return true, nil, err
-				}
-				modified, err := patch.Apply(old)
-				if err != nil {
-					return true, nil, err
-				}
-
-				if err = json.Unmarshal(modified, obj); err != nil {
-					return true, nil, err
-				}
-			case types.MergePatchType:
-				modified, err := jsonpatch.MergePatch(old, action.GetPatch())
-				if err != nil {
-					return true, nil, err
-				}
-
-				if err := json.Unmarshal(modified, obj); err != nil {
-					return true, nil, err
-				}
-			case types.StrategicMergePatchType, types.ApplyPatchType:
-				mergedByte, err := strategicpatch.StrategicMergePatch(old, action.GetPatch(), obj)
-				if err != nil {
-					return true, nil, err
-				}
-				if err = json.Unmarshal(mergedByte, obj); err != nil {
-					return true, nil, err
-				}
-			default:
-				return true, nil, fmt.Errorf("PatchType is not supported")
-			}
+func (o objectTrackerReact) List(action ListActionImpl) (runtime.Object, error) {
+	return o.tracker.List(action.GetResource(), action.GetKind(), action.GetNamespace())
+}
 
-			if err = tracker.Cluster(action.GetCluster()).Update(gvr, obj, ns); err != nil {
-				return true, nil, err
-			}
+func (o objectTrackerReact) Cluster(clusterPath logicalcluster.Path) scopedObjectTrackerReact {
+	return scopedObjectTrackerReact{o.tracker.Cluster(clusterPath)}
+}
 
-			return true, obj, nil
+type scopedObjectTrackerReact struct {
+	tracker ScopedObjectTracker
+}
 
-		default:
-			return false, nil, fmt.Errorf("no reaction implemented for %s", action)
+func (o scopedObjectTrackerReact) List(action ListActionImpl) (runtime.Object, error) {
+	return o.tracker.List(action.GetResource(), action.GetKind(), action.GetNamespace(), action.ListOptions)
+}
+
+func (o scopedObjectTrackerReact) Get(action GetActionImpl) (runtime.Object, error) {
+	return o.tracker.Get(action.GetResource(), action.GetNamespace(), action.GetName(), action.GetOptions)
+}
+
+func (o scopedObjectTrackerReact) Create(action CreateActionImpl) (runtime.Object, error) {
+	ns := action.GetNamespace()
+	gvr := action.GetResource()
+	objMeta, err := meta.Accessor(action.GetObject())
+	if err != nil {
+		return nil, err
+	}
+	if action.GetSubresource() == "" {
+		err = o.tracker.Create(gvr, action.GetObject(), ns, action.CreateOptions)
+		if err != nil {
+			return nil, err
 		}
+	} else {
+		oldObj, getOldObjErr := o.tracker.Get(gvr, ns, objMeta.GetName(), metav1.GetOptions{})
+		if getOldObjErr != nil {
+			return nil, getOldObjErr
+		}
+		// Check whether the existing historical object type is the same as the current operation object type that needs to be updated, and if it is the same, perform the update operation.
+		if reflect.TypeOf(oldObj) == reflect.TypeOf(action.GetObject()) {
+			// TODO: Currently we're handling subresource creation as an update
+			// on the enclosing resource. This works for some subresources but
+			// might not be generic enough.
+			err = o.tracker.Update(gvr, action.GetObject(), ns, metav1.UpdateOptions{
+				DryRun:          action.CreateOptions.DryRun,
+				FieldManager:    action.CreateOptions.FieldManager,
+				FieldValidation: action.CreateOptions.FieldValidation,
+			})
+		} else {
+			// If the historical object type is different from the current object type, need to make sure we return the object submitted,don't persist the submitted object in the tracker.
+			return action.GetObject(), nil
+		}
+	}
+	if err != nil {
+		return nil, err
 	}
+	obj, err := o.tracker.Get(gvr, ns, objMeta.GetName(), metav1.GetOptions{})
+	return obj, err
+}
+
+func (o scopedObjectTrackerReact) Update(action UpdateActionImpl) (runtime.Object, error) {
+	ns := action.GetNamespace()
+	gvr := action.GetResource()
+	objMeta, err := meta.Accessor(action.GetObject())
+	if err != nil {
+		return nil, err
+	}
+
+	err = o.tracker.Update(gvr, action.GetObject(), ns, action.UpdateOptions)
+	if err != nil {
+		return nil, err
+	}
+
+	obj, err := o.tracker.Get(gvr, ns, objMeta.GetName(), metav1.GetOptions{})
+	return obj, err
+}
+
+func (o scopedObjectTrackerReact) Delete(action DeleteActionImpl) (runtime.Object, error) {
+	err := o.tracker.Delete(action.GetResource(), action.GetNamespace(), action.GetName(), action.DeleteOptions)
+	return nil, err
+}
+
+func (o scopedObjectTrackerReact) Apply(action PatchActionImpl) (runtime.Object, error) {
+	ns := action.GetNamespace()
+	gvr := action.GetResource()
+
+	patchObj := &unstructured.Unstructured{Object: map[string]interface{}{}}
+	if err := yaml.Unmarshal(action.GetPatch(), &patchObj.Object); err != nil {
+		return nil, err
+	}
+	patchObj.SetName(action.GetName())
+	err := o.tracker.Apply(gvr, patchObj, ns, action.PatchOptions)
+	if err != nil {
+		return nil, err
+	}
+	obj, err := o.tracker.Get(gvr, ns, action.GetName(), metav1.GetOptions{})
+	return obj, err
+}
+
+func (o scopedObjectTrackerReact) Patch(action PatchActionImpl) (runtime.Object, error) {
+	ns := action.GetNamespace()
+	gvr := action.GetResource()
+
+	obj, err := o.tracker.Get(gvr, ns, action.GetName(), metav1.GetOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	old, err := json.Marshal(obj)
+	if err != nil {
+		return nil, err
+	}
+
+	// reset the object in preparation to unmarshal, since unmarshal does not guarantee that fields
+	// in obj that are removed by patch are cleared
+	value := reflect.ValueOf(obj)
+	value.Elem().Set(reflect.New(value.Type().Elem()).Elem())
+
+	switch action.GetPatchType() {
+	case types.JSONPatchType:
+		patch, err := jsonpatch.DecodePatch(action.GetPatch())
+		if err != nil {
+			return nil, err
+		}
+		modified, err := patch.Apply(old)
+		if err != nil {
+			return nil, err
+		}
+
+		if err = json.Unmarshal(modified, obj); err != nil {
+			return nil, err
+		}
+	case types.MergePatchType:
+		modified, err := jsonpatch.MergePatch(old, action.GetPatch())
+		if err != nil {
+			return nil, err
+		}
+
+		if err := json.Unmarshal(modified, obj); err != nil {
+			return nil, err
+		}
+	case types.StrategicMergePatchType:
+		mergedByte, err := strategicpatch.StrategicMergePatch(old, action.GetPatch(), obj)
+		if err != nil {
+			return nil, err
+		}
+		if err = json.Unmarshal(mergedByte, obj); err != nil {
+			return nil, err
+		}
+	default:
+		return nil, fmt.Errorf("PatchType %s is not supported", action.GetPatchType())
+	}
+
+	if err = o.tracker.Patch(gvr, obj, ns, action.PatchOptions); err != nil {
+		return nil, err
+	}
+
+	return obj, nil
 }
 
 // WatchReaction returns a WatchReactionFunc that applies core.Action to
@@ -333,8 +425,8 @@ func (t *tracker) AddAll(objects ...runtime.Object) error {
 	return nil
 }
 
-func (t *scopedTracker) List(gvr schema.GroupVersionResource, gvk schema.GroupVersionKind, ns string) (runtime.Object, error) {
-	list, err := t.tracker.List(gvr, gvk, ns)
+func (t *scopedTracker) List(gvr schema.GroupVersionResource, gvk schema.GroupVersionKind, ns string, opts ...metav1.ListOptions) (runtime.Object, error) {
+	list, err := t.list(gvr, gvk, ns, opts...)
 	if err != nil {
 		return list, err
 	}
@@ -353,6 +445,14 @@ func (t *scopedTracker) List(gvr schema.GroupVersionResource, gvk schema.GroupVe
 }
 
 func (t *tracker) List(gvr schema.GroupVersionResource, gvk schema.GroupVersionKind, ns string) (runtime.Object, error) {
+	return t.list(gvr, gvk, ns)
+}
+
+func (t *tracker) list(gvr schema.GroupVersionResource, gvk schema.GroupVersionKind, ns string, opts ...metav1.ListOptions) (runtime.Object, error) {
+	_, err := assertOptionalSingleArgument(opts)
+	if err != nil {
+		return nil, err
+	}
 	// Heuristic for list kind: original kind + List suffix. Might
 	// not always be true but this tracker has a pretty limited
 	// understanding of the actual API model.
@@ -391,15 +491,20 @@ func (t *tracker) List(gvr schema.GroupVersionResource, gvk schema.GroupVersionK
 	return list.DeepCopyObject(), nil
 }
 
-func (t *scopedTracker) Watch(gvr schema.GroupVersionResource, ns string) (watch.Interface, error) {
-	return t.tracker.watch(gvr, t.clusterPath, ns)
+func (t *scopedTracker) Watch(gvr schema.GroupVersionResource, ns string, opts ...metav1.ListOptions) (watch.Interface, error) {
+	return t.tracker.watch(gvr, t.clusterPath, ns, opts...)
 }
 
 func (t *tracker) Watch(gvr schema.GroupVersionResource, ns string) (watch.Interface, error) {
 	return t.watch(gvr, logicalcluster.Wildcard, ns)
 }
 
-func (t *tracker) watch(gvr schema.GroupVersionResource, cluster logicalcluster.Path, ns string) (watch.Interface, error) {
+func (t *tracker) watch(gvr schema.GroupVersionResource, cluster logicalcluster.Path, ns string, opts ...metav1.ListOptions) (watch.Interface, error) {
+	_, err := assertOptionalSingleArgument(opts)
+	if err != nil {
+		return nil, err
+	}
+
 	t.lock.Lock()
 	defer t.lock.Unlock()
 
@@ -415,8 +520,12 @@ func (t *tracker) watch(gvr schema.GroupVersionResource, cluster logicalcluster.
 	return fakewatcher, nil
 }
 
-func (t *scopedTracker) Get(gvr schema.GroupVersionResource, ns, name string) (runtime.Object, error) {
-	errNotFound := errors.NewNotFound(gvr.GroupResource(), name)
+func (t *scopedTracker) Get(gvr schema.GroupVersionResource, ns, name string, opts ...metav1.GetOptions) (runtime.Object, error) {
+	_, err := assertOptionalSingleArgument(opts)
+	if err != nil {
+		return nil, err
+	}
+	errNotFound := apierrors.NewNotFound(gvr.GroupResource(), name)
 
 	t.lock.RLock()
 	defer t.lock.RUnlock()
@@ -437,7 +546,7 @@ func (t *scopedTracker) Get(gvr schema.GroupVersionResource, ns, name string) (r
 	obj := matchingObj.DeepCopyObject()
 	if status, ok := obj.(*metav1.Status); ok {
 		if status.Status != metav1.StatusSuccess {
-			return nil, &errors.StatusError{ErrStatus: *status}
+			return nil, &apierrors.StatusError{ErrStatus: *status}
 		}
 	}
 
@@ -484,11 +593,70 @@ func (t *scopedTracker) Add(obj runtime.Object) error {
 	return nil
 }
 
-func (t *scopedTracker) Create(gvr schema.GroupVersionResource, obj runtime.Object, ns string) error {
+func (t *scopedTracker) Create(gvr schema.GroupVersionResource, obj runtime.Object, ns string, opts ...metav1.CreateOptions) error {
+	_, err := assertOptionalSingleArgument(opts)
+	if err != nil {
+		return err
+	}
 	return t.add(gvr, obj, ns, false)
 }
 
-func (t *scopedTracker) Update(gvr schema.GroupVersionResource, obj runtime.Object, ns string) error {
+func (t *scopedTracker) Update(gvr schema.GroupVersionResource, obj runtime.Object, ns string, opts ...metav1.UpdateOptions) error {
+	_, err := assertOptionalSingleArgument(opts)
+	if err != nil {
+		return err
+	}
+	return t.add(gvr, obj, ns, true)
+}
+
+func (t *scopedTracker) Patch(gvr schema.GroupVersionResource, patchedObject runtime.Object, ns string, opts ...metav1.PatchOptions) error {
+	_, err := assertOptionalSingleArgument(opts)
+	if err != nil {
+		return err
+	}
+	return t.add(gvr, patchedObject, ns, true)
+}
+
+func (t *scopedTracker) Apply(gvr schema.GroupVersionResource, applyConfiguration runtime.Object, ns string, opts ...metav1.PatchOptions) error {
+	_, err := assertOptionalSingleArgument(opts)
+	if err != nil {
+		return err
+	}
+	applyConfigurationMeta, err := meta.Accessor(applyConfiguration)
+	if err != nil {
+		return err
+	}
+
+	obj, err := t.Get(gvr, ns, applyConfigurationMeta.GetName(), metav1.GetOptions{})
+	if err != nil {
+		return err
+	}
+
+	old, err := json.Marshal(obj)
+	if err != nil {
+		return err
+	}
+
+	// reset the object in preparation to unmarshal, since unmarshal does not guarantee that fields
+	// in obj that are removed by patch are cleared
+	value := reflect.ValueOf(obj)
+	value.Elem().Set(reflect.New(value.Type().Elem()).Elem())
+
+	// For backward compatibility with behavior 1.30 and earlier, continue to handle apply
+	// via strategic merge patch (clients may use fake.NewClientset and ManagedFieldObjectTracker
+	// for full field manager support).
+	patch, err := json.Marshal(applyConfiguration)
+	if err != nil {
+		return err
+	}
+	mergedByte, err := strategicpatch.StrategicMergePatch(old, patch, obj)
+	if err != nil {
+		return err
+	}
+	if err = json.Unmarshal(mergedByte, obj); err != nil {
+		return err
+	}
+
 	return t.add(gvr, obj, ns, true)
 }
 
@@ -542,7 +710,7 @@ func (t *scopedTracker) add(gvr schema.GroupVersionResource, obj runtime.Object,
 
 	if ns != newMeta.GetNamespace() {
 		msg := fmt.Sprintf("request namespace does not match object namespace, request: %q object: %q", ns, newMeta.GetNamespace())
-		return errors.NewBadRequest(msg)
+		return apierrors.NewBadRequest(msg)
 	}
 
 	_, ok := t.objects[gvr]
@@ -565,12 +733,12 @@ func (t *scopedTracker) add(gvr schema.GroupVersionResource, obj runtime.Object,
 			t.objects[gvr][namespacedName] = obj
 			return nil
 		}
-		return errors.NewAlreadyExists(gr, newMeta.GetName())
+		return apierrors.NewAlreadyExists(gr, newMeta.GetName())
 	}
 
 	if replaceExisting {
 		// Tried to update but no matching object was found.
-		return errors.NewNotFound(gr, newMeta.GetName())
+		return apierrors.NewNotFound(gr, newMeta.GetName())
 	}
 
 	t.objects[gvr][namespacedName] = obj
@@ -600,19 +768,24 @@ func (t *scopedTracker) addList(obj runtime.Object, replaceExisting bool) error
 	return nil
 }
 
-func (t *scopedTracker) Delete(gvr schema.GroupVersionResource, ns, name string) error {
+func (t *scopedTracker) Delete(gvr schema.GroupVersionResource, ns, name string, opts ...metav1.DeleteOptions) error {
+	_, err := assertOptionalSingleArgument(opts)
+	if err != nil {
+		return err
+	}
+
 	t.lock.Lock()
 	defer t.lock.Unlock()
 
 	objs, ok := t.objects[gvr]
 	if !ok {
-		return errors.NewNotFound(gvr.GroupResource(), name)
+		return apierrors.NewNotFound(gvr.GroupResource(), name)
 	}
 
 	namespacedName := ClusterNamespacedName{Cluster: t.clusterPath, NamespacedName: types.NamespacedName{Namespace: ns, Name: name}}
 	obj, ok := objs[namespacedName]
 	if !ok {
-		return errors.NewNotFound(gvr.GroupResource(), name)
+		return apierrors.NewNotFound(gvr.GroupResource(), name)
 	}
 
 	delete(objs, namespacedName)
@@ -622,6 +795,223 @@ func (t *scopedTracker) Delete(gvr schema.GroupVersionResource, ns, name string)
 	return nil
 }
 
+type managedFieldObjectTracker struct {
+	ObjectTracker
+	scheme          ObjectScheme
+	objectConverter runtime.ObjectConvertor
+	mapper          meta.RESTMapper
+	typeConverter   managedfields.TypeConverter
+}
+
+var _ ObjectTracker = &managedFieldObjectTracker{}
+
+// NewFieldManagedObjectTracker returns an ObjectTracker that can be used to keep track
+// of objects and managed fields for the fake clientset. Mostly useful for unit tests.
+func NewFieldManagedObjectTracker(scheme *runtime.Scheme, decoder runtime.Decoder, typeConverter managedfields.TypeConverter) ObjectTracker {
+	return &managedFieldObjectTracker{
+		ObjectTracker:   NewObjectTracker(scheme, decoder),
+		scheme:          scheme,
+		objectConverter: scheme,
+		mapper:          testrestmapper.TestOnlyStaticRESTMapper(scheme),
+		typeConverter:   typeConverter,
+	}
+}
+
+func (t *managedFieldObjectTracker) Cluster(clusterPath logicalcluster.Path) ScopedObjectTracker {
+	return &scopedManagedFieldObjectTracker{
+		ScopedObjectTracker: t.ObjectTracker.Cluster(clusterPath),
+		scheme:              t.scheme,
+		objectConverter:     t.objectConverter,
+		mapper:              t.mapper,
+		typeConverter:       t.typeConverter,
+	}
+}
+
+type scopedManagedFieldObjectTracker struct {
+	ScopedObjectTracker
+	scheme          ObjectScheme
+	objectConverter runtime.ObjectConvertor
+	mapper          meta.RESTMapper
+	typeConverter   managedfields.TypeConverter
+}
+
+var _ ScopedObjectTracker = &scopedManagedFieldObjectTracker{}
+
+func (t *scopedManagedFieldObjectTracker) Create(gvr schema.GroupVersionResource, obj runtime.Object, ns string, vopts ...metav1.CreateOptions) error {
+	opts, err := assertOptionalSingleArgument(vopts)
+	if err != nil {
+		return err
+	}
+	gvk, err := t.mapper.KindFor(gvr)
+	if err != nil {
+		return err
+	}
+	mgr, err := t.fieldManagerFor(gvk)
+	if err != nil {
+		return err
+	}
+
+	objType, err := meta.TypeAccessor(obj)
+	if err != nil {
+		return err
+	}
+	// Stamp GVK
+	apiVersion, kind := gvk.ToAPIVersionAndKind()
+	objType.SetAPIVersion(apiVersion)
+	objType.SetKind(kind)
+
+	objMeta, err := meta.Accessor(obj)
+	if err != nil {
+		return err
+	}
+	liveObject, err := t.ScopedObjectTracker.Get(gvr, ns, objMeta.GetName(), metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		liveObject, err = t.scheme.New(gvk)
+		if err != nil {
+			return err
+		}
+		liveObject.GetObjectKind().SetGroupVersionKind(gvk)
+	} else if err != nil {
+		return err
+	}
+	objWithManagedFields, err := mgr.Update(liveObject, obj, opts.FieldManager)
+	if err != nil {
+		return err
+	}
+	return t.ScopedObjectTracker.Create(gvr, objWithManagedFields, ns, opts)
+}
+
+func (t *scopedManagedFieldObjectTracker) Update(gvr schema.GroupVersionResource, obj runtime.Object, ns string, vopts ...metav1.UpdateOptions) error {
+	opts, err := assertOptionalSingleArgument(vopts)
+	if err != nil {
+		return err
+	}
+	gvk, err := t.mapper.KindFor(gvr)
+	if err != nil {
+		return err
+	}
+	mgr, err := t.fieldManagerFor(gvk)
+	if err != nil {
+		return err
+	}
+
+	objMeta, err := meta.Accessor(obj)
+	if err != nil {
+		return err
+	}
+	oldObj, err := t.ScopedObjectTracker.Get(gvr, ns, objMeta.GetName(), metav1.GetOptions{})
+	if err != nil {
+		return err
+	}
+	objWithManagedFields, err := mgr.Update(oldObj, obj, opts.FieldManager)
+	if err != nil {
+		return err
+	}
+
+	return t.ScopedObjectTracker.Update(gvr, objWithManagedFields, ns, opts)
+}
+
+func (t *scopedManagedFieldObjectTracker) Patch(gvr schema.GroupVersionResource, patchedObject runtime.Object, ns string, vopts ...metav1.PatchOptions) error {
+	opts, err := assertOptionalSingleArgument(vopts)
+	if err != nil {
+		return err
+	}
+	gvk, err := t.mapper.KindFor(gvr)
+	if err != nil {
+		return err
+	}
+	mgr, err := t.fieldManagerFor(gvk)
+	if err != nil {
+		return err
+	}
+
+	objMeta, err := meta.Accessor(patchedObject)
+	if err != nil {
+		return err
+	}
+	oldObj, err := t.ScopedObjectTracker.Get(gvr, ns, objMeta.GetName(), metav1.GetOptions{})
+	if err != nil {
+		return err
+	}
+	objWithManagedFields, err := mgr.Update(oldObj, patchedObject, opts.FieldManager)
+	if err != nil {
+		return err
+	}
+	return t.ScopedObjectTracker.Patch(gvr, objWithManagedFields, ns, vopts...)
+}
+
+func (t *scopedManagedFieldObjectTracker) Apply(gvr schema.GroupVersionResource, applyConfiguration runtime.Object, ns string, vopts ...metav1.PatchOptions) error {
+	opts, err := assertOptionalSingleArgument(vopts)
+	if err != nil {
+		return err
+	}
+	gvk, err := t.mapper.KindFor(gvr)
+	if err != nil {
+		return err
+	}
+	applyConfigurationMeta, err := meta.Accessor(applyConfiguration)
+	if err != nil {
+		return err
+	}
+
+	exists := true
+	liveObject, err := t.ScopedObjectTracker.Get(gvr, ns, applyConfigurationMeta.GetName(), metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		exists = false
+		liveObject, err = t.scheme.New(gvk)
+		if err != nil {
+			return err
+		}
+		liveObject.GetObjectKind().SetGroupVersionKind(gvk)
+	} else if err != nil {
+		return err
+	}
+	mgr, err := t.fieldManagerFor(gvk)
+	if err != nil {
+		return err
+	}
+	force := false
+	if opts.Force != nil {
+		force = *opts.Force
+	}
+	objWithManagedFields, err := mgr.Apply(liveObject, applyConfiguration, opts.FieldManager, force)
+	if err != nil {
+		return err
+	}
+
+	if !exists {
+		return t.ScopedObjectTracker.Create(gvr, objWithManagedFields, ns, metav1.CreateOptions{
+			DryRun:          opts.DryRun,
+			FieldManager:    opts.FieldManager,
+			FieldValidation: opts.FieldValidation,
+		})
+	} else {
+		return t.ScopedObjectTracker.Update(gvr, objWithManagedFields, ns, metav1.UpdateOptions{
+			DryRun:          opts.DryRun,
+			FieldManager:    opts.FieldManager,
+			FieldValidation: opts.FieldValidation,
+		})
+	}
+}
+
+func (t *scopedManagedFieldObjectTracker) fieldManagerFor(gvk schema.GroupVersionKind) (*managedfields.FieldManager, error) {
+	return managedfields.NewDefaultFieldManager(
+		t.typeConverter,
+		t.objectConverter,
+		&objectDefaulter{},
+		t.scheme,
+		gvk,
+		gvk.GroupVersion(),
+		"",
+		nil)
+}
+
+// objectDefaulter implements runtime.Defaulter, but it actually
+// does nothing.
+type objectDefaulter struct{}
+
+func (d *objectDefaulter) Default(_ runtime.Object) {}
+
 // filterByNamespace returns all objects in the collection that
 // match provided namespace. Empty namespace matches
 // non-namespaced objects.
@@ -757,3 +1147,76 @@ func resourceCovers(resource string, action Action) bool {
 
 	return false
 }
+
+// assertOptionalSingleArgument returns an error if there is more than one variadic argument.
+// Otherwise, it returns the first variadic argument, or zero value if there are no arguments.
+func assertOptionalSingleArgument[T any](arguments []T) (T, error) {
+	var a T
+	switch len(arguments) {
+	case 0:
+		return a, nil
+	case 1:
+		return arguments[0], nil
+	default:
+		return a, fmt.Errorf("expected only one option argument but got %d", len(arguments))
+	}
+}
+
+type TypeResolver interface {
+	Type(openAPIName string) typed.ParseableType
+}
+
+type TypeConverter struct {
+	Scheme       *runtime.Scheme
+	TypeResolver TypeResolver
+}
+
+func (tc TypeConverter) ObjectToTyped(obj runtime.Object, opts ...typed.ValidationOptions) (*typed.TypedValue, error) {
+	gvk := obj.GetObjectKind().GroupVersionKind()
+	name, err := tc.openAPIName(gvk)
+	if err != nil {
+		return nil, err
+	}
+	t := tc.TypeResolver.Type(name)
+	switch o := obj.(type) {
+	case *unstructured.Unstructured:
+		return t.FromUnstructured(o.UnstructuredContent(), opts...)
+	default:
+		return t.FromStructured(obj, opts...)
+	}
+}
+
+func (tc TypeConverter) TypedToObject(value *typed.TypedValue) (runtime.Object, error) {
+	vu := value.AsValue().Unstructured()
+	switch o := vu.(type) {
+	case map[string]interface{}:
+		return &unstructured.Unstructured{Object: o}, nil
+	default:
+		return nil, fmt.Errorf("failed to convert value to unstructured for type %T", vu)
+	}
+}
+
+func (tc TypeConverter) openAPIName(kind schema.GroupVersionKind) (string, error) {
+	example, err := tc.Scheme.New(kind)
+	if err != nil {
+		return "", err
+	}
+	rtype := reflect.TypeOf(example).Elem()
+	name := friendlyName(rtype.PkgPath() + "." + rtype.Name())
+	return name, nil
+}
+
+// This is a copy of openapi.friendlyName.
+// TODO: consider introducing a shared version of this function in apimachinery.
+func friendlyName(name string) string {
+	nameParts := strings.Split(name, "/")
+	// Reverse first part. e.g., io.k8s... instead of k8s.io...
+	if len(nameParts) > 0 && strings.Contains(nameParts[0], ".") {
+		parts := strings.Split(nameParts[0], ".")
+		for i, j := 0, len(parts)-1; i < j; i, j = i+1, j-1 {
+			parts[i], parts[j] = parts[j], parts[i]
+		}
+		nameParts[0] = strings.Join(parts, ".")
+	}
+	return strings.Join(nameParts, ".")
+}
diff --git a/third_party/k8s.io/client-go/tools/cache/mutation_cache.go b/third_party/k8s.io/client-go/tools/cache/mutation_cache.go
index 5b87e553b..8045442f1 100644
--- a/third_party/k8s.io/client-go/tools/cache/mutation_cache.go
+++ b/third_party/k8s.io/client-go/tools/cache/mutation_cache.go
@@ -61,7 +61,7 @@ type ResourceVersionComparator interface {
 // If includeAdds is true, objects in the mutation cache will be returned even if they don't exist
 // in the underlying store. This is only safe if your use of the cache can handle mutation entries
 // remaining in the cache for up to ttl when mutations and deletes occur very closely in time.
-func NewIntegerResourceVersionMutationCache(keyFunc cache.KeyFunc, backingCache cache.Store, indexer cache.Indexer, ttl time.Duration, includeAdds bool) MutationCache {
+func NewIntegerResourceVersionMutationCache(logger klog.Logger, keyFunc cache.KeyFunc, backingCache cache.Store, indexer cache.Indexer, ttl time.Duration, includeAdds bool) MutationCache {
 	return &mutationCache{
 		keyFunc:       keyFunc,
 		backingCache:  backingCache,
@@ -70,6 +70,7 @@ func NewIntegerResourceVersionMutationCache(keyFunc cache.KeyFunc, backingCache
 		comparator:    etcdObjectVersioner{},
 		ttl:           ttl,
 		includeAdds:   includeAdds,
+		logger:        logger,
 	}
 }
 
@@ -77,6 +78,7 @@ func NewIntegerResourceVersionMutationCache(keyFunc cache.KeyFunc, backingCache
 // since you can't distinguish between, "didn't observe create" and "was deleted after create",
 // if the key is missing from the backing cache, we always return it as missing
 type mutationCache struct {
+	logger        klog.Logger
 	lock          sync.Mutex
 	keyFunc       cache.KeyFunc
 	backingCache  cache.Store
@@ -160,7 +162,7 @@ func (c *mutationCache) ByIndex(name string, indexKey string) ([]interface{}, er
 			}
 			elements, err := fn(updated)
 			if err != nil {
-				klog.V(4).Infof("Unable to calculate an index entry for mutation cache entry %s: %v", key, err)
+				c.logger.V(4).Info("Unable to calculate an index entry for mutation cache entry", "key", key, "err", err)
 				continue
 			}
 			for _, inIndex := range elements {
@@ -207,7 +209,7 @@ func (c *mutationCache) Mutation(obj interface{}) {
 	key, err := c.keyFunc(obj)
 	if err != nil {
 		// this is a "nice to have", so failures shouldn't do anything weird
-		utilruntime.HandleError(err)
+		utilruntime.HandleErrorWithLogger(c.logger, err, "DeletionHandlingMetaNamespaceKeyFunc")
 		return
 	}