Reject watch resume main (kptdev#1104)

* Reject watch resume calls

Signed-off-by: Gergely Nagy <gergely.l.nagy@ericsson.com>

* Add WatchList feature flag

Signed-off-by: Gergely Nagy <gergely.l.nagy@ericsson.com>

* Fix watch tests: remove goto statements and correct error assertions

- Remove all goto statements from watch_test.go and e2e/api/watch_test.go,
  replacing them with helper functions for better readability.
- Fix test assertions to use IsResourceExpired instead of IsGone, matching
  the implementation which uses NewResourceExpired (standard k8s pattern
  for stale resourceVersion).
- Fix StatusReasonExpired assertion (was incorrectly expecting StatusReasonGone).
- Extract hasExactResourceVersion variable for clarity in createGenericWatch.
- Add cancel() call before returning 410 to avoid context leak.

Signed-off-by: Gergely Nagy <gergely.l.nagy@ericsson.com>

* Fix empty line

Signed-off-by: Gergely Nagy <gergely.l.nagy@ericsson.com>

---------

Signed-off-by: Gergely Nagy <gergely.l.nagy@ericsson.com>

Author: nagygergo

pkg/registry/porch/watch.go

@@ -23,11 +23,14 @@ import (
 	"github.com/kptdev/porch/pkg/engine"
 	"github.com/kptdev/porch/pkg/repository"
 	"go.opentelemetry.io/otel/trace"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metainternalversion "k8s.io/apimachinery/pkg/apis/meta/internalversion"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/watch"
 	genericapirequest "k8s.io/apiserver/pkg/endpoints/request"
+	"k8s.io/apiserver/pkg/features"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	"k8s.io/klog/v2"
 )
 
@@ -37,8 +40,17 @@ func createGenericWatch(ctx context.Context, r packageReader, filter repository.
 
 	allowWatchBookmarks := options != nil && options.AllowWatchBookmarks
 	sendInitialEvents := options != nil && options.SendInitialEvents != nil && *options.SendInitialEvents
+	hasExactResourceVersion := options != nil && len(options.ResourceVersion) > 0 && options.ResourceVersion != "0"
 	allowWatchBookmarks = effectiveAllowWatchBookmarks(allowWatchBookmarks, sendInitialEvents)
 
+	// A non-zero resourceVersion without sendInitialEvents is a plain watch resume.
+	// Porch doesn't support RV-based resumption; return 410 to force a full re-list.
+	if utilfeature.DefaultFeatureGate.Enabled(features.WatchList) && hasExactResourceVersion && !sendInitialEvents {
+		klog.V(2).Infof("watch: returning 410 Gone for plain watch resume (resourceVersion=%q)", options.ResourceVersion)
+		cancel()
+		return nil, apierrors.NewResourceExpired("resourceVersion is not supported for watch without sendInitialEvents")
+	}
+
 	w := &watcher{
 		cancel:              cancel,
 		resultChan:          make(chan watch.Event, 64),